Target Transnistria: Russia’s Maskirovka and Pathways to Escalation (Threatcast)

KEY JUDGEMENTS  I. We assess that Russian intelligence staged the recent provocations in Transnistria as part of a military deception campaign (“maskirovka”). Russia aims to prevent Ukrainian forces in Odesa…

Russian Mass-Casualty Attack on Civilians at Kramatorsk Train Station

A Russian missile attack on Kramatorsk train station in eastern Ukraine has killed at least 50 people, likely only civilians, and wounded 100 others, on 8 April 2022. Kramatorsk hosts…

Defeated in Kyiv, Russia Downsizes War Aims to Donbas and Southern Ukraine

Key Judgements I. Defeated by Ukrainian maneuver defenses and counter-attacks, Russian forces have withdrawn from northwest Kyiv, and are reducing their presence in Chernihiv province. Returned to their launch points…

Russia Invades Ukraine: First Day of War Through OSINT

In the early hours of 24 February 2022, Russia commenced a series of pre-assault operations to soften Ukrainian defenses ahead of an all-out, multi-axis invasion, which is now in progress….

No Time To Dispute: Russia’s A2/AD in the South Kurils

Remote and derelict, riddled with active volcanoes and disputed between Russia and Japan, the South Kurils make the perfect secret lair for any self-respecting evil genius. It’s no wonder the…

Putin’s Mercenaries on Tour: Mapping the Wagner Group’s Global Activities

Key Judgements Since its inception in 2014-2015, the Wagner group has expanded from a frontline contractor in Eastern Ukraine, to spearheading Russia’s foreign policy and private business objectives in Syria,…

"Do Not Enter:" Using OSINT to Monitor Russia's Wargames in the Black Sea

Russia has concentrated warships from all fleets, except the Pacific fleet, in the Black Sea for joint drills. While not unprecedented, it is rare to see such a show of…

Echoes of the Cold War: Why "Bears" Like the G.I.U.K. Gap

Russian military activity in the Greenland-Iceland-UK (GIUK) gap has increased exponentially in the past years. Launched from the Northern Fleet “bastion,” submarine-hunting, anti-surface, and maritime surveillance missions are at the…

Iran Tests Carrier-Killing Missile, Suicide Drones (and Other Insights from Exercise “Great Prophet 15”)

During the latest military exercise(“Great Prophet” 15), the Iranian Revolutionary Guards Corps – Aerospace Forces (IRGC-AF) demonstrated how Iran would attack U.S. military bases and warships in the region. Great…

What We Know About the Secret Israeli-Saudi Meeting in Neom

On 22 November 2020, U.S. Secretary of State Mike Pompeo, the Saudi Crown Prince Mohammed Bin Salman (MBS), and Israeli Prime-Minister Netanyahu met in Neom (Kingdom of Saudi Arabia). The…

NATO ISR Planes Monitor Russian Military Build-Up

U.S. and British reconnaissance aircraft are intensively monitoring eastern Ukraine, Crimea, and Russia’s Black Sea coast amid fears of a renewed Russian offensive. RUSSIA’S 2021 BEAR SCARE In the past…

U.S. and British reconnaissance aircraft are intensively monitoring eastern Ukraine, Crimea, and Russia’s Black Sea coast amid fears of a renewed Russian offensive.

RUSSIA’S 2021 BEAR SCARE

In the past month, Russia has moved over 14,000 soldiers and a vast array of capabilities, including Iskander ballistic missiles,  tanks, howitzers, and thermobaric rocket launchers towards the Ukrainian border. Russia then launched thousands of snap exercises countrywide and established new field camps. One staging ground in Voronezh oblast, hosting over 400 military assets, has all the hallmarks of a logistics node that could support a line of communication into Ukraine. 

OSINT map aggregating and georeferencing videos of Russian military movements near Ukraine, as documented on social media between March 27-30 (T-Intelligence)

Russia’s recent troop movements have alarmed the international community that fears a reignition of the war in eastern Ukraine or, even worse, the opening of a new front from Crimea. 

Operating from international and Ukrainian airspace, U.S. and British drones and other specialized aircraft collect updated, real-time intelligence on Russia’s nefarious activities. Given the types of aircraft visible on openly available flight trackers, the two NATO members primarily collect imagery (IMINT) and signals intelligence (SIGINT). 

IMINT ON DEMAND: RQ-4 IS OUR “FORTE”

Operated by the United States Air Force (USAF), the RQ-4 Global Hawk drone is at the forefront of Washington’s ISR (Intelligence, Surveillance, and Reconnaissance) operations in the Black Sea region. Based in Naval Air Station Sigonella (Italy), the RQ-4 Global Hawk with registration number 11-2049, either callsign FORTE10 and FORTE11, conducts frequent flights over eastern Ukraine. 

USAF RQ-4 drone at Naval Air Station Sigonella (T-Intelligence/Maxar Technologies)

Th RQ-4 Global Hawk is a long-endurance unmanned aerial vehicle (UAV), meaning it has a 24 hour+ flight autonomy. Combined with hi-resolution cameras, the RQ-4 can provide a crystal-clear, live feed of Donetsk and Luhansk’s frontlines to decision-makers and commanders back at base. As seen in the screenshots attached, the RQ-4 loiters extensively and publicly over designated areas of interest. 

Example of flight path taken by a USAF RQ-4 drone on ISR mission (T-Intelligence/ FlightRadar24)

While FORTE10 was a daily visitor of the region even before the latest escalation, its recent activities are likely connected with Russia’s troop build-up. In the screenshot below (11 April), the RQ-4 (now FORTE 11) was orbiting over the Kherson-Mariupol area, north of Crimea, after completing multiple passes over the frontline in Donbas.

The drone’s flight path is unusual and suggests that U.S. commanders are seriously considering that Russia might open a new front in the war against Ukraine and seize the Crimean canal. 

The same RQ-4 drone (reg. no. 11-2049) using callsign FORTE 11 on 11 April while surveilling the area north of Crimea (source: @GDarkconrad)

Ukraine dammed the North Crimean Canal in 2014. As a result, the Russian-occupied Crimea lost nearly 90% of its fresh water supply, leaving it dry. While Moscow plans to solve this issue by re-routing four rivers into the Mezhgorny reservoir by 2024, many observers fear that Russia might use military action to seize the Crimean dam. 

Besides the “daily FORTE”, there various other NATO country platforms surveilling the Black Sea region.

POSEIDON IS WATCHING

Best known for its submarine-hunting capabilities, the U.S. Navy’s P-8A Poseidon Maritime Patrol Aircraft (MAP) also packs a substantial ISR capability. Using its powerful APY-10 multi-mode synthetic aperture radar, the P-8A can detect, classify and track surfaced vessels. The P-8A Poseidon surveillance system also includes the MX-20 – a modular HD imaging system with large-aperture lenses for high magnification, laser-range finding, and laser illumination. 

USN P-8A Poseidon aircraft on the second ramp at Naval Air Station Sigonella (Italy) – T-Intelligence/Maxar Technologies via Google Maps

Besides IMINT, the P-8A can exploit emission from the electromagnetic spectrum. Thanks to its ALQ-240 Electronic Support Measure (ESM) suite, the P-8 can geo-locate and classify enemy radar emitters. On top of that, the P-8 can launch drones equipped with specialized sensors to detect submarines based on fluctuations in the Earth’s magnetic field.

This sensor fusion is invaluable to keep a watch on the Russian Navy’s activity around the Crimea peninsula and Krasnodar Krai. The Poseidon becomes an ever more relevant platform as Russia recently announced that it would deploy ten warships from the Caspian Sea into the Black Sea. 

OLD TIMERS LISTENING IN: P-3C ORION AND ARIES II

The Poseidon’s predecessor platform, the P-3 Orion, is the U.S.’s other platform tasked with monitoring Russia’s build-up from an air-naval perspective. A rare occurrence, the P-3 acts as a force multiplier for the U.S. ISR efforts.

We have observed two P-3 variants operating in the area: the P-3C Orion and the EP-3E ARIES. While the Orion is an old airframe, it can still pull its weight in maritime intelligence collection and fulfil SIGINT duties. 

