Ukraine at D+249: Drone exchanges.

Russian drone and missile attacks continued against Ukrainian civilian infrastructure over the weekend, with electrical power and water distribution utilities especially targeted. The New York Times reports extensive strikes against cities, and the BBC outlines their widespread and disruptive effects on power and water.

Drone attack against Russian warships.

Early Saturday morning a combination of unmanned aerial and surface vehicles struck Russian warships in the occupied Crimean port of Sevastopol. Some accounts claimed damage to the frigate Admiral Makarov, the Moskva's successor as Black Sea Fleet flagship, the Guardian reports, but Russia's Defense Ministry acknowledged only “minor damage” to the minesweeper Ivan Golubets. Nine drones and seven unmanned surface vehicles are said to have been involved in the attack.

TASS quotes Saturday's report by the Russian Ministry of Defense: "Today at 04:20 am, the Kiev regime carried out a terrorist attack on ships of the Black Sea Fleet and civilian ships.... All air targets were destroyed." The Kremlin characterized the incident as a "terrorist attack."

The Ministry of Defense elaborated on the incident, which it connected to British special operators who, it claims, were also responsible for the sabotage of the Nord Stream pipeline. Here's the account, from TASS:

"Experts from the UK Royal Navy, who were preparing military personnel of Ukraine’s 73rd Maritime Special Operations Center for the recent terrorist attack in Sevastopol, were also involved in the Nord Stream gas pipelines sabotage. 'According to the information available to us, representatives of the UK Navy participated in planning, supporting, and executing the terrorist act in the Baltic Sea on September 26 in order to disrupt the Nord Stream and the Nord Stream 2 gas pipelines,' the statement said.

"According to the ministry, British experts also prepared Ukrainian military for the terrorist attack in Sevastopol. 'The preparation of this terrorist act and the training of military personnel of the Ukrainian 73rd Maritime Special Operations Center were carried out under the guidance of British specialists located in the city of Ochakov, Nikolaev region," the department said.

British authorities dismissed allegations of British responsibility as ridiculous. "To detract from their disastrous handling of the illegal invasion of Ukraine, the Russian Ministry of Defence is resorting to peddling false claims of an epic scale," the UK's Ministry of Defence tweeted. "This invented story, says more about arguments going on inside the Russian Government than it does about the west." It's noteworthy that Moscow is now attributing the Nord Stream sabotage to the British and not, as before, to the Americans, but perhaps to the Kremlin that amounts to a distinction without a difference. Anyway, those Anglo-Saxons all look pretty much alike: it's tough to tell Defense Secretary Lloyd Austin from Defence Secretary Ben Wallace, Prime Minister Sunak from President Biden.

Russia suspends Black Sea grain delivery accord.

Russia has suspended its participation in the accord designed to permit food shipments through the Black Sea, the AP reports. Since its warships can no longer ensure safe passage of dry bulk carriers loaded with Ukrainian grain, the Guardian writes, Russia will no longer guarantee food shipments. The explanation seems curious: Russian warships were the only threat to grain shipments; the only force they were protecting the shipping from was their own. NATO, the EU, and the US have all called upon Russia to resume its participation in the UN-brokered accord.

The Russian Foreign Ministry issued an official statement on the incident and its effect on the Black Sea Grain Initiative:

"On October 29, the Ukrainian Armed Forces, under the cover of the humanitarian corridor set up for the implementation of the Black Sea Grain Initiative for the export of Ukrainian agricultural products, launched massive air and sea strikes using drones against the Russian Black Sea Fleet’s ships and infrastructure at the naval base in Sevastopol.

"As a result of the actions (which cannot be qualified as anything other than a terrorist attack) by the Ukrainian armed forces, led by the British specialists, directed, in particular, against Russian ships ensuring the functioning of the humanitarian corridor, the Russian side can no longer guarantee the safety of civilian dry cargo ships participating in the Black Sea Grain Initiative and will suspend its implementation from today for an indefinite period. The corresponding instructions have been issued to Russian representatives in the Joint Coordination Centre in Istanbul, which is in charge of the transportation of Ukrainian food products."

Late Sunday RT offered further explanation of the Russian decision to suspend participation in the accord. The outlet cites a statement by Russia's Ministry of Defense:

"Most of [the drones] were launched from the Ukrainian Black Sea coast, not far from the port city of Odessa, the Russian military said. 'The naval drones were then moving within the security zone of the grain corridor before changing course and heading towards the Russian naval base in Sevastopol,' the statement said. Navigational data from at least one naval drone shows that it was launched from a sea location within the grain corridor security zone, the ministry added. According to Russian specialists, it might have been launched from a civilian vessel chartered by Ukraine or its 'western backers' to transport Ukrainian agricultural produce....According to Moscow, the Russian ships that were targeted by the Ukrainian drones had been involved in providing security for the 'grain corridor,' which was set up to allow exports of Ukrainian food products through the Black Sea as part of a deal negotiated in Istanbul between Moscow and Kiev with UN and Turkish mediation this summer."

