Banner: The swarm assembles. (Source: the DFRLab using DALL-E 2 and Adobe Illustrator)

This report was originally published in Hybrid CoE Research Report 11.

This Hybrid CoE Research Report, a joint effort between the European Centre of Excellence for Countering Hybrid Threats and the Digital Forensic Research Lab (DFRLab), focuses on Ukrainian best practices in countering disinformation, mainly in the period following Russia’s February 2022 full-scale invasion (FSI) of Ukraine. However, many of these practices are the result of an evolution spanning the decade since the Euromaidan revolution. The report identifies the following ten lessons that the West could learn from the unique Ukrainian experience.

Lesson 1: Laying a solid foundation is fundamental

A monitoring system so extensive that it generates overlap is a must. Rapidly refuting the lies, debunking disinformation, and setting the record straight are necessary conditions for successfully countering the disinformation campaigns. Action of any kind should be prioritized, contemplation must not paralyze efforts to fight back, and trial and error is both permitted and encouraged.

Lesson 2: Numbers are crucial

Numbers really matter, be they human resources, financial resources, the number of different countermeasures and the various actors implementing them, or the repetition of key narratives from as many speakers as possible. Despite the fact that Ukrainians are putting far greater resources into counter-disinformation efforts than most Western countries, they understand that the aggressor still outstrips them.

Lesson 3: Overlap is not a drawback, but rigidity is

The overlap between various monitoring, debunking, and counter-disinformation efforts is encouraged, not avoided. More actors working on the same topic means more reliable output, faster responses, and safeguards against the failure of one of them. In coordination, the loose nature and lack of formal procedures facilitates and speeds up responses.

Lesson 4: Cherish the role of civil society

No government in the world can tackle the problem of disinformation alone. Civil society is absolutely crucial. Ukraine has shown how a vibrant, active and energetic civil society, constantly coming up with new ideas, protected the information space even before the government entered the scene, and how crucial it still is for many target audiences.

Lesson 5: Preparation is essential, but not a panacea

Preparation for the conflict was vital; it is important not only to prepare contingency plans and ensure that the relevant teams are ready to act in the event of war, but also to prepare the crisis messaging and backup channels. However, plans must not become dogma; adaptability is also key. The Ukrainian example also serves as a warning, showing that despite facing a prolonged conflict, a society may still refuse to believe the worst-case scenarios.

Lesson 6: Punitive measures are a must

It is impossible to rely only on defence and building up resilience against attacks. Punitive measures that limit the capability of hostile actors, or at least impose additional costs on their behaviour, must be part of the package. For many Ukrainian practitioners, these tools are the most important when it comes to protecting the information space against the aggressor.

Lesson 7: Humour is a serious matter

Content generating amusement is used very deliberately by Ukrainians. Humour helps to reach larger audiences, and humorous content goes viral more often. It also helps to boost the morale of those under attack, and increase resilience to aggression in both the kinetic and the information space. And finally, it helps to impose costs on the disinformers by mocking and ridiculing them, and damaging their credibility.

Lesson 8: Actions speak louder than words

When the atrocities reached their most horrifying level, it became impossible to use disinformation narratives to convince people about a “brotherly” Russia that attacks exclusively military targets. When Western countries took in Ukrainian refugees and started sending military and financial aid, it became impossible to successfully claim that the West had abandoned Ukraine altogether. However, audiences in occupied territories, cut off from any sources of real information, are still under threat.

Lesson 9: The information war is not over – and won’t end anytime soon

Despite some optimistic takes by Western commentators, no one in Ukraine would consider that the information war has already been won and that they could cease their efforts. Everyone understands that Russia’s information aggression will continue adapting to new circumstances, and that it is of the utmost importance to continue fighting against it.

Lesson 10: The West needs to catch up with Ukraine

When it comes to Western partners, Ukrainians would like to see them doing what Ukraine has been doing during the last decade: taking Russian disinformation seriously and actively resisting it. Concerns persist among Ukrainians regarding the success of Russian disinformation abroad. As a nation under attack, they also propose an “Information Ramstein” to provide support not just in the form of weapons but also in the information space. Ultimately, Ukrainian civil society remains reliant on support from the West.

Ukraine has by far the most experience in countering Kremlin disinformation, facing Russian aggression both in the military and in the information domain. Ukrainians have experienced firsthand how information aggression transforms into real-life, kinetic aggression, and how the latter is facilitated and justified by information aggression.

Ukraine has been on the front line of Russia’s information aggression ever since the Euromaidan revolution and Revolution of Dignity in late 2013 and early 2014. The “most amazing information warfare blitzkrieg we have ever seen in the history of information warfare” has transformed into an information war of attrition that has been ongoing for a decade. Throughout this time, Ukrainians have gained vital experience and fine-tuned their best practices.