Photo of the ARIES II aircraft (reg. no. 161410) conducting Black Sea missions (copyright: Levery)

The other variant observed is an evolution and conversion of the Orion, known as the EP-3E ARIES II (Airborne Reconnaissance Integrated Electronic System II). Operated by a crew of 22+ specialists, ARIES II provides near real-time tactical SIGINT and full-motion video intelligence to commanders. ARIES can also intercept human communications (Communication Intelligence/ COMINT) and exploit a wide range of electronic emissions from deep within enemy territory. 

Plus, the EP-3E ARIES flight crew also brought some humor into the mix. During a flight around Crimea on 10 April, an ARIES II appeared on flight trackers with the callsign “AK47,” and claimed to be an “AirAsia” flight. 

ARIES II aircraft (callsign AK47, reg. no. 161410) from Souda Bay Naval Air Station on Black Sea mission on 12 April (T-Intelligence/ FlightRadar24)

ELECTRONIC STALKERS: RC-135W RIVET JOINT FLIGHTS

The last but not least platform active in the area is the Royal Air Force’s RC-135W Rivet Joint, operated by the 51st Squadron from RAF Waddington. The RC-135W is an Electronic Intelligence (ELINT) aircraft that can monitor radars, communications, and other signals emitted by the Russian units in Crimea. 

ELINT aircraft are particularly good at mapping out the enemy’s Electronic Order of Battle (EOB). EOB typically includes the identity, capability, operating details, and location of enemy threat emitters and their role within an integrated air defense network.

Compilation of RC-135W Rivet Joint missions near Crimea (T-Intelligence/ FlightRadar24)

RC-135W aircraft have started regularly operating in the Black Sea in late February/early March. This is likely when the first signs of Russian troop movements became apparent to the American and British intelligence community. Two RC-135W aircraft (reg. ZZ666 and ZZ664) conducted the recon runs using at least four different callsigns – RRR7227, RRR7238, RRR7239 and RRR7240. 

ISR PARTIES

Many of the aircraft listed have also operated simultaneously in the Black Sea theater. The tweet attached shows the airspace over the Black Sea on 6 April. 

An RQ-4 UAV was completing its second orbit over Severomonsk, while the RAF’s RC-135W was active near the Kerch Strait. Outbound from Sigonella, a P-8A Poseidon was on its way to join to ISR party. 

Another mentionable ISR party took place on 14 April and featured a different assembly of allied aircraft. A U.S. EP-3E Aries II from Souda Bay (reg. no. 16140) scanned Crimea’s southern coast for signals and other emissions. Further down south, a Turkish Navy ATR C-72-600 aircraft was patrolling the Black Sea’s midsection, making a rare appearance on flight trackers. The “no callsign” aircraft is the US Navy’s P-8A Poseidon (outbound from Sigonella) on its way for another mission over the Black Sea. 

14 April: Aries II SIGINT plane (USN, not USAF as shown on flight radar), C-72-600 maritime patrol aircraft (Turkish Navy), P-8A Poseidon and a RQ-4 Global Hawk drone (NATO – not pictured) are active over the Black Sea in a joint ISR mission (T-Intelligence/FlightRadar24)

One of NATO’s few independently-operated RQ-4 Global Hawks was was also active in the region. However, the drone deactivated its transponder before we had the chance to screenshot it.

PREVENTING SURPRISES

ISR platforms such as those observed on flight trackers enable commanders and decision-makers to “see and hear” what the Russian military is preparing near Ukraine. These missions are critical to ensure that NATO will not be caught by surprise should Russia mount a new sneak attack.

While Russia’s build-up is at 2014-2015 levels and poses a credible threat, there is still no clear indication that Moscow intends to launch a new offensive in Ukraine. 

T-Intelligence will continue to monitor the situation. 


by HARM

This article has been updated on 14 April to include a new image of an ISR “party” and a paragraph explaining it. 

Comments Off on NATO ISR Planes Monitor Russian Military Build-Up

Satellite Imagery shows Russian Military Staging Ground near Ukraine

Geospatial intelligence (GEOINT) shows a Russian military staging ground in Voronezh oblast. The newly discovered site has the hallmarks of a logistics node that could sustain a line of communication…

Geospatial intelligence (GEOINT) shows a Russian military staging ground in Voronezh oblast. The newly discovered site has the hallmarks of a logistics node that could sustain a line of communication to the Ukrainian border. 

A Conflict Intelligence Team (CITEAM) investigation revealed that many of the Russian military columns tracked by the OSINT community, including T-Intelligence, for the past days, have reached their destination. CITEAM’s study points to a rural location near Pogonovo training center, south of Voronezh city

Armed with this information, we pulled 3m/px satellite imagery of the site. Temporal analysis (2 April vs. 6 April) indicates a dramatic increase in vehicle activity and infrastructure on 6 April 2021. 

2 April vs. 6 April 2021: a countryside location south of Voronezh city becomes a staging ground for Russia’s recent troop build-up. (T-Intelligence)

High-resolution satellite imagery obtained by the New York Times provides a detailed look into the staging ground.    

Approximately 400 vehicles are visible on the satellite imagery. Armored personnel carriers make up the bulk of the forces amassed at the staging ground. Heavy artillery, including 2S19 Msta-S self-propelled howitzers and TOS-1 Thermobaric rocket launchers, is also present in large numbers. 

The military has also established semi-permanent living facilities such as barracks and field hospitals. With constructions visibly ongoing, the staging ground is expected to grow.

Ukraine’s Kharkiv and Samy regions are five hours away from the staging ground, significantly closer than Luhansk (under separatist/Russian control). 

If the staging ground is to support a conventional offensive in Ukraine, it will likely serve as a near-theater logistics node, facilitating the flow of assets further down the line of communication. It is possible that other, smaller nodes are already being established and serviced closer to the border.

Despite the recent findings, there is still no indication that a new Russian attack is imminent. 


by HARM

See our previous situation reports on Russia’s latest troop movements (April 2; April 7)

Comments Off on Satellite Imagery shows Russian Military Staging Ground near Ukraine

Russia’s Military Build-Up near Ukraine (II): Troops from Siberia, Snap Drills in Crimea, and More Convoys

The Russian Federation’s military build-up near Ukraine is expanding, drawing forces from the Central Military District and escalating as thousands of snap exercises take place throughout the country.  Social media…

The Russian Federation’s military build-up near Ukraine is expanding, drawing forces from the Central Military District and escalating as thousands of snap exercises take place throughout the country. 

Social media users have continued to capture scores of rail flatbeds hauling main battle tanks, infantry fighting vehicles, rocket launchers, fuel trucks, and even air defenses. 

Sequel to our initial report, here is T-Intell’s breakdown of the most noteworthy open-source information from 2-7 April 2021:


1. Probably the most noteworthy development is the deployment of units from the Central Military District (CMD) towards the Ukrainian border. Russia typically moves and parades units from the Southern Military District and Western Military District if it wants to “bear scare” Ukraine and the West. 

However, this week, Conflict Intelligence Team (CITEAM) observed BMPs, MLRS, and other vehicles moving west from Yurga and Novosibirsk (Siberia) on railways. 

Many vehicles’ license plates, which indicate the unit’s origin, have been partially covered to preserve some degree of operations security during the cross-theatre movement. 

It is unusual for CMD units to deploy so far from “home” except for strategic exercises. This development sets the recent troop build-up apart from past “bear scares.” 

2. Russia ordered all of its forces to conduct readiness inspections. According to the Russian Defense Ministry, a total of 4048 exercises of various scales will take place during April, including 812 bilateral exercises, at 101 training grounds and 520 facilities of the training and material base. Checks will take place in all military districts, and all types and branches of troops will take part in them.

One such snap exercise took place in Opuk training range, Crimean peninsula. Over 200 troops from the 810th Naval Infantry Brigade (Black Sea Fleet) simulated an operation to capture a beachhead. Ground forces assaulted enemy positions using BTR-82s armored personnel carriers and Mi-8AM and Ka-27 helicopters. 

3. Enter the battle-hardened “Pskov paratroopers.” Train markings seen in a TikTok video suggest that Russia has instructed one of its most experienced units, the 104th Guards Air Assault Regiment, to join the build-up – CITEAM has found. Based in Cheryokva and part of the 76th Guard Air Assault Division, the 104th is a unit known for having fought and sustained heavy casualties in Eastern Ukraine. The forward-positioning of this echelon adds further credibility to Russia’s build-up. 

