Image: Igor Kirillov, Chief of the Radiation, Chemical and Biological Protection Troops of the Armed Forces of the Russian Federation. (Source: Vadim Savitsky/press service of the Ministry of Defense of the Russian Federation/TASS)

As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian War Report.

Kremlin recycles old narratives to claim Ukraine is constructing dirty bombs and bioweapons

Journalists in Odesa receive threatening emails for “dissemination of Nazi propaganda”

Ukrainian social media accounts misinterpret Putin video as fake

Russia continues to bombard Ukrainian cities

Russia continues to launch attacks on Ukraine from Belarus

TikTok suspends video uploads and livestreams on its platform in Russia

RFE/RL instructs Russians how to bypass censorship of news websites

Concerns arise that Ukrainian invasion is accelerating internet fragmentation

Telegram founder publicly declares he won’t share Ukrainian user data with Russia

Belarusian fighters continue to join Ukrainian resistance

Georgian citizens worry about Russian influx, demand cancellation of visa-free regime

Russia claims it will partially lift sanctions on Georgia

In a further attempt to justify its invasion of Ukraine, the Kremlin once again accused Ukraine of provoking Russia by developing dirty bombs and biological weapons. Russia’s Ministry of Foreign Affairs claimed on March 6 that the Security Service of Ukraine and Azov Battalion “mined a reactor at an experimental nuclear facility at the Kharkov Institute of Physics and Technology” in order to “accuse Russia of creating an ecological catastrophe.” The claim was based on an “alert” from Russia’s Ministry of Defense and quotes from the Kremlin-owned outlet Sputnik. The accusation is the latest in a series over the last two weeks in which Russian officials and Kremlin media have claimed without evidence that Ukraine was creating a dirty bomb.

That same day, the Russian Defense Ministry asserted that it had obtained documentary proof that Ukraine and the US had collaborated to develop biological weapons. According to Major General Igor Konashenkov, who made the announcement, “In the course of a special military operation, the facts of an emergency cleansing by the Kyiv regime of traces of a military biological program being implemented in Ukraine, funded by the US Department of Defense, were uncovered.” According to TASS, the US and Ukraine attempted to destroy samples of “plague, anthrax, tularemia, cholera and other deadly diseases” on February 24, the day of Russia’s invasion. TASS published digital scans of several documents the defense ministry claimed were evidence of the bioweapons program, though did not elaborate further on their provenance.

The Kremlin has repeatedly used forged documents, including false signatures, as part of previous influence operations, notably the campaign that the DFRLab referred to as Operation Secondary Infektion in its 2019 investigation of Russian influence activities.

On February 7, the Kremlin doubled down on its allegations. According to TASS, Ukraine operated bioweapon facilities in Kharkiv, Poltava, and Lviv, and shared “thousands of patient serum samples, primarily those belonging to the ‘Slavic ethnic group,’” with the Walter Reed Naval Hospital near Washington DC. TASS quoted Igor Kirillov, Chief of the Radiation, Chemical and Biological Defense Forces of the RF Armed Forces, who stated, “Analysis of acts of destruction shows the work with the pathogens of plague, anthrax and brucellosis in the Lviv biological laboratory, pathogens of diphtheria, salmonellosis and dysentery in laboratories in Kharkiv and Poltava.”

The Kremlin has a long history of accusing the West of developing biological agents, going back to the Cold War. In 2020, pro-Kremlin media attempted to blame the US for the COVID pandemic, suggesting it was either manufactured in a biolab in Tbilisi, or at Ft. Detrick, Maryland. 

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

—Andy Carvin, Managing Editor, Washington DC

Media outlets in the Ukrainian port city of Odesa received threatening emails on Friday from an anonymous sender using the email odezzarus@protonmail.com. The email’s subject line stated, “your chance to be saved.” The message urged outlets to give up anti-Russian activities and place a pro-Kremlin banner on their websites spelling Odesa with a “Z” instead of an “s.” The letter Z has become a symbol adopted by Russian President Vladimir Putin’s supporters to express solidarity with the invasion, as Russian forces have used the Z marking on their military equipment, likely to avoid so-called friendly fire incidents. The email claimed that these actions would “soften the inevitable punishment for Nazi involvement.” 

