BANNER: A tank drives along a street in the separatist-controlled city of Donetsk, Ukraine, February 22, 2022. (Source: REUTERS/Alexander Ermochenko TPX IMAGES OF THE DAY)

Kremlin-owned and pro-Kremlin online outlets increasingly reported over the four months leading up to Russia recognizing the independence of the breakaway republics that Ukraine is preparing to attack the Donbas region or Russia. Between November 2021 to January 2022, coverage in Russian media of the Ukrainian attack preparation narrative rose dramatically, with a nearly 50 percent increase in January 2022.

On February 21, 2022, Russian President Vladimir Putin used claims that implicated Ukraine or other Western countries as the aggressor to justify recognizing the independence of the so-called Donetsk and Luhansk People’s Republics (DNR and LNR) and sending in Russian “peacekeeping forces” into the regions. Russia, meanwhile, continues to amass combat units along the Ukraine border and in Belarus.

US intelligence and military assessments have found that Russia has enough forces in place to begin a full-blown invasion of Ukraine at any time. US officials also exposed a Russian plan to use a fabricated video as a pretext for invading Ukraine. The Kremlin denied the reports about the potential fake video, saying “similar has been said before as well. But nothing came of it.”

The DFRLab is tracking Russia’s movements across the military, cyber, and information domains in its ongoing Russian Hybrid Threats Report monitoring project.

While monitoring the Russian information space in late 2021, the DFRLab observed an increase in the narrative that Ukraine plans to attack the Donbas region, where the DNR and LNR are located, or Russia itself. To measure how the narrative proliferated on Russian media, the DFRLab selected ten Kremlin-owned and pro-Kremlin online outlets with a history of spreading Kremlin narratives. The outlets selected were Ria.ru, Russian.RT.com, Vesti.ru, Vz.ru, Iz.ru, Mk.ru, Lenta.ru, Gazeta.ru, Rbc.ru, and Tsargrad.tv.

We then selected six Russian keywords to track the coverage of the narrative. When applicable, we used the root of the Russian word — i.e., the common letters prior to the ending, as the Russian language has six noun cases that alter the suffixes.

We applied a combination of these words to identify articles pushing the above narrative. The combinations were: “Наступлени AND Украин” (“attack AND Ukraine”); “Нападени AND Украин” (“attack AND Ukraine”); “Атак AND Украин” (“attack AND Ukraine”); and “Провокаци AND Украин” (“provocation AND Ukraine”). We also searched these keyword combinations alongside the abbreviation for the Armed forces of Ukraine (“ВСУ”). In total, we utilized eight combinations consisting of six keywords.

The time period of the queries ran from November 1, 2021 through January 28, 2022.

To collect the data, the DFRLab used SerpAPI, a real-time API (Application Programming Interface) with access to Google’s search engine results page (SERP). The query yielded 2,888 articles containing the keyword combinations that were published between the analyzed time period.

To exclude false positives — articles that used the keywords but that did not spread the narrative — the DFRLab manually reviewed the content of all articles collected to identify those spreading the narrative. The results from the SerpAPI query showed the article’s title, lead, and opening paragraphs. In some instances, this information was sufficient in assessing whether the article was spreading the narrative. In other instances, if the scraped data was not sufficient, the DFRLab reviewed the article in its entirety to verify the content.

After removing false positives, the DFRLab found 317 articles sharing the narrative that Ukraine was preparing an attack. The outlet with the greatest number of articles pushing this narrative was Ria.ru, followed by Tsargrad.tv, Iz.ru, and Vesti.ru.

Some of the research limitations included: (1) Other synonyms for the Russian words “attack” and “escalation” might have been used by the outlets; 2) A self-selection bias in choosing only ten online outlets while others might have been pushing the same narrative; 3) The time period was limited to only the past three months; 4) Results relied on using a real-time streaming API, which only collected mentions from Google’s search results.

The identified articles covering the narrative that Ukraine is planning a provocation or attack against eastern Ukraine or Russia were presented in the following forms: coverage of Russian authorities’ statements, coverage of authorities’ statements in the separatist Donbas region, and interviews with Russian political commentators.

The DFRLab observed differences in the narrative throughout the observation period. Some articles accused Ukraine of provoking a conflict or attack, while others accused NATO and the West (particularly the United States) of being behind the provocations. While some articles claimed that Ukraine would attack the Donbas, others named Russia as the target. In the three-month period, the narrative also became increasingly hostile. In November 2021, for example, articles claimed that Kyiv was violating the ceasefire agreement and that there was a possibility Ukraine could attack the Donbas. In December 2021, the outlets blamed the United States for training extremists for the purpose of attacking the Donbas. In January 2022, the outlets claimed that Ukraine might stage a chemical attack in Donbas and blame it on the separatist authorities.

Out of the 317 articles spreading the narrative, 151 of the articles were published in January 2022.

The DFRLab identified days when the mentions of the narrative significantly increased and compared the dates to political developments in Ukraine. The narrative appeared in the following contexts:

In a possible attempt to stage a crisis in the Sea of Azov, the FSB, Russia’s federal security agency, stated that a Ukrainian warship was moving towards the Kerch Strait, disregarding Russian coast guard vessels’ signals and “possessing a threat to maritime safety.” Kyiv rebuked the accusation, stating that the warship was moving inside Ukraine’s territorial waters. The US Embassy in Kyiv also responded to Russia’s false accusations assessing it to be a distraction tactics. Narrative referenced in eighteen articles published on December 10, 2021.

The New York Times reported that the United States and the United Kingdom sent cyberwarfare experts to Ukraine to help in “better preparing the country to confront” Russia’s next steps. Narrative referenced in eighteen articles published on December 21, 2021.

The United Kingdom reported a Kremlin plan to install a pro-Russian government in Ukraine, while German Navy chief Kay-Achim Schönbach resigned after publicly stating that Ukraine would never get Crimea back and that Russian President Vladimir Putin “deserved respect.” Narrative referenced in twenty articles published on January 23, 2022.

The European Union stated they are ready to impose “never-seen-before” sanctions on Russia if it invades Ukraine. Ukraine’s foreign ministry also said the US decision to order the departure of family members of Kyiv embassy staff is a “premature one and an instance of excessive caution.” Narrative referenced in eighteen articles published on January 24, 2022.

US President Joe Biden said he would consider imposing personal sanctions on Vladimir Putin if Russia invades Ukraine, while US State Department spokesman Ned Price stated that the United States “made clear to Belarus that if it allows its territory to be used for an attack on Ukraine, it would face a swift and decisive response from the United States and our allies and partners.” Narrative referenced in seventy-nine articles published between January 26–28, 2022.

To get a better sense of how the news outlets reported versions of the narrative, the DFRLab added the headlines and text of the 317 identified articles to a word tree. A word tree puts keywords in context by identifying the most commonly used words following a specific keyword. For example, the keyword нападения (attack) was connected to “on Russia,” “on Donbas,” “on Crimea,” and “by Ukraine on.”

The above example showcases one Russian translation of the word “attack.” However, other terms, including наступления (attack/offensive) and провокация (provocations), were also used in a similar context.

As the world watches the situation in Ukraine’s with keen interest, the escalation of narratives that could be used by Russia as a supposed pretext for a retaliatory kinetic response against Ukraine is cause for concern.

Eto Buziashvili and Esteban Ponce de León, “Russian outlets steadily increased claims that Ukraine will start a war,” Digital Forensic Research Lab (DFRLab), February 22, 2022, https://medium.com/dfrlab/russian-outlets-steadily-increased-claims-that-ukraine-will-start-a-war-144d60fe10b9.