4. Advanced air defenses spotted on flatbed railcars, ready for deployment. A video shows a Pantsir S-1 (AFIC/NATO reporting name: SA-22 Greyhound) and numerous S-300 tractor erector launchers (SA-20B Gargoyle) without their missile tubes in an unidentified railway terminal – reportedly Voronezh. This deployment was probably connected with the snap air defense exercise in the Ashuluk training range on 6 April.

Video frame collage showing Pantsir and S-300 systems

5. Russia continues to amass a diverse and increasingly credible posture. The hardware spotted on the move in the past three days include (but are not limited to): 

  • T-90 main battle tanks (moving from Makhachkala to Crimea); 
  • T-72 main battle tanks and BMP-3 infantry fight vehicles (Kropotkin train station, Krasnodar); 
  • 2S4 Tyulpan 240mm self-propelled mortar system (Krasnodar)
  • Tunguska anti-air artillery (on the move M1 highway); 
  • MT-LB armored personnel carriers (Voronezh region);
  • Towed howitzer, likely 2A65 Msta-B (Klintsy, Bryansk region);
  • 2S23 self-propelled artillery, 
  • TOS-1 thermobaric rocket launchers (Voronezh region).

6. Despite multiple social media claims, large-scale fighting has not reignited in Donbas. However, there has been a spike in ceasefire violations. The OSCE Special Monitoring Mission (SSM) recorded 1,424 ceasefire violations in the Donetsk region between 2-5 April. In the previous reporting period (2-3 April), the mission recorded 594 ceasefire violations. In Luhansk, the SMM recorded 126 ceasefire violations, a slight decrease from the 427 violations noticed in the previous reporting cycle. 

Visualisation of ceasefire violations in Eastern Ukraine © OSCE SSM

In addition, the SSM also noted the disappearance of seven multiple launch rocket systems (BM-21 Grad, 122mm) and five towed howitzers (2A65 Msta-B, 152mm) from a warehouse in the non-government-controlled Luhansk region on 1 April 2021. The report specifically mentions that this is the first time these heavy weapons have disappeared. 

7. The Russian-backed “Donetsk People’s Republic” (DPR) has announced military conscription for citizens born 1994 – 2003. Signed on 25 March, the DPR plans to implement the draft between 1 April 2021 and 5 July 2022. Despite the symbolic timing, DPR only expects to mobilize around 200 conscripts. Conscription campaigns are likely to continue and, in time, increase in scope.  

PRELIMINARY ASSESSMENT

What initially seemed like another annual “bear scare” – Russia’s typical postures ahead of negotiations – has now turned into a credible threat for a renewed offensive against Ukraine. This reading is based on logistical and military indicators that measure capability for an invasion, not the intention – which is political. 

Russia’s intentions remain unclear, and our confidence levels for large-scale conventional operations against Ukraine are low to moderate. We maintain our assessment that Russia aims to posture and intimidate. However, given the forces’ heightened readiness and hardware deployed, this can change at any moment. 


by HARM

special credits to @GirkinGirkin for aggregating a vast amount of media material from Russian-language accounts

Comments Off on Russia’s Military Build-Up near Ukraine (II): Troops from Siberia, Snap Drills in Crimea, and More Convoys

Russia’s Massive Troop Movements near Ukraine: Another “Bear Scare”?

Videos on social media show a massive Russian military deployment near the Ukrainian border in the past 72 hours. Main battle tanks, infantry fighting vehicles, armored personnel carriers, self-propelled artillery, rocket…

Videos on social media show a massive Russian military deployment near the Ukrainian border in the past 72 hours.

Main battle tanks, infantry fighting vehicles, armored personnel carriers, self-propelled artillery, rocket launch systems, logistics trucks, and amphibious trailers (bridge-layers) have poured into occupied Crimea, Krasnodar Krai, and Rostov oblast.

OSINT map aggregating and georeferencing videos of Russian military movements near Ukraine, as documented on social media between March 27-30 (T-Intell)

The troop movements are so big that Russian agricultural machinery manufacturers and farmers have complained to the government that they cannot move their equipment ahead of the harvest season because the military requisitioned all of the flatbed railcars. 

While the recent movements are out of the ordinary, they are not unprecedented. Russia has periodically launched large-scale snap deployments in an attempt to “bear scare” before upcoming negotiations or to test its adversaries ever since it invaded Ukraine in 2014. 

HYPOTHESES FOR THE RECENT SITUATION:

1.Tit-for-tat for Ukraine’s moderate troop surge near Donbas and Luhansk in early March (following an increased number of ceasefire violations by Russia in Donbas).

In early March, a string of videos and images surfaced on social media, reportedly showing Ukrainian military hardware, T-64 tanks, APCs, and other vehicles, moving by train towards the war-torn Donbas. 

While most of the footage remained unverified, the vast majority of the media material was genuine (not recycled from other build-ups), and a small amount could even be authenticated. For example, the images below show Ukrainian military vehicles on flatbed railcars in the Dnepropetrovsk train station. 

Geolocation of images showing Ukrainian military vehicles in Dnipro train station

The deployments followed an uptick in ceasefire violations that resulted in Ukrainian soldiers’ death and increased sightings of advanced Russian weaponry in the Donbas. 

Russia’s latest saber-rattling is likely a direct response to the presumed Ukrainian reinforcements in the east. 

2.Posturing for ceasefire negotiations.  

This is a strong candidate theory considering that talks between the Trilateral Contact Group (Ukraine, Russia, OSCE) on Ukraine to extend the ceasefire monitoring mission beyond April 1st, have nearly failed. However, the OSCE managed to extend the mandate for another year in the final hours of March 31st. 

3.Preparations for a renewed offensive against Ukraine.

The hardware type deployed and deployment locations are consistent with preparations for a multi-front assault on eastern Ukraine. Russian forces could escalate violence in Donbas while simultaneously assaulting Mariupol from Crimea to finish off the land-bridge linking Donbas with the occupied peninsula. 

Russia’s movements have certainly stirred international anxiety, and NATO seems to be taking the risk seriously. U.S. Chairman of the Joint Chief of Staff Gen. Milley had a phone call with his Russian counterpart, Gen. Gerasimov, discussing the recent troop build-up on March 31st. The U.S. European Command has reclassified Ukraine’s risk status from “possible crisis” to “potential imminent crisis.”  

There has also been a spike in aerial intelligence collection sorties off the Crimean coast. A British Electronic Intelligence (ELINT) aircraft and American drones are among the platforms that “glued their eyes” on Russia’s military manoeuvres. 

While a renewed invasion is the most impactful scenario, it is also the most unlikely at this point in time. 

PRELIMINARY ASSESSMENT

Apart from the mentioned hypotheses, there could be a myriad of other reasons that contribute to the latest actions, such as the relocation of 56th Airborne brigade from Kamyshin to Feodosia, unannounced military exercises, or extended deployments post-drills. 

The recent movements are likely just another “bear scare,” however, one should never rule out the possibility of a renewed Russian offensive in eastern Ukraine. Ultimately, this is a fluid and volatile situation that can escalate or cool down at any moment. Prudent caution is advised. 


by HARM

ALERT: Read our second part report on Russia’s build-near near Ukraine’s border, here, encompassing the latest developments between 1-7 April. 

This article is an extended version of the situation report that we shared on Facebook on 1 April 2021.

Update [2 April 2021, 1700z – CET] to include tweet of flight tracker showing P-8 Poseidon patrolling near Kerch strait.

Update [7 April 2021 1700z – CET] to include link to our second report on the issue. 

Comments Off on Russia’s Massive Troop Movements near Ukraine: Another “Bear Scare”?