Many Western observers started paying greater attention to Ukraine’s fight in the information space after 24 February 2022. Russia’s full-scale invasion (FSI) was accompanied by genocidal rhetoric targeted towards domestic Russian audiences, and information operations aiming to paralyze both Ukrainian resistance and international support for Ukraine. Ukrainians responded with tenacious resistance and inventive communication. The Ukrainian fight against Russian disinformation was so inspiring that many in the West started declaring Ukraine’s victory and Russia’s defeat in the information war as of early 2022 – despite the fact that Ukrainian professionals did not agree that the battle for public opinion was over.

In this report, we identify and explore best practices in Ukraine’s counter-disinformation efforts. We turned to the people who are currently the most active in countering disinformation – particularly Ukrainians who have been working on this issue since 2014. The longest-serving “information warriors” are in civil society, but the government has also played a crucial role since the start of the invasion.

We conducted these interviews aiming to identify the lessons learnt during the period that followed the FSI. However, as many interviewees highlighted, these lessons are largely the result of an ongoing evolution in Ukraine ever since Euromaidan. Thus, in a sense, this report is a summary of the lessons learnt and best practices gathered in Ukraine in the last decade. It also shows how long experience and solid preparation contribute to information defence in the case of a hot conflict: whereas the Ukrainian response in 2014 lacked preparation, the response after the FSI shows what a difference several years of dedicated effort countering information aggression can make.

We sought to focus on those aspects of the Ukrainian counter-disinformation effort that might be the most distinctive compared to current practices in the West. In doing so, we aimed to arrive at ten lessons that could be the most inspiring for Europeans and North Americans working within the information domain.

This report is based on 22 interviews with Ukrainian professionals working to counter Russian disinformation, propaganda and information aggression targeting both Ukrainian and foreign audiences. The professionals represent the governmental sector, both civilian and military, the non-governmental sector, private business, and the media. All but two of the interviews were conducted with individuals; in two cases, there were multiple interviewees from the same institution. The interviewees and their affiliations are listed below. We asked them about their experience with Russian disinformation in the post-FSI period, their views on its success, and the various ways to combat it.

Around half of the interviews were conducted by the authors of this study in person in Kyiv in May 2023, while the other half took place online in June 2023. A majority (15) of the interviews were conducted in English and the remaining seven in Ukrainian. The interviews lasted from 40 to 120 minutes, totalling approximately 26 hours. All the interviews, apart from two with representatives of the intelligence community, were recorded and transcribed using OpenAI Whisper. By going through the text, we identified key lessons and recurring themes throughout the hundreds of pages of transcription.

We subsequently examined how Ukrainians think and work to combat disinformation and propaganda differently from the West. The analysis was driven by the following main research question: What are the key lessons for countering Russia’s disinformation? We then worked to identify factors that have led to Ukraine’s success in confronting disinformation, as well as best practices that could serve as inspiration for the West. As such, this report does not focus per se on tabulating Ukrainian institutions and actors involved in this work. For readers interested in such a description, the authors recommend the report by FOI, Ukraine’s Information Front. Strategic Communication During Russia’s Full-Scale Invasion of Ukraine. Their work also includes extensive desk research and a list of secondary sources.

In this report, we focus on the interviews and use secondary sources only in exceptional cases. We shift the focus away from the institutional division of labour – first, because the institutional environment in Ukraine is still developing and might not be the most inspiring aspect of the Ukrainian response for other countries; second, because of the prevalent overlap and its organic, loose, and slightly disorganized nature, as we explore below.

The focus of the report is on Ukraine’s efforts to counter the Kremlin’s disinformation rather than a deep dive into the narratives spread by the Kremlin’s disinformation machine. For those interested in the content and aims of Russia’s information aggression, the authors recommend the February 2023 DFRLab report, Undermining Ukraine: How the Kremlin employs information operations to erode global confidence in Ukraine, edited by Roman Osadchuk, one of the authors of this report.

All individual statements in this report are based either on direct quotes or on a synthesis of the interviews, namely a summary of the most frequently repeated points and principles as the authors recorded them. If requested, the quotes used in the report were cleared by the interviewees prior to publication.

A brief note on terminology: practitioners interviewed for this report often used certain words informally or interchangeably, sometimes at variance with traditional dictionary definitions. These include disinformation, propaganda, fakes, conspiracies, information operations, information-psychological operations, information attack,and information aggression. Interviewees did not offer definitions for these terms or draw specific boundaries between them. (It is possible and probable that had the interviewees been what they understand by each of the words, they would have provided us with some definitions. However, the focus of this report was on the countermeasures rather than the terminology.) While the conversational approach to these engagements might not be strictly academic, the context in which the interviewees used these terms provided insights into their thinking. Moreover, their prioritization of action over theory resulted in a situation in which their descriptions were ultimately more developed than dictionary definitions.

