Image: Russian “evidence” that Ukraine intends to invade Crimea, including linguistic and cultural clues suggesting they were made in Russia. (Source: Telegram)

As Russia expands its assault on Ukraine, the Atlantic Council’s Digital Forensic Research Lab (DFRLab) is keeping a close eye on Russia’s movements across the military, cyber, and information domains. With more than five years of experience monitoring the situation in Ukraine, as well as Russia’s use of propaganda and disinformation to undermine the US, NATO, and the European Union, DFRLab’s global team presents the latest installment of the Russian War Report.

Russia produces “evidence” claiming Ukraine will attack Crimea

Russia accuses Hunter Biden and George Soros of funding Ukrainian biolabs

Russian military leaders not seen in public for weeks

New videos suggest Russia is sending additional missiles to Belarus

Russia blocks access to Google News, leveraging increasingly restrictive moderation laws

On March 24, the pro-Kremlin Telegram channel Оперативные сводки (“Operative news”) published photos of medals and certificates that it alleged were going to be used to reward Ukrainian troops “for the capture of Crimea.” The post said the medals and documents were found in Ukrainian conscription offices. Another Telegram channel, Kremlin Z, claimed that these items were discovered in the city of Kherson, currently occupied by Russia. Russian media amplified this message, claiming that the medals were evidence that Ukraine, with the help of NATO, was planning to attack Crimea. 

This appears to be the latest in a string of Russian false-flag allegations, due to the alleged evidence’s incorrect use of official Ukrainian terminology. Ukraine considers Crimea to be temporarily occupied or annexed by Russia, so if such materials were to exist, they would likely reference the “liberation” of Crimea rather than its “capture.”  Further, official Ukrainian documents refer to Crimea as “the Autonomous Republic of Crimea” or “AR Crimea,” while materials allegedly found by Russia did not. The certificates also mention that the medal would be awarded under a Ukrainian presidential “order,” even though Ukrainian military personnel only receive awards via presidential “decree.” Notably, Russia itself uses the word “order” to describe ministerial awards and decrees for presidential awards, as documented in an investigation by Bellingcat. 

Lastly, the initials of Ukrainian President Volodymyr Zelenskyy are incorrect in the materials. The certificates state that his first two initials are “ВА,” which is correct in Russian Cyrillic, which spells his full name as Влади́мир Алекса́ндрович Зеле́нский, or Vladimir Aleksandrovich Zelenskiy. However, this does not correspond with Zelenskyy’s first two initials in Ukrainian Cyrillic. In Ukrainian, his name is spelled Володимир Олександрович Зеленський, or Volodymyr Oleksandrovich Zelenskyy, so the correct Ukrainian Cyrillic abbreviation for his first two initials is “ВО.”

—Roman Osadchuk, Research Associate

Russia’s Ministry of Defense (MoD) accused investment firm Rosemont Seneca, headed by Hunter Biden, and philanthropist George Soros of financing Ukrainian biolabs. TASS quoted Igor Kirillov, Chief of the Radiation, Chemical and Biological Defense Forces of the RF Armed Forces, who stated that Russia has traced “the scheme of interaction between US government agencies and Ukrainian biological programs. Attention should be drawn to the involvement in the financing of these activities of structures close to the current US leadership, in particular the investment fund Rosemont Seneca, led by Hunter Biden.” He added, “The US Agency for International Development, the George Soros Foundation, and the Centers for Disease Control and Prevention are directly involved” in financing the labs.

Kremlin outlets have amplified Kirillov’s statement in articles using variations of titles accusing Hunter Biden, son of US President Joe Biden, of funding Ukrainian biolabs. Russia’s State Duma speaker, Vyacheslav Volodin, stated that President Biden now “is obliged to explain to the world community the evidence concerning the activity of biological laboratories discovered in the course of the military operation in Ukraine.”

The latest Kremlin statements represent the latest expansion of Russia’s attempts to justify war in Ukraine with false-flag narratives claiming that Ukraine was planning to use biological research laboratories to create and deploy bioweapons against Russia.

—Eto Buziashvili, Research Associate, Washington DC

On March 22, Dmitry Treschanin, a Russian journalist working for banned independent Russian media outlet Mediazona, tweeted that Russian Minister of Defense Sergei Shoigu had not been seen in public since March 11. Another Russian independent media outlet, Agenstvo, published a timeline listing all of Shoigu’s public appearances since February 24, the day Russia invaded Ukraine. Agenstvo confirmed that the last verifiable Shoigu appearance was on March 11. There are reports that Shoigu met with Russian President Vladimir Putin on March 18 and later handed out medals to war heroes, but neither instance has been confirmed.

Kremlin-controlled media outlets and Telegram channels disregarded the claims about Shoigu as “Ukrainian fakes.” On March 24, Rossiya 24 interrupted its program to air footage from a Russian Security Council video call in which Shoigu allegedly participated; a similar video appeared on RIA Novosti’s Telegram channel. The Moscow Times, an independent media outlet, posted a side-by-side video comparing the March 24 footage with video from a March 11 call.