Echoes of the Cold War: Why “Bears” Like the G.I.U.K. Gap

Russian military activity in the Greenland-Iceland-UK (GIUK) gap has increased exponentially in the past years. Launched from the Northern Fleet “bastion,” submarine-hunting, anti-surface, and maritime surveillance missions are at the…

Russian military activity in the Greenland-Iceland-UK (GIUK) gap has increased exponentially in the past years. Launched from the Northern Fleet “bastion,” submarine-hunting, anti-surface, and maritime surveillance missions are at the forefront of Russia’s sorties in the GIUK. These operations often come close to Norwegian, Icelandic, and British airspace, forcing NATO to scramble interceptors and shadow the visiting aircraft. With Russia’s newfound interest in the Cold War-era flashpoint, NATO is gearing up to level the playing field. 


I. RUSSIAN AIRCRAFT SHADOW NATO AIRSPACE

1.The Russian aircraft launch from air bases in the Kola Peninsula and travel south through the Barents and Norwegian Seas. During their forays, they regularly pass through NATO flight information regions (FIRs) without broadcasting their position or communicating with civil authorities. The Norwegian, Icelandic, and British FIRs have seen the most “visitors.”

Map shows OSINT observations of Russian aircraft transits through NATO areas of interests and main QRA launch points

2.Airspace around the world is divided into Flight Information Regions (FIRs). Each FIR is managed by a controlling authority, which is responsible for ensuring that air traffic is deconflicted and safe. 

SCRAMBLE, SCRAMBLE, SCRAMBLE

3.Because of the flight path, the Royal Norwegian Air Force (RNoAF) is the first to detect and respond to Russian flybys. The RNoAF regularly scrambles F-16s and, more recently, F-35A stealth fighters from Bodø and Ørland to monitor and conduct visual identification of the visiting formations. As the Russians proceed southwards, the RNoAF hands the interception duties to other NATO forces.

4.The British Royal Air Force (RAF) scramble interceptors from RAF Lossiemouth, the air base responsible for defending the UK’s northern airspace. Lossiemouth’s Eurofighter Typhoons are on Quick Reaction Alert (QRA), which means they are ready to respond to any threat, at any moment – 24/7. T-Intelligence has frequently reported on RAF’s Lossiemouth successful interceptions of Russian aircraft in the past three years.  

5.In many instances, Russian transited FIR corridors used by civilian airliners to enter and depart British airspace. In at least one situation, the British air traffic control (ATC) had to divert commercial flights to mitigate collision risk with the “incognito” Russian aerial formation. 

6.NATO aircraft serving in the Icelandic Air Policing mission (Iceland does not have an air force) have also intercepted Russian aircraft. NATO QRA aircraft have frequently encountered Tu-142 maritime patrol aircraft, Bear F and J versions, and MiG-31s. 

7.The Combined Air Operations Center (COAC) from Uedem, Germany, coordinates NATO interceptions in the GIUK. The COAC also deploys E-3 Sentry aircraft from Geilenkirchen (Germany) to provide air control and battlespace awareness. COAC-Uedem serves under the Allied Air Command (AIRCOM), which is NATO’s core headquarters responsible for air operations.

“THIS IS ̶N̶O̶T̶ A DRILL”

8.Russian aerial formations in the GIUK typically consist of Russian Aerospace Forces (RuAF) Tu-160 Blackjack bombers and Russian Navy (RuN) maritime patrol aircraft, namely Tu-142 variants. On some occasions, we noted RuAF-RuN composite formations of Blackjacks, Bear-F s (anti-submarine & maritime patrol), or Bear-Js (airframe designed to communicate with submarines). MiG-31 Foxhound interceptors have sometimes, although seldom, escorted the Bears.

Compilation: NATO QRA aircraft intercepting Russian aircraft over the GIUK (T-Intell)

9.Judging by the airframe composition, the Russians primarily conduct anti-submarine warfare (ASW) exercises in the GIUK. ASW is the art of detecting, denying, and engaging enemy submarines. Airframes like the Bear Fs can drop buoys that survey the seas for submarines. Once detected, Bear Fs can transmit the targeting data to Russian submarines via Bear-J communication relay. The kill-chain also works vice-versa, with submarines indicating the enemy positions to Bear-Js that, in turn, relay them to surface ships and aircraft. Alternatively, Bear-Fs can be armed with anti-ship missiles and anti-submarine torpedoes, being able to prosecute enemy vessels without assistance. However, the latter option is less likely as the Russian Navy, as its Soviet predecessor, emphasizes the concept of combined forces – coordinated operations among surface, subsurface and aerial assets. 

10.The presence of Blackjacks, which can carry and launch up to 12 cruise missiles, indicates that the Russians are also rehearsing anti-surface warfare (ASuW). This means that NATO bases in Norway, the UK, and Iceland and ports and vessels are on the mock-kill list. These objectives are essential for NATO’s Transatlantic sea lines of communications (SLOCs) – the strategic corridor linking North America to Europe.

11.Besides rehearsing specific mission profiles, Russian flybys in NATO flight information regions (FIRs) test the readiness, disposition, response time, and interception tactics of NATO QRA bases in the GIUK – RAF Lossiemouth (UK), Keflavik (Iceland), and Bodø and Ørland (Norway). While seemingly generic, this kind of intelligence is critical for any air force that wants to stay prepared for wartime operations.

12.To understand why the Russian military is conducting these flights – and, likely, covert sails – through the GIUK, we must examine the region’s importance to Russia’s overall naval strategy and disposition.


II.THE GIUK GAP: WHY IT MATTERS TO RUSSIA

13.The GIUK gap is a series of strategic routes between Greenland, Iceland, and the United Kingdom. The GIUK connects the North Atlantic to the Norwegian Sea and the Barents Sea – which is why it matters to Russia. 

14. From a geographical perspective, the GIUK is a two-way street. While historically the Gap has favoured the defenders of the North Atlantic, forces moving towards the Norwegian Sea must also funnel through these waterways. 

NORTHERN FLEET

15.The Barents Sea hosts the crown jewel of the Russian Navy – the Northern Fleet. Nowadays, the Northern Fleet is a flotilla in name only. In 2014, the Fleet became an autonomous command, known as Northern Fleet Joint Strategic Command. Since 31 January 2021, the Northern Fleet is a military district, the highest military-territorial division of the Russian Federation. The Northern Fleet Military District (NFMD) commands airbases, harbors, nuclear storage sites, and shipyards sprawling from the Kola Peninsula to the Arkhangelsk Oblast and Arctic archipelago. 

 

16.The importance of the NFMD stems primarily from its submarine force. More specifically, the Russian nuclear-powered ballistic missile submarines (SSBNs in the US Navy terminology), which continue to stir anxiety on both sides of the Atlantic. 

17.At the height of the Cold War, the U.S. Office of Naval Intelligence assessed that the Soviet Northern Fleet would cut NATO’s Transatlantic sea lines of communication (SLOC) in case of war. But as open-source intelligence from the CNA later found, counter-SLOC was a low-priority mission for the Soviets, or it became so in the 1980s. The introductory comments from this declassified CIA report captures the growing realization among the U.S. intelligence community that “sea denial operations in the North Atlantic are not a high priority item for the Soviet naval efforts” (Director of Central Intelligence, Stansfield Turner in 1978).

Russian SSBNs in 2021 (T-Intelligence compilation using Google Earth imagery)

WITHHOLDING STRATEGY AND BASTION DEFENSE

18.Instead of staging a battle for the Atlantic, the Soviets were primarily concerned with defending the Northern Fleet’s SSBNs. Capable of launching long-range nuclear attacks, the SSBN fleet was to be preserved as a second-strike capability following a limited nuclear exchange. This came to be known as the “withholding strategy” or the “pro-SSBN” mission.

19.To enhance SSBN survivability, the Soviets designed a multi-layered and all-domain concept known to the US intelligence community as Close Abroad Bastion (CAB), or simply “bastion.” Bastions were intended to prevent NATO submarines from infiltrating the SSBN area of operations such as the Bering Sea or the Arctic Ocean, where Soviet submarines would hide underneath the polar ice caps, and surface when needed to fire. As periodically demonstrated, Russia’s submarines are still able to surface from under the thick arctic ice.

(The video below shows a Russian submarine ice exercise that took place near Alexandra island, in the Franz Joseph archipelago on 26 March 2021).


 

20.The bastion concept called for the wholesale mining of the sea approaches, hunting enemy submarines with a combination of ASW aircraft, attack submarines, and warships, and lining up friendly shores with coastal defense batteries.  