Where possible, the authors tried to stick to three basic terms: disinformation, understood as false information spread deliberately with the intention to deceive; propaganda, understood as information, sometimes biased or misleading, used to promote a political cause or interest; and information aggression, an umbrella term that covers most of the terms mentioned in the previous paragraph, plus various active measures facilitating the impact of information operations (e.g., creating proxies, fake civil society or using agents within the adversary’s camp).

We also requested an interview with the Presidential Administration of Ukraine, but there was no response to our requests.

The whole effort of countering information aggression starts with the simplest tasks: extensive monitoring of the information space in conjunction with rapid countering, refuting, or debunking of false information. One basic principle noted by interviewees is that it is more important to act quickly than to contemplate whether action is necessary and which action or actor would be the right one.

These principles seem to be in stark contrast to those in many European countries, where such monitoring units are often underfunded and understaffed, or where the common refrain is that “debunking doesn’t work.” The professionals in Ukraine would appear to think differently, as the debate largely concerns whether everything should be debunked as quickly as possible, or whether there are more marginal stories that can be merely monitored, without further reaction. Success also requires many other actions to be taken. These are discussed below.

Each relevant government and military institution has its own methods for monitoring the information space for disinformation narratives. This situational awareness work is strengthened by the monitoring conducted by the Ukrainian government’s Center for Countering Disinformation (CCD) and the Centre for Strategic Communications (CSC), alongside monitoring work conducted by various non-governmental actors. “When we work in a coordinated and fast manner, disinformation is detected very quickly and reliably, and it’s possible to react to it quickly,” said Taras Dzyuba of the Armed Forces of Ukraine. The aim of the whole monitoring system is not only to detect false information swiftly, but also to respond swiftly.

Interviewees did not seem to be concerned about possible overlaps in monitoring efforts conducted by various government bodies and NGOs. They considered it safer to have more actors seeing the same piece of information, rather than risking it falling through the cracks. In fact, situations in which multiple monitoring observers see the same problem in the information space make their detection efforts more reliable, a principle we will discuss in more detail in Lesson 3.

The crucial role of extensive monitoring and detection will also be touched upon in Lesson 5, where we discuss whether those who monitored the information domain observed any indications of the full-scale invasion before 24 February 2022. The key point is that it is critical to constantly monitor as much as possible. Without exhaustive monitoring to identify patterns and potential outliers, including in peacetime, it becomes impossible to notice a deviation from the norm, such as a sudden increase in a particular disinformation narrative.

Gaps in monitoring can also lead to threats. “The enemy’s special services are engaged in IPSO (informational and psychological special operation), which is a specific activity in terms of planning, implementation, and monitoring. So our special services should be engaged in appropriate countermeasures,” said Oleksandra Tsekhanovska, a Ukrainian expert in countering disinformation. She continued:

“And such counteraction is only possible through constant monitoring, including quantitative data to detect the preparatory stage. Because when the IPSO reaches the audience, it’s already too late. That’s why it’s very difficult for me to determine which internal conflicts, such as those we’re currently experiencing in Ukraine, are entirely or partly the result of the activities of the Russian special services, and which are a natural reaction to the stressful events, to the imperfection of our political system, or other factors.”

More often than not, whenever false information is identified, it is countered (i.e., debunked) in some way as soon as possible. There have even been phases when this rule has been applied in 100% of identified cases – such as when the many months of military buildup and threatening rhetoric from the Russian side started being accompanied by false stories about alleged Ukrainian attacks on Russian territory in the final weeks before 24 February. Accompanied by increasing reports of the imminent FSI, these disinformation campaigns were perceived by Ukrainians as Russian attempts to create a justification for war similar to the Gleiwitz incident, the false-flag operation conducted by Nazi Germany immediately prior to its 1939 invasion of Poland. Ukraine’s strategy was therefore to officially debunk even the most absurd accusations as publicly as possible.

“When you realize that they can use any marginal story to create a casus belli, you understand that the risks of not refuting it are much higher than the risks of inadvertently boosting a stupid marginal story. So we decided to refute everything, absolutely everything. I remember that we had to make Minister Dmytro Kuleba refute another crazy Russian story on his Twitter every two or three hours,” said Gosha Tykhyi, advisor to Ukrainian Minister of Foreign Affairs Dmytro Kuleba.

Similarly, interviewees from the Center for Countering Disinformation highlighted the rapid debunking of each and every Russian fake through every relevant government spokesperson as the key principle they followed at the time – and the most important factor in ensuring that no fakes got out of control.

“Just as quickly as these fakes surfaced, the response was equally fairly quick. Every centre, every NGO, even our president, everybody was constantly reaching out on television or any other information source, debunking everything and explaining what had happened. This is the crux of how we are surviving these informational attacks,” said one CCD official.

This principle was also instrumental in the first hours after the FSI. The situation was chaotic, and even some information professionals were shaken by reports that the Ukrainian leadership had fled the country. For some interviewees, the famous “We are here” video of President Zelensky and his team – a rapid refutation of the Russian lies claiming that the country’s leadership had fled – was the point at which they concluded that the fight for the information space was an absolute and ongoing imperative.