A large number of grain ships--218, according to what the Ukrainian government told Reuters--are said to be waiting in Ukrainian ports. The first ship blocked since Russia withdrew from the accord is the Ikaria Angel, a freighter chartered for a humanitarian mission delivering wheat to Ethiopia, the Telegraph reports. Al Jazeera says that the UN, Ukraine, and Turkey are working to organize ship movements despite Russia's withdrawal from the accords. NBC news reports that Ukrainian officials have said that a total of a dozen ships have so far left three ports.

Wagner Group lowers its recruiting standards.

The Wagner Group appears to have found it necessary to lower standards in its recruitment of convicts mercenaries. The UK's Ministry of Defence (MoD) wrote, in Sunday morning's situation report: "On 27 October 2022, Russian mogul Yevgeny Prigozhin posted online, apparently admitting allegations that his private military company, the Wagner Group, had altered its standards & was recruiting Russian convicts suffering from serious diseases including HIV & Hepatitis C. The role of Wagner Group has evolved significantly since Russia’s invasion of Ukraine. In previous conflicts, it maintained relatively high recruitment standards, with many of its operators having previously served as professional Russian soldiers.The admission of prisoners with serious medical concerns highlights an approach which now prioritises numbers over experience or quality. Prigozhin has recently discussed plans to create a 200km long defensive ‘Wagner Line’ in eastern Ukraine. This endeavour would require a large labour force. There is a realistic possibility that some of the convict recruits will initially be put to work constructing the defences."

In this morning's situation report, the MoD returned to the topic of how poorly equipped newly mobilized Russian forces are proving to be. "Russia has deployed several thousand newly mobilised reservists to the front line in Ukraine since mid-October. In many cases they are poorly equipped. In September, Russian officers were concerned that some recently mobilised reservists were arriving in Ukraine without weapons. Open source images suggest that those rifles which have been issued to mobilised reservists are typically AKMs, a weapon first introduced in 1959. Many are likely in barely usable condition following poor storage. AKM fires 7.62mm ammunition while Russia’s regular combat units are mostly armed with 5.45mm AK-74M or AK-12 rifles. The integration of reservists with contract soldiers and combat veterans in Ukraine will mean Russian logisticians will have to push two types of small arms ammunition to front line positions, rather than one.This will likely further complicate Russia’s already strained logistics systems.

Russian forces remove Prince Potemkin's body from Kherson.

The curious removal of Grigory Potemkin's remains from Kherson was the subject of Saturday's situation report from the MoD. After noting a Russian statement about civilian evacuations from Kherson ("On 27 October 2022, the Russian-appointed governor of Ukraine's occupied Kherson region, Vladimir Saldo, said that more than 70,000 people had now left Kherson city") the report turned to Prince Potemkin. "On 26 October 2022, Saldo also claimed that Russia had removed the remains of the well-known 18th century Russian statesman, Prince Grigory Potemkin, from his tomb in Kherson’s cathedral to the east of the Dnipro. In the Russian national identity, Potemkin is heavily associated with the Russian conquest of Ukrainian lands in the 18th century and highlights the weight Putin almost certainly places on perceived historical justification for the invasion. This symbolic removal of Potemkin and the civilian exodus likely pre-empts Russian intent to expedite withdrawal from the area."

More US aid to Ukraine announced.

On Friday, the Department of Defense (DoD) announced "authorization of a Presidential Drawdown of security assistance valued at up to $275 million to meet Ukraine’s critical security and defense needs. This authorization is the Biden Administration’s twenty-fourth drawdown of equipment from DoD inventories for Ukraine since August 2021."

Deputy Pentagon Press Secretary Sabrina Singh said that the most recently approved package of military aid for Ukraine includes: 

• "Delivery of eight National Advanced Surface-to-Air Missile Systems most likely next month, with training on the system currently underway. 
• "Additional ammunition for High Mobility Artillery Rocket Systems. 
• "500 precision-guided 155 mm artillery rounds. 
• "2,000 155 mm rounds of remote anti-armor mine systems. 
• "Over 1,300 anti-armor systems, including AT4 anti-tank weapons and shoulder-launched multipurpose assault weapons. 
• "125 Humvees. 
• "Small arms with more than 2.75 million rounds. 
• "Four satellite communications antennas to augment Ukraine's communications capabilities, which include Starlink."