21.The Soviets established two bastions, one in the Sea of Okotoks (Soviet Pacific Fleet) and another in the Barents Sea (Soviet Northern Fleet). In 1988, the U.S. Navy intelligence estimated that only 25% of the Northern Fleet would not have been dedicated to the pro-SSBN mission in case of war (see page 53).

RUSI Graphic shows estimated Russian bastion area in the Northern Fleet Military District

22.In response to the bastion strategy, the U.S. Navy launched a series of operations to infiltrate Soviet bastions and keep tabs on the Northern Fleet’s submarines around the clock. On 20 March 1993, an American submarine and a Russian SSBN collided off the Kola peninsula, underscoring just how easy it was for the U.S. Navy to infiltrate Russia’s bastions. The international incident forced both the U.S. and Russia to rekindle their submarine “cat-and-mouse” tactics.

23.Nowdays, the Russian Navy is no more than a shadow of its Soviet predecessor. In 1990, the Red Fleet had approximately 600 ships, of which 59 SSBNs. In 2015, the Russian Navy only operated around 170 boats – 13 of which were SSBNs. The number of SSBNs is down to 10 in 2021.

24. After decades of declining capabilities, Russia’s submarine force is now poised to grow and evolve for the first time. As part of a master plan to overhaul the Navy’s underwater capabilities, Russia is developing six submarine classes simultaneously: Borei-II (SSBN), Bolgorod (strategic), Khabarovsk (cruise missile), Yasen-M, Lada, and Improved Kilo. 

25.At the center of the Navy’s modernization program is the Poseidon weapon (AFIC/NATO Reporting name: Kanyon) – a nuclear-tipped, autonomous torpedo with unlimited range. Naval warfare expert H.I. Sutton describes Poseidon as a “second-strike doomsday weapon to literally go under missile defenses.” Alongside Bulava, a modern submarine-launched intercontinental-ballistic missile (ICBM), the Poseidon will spearhead a new generation of Continuous At-Sea Deterrence (CASD).

26.As the vast majority of these new toys will be in service with the NFMD, Russia has started paying more attention to the GIUK. Russia must closely surveil the GIUK Gap to mitigate and deny enemy infiltrations. This explains the periodic NATO interceptions of Russian maritime patrol and ASW aircraft in this area.

Technical details of Poseidon/Status-6 were likely deliberately leaked on state TV before President Putin could announce the new weapon

28.Russia also prepares to contest the GIUK in case of war. Therefore, Russia’s assertive behavior in the GIUK can be interpreted as a form of active forward-defense of the bastion concept, which inevitably entails anti-surface warfare against British, Norwegian, and American forces. 

29. Another reason for Russia to consider forward-defense in the GIUK is the threat posed by NATO stand-off weaponry. For example, a Tomahawk land-attack cruise missile can be fired from 1,600 km away (Block IV), meaning that Russian forces must intercept enemy launch platforms earlier and at a greater range. 

30.Besides its role for forward defense, the GIUK gap remains a strategic chokepoint for Russia to move warships into the North Atlantic. As outlined in its 2015 maritime strategy, the Russian Navy must ensure the “free access of the Russian fleet to the Atlantic.”

31.Russia’s interests beyond the GIUK gap stretch from overseas combat operations and joint drills to seabed warfare (attacking underwater internet cables) and intelligence collection on American submarines. 


III. NATO COUNTERMEASURES: BACK TO THE FUTURE

32.As Russia’s activities in the High North increased, the Bastion concept, the SSBN threat, and the GIUK dilemma re-emerged on NATO’s agenda. The Alliance and member states have undertaken a series of measures to curtail Russia’s revanchist designs in the GIUK gap and the Arctic.

NATO LEVEL MEASURES:

  • Establishment of a new NATO headquarters, called the Atlantic Command in Norfolk, Virginia, in 2020. The new HQ will help NATO navies from both sides of the pond better coordinate operations in the Atlantic.
  • Icelandic Air Policing (IAP) upgraded to QRA. Lacking an air force and witnessing various airspace intrusions from the Russian Air Force, Iceland requested NATO assistance in 2006. NATO established an Icelandic air policing mission in 2008. In 2014, IAP was put on Quick Reaction Alert (QRA), increasing the readiness and requirements for air policing in response to the increased Russian activity.
  • Increased integration under the Allied Air Command (AIRCOM). AIRCOM is NATO’s core headquarters responsible for air operations. Operating under AIRCOM, the Combined Air Operations Centre (CAOC) from Uedem, Germany, commands NATO’s Air Policing missions in the North on a tactical level. Thanks to COAC, multinational air policing in the GIUK gap is conducted more effectively and in an integrated matter. 
  • Increase and expansion of joint military exercise in the High North. The most notable joint drill was Trident Juncture 2018 (TRJE18), organized in Norway. Encompassing over 50,000 troops from 31 member states and partners, TRJE18 was NATO’s biggest exercise since 2002. The GIUK featured heavily on the exercise agenda. In response, Russia launched electronic attacks on Norway and Finland, jamming GPS and disturbing civilian air traffic in the High North.  

STATE-LEVEL MEASURES:

  • Budgetary increases enabled many member states to implement ambitious procurement plans that impact the GIUK region. For example, the UK is in the process of acquiring no less than nine P-8 Poseidon “submarine-hunting” aircraft. Five of which are already in service with RAF Lossiemouth. Norway (like the UK) has already purchased a bulk of F-35 stealth fighters and builds new warships and submarines. 
  • The US Navy is re-establishing the 2nd Fleet that patrolled the Atlantic Ocean in the Cold War. The 2nd Fleet was terminated in 2011 in a move to save costs. 
  • The US military has undertaken various measures to enhance its ability to respond faster to potential flashpoints in the High North. At the center of these measures is Norway, where U.S. Marines train annually for arctic warfare, and American vessels (including submarines) conduct port visits.

  • Most recently, the US Air Force has deployed B-1b bombers to Norway for the first time. Until now, most US operations in the Arctic military were staged out of the UK. In addition, the local press reported that Norway is considering leasing its naval base near Olavsvern (Norway’s far north) for use by American submarines. 

OUTLOOK

Russian flights and sails through the GIUK will persist as a form of forward-defense of its Barents Sea bastion. Russia must also maintain a foothold in the NATO-dominated waters around the UK and Iceland to secure access into the North Atlantic for peacetime and combat operations, unconventional warfare, and other objectives.

NATO’s response so far has been adequate to Russia’s resurgence. However, the Alliance must take further measures, especially strengthening ASW capabilities, to effectively counter Russia’s increasingly sophisticated submarine forces. 

The age of anti-submarine warfare in the High North is back.


by HARM

This strategic analysis was enabled by Open-Source Intelligence (OSINT). Now you can learn OSINT too! Head over to Knowmad OSINT and check out our training offer.

Comments Off on Echoes of the Cold War: Why “Bears” Like the G.I.U.K. Gap

Russia Brags About Bombing Syrian Hospital To Prove ‘Iskander’ Works

Armenia’s Prime-Minister Nikol Pashinyan shocked the Russian Defense Ministry when he complained about the Iskander-E missile system’s ineffectiveness in a public interview (23 February 2021). PM Pashinyan said that the Iskander missiles launched…

Armenia’s Prime-Minister Nikol Pashinyan shocked the Russian Defense Ministry when he complained about the Iskander-E missile system’s ineffectiveness in a public interview (23 February 2021). PM Pashinyan said that the Iskander missiles launched during the short war with Azerbaijan over the Nagorno-Karabakh region “didn’t explode or maybe 10 percent of them exploded.” When asked why the Iskander disappointed, Pashniyan hinted at the missile’s old age: “I don’t know… maybe they were weapons from the ‘80s.”

“IT WORKS JUST FINE”

In response to Pashiynan’s claims, Russia has released a video montage showing two successful Iskander strikes – both ballistic and cruise missile variants – in Syria. But instead of clearing the Iskander’s name, Russia has inadvertently proved that it has targeted hospitals – an allegation that Moscow has perpetually disputed despite evidence to the contrary from open-source investigations (e.g. New York Times) and even the United Nations (UN). 