The next day, Odesa journalist Konstantin Gak said he received a second email from the same sender. The email included multiple Z’s and claimed local journalists bear personal responsibility for the “betrayal of Russian identity” and “dissemination of Nazi propaganda.” The sender claimed “redemption” is inevitable and to “soften the sentence,” journalists should “riot.”

Gak noticed that the sender forgot to delete a part of the email that provided instructions for how to compose the message. According to the instructions, senders are told, “add here a few paragraphs on local specifics,” “these emails should be disseminated every day to crush the morale,” “send emails individually, not to a list,” and “think about painful dots to push on.” These instructions suggest the emails could be part of a broader campaign to threaten Ukrainian journalists.

—Roman Osadchuk, Research Associate

The office of Russian President Vladimir Putin published a video on March 5 showing a meeting between the Russian leader and Aeroflot flight attendants ahead of International Women’s Day. Both Kremlin–owned and Western media outlets covered the meeting.

The Kremlin-owned television program Rossiya 24 published a video clip from the meeting, in which Putin discusses the possibility of NATO imposing a no-fly zone over Ukraine. A poor-quality version of the video was posted on Reddit, with the user drawing attention to how Putin’s hand appears to “pass through” his microphone. The user claimed this was evidence that Putin used a green screen to be edited into the video. The post garnered 25,600 engagements on social media, according to a query conducted on BuzzSumo, a social media listening tool. 

However, all evidence points to the video glitch resulting from compressing a low-resolution video. US media outlet Mother Jones reviewed the video and compared it with a higher-quality version. Putin’s hand does not pass through the microphone in the higher resolution video, proving that the illusion was likely due to video compression. Reporting from other western media outlets supports the compression theory as well.

The Reddit post was eventually deleted by the individual who uploaded it.

Nevertheless, many Ukrainian media outlets amplified the story. For example, Ukrainian media outlet NV.ua went further and claimed that the reflection in Putin’s teapot shows empty chairs; therefore, the outlet argued, Putin did not meet the flight attendants in person. While the reflection in the teapot is too blurry to be conclusive, it seems likely that the so-called empty chairs are actually the flower petals from the table’s floral arrangement.

Despite the debunks of the “passing through the mic” theory, pro-Ukrainian social media accounts exploited allegations of the video being staged. For instance, a Twitter account named Ukrainian Meme Forces combined the low-compression clip with a video showing Ukrainian President Volodymyr Zelensky pushing a microphone away.

The claim that Putin’s hand passed through the mic due to intentional editing was likely considered plausible because the Kremlin has manipulated videos in the past, while Putin’s now-infamous use of enormously long tables has sparked allegations that he is paranoid about meeting with people. 

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

Russian artillery and aerial bombardments of civilian areas continued throughout the weekend. On March 6, an evacuation route for civilians was shelled in the northwestern Kyiv suburb of Irpin. As many as eight people died in the attack. In Pyatikhatki, a suburb of Kharkiv, a busy supermarket was hit with artillery fire, according to local media citing the Ukrainian prosecutor-general; at least four were killed and fifteen injured as a result of the shelling. Indiscriminate shelling continued against Izium, Chernihiv, Mykolaiv, Severodonetsk, Mariupol, and many more cities. Russian forces took the Zaporizhzhia nuclear power plant on Friday, damaging the facility and risking disaster in the process.

—Michael Sheldon, Research Associate, Washington DC

On March 7, the Ukrainian Armed Forces announced that Russians are using airfields located in Belarus to conduct airstrikes on Ukraine. Independent Belarusian media outlet Flagshtok reported on the same day that Russia is disguising the transportation of missiles by using standard freight trains. On March 6, the large-scale departure of Russian aircrafts from Belarus to Ukraine was reported. 

