Tag: OSINT

“Do Not Enter:” Using OSINT to Monitor Russia’s Wargames in the Black Sea

Russia has concentrated warships from all fleets, except the Pacific fleet, in the Black Sea for joint drills. While not unprecedented, it is rare to see such a show of…

Russia has concentrated warships from all fleets, except the Pacific fleet, in the Black Sea for joint drills. While not unprecedented, it is rare to see such a show of force.

The cross-theater deployments and large-scale exercises bear the hallmarks of a maritime build-up intended to intimidate Ukraine and deter NATO activities in the Black Sea.

This report showcases the Russian assets and maneuvers and analyzes how these actions are shaping the Black Sea theater of operations.


OBJECTIVE FEAR

Russia’s maritime build-up in the Black Sea has two aims:

  • intimidate Ukraine;
  • deter and complicate NATO activity in the Black Sea.

CROSS-THEATER DEPLOYMENTS

Russian naval task forces from the Caspian, Baltic and Northern Fleets have joined the Black Sea Fleet for exercises near Crimea.  

Caspian Flotilla: Around 15 vessels of the Capsian Flotilla, namely gunboats and landing crafts, entered the Black Sea on 16 April. 

Assets identified: 

  • 6x Project 11770 landing crafts (no. 721, 722, 723, 724, 725, 726) – NATO/AFIC reporting name: Serna-class.
  • 3x Project 1204 artillery gunboats (no. 042, 044, 045) – NATO/AFIC reporting name: Shmel-class.
  • 1x Project 16611 small hydrographic survey vessel (no. 01817).

The deployment was announced on 8 April but in a smaller number. The ships set sail on 11 April, with social media photos documenting their passage through the Don-Volga channel. Footage dated 16 and 17 April shows some of the Caspian task force vessels transiting the Kerch Strait that links the Sea of Azov with the Black Sea. 

OSINT map shows sail path of the Caspian task force (T-Intelligence 2021)

Baltic and Northern Fleets: Both fleets deployed Project 775, or Ropucha-class, landing ships to the Black Sea. Capable of carrying over 450 tones of hardware, primarily tanks or other vehicles, the Ropucha was purpose-built for beach landings. As a versatile hauling platform, the Ropucha has been Russia’s maritime logistical workhorse to deploy and support forces in Syria. 

Shispotters documented their northbound pass through the Bosphorus strait on 17 April.

Baltic Sea assets:

  • 2x Project 775 landing craft ( Kaliningrad no.102 & Korolev no.130) 

Northern Fleet assets: 

  • 2x Project 775 landing craft ( Kondopoga 027 & Alexander Otrakovsky 031) – NATO reporting name: Ropucha-class

The maritime build-up augments Russia’s land maneuvers near Ukraine’s border that have been ongoing for the past month. 

In addition to land and naval movements, Russia has also redeployed over 50 aircraft to Crimea. Ukraine estimates that Russia is now garrisoning nearly 110,000 troops near the Ukrainian border. 

MANEUVERS: COASTAL DEFENSE, AMPHIBIOUS ASSAULT

Russian forces in Crimea will hold a myriad of land, air, and naval exercises until 1 May. Some are already underway, while others will commence this week. 

The Russian drills have so far simulated the defense of Crimea and amphibious assaults of the enemy littoral – undoubtedly a message to Ukraine. Exercises involving marine and amphibious assaults are expected to continue. For example, in the next stage of a multi-phase campaign, Russian marines “will deliver artillery fire against a notional enemy’s coastal targets that will precede a seaborne assault on the shore.”

The satellite imagery below likely shows a Russian naval formation conducting a military exercise off the Crimean coast and near the Kerch Strait. Dated 19 April, the imagery was captured by the Sentinel-1’s synthetic aperture radar, a sensor that allows us to see through cloud cover.  The exercise area is covered by a notice to mariners (NOMAR) that Russia issued a few days ago. 

Sentinel-1 SAR satellite shows large and organized naval formation in a known Russian training area (T-Intelligence 2021)

The timelapse below shows the build-up of military hardware and logistics at the Opuk firing range. High-resolution imagery obtained by Der Spiegel provides a closer look at the staging ground.

Update: Monitoring the waters off Opuk, we have observed another spike in maritime activity on 21 April. The SAR imagery shows new Russian naval manoeuvres that are consistent with a coastal assault. With the exception of one search and rescue vessel (MMSI: 273145123), none of the ships were broadcasting AIS. No activity has been noticed on the previous day (April 20). 

 

New Russian maritime drills spotted on satellite imagery on 21 April (T-Intelligence)

Using visual evidence published by Zvezda TV on 22 April, we were able to confirm that these vessels and movements are connected to Russia’s exercises.

RUSSIAN NO-FLY/NO-SAIL ZONE?