The second clip from the compilation shows an Iskander missile hitting an H-shaped building. Twitter user and geolocation wizard @obretix identified the target as a hospital in Azaz, near the Turkish border. While the footage is undated, the attack seems to match reports from early 2016 about an unclaimed strike on Azaz hospital. 

HOSPITAL ATTACK TOOK PLACE IN EARLY 2016

An Airwars assessment from 19 January 2016, quoting two Syrian sources, informs: “Russian forces targeted the town of Azaz with two ballistic missiles, causing the death of one civilian and injury of several others.”

A Reuters report from 15 Feb 2016 similarly mentions an unattributed missile strike on a “hospital and school sheltering refugees in Azaz, Syria,” quoting local residents and medics. A Physicians Across Continents (PAC) Facebook post corroborates the Reuters report and describes an airstrike on Azaz hospital. 

Sentinel-2 satellite imagery from that time is sparse and does not cover every day. However, when comparing imagery from 17 January vs. 16 February, there seems to be a “splash” mark on the impact area seen in the footage.

T-Intell retroactive battle-damage assessment of Iskander strike on Azaz hospital @ Sentinel 2 satellite images via Sentinel Hub and frame extracted from RIA footage

Google Earth Pro high-resolution imagery from 20 March 2016 shows the same area at Aziz hospital visibly scared.

Azaz Hospital on 20.3.2016 © Maxar Technologies via Google Earth Pro

In conclusion, Russia’s Iskander attack on the hospital took place before mid-March 2016, and very likely between 17 January and 16 February.

Turkey has since repaired and renovated the hospital, and it is now functional again. 

BACKFIRE

The Iskander is not the first Russian system that is publicly scrutinized. Observers, including T-Intelligence, have noted the ease with which Turkish drones managed to hunt down Russian-made Pantsir aerial defense systems in Syria and Libya. The Russian Defense Ministry is growing increasingly defensive about the effectiveness of its capabilities. However, with this latest “public relations” stunt, Russia has foremost proven that it bombs hospitals, not that the Iskander-E works. 

Comments Off on Russia Brags About Bombing Syrian Hospital To Prove ‘Iskander’ Works

Erbil Rocket Attacks: Iranian Munnition, Usual Suspects

On the night of 15 February, approximately 14 rockets landed in Erbil, the capital of Iraq’s Kurdistan Regional Government (KRG). TARGET: ERBIL Three projectiles hit the military annex of Erbil…

On the night of 15 February, approximately 14 rockets landed in Erbil, the capital of Iraq’s Kurdistan Regional Government (KRG).

TARGET: ERBIL

Three projectiles hit the military annex of Erbil International Airport that the Coalition built to service counter-ISIS operations. Three housing facilities were destroyed in the attack, killing one contractor (non-US) and injuring others. 

Battle Damage Assessment: Contractor housing facilities destroyed at Erbil Air Base

At least two other rockets landed in residential areas, destroying public and private properties and injuring bystanders.

IRANIAN ROCKETS

The unexploded ammunition recovered by Kurdish counter-terrorism forces is identical to the Iranian-made “Haseb” 107mm rocket artillery, a copy of the Chinese Type 63. This type of munition is ubiquitous among Iraqi Shiite militias courtesy of the IRGC-Quds Force. 

Iranian rockets used in the attack

The Haseb has a short-range (7-10 km), which meant the aggressors launched the attack from proximity. As Haseb rockets can be launched from the back of a minivan or pick-up truck, they can easily be smuggled in denied areas. 

دەزگا ئەمنییەکان ئەو ئۆتۆمبێلەیان دۆزییەوە کە مووشەکەکانی ئاراستەی هەولێر کردبوو

بە گوێرەی زانیارییەکانی پەیجی…

Posted by ‎دژه تیرۆری کوردستان Kurdistan CT‎ on Monday, February 15, 2021

 

Images released by Kurdish authorities show the launch vehicle, a light food truck, with a disguised rocket artillery system. The vehicle appears to have infiltrated the city under the cover of delivering food to a local market. 

USUAL SUSPECTS: IRAQI SHIITE MILITIAS

A group calling itself “Saraya Awliya al-Dam” (Custodians of the Blood) claimed responsibility for the attack. According to the Washington Institute, Saraya Awliya al-Dam is just a cover used by Asaib al-Haq (AHH), a seasoned Iraqi Shiite militia with strong ties with Iran. The U.S. Department of State designated AHH as a Foreign Terrorist Organization on January 3, 2020. 

Iranian-backed attacks on Coalition forces in Iraq are not new. The targeting of Erbil is, however, largely unprecedented (the Sept 2020 attack is the only exception) and could indicate an expansion of Iranian-approved targets. If that’s the case, Iraq’s most stable area is now in Tehran’s crosshairs. 

Comments Off on Erbil Rocket Attacks: Iranian Munnition, Usual Suspects

Iran Tests Carrier-Killing Missile, Suicide Drones (and Other Insights from Exercise “Great Prophet 15”)

During the latest military exercise(“Great Prophet” 15), the Iranian Revolutionary Guards Corps – Aerospace Forces (IRGC-AF) demonstrated how Iran would attack U.S. military bases and warships in the region. Great…

During the latest military exercise(“Great Prophet” 15), the Iranian Revolutionary Guards Corps – Aerospace Forces (IRGC-AF) demonstrated how Iran would attack U.S. military bases and warships in the region. Great Prophet 15 (GP15) was Iran’s third drill in almost two weeks – at a time of rising tensions due to the U.S. President Donald Trump’s departure from the White House.

  1. GP15 is part of a series of annual wargames organized by the IRGC to test new capabilities and tactics. Initiated on 15 January, this year’s exercise featured two stages during which the IRGC-AF simulated a combined drone and missile attack on enemy “U.S.” air defenses, bases, and warships in the Middle East. 
  2. The IRGC-AF successfully test-fired some of its newest and most sophisticated unmanned aerial vehicles (UAVs) and ballistic missiles (B.M.s), including a long-range anti-ship variant that could theoretically target U.S. aircraft carriers. 
  3. The IRGC-AF exercise had three main objectives: To respond to the tensions with the United States, reinforce Iran’s strategic deterrent, and test new ballistic missile technologies. 

STAGE ONE: AIR DEFENSE ATTACK

(1)In the first phase of GP15, the IRGC-AF simulated a drone swarm attack on enemy radar sites and air defenses. Footage released by Iranian media showcased the following UAVs: 

  • Shahed 161 combat reconnaissance drone (at least four) flying in formation. One of the many drone variants that the IRGC-AF developed based on the U.S. RQ-170 captured in 2011. 

Shahed 161 during GP15

  • Shahed 129 medium altitude long-endurance (MALE) drone. At least one was shown taking off, armed with Sadid-345 glide bombs, and then airborne. Similar with the Israeli Hermes 450 and American MQ-1 Predator, the Shahed 129 is one of Iran’s most seasoned UAV. The IRGC-AF operated the Shahed 129 extensively in the Syrian Civil War, and it continues to support it with upgraded ordnance and sensors

Shahed 129 with Sadid-345 bombs participates in GP15

  • Unidentified loitering munition (aka “suicide drones”) neutralizing target buildings and a mobile surface-to-air missile (SAM) system. 

A rare sighting: the IRGC’s coy suicide drone makes a cameo at GP15, destroying a variety of targets.

  • This unidentified model is similar to the suicide drone Saudi Arabia recovered after the Iranian attack on petrochemical facilities in Abqaiq-Khurais and Afif in 2019. Unable to identify the drone, the Saudis have labeled it “Delta Wave UAV.” Experts have pointed out that Delta Wave might be an evolution of the Toofan-2 suicide drone that Iran unveiled in 2015. 

Comparison between the suicide drone from GP15 and the airframe wreckage from Abqaiq-Khurais and Afif, Saudi Arabia (2019)

(2) The use of drones and specifically “suicide drones” for S/DEAD roles (suppression/destruction of enemy air defenses) is a logical tactic for Iran. Due to their stealthy characteristics, suicide drones can fly below the radar to strike enemy air defenses and heavily defended targets. With the drone-cruise missile attack in 2019 on Saudi Arabia, Iran has already proved this works in a real-world engagement. 

(3) An advantage of loitering munition is that it is inexpensive, especially compared to ballistic missiles tipped with anti-radiation warheads like the IRGC used for SEAD in previous exercises.  