On March 7, the Russian Ministry of Defense proposed routes for “humanitarian corridors” that lead to Russia and Belarus. Ukraine rejected the proposal. Meanwhile, James Cleverly, the UK Minister for Europe and North America, called the proposed Russian routes “cynical beyond belief” and “nonsense.”

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

On March 4, Chinese social media platform TikTok announced that the company will indefinitely ban users in Russia from live-streaming or uploading new content due to Russia’s recently enacted ”fake” news law. However, the company underlined that the new restrictions would not impact the platform’s in-app messaging service. According to the new law, people who disseminate false information about the actions of the Russian Armed Forces in Ukraine face up to fifteen years in prison. 

TikTok also announced a labeling policy for accounts run by Russian state media. So far, the accounts Soapbox, GetWasteed, and InTheNow have all received the label. Earlier, TikTok announced that it was restricting access for Russian state-controlled media accounts within the European Union. In response, Russian information agency Roskomnadzor wrote a letter to TikTok demanding the company to clarify why it had removed videos by state-controlled news agency RIA Novosti.

—Givi Gigitashvili, Research Associate, Warsaw, Poland

After Russia blocked the news outlet Radio Free Europe/Radio Liberty (RFE/RL), the organization took to Twitter to provide tips on bypassing Russian censors to access its website. Among the various options, RFE/RL suggested its readers use a VPN or a Tor browser to access the dark web version of their website. RFE/RL also encouraged readers in Russia to subscribe to their Telegram channel. The BBC provided similar guidelines last week to help users circumvent Russia’s blocking of its website.

—Eto Buziashvili, Research Associate, Tbilisi, Georgia

On March 7, Telegram founder Pavel Durov posted a statement on his official Telegram channel in which he made clear that he will not share Ukrainian Telegram user data with Russian authorities. Durov, who is Russian but lives abroad, explained that his mother is Ukrainian and he has family in the country. He then noted, “Some people wondered if Telegram is somehow less secure for Ukrainians, because I once lived in Russia. Let me tell these people how my career in Russia ended.”

Durov continued by explaining how the Russian security agency tried to pressure him in 2013 to release Ukrainian user data from the social network VK, which he also founded. “I refused to comply with these demands, because it would have meant a betrayal of our Ukrainian users,” he explained. “After that, I was fired from the company I founded and was forced to leave Russia.”

He concluded the statement by writing, “When I defied their demands, the stakes were high for me personally. I was still living in Russia, and my team and my old company were also based in that country. Many years have passed since then. Many things changed: I no longer live in Russia, no longer have any companies or employees there. But one thing remains the same – I stand for our users no matter what. Their right to privacy is sacred. Now – more than ever.”

—Andy Carvin, Managing Editor, Washington DC

Following last week’s sanctions decision, RT and Sputnik remain banned in the European Union, and Russian state media remains labeled, de-ranked, and defunded across numerous international social media platforms. International technology companies such as Apple and Microsoft have suspended sales within Russia. As the international community moves to shut down Russian disinformation, fears have arisen that Russia may take increasing steps to wall off its internet and slow the sharing of international information in turn. 

As previously noted, Kremlin recently passed a law criminalizing the sharing of “fake news,” an arbitrary designation that will be used to police any unfavorable or critical speech and has heavily impacted independent journalists operating in country. In addition to the policing of speech, there are signals that the Russian government may move towards the technical separation of its internet from the global internet. Prior to the conflict, Russia has passed laws which give Roskomnadzor more control over digital architecture, creating a legal and technical basis for the establishment of an insular, or “sovereign” domestic internet, though evidence of success is limited. Recently, the Ministry of Digital Development ordered that all government websites and telecommunications providers switch to the Russian domestic DNS, hosts, and providers.

This follows a request from the Ukrainian government to ICANN, the international nonprofit that manages global internet operability, to suspend the main Russian domain name .ru. While ICANN rejected this request, global debates about the role of governments in the administration of the internet are growing. Currently, Russian and Chinese officials are campaigning for the International Telecommunication Union, the UN body responsible for communication and information technologies, and governments to assume more control over internet administration and function.