Debunking lies is not in itself a sufficient condition in the counter-disinformation fight: it is not enough to counter the threat. However, it is a necessary condition: without it, it is just not possible to counter disinformation successfully. Debunking also serves an important secondary role, enabling the maintenance of a database of cases and tactics used by Russia, which serves as a template for subsequent pre-bunking measures. While Ukrainians face new false narratives and disinformation every day, it becomes easier to disregard them, since they have already seen similar cases debunked in the past. Thus, databases of previously debunked disinformation cases, even when scattered across multiple entities, platforms, and websites, provide rapid informational immunity against further influence and disinformation campaigns. In less tense situations, it is possible to focus on refuting only the most relevant stories and lies that have the potential to cause harm, and to start using other tools in the toolbox, such as discrediting the sources spreading disinformation, as discussed below.

As mentioned previously by Gosha Tykhyi, the downside of debunking a story can be that it gives a less important story the visibility that it would not otherwise receive. To counter this, Ukrainian AI startup LetsData provides alerts telling clients when not to debunk a story: “We are literally alerting people by saying: Please don’t touch it. If it starts developing, we’ll let you know. But for now, it isn’t, so just leave it alone,” said LetsData co-founder Ksenia Iliuk.

However, the urge to respond, at least in some form, is deeply ingrained in the mindset of Ukrainian practitioners, and points to another basic principle of the Ukrainian response that seems to contradict that of many European countries: the prioritization of rapid action over slower deliberation and procedures. It seems that many counter-disinformation professionals in Ukraine consider that it is more important to act rapidly in some way, even if the action is imperfect, and refine the response along the way, rather than endlessly contemplating whether action is necessary, whether it is the right one, or whether some other actor should take the initiative instead. This would only allow the aggressor to conduct their operations unopposed.

When interviewing CCD officials and discussing how some Western actors find reacting to disinformation stories too laborious, while refuting or debunking lies is generally the norm in Ukraine, one official responded, “This might not correspond with what you would like to hear, but we have the idea that any kind of communication is better than no communication at all.”

This is not to say that communication is not thought through, however. Practitioners discussed how they evaluate various data showing the impact of their messages and try to refine the messaging based on these data. However, it seems that when facing a new situation, their instinct is always to react in some way – and only later, when the situation is calmer and less urgent, to evaluate whether the reaction could be better next time. This results in much trial and error, which necessarily involves tolerance for mistakes.

The principle of prioritizing action over excessive contemplation can also be perceived in the debates on the success, or lack thereof, of Russian information operations. This will be discussed more broadly in Lesson 9. However, another difference between the Ukrainian and Western approaches should be highlighted here. In the West, it is common to encounter the mindset that because we are not always sure of the impact or success of malign actors’ disinformation efforts, there is no need to “overreact.” The Ukrainian approach to disinformation is exactly the opposite. Ukrainian practitioners generally agreed that although it is almost impossible to accurately measure the impact of disinformation operations, they do not consider this a reason to constrain their responses. On the contrary, if it remains uncertain how much damage malign actors have caused or could cause in the future, every effort must be made to minimize the damage, including rapid responses.

These basic principles – that the information space needs to be thoroughly monitored to a point where overlap is common or even encouraged; that instances of disinformation require a response, even from the highest level; and that it is necessary to act rather than hesitate – might appear practically fundamental to many Ukrainian counter-disinformation professionals. However, these principles do not seem to be broadly accepted among Western practitioners. It is for this very reason that we felt it necessary to highlight them and their role as a foundation for subsequent counter-disinformation efforts.

Taking the basic tasks very seriously leads to another principle of the Ukrainian response: the country as a whole devotes significant resources to the counter-disinformation fight, throwing big numbers into the arena. Without these resources, extensive monitoring and rapid response efforts would simply not be possible. We are not just talking about human resources, financial resources, or the number of institutions and organizations that are active in the information battle, although these numbers often exceed corresponding resources in many European countries. It is also about the number of different measures attempted, the number of channels used, and the successful dissemination of coordinated messaging involving multiple speakers across multiple audiences.

The extensive number of actors and activities involved in Ukrainian counter-disinformation efforts naturally also creates competition, often leading to multiple narrative options to choose from, increasing the likelihood of successful public engagement. Quantity therefore serves not only as a defensive measure, but as an offensive measure that creates better narrative “weapons” in the information domain. Thanks to the considerable number of resources available to Ukrainian counter-disinformation practitioners, Ukraine can detect more threats over a shorter time span, develop multiple options that result in higher-quality communication products, and reach larger audiences more quickly.

Many interviewees noted that the number of actors involved in counter-disinformation work had increased significantly since the Revolution of Dignity in 2013–2014. Initially, this emerged mainly in the non-governmental sector, later expanding within state structures as well. Notably, the Ukrainian government drew heavily on the expertise of civil society and media actors, including Liubov Tsybulska, Ihor Solovey and Gosha Tykhyi. Civil society continues to play a leading role in counter-disinformation efforts.