(4) After the SEAD mission, the IRGC-AF fired its second kinetic package, a barrage of rockets and missiles, to destroy the enemy base. The ballistic missile attack could have also played a support role in saturating the enemy air defenses. Footage from the exercise shows the coordinated launch of thirteen Zolfaghar/Dezful missiles on 15 January. 

Dezful ballistic missiles lined up to fire in anger (frame from @Imamedia video)

(5) IRGC-AF claims to have tested new high-performing variants of the Zolfaghar and Dezful ballistic missiles (B.M.), as well as Zelzal (guided artillery rocket). Iran alleges that these new variants feature radar-absorbent material and a detachable warhead. Video analysis of exercise footage confirms the latter capability. 

Freeze frame: IRGC-AF demonstrates separable warhead capability

 

STAGE TWO: KEEPING U.S. AIRCRAFT CARRIERS AT BAY 

(6) In the second and final stage of GP15, the IRGC-AF turned its attention to the maritime domain. At least three Sejil-2, two Gadhr, and one Emad medium-range B.M.s struck naval targets in the Gulf of Oman and the northern Indian Ocean on 16 January 2021. 

(7) The main event of GP15 was the maiden launch of a long-range anti-ship ballistic missile (AshBM). The missile traveled for 1,800 km to the northern Indian Ocean, where it reportedly hit a floating target. 

(8)The U.S. military confirmed the event, adding that two Iranian missile splashed down 32 km from a commercial vessel and 160 km from the Nimitz Carrier Strike Group (CSG). The missile test did not pose a threat to the Nimitz carrier or its escorts. 

Overview: Possible Iranian AshBM attack route towards the Arabian Sea and the location of the U.S. Nimitz aircraft carrier the day after the missile test

(9)Iran already possesses short-range AshBM, namely the Khalij Fars (200 km) and Zolfaghar Basir (700 km), ideal for overwhelming enemy targets in the Persian Gulf and the Gulf of Oman. However, a functional long-range capability would be a game-changer. 

(10) If the new Iranian AshBM is indeed a credible threat, the U.S. would need to withdraw its aircraft carrier from the 1,800 km engagement range in the event of a war. Having to operate from such a distance would significantly reduce the effectiveness of offensive naval operations. Fighter jets would have to travel farther, reducing sortie rate and operational tempo, while most ship-launched missiles would be entirely out of range. 

(11) Pushing American carriers and destroyers far away from Iranian shores adds another layer to Iran’s anti-access/area denial (A2/AD) strategy. While Iran has produced a massive and diverse arsenal of short-range missiles (both cruise and ballistic) that brings the entire Gulf region in the IRGC’s crosshairs, long-range advancements are relatively rare. 

Iranian anti-ship cruise missile engagement ranges (© Defense Intelligence Agency/DIA)

Iranian ballstic missile engagement ranges (© Defense Intelligence Agency/DIA 2019)

(12) There is nevertheless reason to be skeptical about the Iranian claims. Currently, information on the AshBM is minimal. We know that a missile test took place and that a warhead crashed into the Indian Ocean after a 1,800 km flight. There is no image or video of the missile. It is not even clear if the long-range AshBM is an entirely new model or a spinoff of one of the missiles launched on Saturday.

(13) Furthermore, the kill chain to strike a U.S. carrier guarded by Aegis-capable destroyers is very complicated especially in wartime conditions, as the WarZone eloquently explained. While the recent exercise may not represent a clear and immediate threat to carrier operations in the region, it does indicate that Iran is getting closer to limiting the U.S. Navy’s freedom of movement in the area. 


by HARM

editing by Gecko

Cover image and video frames @Imamedia

Media analysis sources for reference: video 1, video 2

Comments Off on Iran Tests Carrier-Killing Missile, Suicide Drones (and Other Insights from Exercise “Great Prophet 15”)

Diamonds are Forever: Russia Doubles Down on Central African Republic (CAR)

1. Russia has deployed over 300 regular military forces and hardware to the Central African Republic (CAR) in December, according to Russia’s foreign ministry. CAR officials have confirmed this information….

1. Russia has deployed over 300 regular military forces and hardware to the Central African Republic (CAR) in December, according to Russia’s foreign ministry. CAR officials have confirmed this information. They have stated that President Faustin Toaudera, who was running for re-election, requested Russia’s military assistance to prevent election violence. 

ELECTIONS UNDER THREAT OF VIOLENCE

2. In late November 2020, rebel forces launched an offensive against the capital city of Bangui, threatening the upcoming parliamentary and presidential elections in CAR. President Toaudera has accused the opposition of working with the rebels and preparing a coup against his government. The opposition denies these allegations and accuses Toaudera of inviting the Russian military to reinforce his position. 

3. Presidential and parliamentary elections took place on 27 December amidst violence and widespread reports of irregularities. On January 3rd, the CAR electoral commission announced Toaudera’s victory. 


RUSSIAN AIRLIFT OPERATIONS TO CAR

4. First signs of an increased Russian military presence appeared on social media between 16 and 19 December. Locals shared photos of Russian cargo planes at Bangui Airport. Preliminary OSINT indicates that the following assets airlifted Russian soldiers and equipment to CAR:

16 December: 

  • 2x Ilyushin Il-76 (RF-tail numbers unclear)

Annex 1

24 December: 

  • 1x Antonov An-124 (RF-82034), which delivered two Mi-8AMTsh helicopters (AFIC/NATO Reporting name: Hip)

Annex 2

27 December:

  • 1x Ilyushin Il-76 (RF-76771)
  • 1x Ilyushin Il-76 (RF-86901)
  • 1x Ilyushin Il-76TD (EX-76003)Operated by FLY SKY AIRLINES LLC, flight EX-76003 hauled Toyota Land Cruisers and equipment identified as the Turkish-made Otokar Cobra armored personnel carrier (APC).

Annex 3

28 December:

  • 1x Ilyushin Il-76 [RF-86901]

*Flight log is preliminary and is limited to December 2020, landing dates can be inaccurate, and the list incomplete. 


5. Observed activities of the Russian reinforcements are:

  • Aerial patrol over Bangui. Multiple Social media intelligence (SOCMINT) sources indicate that the two Hi-8s conducted overwatch.

  • Internal foreign defense. Russian forces, likely special operations forces, military intelligence and private contractors, conducted joint operations with the CAR military in the Bangui area of operations. Images show Russian soldiers manning checkpoints, patrolling the periphery, and clearing villages around the capital.  (evidence 1; evidence 2).
  • Enhanced VIP protection. Social media photos show armed men in military fatigues consistent with Russian special forces (Spetsnaz) guarding CAR President Toaudera during campaign rallies.

Annex 5 Russian operatives have been part of Touadera’s security detail for years

  • Public Relations (PR). Russian-supplied BRDM-2 amphibious armored vehicles, branded with the Russian-CAR friendship stickers,  featured in campaign rallies and parades (video evidence starts at 3:05). The same vehicles were then observed in combat and patrol. Russian and CAR forces have reportedly already lost one BRDM-2 in fights with rebel forces. 

 

PRE-EXISTING RUSSIAN ASSETS

6. Russia’s latest military deployment expands its previously discrete presence in CAR. At least two Kremlin-sponsored private military corporations (PMCs), namely Vagner and Sewa Security Services, have been present in the country since 2017 when Russia and CAR signed a security agreement. 

7. As a T-Intelligence assessment found in 2018, “the Russian-CAR security accord mainly seems to serve as a front for advancing the commercial interests of Putin’s oligarchic circle on the mineral market in Africa.” Our OSINT investigation identified “Lobaye Invest” as the leading Russian company profiting from diamond extractions in CAR. In 2020, the U.S. Department of Treasury put Lobaye Invest and owner Yevgeny Prigozhin, who also reportedly heads Vagner, under economic sanctions. 

8. Vagner contractors carry out a number of missions, primarily site and external security for diamond mining operations. While one of the world’s poorest countries, CAR is rich in mineral resources such as gold, (gem-quality) diamonds, and uranium. In 2019, The Africa Report published an extensive inquiry into the network of Russian companies profiting from CAR’s diamond exploitations contracts 

9. “Sewa Security Services” is another Russian private military corporation (PMC) operating in CAR under the 2017 security accord. Sewa is primarily engaged in VIP protection. Throughout the years, press and social media photos have shown Sewa operatives and other contractors guarding CAR political figures, including President Toudega. 