As it is standard procedure, Russia issued a series of notice to airmen (NOTAMs) and notice to mariners (NOMARs) ahead of its exercises, informing seafears and pilots of which areas they should avoid. 

Map of NOTAMs and NOTMARs issued by Russia in connection to its military exercises in the Black Sea (T-Intelligence 2021)

Most “danger areas” are in effect until the end of April. However, in the Kerch strait, Russia plans to suspend the right of passage of foreign warships and “other state ships” until 31 October (purple rectangle). Russia’s state agency later claimed that “the planned restrictions will not affect navigation in the Kerch Strait or its entry points.” 

Russia’s temporary air-naval restrictions will have severe ramifications for maritime traffic to and from the Ukrainian port cities in the Azov sea, such as the strategic city of Mariupol. Russia’s de facto blockade of the Kerch strait will also prevent the Ukrainian navy, primarily based in Odessa, from reaching Mariupol in the event of a crisis.

In addition, Russia aims to deter NATO countries from even considering a “freedom of navigation” operation through the strait or a port visit on Ukrainian coast in the sea of Azov. However, the alliance has never suggested that it is considering such missions. 

DENYING NATO ISR ADVANTAGE?

Another key effect of Russia’s excessively large NOTAMs and NOMARs is that it could deter or significantly limit NATO’s ISR (Intelligence, Surveillance, and Reconnaissance) missions on Russia’s exercises.

U.S. and British reconnaissance aircraft have been intensively monitoring eastern Ukraine, Crimea, and Russia’s Black Sea for the past weeks. Drones and maritime patrol aircraft are surveilling Crimea’s coast daily up until 19 April, keeping a close watch on Russia’s build-up – read more about NATO’s ISR operations here.

Given the latest NOTAMs, NATO surveillance platforms could be targeted by Russian anti-air fire or electronic attacks. From a legal standpoint, Russia has no authority to restrict the regional airspace, as Crimea is still internationally recognized as Ukrainian territory and falls under the Kiyv flight information region (FIR). However, the Russian build-up displays a credible capability and threat. It remains to be seen if NATO ISR missions will continue, and if so, how. 

DETERRENCE TEST FOR NATO

The movement of extra-regional NATO vessels will also be indicative of whether Russia’s muscle-flexing and deterrence work. Two U.S. warships are currently on station in the Aegean Sea after President Biden abandoned plans to sail into the Black Sea, fearing that this move would provoke Russia. 

Despite Washington’s reluctance, London has instructed two Royal Navy warships, one Type 45 destroyer and one Type 23 anti-submarine frigate, to deploy to the Black Sea. It remains to be seen if London will go through with the plan in May and if the U.S. warships will continue to idle in Greek waters. 

One thing is certain, regional NATO countries and Ukraine would breathe easier knowing that advance British and American destroyers are in the Black Sea just in case Russia’s wargames turn out to be something else.  


by HARM

editing by Gecko

Update 23 April – added a new satellite image of Russian naval drills from 21 April and two explanatory paragraphs. 

Update 22 April – additional comments have been added on the paragraph about NOTAMs and NOMARs to clarify Russia’s perspective on its plans to limit navigation through the Kerch strait. 

Please follow and like us:
No Comments on “Do Not Enter:” Using OSINT to Monitor Russia’s Wargames in the Black Sea

Attack on Vienna: 9 Minutes of Terror (SOCMINT)

On 2 November 2020, at around 2000 CET, a gunman opened fire in downtown Vienna, killing four people and injuring 23. The Austrian special forces responded swiftly and neutralized the…

On 2 November 2020, at around 2000 CET, a gunman opened fire in downtown Vienna, killing four people and injuring 23. The Austrian special forces responded swiftly and neutralized the attacker approximately nine minutes after the shooting started. 

Hours before the attack, the gunman pledged allegiance to ISIS and terrorist leader Abu Ibrahim al-Hashimi al-Qurashi in an Instagram post. Like in similar cases, this enabled ISIS to take credit for the attack. 

THE GUNMAN

Austrian Police identified the gunman as Kujtim Fejzulai (KF), a 20-year old Austrian. He had Albanian roots and held both Austrian and Macedonian citizenships. 

KF was known to the Austrian Office for the Protection of the Constitution and Counterterrorism since 2018 when he attempted to travel to Syria to join ISIS. Turkish intelligence apprehended FK before he could cross the border and extradited him to Austria. FK was sentenced to 22 months in jail on terrorism charges but was paroled eight months later.  

In July 2020, KF traveled to neighboring Slovakia to buy ammunition for a Kalashnikov AK-47 assault rifle. He nevertheless returned empty-handed as he did not have a gun license. The Slovak police say they informed their Austrian colleagues immediately, which the Austrian Interior Ministry corroborates. 

Despite the tip-off from the Slovaks, the Austrians failed to exploit the intelligence and arrest the attacker. KF went free, attended radical mosques, and eventually procured weapons. FK also met with known foreign Islamists last summer – two from Germany who were under surveillance and two from Switzerland who have been arrested. 