—Jacqueline Malaret, Assistant Director, Washington, DC

Reports continue to surface showing that Belarusians are joining Ukrainians to fight against Russia. On March 5, a Belarusian volunteer in Kyiv, Vadzim Prakopyeu, reported that 200 Belarusians are currently fighting with the Ukrainian Armed Forces, and an additional 300 volunteers are planning to join the Foreign Legion. These claims are supported by online videos of Belarusian volunteers holding drills in Ukraine.

According to the Belarusian opposition, there are signs that the Belarusian army is avoiding direct confrontation with the Ukrainians. According to Franak Viačorka, a senior advisor to Belarusian opposition leader Sviatlana Tsikhanouskaya, the Belarusian forces were supposed to enter Ukraine in late February, “but something went wrong.” These claims are supported by the recent resignation of Deputy Defense Minister Major General Viktor Gulevich. He reportedly resigned on March 6 due to not being able to “support the current Russian invasion of Ukraine.” According to Tsikhanouskaya, Lukashenka has effectively ceded the control of the Belarusian military to the Kremlin.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

Georgian citizens are raising alarms bells on social media over reports that Russian citizens are moving to Georgia to escape the toll of international sanctions. Some examples of the posts include a video of Russian citizens standing in ATM lines in Tbilisi, real estate agents sharing posts from homeowners who refuse to host Russian citizens, and private companies refusing to provide services to Russian citizens.

Last week, Georgian citizens launched a petition calling on the government to cancel the visa-free regime with Russia, in order to differentiate between those fleeing Russian President Vladimir Putin’s regime and other visitors from Russia. 

According to iFact, an investigative journalism organization, 201 Russian citizens applied to the Georgian Public Registry between March 1 and March 4 to start a business.

In response, Irakli Kobakhidze, Chairman of the Georgian Dream ruling party, said, “the campaign against Russians is a manifestation of discrimination and chauvinism.” He added that perpetrators of such action would be punished. Civil society actors harshly criticized this statement. In addition, activists criticized the decision to bar journalist Mikhail Fishman, a Dozhd TV host, from entering Georgia. 

On March 7, citizens took to the streets with another similar demand, calling on the government to ban Russian state-affiliated media and close the sky to Russian planes. Four activists were arrested right after the demonstration ended. A policeman told media that activists were detained because they were throwing toilet papers at the administration building of the Government of Georgia and insulted police, but footage demonstrates that the protesters were detained while they were leaving the territory. One of the protesters was detained while he was live-streaming arrests.

—Sopo Gelava, Research Associate, Tbilisi, Georgia

Rosselkhoznadzor, Russia’s veterinary supervision agency, said it would permit fifteen Georgian companies to export dairy products to Russia, a claim that Georgia’s economic minister Levan Davitashvili denies. According to the agency, the decision comes after negotiations between the heads of Rosselkhoznadzor and Georgia’s National Food Agency. However, according to Georgian online media outlet Civil.ge, one of the largest Georgian dairy companies, Sante GMT, refused to export their products to Russia. 

The Ukrainian embassy in Georgia said that Russia decided to partially lift sanctions on Georgia on the condition that Georgian authorities disapprove of sanctions against Russia. “We believe the promotion of trade relations with Russia, whose armed forces are attacking peaceful Ukrainian cities with missiles and bombs, killing innocent civilians, including children, to be unacceptable in the strongest terms,” the embassy statement said. 

The embassy also called on the Georgian government to distance itself publicly from Russia, “whose leadership is violating international law and perpetrating war crimes in Ukraine.” The wrote, “Due to the 2008 Russian armed aggression against Georgia, the Georgian people, unfortunately, are well aware of the horrors of war that Ukrainians are forced to go through now. At the same time, it appears that the Georgian authorities must have forgotten all that and are now trying to seize the moment to cater for their own interests.” 

Contrary to Rosselkhoznadzor’s statement, Levan Davitashvili said there had not been any communications about exporting dairy products to Russia since 2020.

—Sopo Gelava, Research Associate, Tbilisi, Georgia