“During Euromaidan, there was a scarcity of voices,” said Alya Shandra, editor-in-chief at Euromaidan Press. “Today there is a wide, active and coordinated Ukrainian Twitter ecosystem dispelling Russian disinformation.” Texty editor-in-chief Roman Kulchynsky added, “Civil society was fully involved even before the FSI. Thanks to them, the people knew what Russian disinformation was and didn’t trust it.” Ihor Solovey, head of the Centre for Strategic Communications, also noted that ever since the Euromaidan revolution, more and more projects countering disinformation had emerged over the years as various civil society actors worked together in different segments across the information ecosystem. “This magnitude saved Ukraine in many respects,” Solovey stated.

The importance and advantages of a plurality of actors were indirectly confirmed by some disagreements among the interviewees. Some saw no successful Russian influence in the Ukrainian information space, while others convincingly described the Kremlin’s obvious successes. Some interviewees did not see any prepared disinformation activities before the FSI or during the initial days afterwards, while many others documented multiple instances, such as the mushrooming of dedicated, hyperlocal Telegram channels that started spreading Russian propaganda as if on command in multiple Ukrainian cities.

The lesson is obvious – the more actors looking at the information space from various perspectives, the smaller the probability that some crucial development or threats will go unnoticed.

Apart from organizations that had been working on this topic in a systematic manner years before the FSI – StopFake, Detector Media, Ukrainian Crisis Media Centre, Internews, and Texty, among many others – there was a massive boom in volunteer activity after 24 February 2022. “I can’t even imagine how many people joined these efforts,” said hybrid threat expert Liubov Tsybulska.

“When the war started, I was getting so many messages, requests from people I didn’t know. They were just texting, ‘I’m sitting in the shelter, what can I do, I have a phone, I have a laptop, I can just text something on YouTube, I can go to Russian websites, some forums, whatever, and spread information there – just give me the messages’.”

These activities involved individual activists as well as civil society groups and private businesses. Some were loosely connected, while others were more organized as a form of “territorial defence” for the information space. Regardless of their background or organizational structure, they take on a number of tasks, including debunking false information and disseminating truthful information, calling out Russian and pro-Russian voices, and monitoring the information space, with some even engaging in sophisticated cyberattacks against targets in Russia.

The combined resources of the Ukrainian media were also pooled towards one goal. The Ukrainian government established “United News telethon”, a joint effort of various national channels that started broadcasting on 24 February 2022. The channel provided verified information, serving as a crucial source for the Ukrainian public at the beginning of the invasion. At the time of publishing this report in early 2024, it is still active, although some experts no longer see the need for such a format.

Apart from civil society and the media, the government also deployed more resources. “Compared to the pre-war situation, our activities have multiplied and we have intensified measures to detect information aggression as well as measures to counter it,” an SSU official said.

In collaboration with the CCD, the authors of this report worked to calculate the number of government stakeholders involved in Ukraine’s counter-disinformation efforts. While it is difficult to estimate the total number of civil servants working on this topic, it is likely to be in the high hundreds. Even more difficult is tabulating how many NGOs and volunteers are participating. “Half the country got involved,” remarked political scientist Vadym Denysenko.

The sheer number of institutions and individuals engaged in counter-disinformation activities has led to these efforts spreading across countless channels, both online and offline. “If the government wants to counter disinformation, it should try to be everywhere,” said Volodymyr Yermolenko, president of PEN Ukraine and editor-in-chief of UkraineWorld. “Go to these platforms and the influencers already there and try to work with them.” As an example of civil society cooperation, he described how colleagues at Internews had approached YouTube influencers. Internews specialists provided the content, he explained, while influencers used their reputation to disseminate content countering Russian propaganda to wider audiences.

Hybrid threat expert Liubov Tsybulska described how communicators from Ukraine’s armed forces followed shifts in the platform behaviour of the Ukrainian public, leading to them increasing their output on Telegram. Ksenia Iliuk of LetsData highlighted how the government started amplifying content from African TikTok users to counter stories accusing the country of racism against African students. Armed Forces of Ukraine representative Taras Dzyuba even mentioned how young Ukrainians used online games like World of Tanks to showcase Russian losses on the battlefield: “They didn’t expect us to break into the whole information space and show the losses to the whole world, including the Russian population. This involved magnitude [in terms of scale], creativity, and the element of surprise for the enemy.”

Relatedly, practitioners remained mindful of the need to target many different audiences. Regular exercises and education programmes designed to raise awareness about Russian disinformation are conducted by relevant centres for military and security personnel, for government officials, and for local government employees.