A member of the close protection unit for Central African republic President Touadera, composed by Russian private security company operatives from Sewa Security, are seen in Berengo on August 4, 2018. – Russian military consultants have set up training for the Central African Armed Forces and the Internal Security Forces after delivering weapons to the country. Already trained by the European program (EUTM), the soldiers are trained in the handling of weapons by the Russian consultants. (Photo by FLORENT VERGNES / AFP via Getty Images)

10. Important: It is likely that “Sewa Security Services” is Vagner’s cover name and company under which the PMC operates in CAR. 

11. Vagner and/or Sewa are also engaged in capacity building for the CAR military and, to a lesser extent, foreign internal defense. The Berengo estate, 35 km southwest of Bangui, is operational command and headquarters of the Russian contractors in CAR. 

GEOINT Vagner PMC barracks near Bangui (Analysis by T-Intelligence; imagery courtesy of Planet Inc.)

OUTLOOK

12. It is evident that Russia’s troop deployment aimed to strengthen President Touadera’s position ahead of elections. The Kremlin’s investments in diamond drilling in CAR depend on the stability of Touadera’s presidency. 

13. Apart from local rebels, Russia’s main adversary in CAR is France. Under President Macron, France has worked to rebuild influence in Francophone Africa, which directly threatens the Kremlin’s interests in CAR. To protect its investments, Russia will double down on CAR, increase troop numbers (regular and irregular) and throw more assets into the fight. 


by HARM

editing by Gecko

Comments Off on Diamonds are Forever: Russia Doubles Down on Central African Republic (CAR)

Attack on Vienna: 9 Minutes of Terror (SOCMINT)

On 2 November 2020, at around 2000 CET, a gunman opened fire in downtown Vienna, killing four people and injuring 23. The Austrian special forces responded swiftly and neutralized the…

On 2 November 2020, at around 2000 CET, a gunman opened fire in downtown Vienna, killing four people and injuring 23. The Austrian special forces responded swiftly and neutralized the attacker approximately nine minutes after the shooting started. 

Hours before the attack, the gunman pledged allegiance to ISIS and terrorist leader Abu Ibrahim al-Hashimi al-Qurashi in an Instagram post. Like in similar cases, this enabled ISIS to take credit for the attack. 

THE GUNMAN

Austrian Police identified the gunman as Kujtim Fejzulai (KF), a 20-year old Austrian. He had Albanian roots and held both Austrian and Macedonian citizenships. 

KF was known to the Austrian Office for the Protection of the Constitution and Counterterrorism since 2018 when he attempted to travel to Syria to join ISIS. Turkish intelligence apprehended FK before he could cross the border and extradited him to Austria. FK was sentenced to 22 months in jail on terrorism charges but was paroled eight months later.  

In July 2020, KF traveled to neighboring Slovakia to buy ammunition for a Kalashnikov AK-47 assault rifle. He nevertheless returned empty-handed as he did not have a gun license. The Slovak police say they informed their Austrian colleagues immediately, which the Austrian Interior Ministry corroborates. 

Despite the tip-off from the Slovaks, the Austrians failed to exploit the intelligence and arrest the attacker. KF went free, attended radical mosques, and eventually procured weapons. FK also met with known foreign Islamists last summer – two from Germany who were under surveillance and two from Switzerland who have been arrested. 

THE OBJECTIVE

Neither the timing nor the target area was a coincidence. KF launched the attack four hours before new coronavirus restrictions came into effect. As the Viennese enjoyed a last night out, bars and restaurants were packed. 

The attack started near a Jewish Cultural Center on Seitenstettengasse, which was initially considered the gunman’s target. It became clear later that KF’s aim was broader. Thanks to Social Media footage and openly available mapping services, we can partially recreate the attacker’s path. 

THE ATTACK

1. Aprox. 20:00 hours (CET), Seitenstettengasse, 48°12’42.2″N 16°22’28.5″E

Tactical overview 1: Vienna gunman begins his rampage

CCTV footage from the Jewish Cultural Center shows Fejzulai, armed with an AK-47, wearing a white robe and a ski mask, running down Seitenstettengasse. At approximately 20:00 CET, KF guns down his first victim in front of Meinz Cocktail Bar. 

 2. Aprox. 20:05, Schwedenplatz tram station, 48°12’43.5″N 16°22’33.8″E

Tactical overview 2: Gunfight between terrorist and police officers

The attacker appears again on social media. An eyewitness recorded a gunfight between the Austrian police and the terrorist at the Schwedenplatz tram station. The fire exchange resulted in the injury of one officer. The eyewitness filmed the gunfight from the 1st floor of the McDonalds across the street.

3. Aprox. 20:07, Stephandsom Strasse, 48.212196’’N, 16.375128’’E

Tactical overview 3: Gunman flees location of gunfight

An eyewitness video shows the gunman fleeing the gunfight scene via Stephandsom Strasse. KF passes in front of a Billa supermarket and a theatre before taking a left turn toward St. Ruprecht church, where he is ultimately gunned down by the police. 

4. Aprox. 20:09, St. Rupert’s Church, 48°12’43.6″N 16°22’28.6″E

Tactical overview 4: Tango down

The Austrian police guns down KF near St. Rupert’s Church. A photo shared on Twitter shows the suspect laid flat on the cobblestone.  

HUNT FOR SECONDARIES?

Initial reports indicated there were multiple active shooters. Social media photos show the arrest of several suspects. 

Austrian policemen arrest several suspects in connection with the ongoing security situation on 2 November 2020

Over the next few days, the Austrian authorities continued the hunt for potential accomplices through airborne patrols and follow-up raids. At least two helicopters were spotted on flight trackers, displaying behavior consistent with aerial surveillance.

Callsign “FLYCOM2,” operated by a private airborne monitoring company, surveilled the southern city of Graz and the Slovenian border. This sortie was very likely connected with follow-up counter-terrorist activities.  

Callsign “FLYCOM2” flying in a holding pattern over Graz before returning back to Slovenia (ADS-B Exchange screenshot)

The second helicopter flew with no identity and crossed into Slovakian airspace. The helicopter loitered over Bratislava before it returned to the Vienna metropolitan area. While we cannot tell with certainty who was operating the aircraft or what equipment it was carrying on board (SIGINT, IMINT), it is highly likely that this was also a follow-up counter-terror operation. 

“Anonymous” helicopter flies over Vienna after completing a sorties in Slovak airspace (ADS-B Exchange screenshot)

Austrian police also analyzed an estimated 20,000 video materials from eyewitnesses of the attacks, searched over 18 properties, and detained 14 persons believed to be connected with the gunman. 

Despite these efforts, the police have been unable to conclusively determine whether the gunman had any accomplices. 

THE AFTERMATH

KF’s attack marks the return of mass shootings in Europe after a period of relative calm. The Vienna shooting follows a series of terrorist attacks that have shaken France in recent weeks. 

There is reason to believe that ISIS might attempt to capitalize on the recent tempo and order or coordinate a new attack. However, given the group’s precarious situation in Syria and Iraq, it is unlikely that the “central leadership” will produce more than propaganda and calls to action to incite followers abroad. 

SITE Intelligence Group reports that ISIS propaganda has already launched a social media offensive earlier this month. Pro-ISIS media is inciting lone-wolf attacks against the West, with emphasis on Madrid and Paris

Another important lesson to draw from this attack is that no country, not even neutral ones like Austria that refrain from foreign intervention, are safe from jihadi terrorism.


T-Intelligence congratulates the Austrian security forces for enlisting the crowds’ help in the blitz chase for the shooter. At the height of the attack, the Viennese Police asked social media users to send images and videos related to the attack. User-generated content of the shooter posted on social media, proved to be valuable Open-Source Intelligence (OSINT) for live situational awareness, trial evidence, and forensics data.

Learn more about OSINT here.  


by HARM

Comments Off on Attack on Vienna: 9 Minutes of Terror (SOCMINT)

Type on the field below and hit Enter/Return to search