Ukraine at D+140: Discriminate and indiscriminate war.
N2K logoJul 14, 2022

Russian tactics remain indiscriminate, and there's a growing international consensus that Moscow views this as a feature, not a bug. Ukraine's SSSCIP looks at the evolution of the cyber phases of Russia's war (and it believes the Russian hacktivists are GRU front groups. Smartphones are changing targeting (and not in a good way for smartphone users).

Ukraine at D+140: Discriminate and indiscriminate war.

A deliberately indiscriminate war.

Today's situation report from the UK's Ministry of Defence (MoD) sees little change on ground, but more suffering from heavy Russian artillery fire directed at towns and cities. "In the Donbas, Russian forces continue to conduct artillery strikes across a broad front followed by, in some areas, probing assaults by small company and platoon-sized units. However, they have achieved no significant territorial advances over the last 72 hours and are in danger of losing any momentum built up following the capture of Lysychansk." Many of those strikes have nothing to do with anything resembling plausibly defensible target selection, nor even the indefensible but arguably utilitarian reduction of built-up areas in preparation for their occupation. An example of this tactic was seen this morning, with a Russian strike against Vinnytsia, a city west-southwest of Kyiv and far from any fighting. The Guardian reports that the attack was carried out with Kalibr cruise missiles--long-range strike weapons of indifferent precision--fired from a Russian submarine in the Black Sea. At least twenty are dead, including several children; the attack seems to have been timed to catch people in crowded streets. Ukrainian President Zelenskyy said of the strike, and of Russian operations generally, “Every day Russia destroys civilian population, kills Ukrainian children and directs rockets at civilian targets where there is nothing military. What is this if not an open act of terrorism? It is a killer state. A terrorist state.”

A long essay in the Atlantic opens with a description of the bombing of Serhiivka, a Black Sea vacation community to introduce the argument that the Russian goal is frankly terroristic, and should be understood as such. The essay also argues that such tactics should be understood as war crimes. The International Criminal Court (ICC) is seeking to coordinate international efforts to deal with, presumably at least to investigate, perhaps eventually to prosecute, such crimes. It's convened a meeting, the Ukraine Accountability Conference, in the Hague this week. The AP, which is following the ICC's efforts, has tallied at least three-hundred-thirty-eight distinct war crimes during the special military operation. Among the alleged war crimes, in addition to the deliberate attack of civilian targets, are forced deportations of Ukrainian civilians and widespread sexual assault by occupation troops.

The two general principles that inform the laws of armed conflict are proportionality--that is, not doing more damage than military necessity warrants--and discrimination--that is, refraining from attacks against noncombatants. Russia's operations seem generally to proceed in disregard of both.

Fitting your objectives to your tactics, and your tactics to your capabilities.

The MoD's situation report continues with a characterization of Russian tactics. They match the equipment Russia is deploying in its reconstituted invasion force: obsolescent and incapable of effective maneuver. "The ageing vehicles, weapons, and Soviet-era tactics used by Russian forces do not lend themselves to quickly regaining or building momentum unless used in overwhelming mass – which Russia is currently unable to bring to bear." And talks over grain exports offer little prospect of evolving into negotiations that might bring the war to a close. "Despite 13 July 2022 talks between delegations from Ukraine, Russia, Turkey, and the UN on grain exports and recent successfully negotiated prisoner exchanges, the prospects for wider talks to end the conflict remain low."

An overview of the cyber phase of Russia's hybrid war.

The State Service for Special Communications and Information Protection of Ukraine (SSSCIP) has issued a report on the current state of the cyber phases of Russia's war as they unfolded during the second quarter of the year. It sees Russia as concentrating on, first, espionage, second, network disruption, third, data wiping, and fourth, disinformation. Of these four, the network disruption and disinformation have come to represent a relatively greater fraction of Russian cyber operations. "Comparing to the first quarter of 2022, the number of critical IS events originating from Russian IP addresses decreased by 8.5 times. This is primarily due to the fact that providers of electronic communication networks and/or services that provide access to the Internet blocked IP addresses used by the Russian federation." The SSSCIP considers the nominal hacktivists who've been recently active as simple front groups for the Russian intelligence services. "By attribution, the absolute majority of registered cyber incidents is related to hacker groups funded by the Russian federation government. In particular, these are UAC-0082/UAC-0113 (related to Sandworm), UAC-0010 (Gamaredon) and others, mentioned in the report. In the second quarter of 2022, the main targets of hackers from the Russian federation were the Ukrainian mass media, the government and local authorities sectors. Most information security events can be associated with APT groups and hacktivists activities."

Smartphones as sources of targeting information.

Traditionally targeting cells distinguish between "targets" (something sufficiently identified and located to be hit with an attack) and "target indicators" (information that provides a lead that may, with further investigation, be developed into a target). Sometimes the process is quick (as it might be with data from weapons-locating radar), at other times protracted (as it might be with spot reports from the field). The commodification and ubiquity of smartphones, on the battlefield and elsewhere, have not only given armies a new operational security challenge, but they've also provided targeting cells with a wealth of battlefield information that can develop targets with a hitherto unprecedented immediacy. An analysis Mike Fong, CEO of Privoro, published in HelpNetSecurity explains the risks and opportunities the smartphone presents on the battlefield:

"Of all the signals given off by smartphones in the normal course of operation, location data is perhaps the most valuable during battle. Unlike captured conversations or call metadata, location data is actionable immediately. Location data can reveal troop movements, supply routes and even daily routines. A cluster of troops in a given location may signal an important location. Aggregated location data can also reveal associations between different groups.

"The obvious risk to soldiers is that their location data can be used by the enemy to direct targeted attacks against them. Notably, it has been reported that a Russian general and his staff were killed in an airstrike in the early weeks of the invasion after his phone call was intercepted and geolocated by the Ukrainians."

It's worth noting that targeting a general's smartphone is a far more discriminating way of war than designating a city for destruction.

Thus monitoring phones can yield not only intelligence, but targets. Fong's conclusion is that how an army handles smartphones and the data they throw off can be a difference-maker on the battlefield: "Smartphones are so ubiquitous that their presence on the battlefield is inevitable, even when they’ve been prohibited or otherwise discouraged from use due to lethal consequences. But each location ping gives the enemy another signal that may ultimately culminate in a targeted missile strike or an improved defensive posture. The side that can best fight this information battle very likely has the upper hand in winning the war."