Another important element is the need to keep repeating the message. “You have to deliver content every day,” said security reporter Maria Avdeeva. “You can’t just put up a list of fake news channels and expect people to remember it; you have to repeat the message on a daily basis.” Interviewees also mentioned that this repetition mechanism works for Russia too, as researchers have noted in previous studies. To help combat this, Ukrainian diplomats look for opportunities whereby international partners can amplify Ukrainian messaging and debunking efforts, helping them reach an even wider audience.

Despite the quantity of resources that Ukraine devotes to combatting disinformation, which, as previously noted, seems to be far greater than anywhere in the West given the mass mobilization involved, key players still feel outnumbered by Russia’s disinformation machine. “We don’t have the resources that the Russians have,” a CCD interviewee explained, noting how Ukrainian counter-disinformation efforts are less active in much of the world, including Africa, Latin America and Asia. Liubov Tsybulska also described how the Ukrainian government relies upon additional support from civil society because “they didn’t – and still don’t – have the necessary resources. They are not comparable to the threat.”

Taras Dzyuba also described outnumbering of a different kind: broadcast infrastructure. “Our biggest transmitters in Donbas had 10-kilowatt capacity, so the Russians built 30-kilowatt transmitters,” he said. “They increased the capacity, they increased the number of channels. The technical capabilities determine a lot.”

The numbers can also have a negative connotation – in cases where Ukraine did not allocate the necessary resources, Russia successfully filled the informational vacuum. “In the initial days of the war, some of the Russian vbrosy [disseminators of disinformation] spread like wildfire on Telegram. When information is scarce, propagandists have the upper hand,” said Alya Shandra of Euromaidan Press. This also confirms the principle highlighted in Lesson 1: It is better to communicate in some way, rather than allow the adversary to be the only one filling the information space.

While Ukraine continues to dedicate significantly more resources to countering disinformation than most European countries, practitioners acknowledged that Russia outspends them, and that the ongoing challenge is so demanding that more resources will be required.

Given the large number of actors involved in countering disinformation, an important question arises: How do they coordinate with each other, and how do practitioners ensure that their activities do not overlap?

The answer to the second part of the question might be surprising. There is no need to avoid overlap at all; in fact, many interviewees perceived the overlap as a positive outcome, with undeniable advantages such as more robust monitoring, independence, creativity, rapid response times, and potential safeguards against failures by individual actors.

When it comes to coordination, the prevailing mindset favours a lack of formal procedures and an overall non-bureaucratic approach to countering disinformation. Indeed, coordination is not very rigid, either between civil society organizations, or between the government and civil society (see Lesson 4 below).

Coordination in countering disinformation existed even before the FSI. There were two unifying forces – under the umbrella of the NDI Disinformation Hub and in cooperation with the Centre for Strategic Communications. “The ecosystem of people dealing with Russian disinformation was created a while ago, and it became a self-coordinating group to which people added trusted contacts. The group discussed what Russia is pushing through and what we can say [in response],” explained security expert Maria Avdeeva.

On 24 February, the situation changed dramatically, as many new people and organizations wanted to help combat Russian aggression in the information sphere. “Small groups organized themselves, found each other and did something. Naturally, they made a lot of mistakes, so it was organic,” noted political scientist Vadym Denysenko. New alliances and groups started emerging from the grassroots – people coordinated with each other, creating volunteer chats focusing on everything from debunking Russian disinformation, collecting evidence of Russian war crimes, sharing tips on how to help foreign journalists, communicating with foreign audiences with truthful information on the ground, and creating visuals such as caricatures and posters. “The ‘elf’ communities organized themselves in the first days of the invasion,” said Odesa-based journalist Evgenia Genova, in reference to the groups knowns as “Elves” who counter Russian trolls in the information space.

People from NGOs, governmental bodies, and businesses worked together as if structural boundaries did not exist. No one controlled or could control this process, as people organized themselves into small cells based on personal contacts, acquaintances, or even recommendations without really knowing each other. “That was a very valuable and unique moment when we started working together,” noted Liubov Tsybulska. “We always compare ourselves to a beehive. We are like bees, we know exactly where to fly and who to sting.” Many independent groups united over the shared purpose of deflecting Russian information aggression without necessarily having a single decision-making centre, organically creating a decentralized ecosystem.

This approach helped the Ukrainians in their fight against Russian disinformation. “We avoid a vertical approach. If we went through procedures, it would be slow and require approval from multiple people, and threat and risk analyses. The rapid horizontal work allows us to do things at speed and with great quality,” said Taras Dzyuba. This absence of procedural approval was in stark contrast to the Kremlin’s tactics: in the first months of the invasion, Russia was not prepared to be flexible in its communication and lagged behind after the initial invasion plan failed.

In small and informal groups, much depends on the personal initiative of many individuals, which was encouraged, not discouraged. The creative potential of these groups was unlimited and unrestrained thanks to the absence of a lengthy formal approval process, making them flexible and highly adaptable to the rapidly changing landscape of the war – again, in contrast to Russia’s unwieldy and centralised propaganda machine.