THE OBJECTIVE

Neither the timing nor the target area was a coincidence. KF launched the attack four hours before new coronavirus restrictions came into effect. As the Viennese enjoyed a last night out, bars and restaurants were packed. 

The attack started near a Jewish Cultural Center on Seitenstettengasse, which was initially considered the gunman’s target. It became clear later that KF’s aim was broader. Thanks to Social Media footage and openly available mapping services, we can partially recreate the attacker’s path. 

THE ATTACK

1. Aprox. 20:00 hours (CET), Seitenstettengasse, 48°12’42.2″N 16°22’28.5″E

Tactical overview 1: Vienna gunman begins his rampage

CCTV footage from the Jewish Cultural Center shows Fejzulai, armed with an AK-47, wearing a white robe and a ski mask, running down Seitenstettengasse. At approximately 20:00 CET, KF guns down his first victim in front of Meinz Cocktail Bar. 

 2. Aprox. 20:05, Schwedenplatz tram station, 48°12’43.5″N 16°22’33.8″E

Tactical overview 2: Gunfight between terrorist and police officers

The attacker appears again on social media. An eyewitness recorded a gunfight between the Austrian police and the terrorist at the Schwedenplatz tram station. The fire exchange resulted in the injury of one officer. The eyewitness filmed the gunfight from the 1st floor of the McDonalds across the street.

3. Aprox. 20:07, Stephandsom Strasse, 48.212196’’N, 16.375128’’E

Tactical overview 3: Gunman flees location of gunfight

An eyewitness video shows the gunman fleeing the gunfight scene via Stephandsom Strasse. KF passes in front of a Billa supermarket and a theatre before taking a left turn toward St. Ruprecht church, where he is ultimately gunned down by the police. 

4. Aprox. 20:09, St. Rupert’s Church, 48°12’43.6″N 16°22’28.6″E

Tactical overview 4: Tango down

The Austrian police guns down KF near St. Rupert’s Church. A photo shared on Twitter shows the suspect laid flat on the cobblestone.  

HUNT FOR SECONDARIES?

Initial reports indicated there were multiple active shooters. Social media photos show the arrest of several suspects. 

Austrian policemen arrest several suspects in connection with the ongoing security situation on 2 November 2020

Over the next few days, the Austrian authorities continued the hunt for potential accomplices through airborne patrols and follow-up raids. At least two helicopters were spotted on flight trackers, displaying behavior consistent with aerial surveillance.

Callsign “FLYCOM2,” operated by a private airborne monitoring company, surveilled the southern city of Graz and the Slovenian border. This sortie was very likely connected with follow-up counter-terrorist activities.  

Callsign “FLYCOM2” flying in a holding pattern over Graz before returning back to Slovenia (ADS-B Exchange screenshot)

The second helicopter flew with no identity and crossed into Slovakian airspace. The helicopter loitered over Bratislava before it returned to the Vienna metropolitan area. While we cannot tell with certainty who was operating the aircraft or what equipment it was carrying on board (SIGINT, IMINT), it is highly likely that this was also a follow-up counter-terror operation. 

“Anonymous” helicopter flies over Vienna after completing a sorties in Slovak airspace (ADS-B Exchange screenshot)

Austrian police also analyzed an estimated 20,000 video materials from eyewitnesses of the attacks, searched over 18 properties, and detained 14 persons believed to be connected with the gunman. 

Despite these efforts, the police have been unable to conclusively determine whether the gunman had any accomplices. 

THE AFTERMATH

KF’s attack marks the return of mass shootings in Europe after a period of relative calm. The Vienna shooting follows a series of terrorist attacks that have shaken France in recent weeks. 

There is reason to believe that ISIS might attempt to capitalize on the recent tempo and order or coordinate a new attack. However, given the group’s precarious situation in Syria and Iraq, it is unlikely that the “central leadership” will produce more than propaganda and calls to action to incite followers abroad. 

SITE Intelligence Group reports that ISIS propaganda has already launched a social media offensive earlier this month. Pro-ISIS media is inciting lone-wolf attacks against the West, with emphasis on Madrid and Paris

Another important lesson to draw from this attack is that no country, not even neutral ones like Austria that refrain from foreign intervention, are safe from jihadi terrorism.


T-Intelligence congratulates the Austrian security forces for enlisting the crowds’ help in the blitz chase for the shooter. At the height of the attack, the Viennese Police asked social media users to send images and videos related to the attack. User-generated content of the shooter posted on social media, proved to be valuable Open-Source Intelligence (OSINT) for live situational awareness, trial evidence, and forensics data.

Learn more about OSINT here.  


by HARM

Please follow and like us:
No Comments on Attack on Vienna: 9 Minutes of Terror (SOCMINT)

Type on the field below and hit Enter/Return to search