In both videos, Shoigu appears to be wearing the same outfit, and his tie even tilts to the same side in both clips. However, Shoigu’s movements in the videos are not identical, so it is unclear if the video was taken from additional footage during the March 11 event that had not been previously released. Earlier, the fringe outlet Sensaciy.net claimed, “Facts from Russian media confirm that Shoigu, Gerasimov, and others have not disappeared.” The article linked to footage of Shoigu, but it too was recorded on March 11, the day he was last documented publicly, showing Shoigu handing out war medals.

Agenstvo also reported that Chief of the General Staff of the Russian Armed Forces Valeriy Gerasimov had not made any public appearances since March 11. Advisor to the President of Ukraine Mihailo Podolyak noted on his Telegram channel that other “heavyweights” from the Kremlin regime, such as Nikolai Patrushev (Secretary of Russia’s Security Council), Aleksandr Bortnikov (Head of Russia’s Federal Security Service), and Sergey Naryshkin (Head of Russia’s Intelligence Service), had also not made any recent public appearances. Additionally, the Washington Post reported on March 24 that US defense and military leaders could not reach Russia’s military leadership on the phone. 

—Nika Aleksejeva, Lead Researcher, Riga, Latvia

Newly released videos suggest that Russia has deployed additional mobile short-range ballistic missile systems to Belarus. A March 24 video shows Russian military Kamaz trucks on Belarus’s M10 highway carrying at least fourteen missiles, used for Iskander missile systems. According to reports, the missiles were on the move from Rechitsa towards the city of Gomel. Large boxes used to transport Iskander missiles are visible on the trucks. Iskander missiles have the capability of carrying either conventional or nuclear warheads.

Another video surfaced on the same day showing nine Kamaz trucks, allegedly near the village of Dudichi in the region of Grodno. Similar to the first video, the convoy was travelling with a loading vehicle, with each truck carrying two missile boxes. The DFRLab has not yet geolocated these videos or verified whether these two videos show the same convoy.

On March 23, additional footage showed alleged Iskander missiles being fired from Belarus toward Ukraine. The videos could not be geolocated at the time of writing, though the comments on the video claim that the missiles were launched from the Lipov area in Gomel Oblast, southern Belarus. According to Google Maps, the Bobrovichi airport, which has reportedly been used for attacks against Ukraine, is sixteen kilometers away from the village of Lipov.

—Lukas Andriukaitis, Associate Director, Brussels, Belgium

On March 23, Interfax confirmed that Russian communications regulator Roskomnadzor had blocked access to Google News in the country. According to the Interfax report, the decision cited claims that numerous articles on Google News provided “publications and materials containing unreliable, publicly significant information” about the war in Ukraine. 

Roskomnadzor’s action confirms earlier reports from users in Russia and a Google spokesperson who noted people were having difficulty accessing the Google News app and website in Russia, and it was not due to any technical problems. Additionally, TechCrunch reported that a source inside Russia had confirmed to the outlet that the service had been blocked.

The Google News ban came hours after Google published updated advertising guidelines announcing that it would not allow global users to monetize online content that “exploits, dismisses, or condones” the war in Ukraine. Google’s new policy applies to all websites, apps, and YouTube channels that earn profits from Google advertising services. The ban also followed numerous news releases by Roskomnadzor reprimanding Google, though most have been focused on the activities of its subsidiary, YouTube. One release published on March 18 claimed that Google has taken “a clear anti-Russian stance,” and that its actions “not only violate Russian law, but also contradict generally accepted norms of morality.”  

Russia’s decision to ban Google News draws on both long-standing and new laws. A 2012 law allows Roskomnadzor to request that internet service providers block access to a domain if it contains materials promoting drug use, child pornography, or calls for “extremism” or “mass riots.” The broad wording of this law has been used repeatedly since the beginning of Russia’s invasion of Ukraine to block access to sites Russia deems anti-war. In 2017, Russia passed federal law No. 208-FZ, which holds news aggregators like Google or Yandex accountable for the accuracy of the information “of public significance” that they host, and ostensibly seeks to prevent the “dissemination of false news.” The phrasing used in this law closely matches that of Roskomnadzor in its decision to ban Google News. 

More recently, Russia passed amendments criminalizing public dissemination of false information about Russia’s Armed Forces. Multiple Russian state news outlets referenced this updated law, Article 207.3 of the Criminal Code, in their reporting on the Google News ban. Working in conjunction, these laws can be used by Russia to block access to Google News—and possibly Google itself if the Kremlin chooses—with minimal obstacles.

—Ingrid Dickinson, Young Global Professional, Washington DC

—Danielle Dougall, Young Global Professional, Washington DC