"Allies and partners are also providing security assistance to Ukraine, she said. Spain will be delivering HAWK surface-to-air missiles, and Germany will be delivering IRIS-T air defense systems."

Cooperative defense in cyberspace.

Countries sympathetic to Ukraine have contributed weapons, ammunition, and other supplies to Kyiv's defensive war. They've also contributed cyber operational capability. The BBC was permitted a look inside US Cyber Command's forward deployment to Ukraine and other countries threatened by Russian cyber operations. In their hunt forward operations, Cyber Command's teams concentrate on detecting threat activity and reporting it to their partners so the partners can themselves eject the threat actors from their networks. The combined operations the BBC described were conducted before Russia's February invasion, but they continued in county up until the eve of the invasion, at which point the team was relocated from Ukraine. While it was there, however, it contributed both to mitigation of SolarWinds exploitation and Ukraine's preparation to withstand wiper attacks.

The BBC points out that "Hunt Forward missions are classed as 'defensive' but Gen Paul Nakasone, who leads both the military's Cyber Command and the National Security Agency confirmed offensive missions have also been undertaken against Russia in the wake of the invasion of Ukraine. But he and others declined to provide further detail."

A Ukrainian ally describes its exposure to Russian cyberattacks.

Varis Teivans, deputy manager of Latvia’s Computer Emergency Readiness Team (CERT) described his country's experience of Russian cyber operations since the war against Ukraine began. In a conversation with the Record by Recorded Future, he said that the rate of cyberattacks against Latvia had increased by 30% since the war began in February. The Baltic country's experience has been a familiar one: nuisance-level state-inspired nominal hacktivism (much of it by KillNet, F*ckNet, and XakNet) has dominated the threatscape. These attacks have often shown poor intelligence preparation (a website associated with a close airport, for example, was hit) and often amount to nothing more than what Teivans characterized as "PR," as in the publication of publicly available information with the claim that it had been obtained through hacking. The state organizations proper, the APTs run directly by Russian intelligence services, are of more concern, but while their aim and their planning are better than the hacktivist militias, they too seem to have concentrated more on distributed denial-of-service (DDoS) as means of disruption. That could change as the war situation changes. Teivans said, "We are still at a stage where kinetic warfare is a priority for the attacking nation, while cyber is only a tool for threat actors to gain some economic and political advantage or a means to support kinetic operations.”

Despite a lack of results so far, Ukraine, NATO, and the EU remain on alert for Russian cyberattacks on the power grid.

Russia has so far not repeated its successful 2015 and 2016 attacks against Ukraine's power grid, but POLITICO reports that Ukraine and nations sympathetic to it haven't dropped their guard. They believe that Russia is likely to resume attempts against power grids as winter closes in, when such attacks, if successful, would have greater effect. "“I’m totally confident that they are using this time period for preparing for planning of new destructive cyberattacks, which can affect not only Ukraine but our partners as well," POLITICO quotes Victor Zhora, deputy chair of Ukraine’s State Service of Special Communications and Information Protection.

Former UK Prime Minister Truss's phone may have been compromised.

Russian intelligence services are believed to have successfully compromised former British Prime Minister Liz Truss's personal smartphone, the Mail on Sunday reported in an exclusive this weekend. The compromise is thought to have occurred while Ms Truss was serving as Foreign Minister, and continued through the summer's Conservative Party leadership campaign, according to Reuters. The BBC says that Labour and Liberal Democrat members of Parliament have called for a government investigation. This would presumably extend to how any compromise was accomplished, what information would have been compromised, and the extent to which officials use personal devices to communicate about official business.

The Guardian quotes opposition party representatives on the incident:

"Labour’s shadow home secretary, Yvette Cooper, said: 'There are immensely important national security issues raised by an attack like this by a hostile state which will have been taken extremely seriously by our intelligence and security agencies. There are also serious security questions around why and how this information has been leaked or released right now which must also be urgently investigated. It is essential that all of these security issues are investigated and addressed at the very highest level and we need to know that the government recognises the gravity of this and the importance of fully protecting our national security.'

"The Liberal Democrat foreign affairs spokesperson, Layla Moran, said: 'We need an urgent independent investigation to uncover the truth. Was Liz Truss’s phone hacked by Russia, was there a news blackout and if so why? If it turns out this information was withheld from the public to protect Liz Truss’s leadership bid, that would be unforgivable.'”