The tactic of multiple groups working together in the same sphere is not without problems, however. The effort created some overlap due to the absence of intergroup communication, leading to some clusters working on the same issues or topics independently, producing content debunking the same disinformation narratives, and creating redundancy that might have been avoided with better coordination. “The problem is that most of the agencies, including civil society, are acting based on gut instincts,” noted LetsData’s Ksenia Iliuk.

However, most of our interviewees highlighted that the duplication of effort was not a fault but a feature. While some topics indeed received considerable attention, this structure and volume allowed Ukrainian civil society to cover more issues and amplify the Ukrainian voice. When several groups reach the same conclusion regarding a disinformation campaign, such as the false Stinger systems trade and the arrest of Ukrainians in Germany, the findings are more reliable. Similarly, when actors using different tools and methods reach similar conclusions, the findings will be more persuasive for readers.

The overlap also creates a safety net: if any of the groups or entities are offline or overlook something, others pick up the slack. The whole system is thus more resilient in the event of any actor facing problems, ranging from relocation and blackouts to Distributed Denial of Service (DDoS) attacks and loss of equipment. At the same time, it becomes harder for Russia to disrupt such a decentralized network, as there is no single hub for Russia to destroy and paralyze Ukraine’s ability to counter disinformation and propaganda.

At first glance, it may seem that loose coordination, independent actors, and the chaotic nature of the ecosystem are a major handicap in the fight against a massive and organized propaganda machine. However, the post-FSI situation in Ukraine shows that the advantages can outweigh the disadvantages. Such a loose and decentralized network, unencumbered by rigid procedures, has a quicker reaction time, reaches a wider range of audiences, engages civic activists who would be discouraged by formal and bureaucratic procedures, and fosters creativity and spontaneity – both of which are crucial in the battle for the information space. Moreover, it helps achieve scale (see Lesson 2); more actors experiment with their own distinct approaches, each of which might work for a different target audience.

The large number of actors involved in countering disinformation has another secondary effect: the government has the luxury of working with a very vibrant civil society, and the opportunity to attract some of the most outstanding and tested individuals to the civil service, pick the most successful projects and organizations for cooperation, and fill the gaps that the government alone cannot fill. Russian disinformation is too broad and fast-changing for the government, while it is too deep and systemic for civil society – by working together, both sectors can help each other achieve their common goal. This process first became prevalent in 2014 when people from civil society organizations started playing an important role in policy, sometimes moving directly into government. The cooperation after the FSI helped Ukraine counter disinformation more effectively, reach a bigger audience, and enable the government and NGOs to be more successful in their work.

Since 2014, Ukraine has faced an immense hybrid war with Russia, in which it has needed to fight in both the kinetic and information realms, as is evident from the many “explanations” that Putin presented for the war, based on long-running disinformation campaigns. In the information domain, the Kremlin outstripped Ukraine in capacity and funding, with RT and Sputnik freely operating worldwide in multiple languages before the 2022 invasion.

In 2014, the Kremlin barraged the international information space with messages about a “failed state”, “Ukrainian aggression,” and a number of MH-17 conspiracy theories, with the Ukrainian government unable to address all the false allegations in an effective manner. Therefore, to meet the need, multiple initiatives and actors appeared on the scene to counter Russian disinformation. Since then, civil society has emerged as an influential player, debunking false messaging and duly assisting the government. This cooperation between civil society and the government has benefitted Ukraine by allowing it to respond to multiple threats. “It wasn’t led from top to bottom; very often it was a bottom-up drive. It’s important to underline that this [cooperation] wasn’t something that just appeared in response to the Russian FSI; a lot of work had been done since 2014,” journalist and Chatham House Academy fellow Olga Tokariuk pointed out.

“No country can deal with such an enormous amount of information without harnessing the capability of civil society,” noted CSC’s Ihor Solovey. The problem is far-reaching and there is no simple solution. Moreover, the government and civil society have different remits, audiences, and levels of flexibility, allowing them to complement each other. “Civil society organizations are more flexible and sensitive, and have an audience that the government would never have,” Solovey added.

Civil society organizations can independently reach out to social media platforms with requests to protect user data, but the same request coming from the government would have a different impact. Alternatively, governmental bodies cannot detect every single information campaign at both local and national levels, which is why NGOs, which are more attuned to local topics, are better suited to cover that front while helping the government identify the societal cracks exploited by Russia. Broadly speaking, cooperation between civil society and government was often flexible and informal, allowing it to focus on specific, organic problem-solving rather than the creation of formal and systematic procedures for collaboration.

Capacity expanded even further when the Ukrainian government created two entities to counter disinformation in March, 2021: the Centre for Strategic Communications within the Ministry of Culture and Information Policy, and the Center for Countering Disinformation within the National Security and Defence Council. In particular, the CSC communicated with civil society from its inception, understanding the immense importance of the expertise concentrated in the non-governmental sector.

The cooperation opened up new ways to counter disinformation, but it did not imply interdependence or a vertical relationship. Instead, it was built on the principle of horizontal cooperation, whereby partners could amplify each other’s work by sharing their expertise and findings, or through joint programmes, training, and problem-solving.

“This war is the greatest illustration of the cooperation between government and society, and it works on all fronts. It’s just on an ad hoc basis, mainly like a partnership or a connection between friends,” said Artem Starosiek, CEO of Molfar OSINT Community.

For example, government bodies use NGO monitoring and research to adjust their policies. “We used LetsData materials to develop policy documents and recommendations,” said CSC chief Ihor Solovey. LetsData’s Ksenia Iliuk added:

“Civil society was generating a lot of very good content that didn’t actually debunk, but literally destroyed so many narratives and everything in a very creative, very appealing way. I think the best thing that the state did in this regard was to amplify that.”

This dynamic worked both ways. According to Alyona Hryshko of Internews Ukraine:

“Government bodies monitor the situation, and their official representatives share information with civil society organizations. We then relay this information to our audience, highlighting some details about the current situation on the battlefield or other information we’ve gained during the information war.”

Some interviewees suggested that structuring this cooperation might benefit all actors and make it more efficient. However, such action would require additional time and effort – a difficult task during wartime – and could lead to duplication of effort and miscommunication. Moreover, civil society and government are not monolithic structures, but are composed of various actors: some are open to partners, while others are not. “There’s an opportunity to cooperate based on personal agreements. We aren’t trying to provide something for the government or engage in joint projects, but if there’s a will, there’s an opportunity to do so,” noted Roman Kulchynsky.

“Governmental institutions are made up of different people. Only those institutions that were led by people who were open to and interested in cooperation demonstrated a high level of involvement,” said counter-disinformation expert Oleksandra Tsekhanovska.

Disinformation campaigns and the resilience required to resist them do not develop overnight. Instead, they emerge and evolve over time, but catalyze even further in extreme circumstances, such as an invasion. Russia has continued to attack Ukraine in the information space since at least 2013, making some patterns stand out. When information attacks are predictable, it is possible to plan in advance how to respond to them.

Ukrainian government bodies stepped up their preparations as intelligence sources, civil society monitoring, and media reporting revealed increasing signs of an attack. To confront such a problem, it was necessary to plan not just general contingency procedures, such as splitting the office into multiple groups in different regions, but also specific prepared messages and instruments that could be deployed at short notice. This preparation included informing Ukrainian society of the impending danger. Government officials prepared materials on what people should do in case of an emergency. “Even if the risk is low, you need to prepare your people for what to do in case of trouble,” said Petro Burkovskyi, executive director of the Democratic Initiatives Foundation.

According to adviser Gosha Tykhyi from the Ministry of Foreign Affairs (MFA):

“We developed such a plan in summer 2021, which was written down and put into effect by the minister, and we basically had it in place. The plan prescribed specific algorithms, specific actions for various members of the team, for different departments, what everyone should do, how everyone should coordinate, how we would communicate if there was no mobile connection, how we would maintain the lines.”

This suggests that the state agency had multiple tools at its disposal that could be enacted in multiple scenarios, which streamlined MFA activities and helped to avert chaos in the critical first days after the invasion. “If we hadn’t done that, I think we would have descended into chaos because on the first day of the invasion, it wasn’t possible to really think much because the workload was so heavy that you needed some things prepared in advance,” Tykhyi added.

The availability of official information is crucial for people in the first moments of an emergency because an information vacuum can always be filled by conspiracies, disinformation, or information operations conducted by the adversary.

Some state services analyzed where people were getting their information from and created official accounts on the main social media platforms used by citizens.

“When this tension began around the war, with Russian troops on our border, the STRATCOM units within the armed forces had already launched new Telegram channels. These channels were ready when the FSI started, and they informed citizens that they had people who would update them all the time, every two minutes,” said Liubov Tsybulska.

The lesson for governmental communicators is this: be where your audiences are, rather than forcing them to search for information buried on platforms that suit you. If you fail to do that, people might consume adversarial messages there instead.

Despite all the possible preparations for and simulations of future events, it is impossible to predict everything accurately. Our interviewees agreed that the first days of war unleashed chaos in multiple areas of life, including communication. “Because of the general chaos in the first days of the invasion, there was very little official information about what was happening, so people mainly got all kinds of information from Telegram channels,” said Maria Avdeeva.

Even the most sophisticated plans cannot be followed blindly because the situation might change swiftly. The plans should be an initial step and pointer, not untouchable dogma, to avoid getting mired in an ineffective way of action. Multiple interviewees highlighted that the Russians had inefficient communications from the very start of the invasion because their information campaigns were inflexible. “Russians operate according to a plan,” said armed forces representative Taras Dzyuba. “If they plan military aggression, they have a plan for an information operation or campaign. They need many different approvals, and they won’t adjust operations, even if they see the need.” Effective communication therefore requires a plan, but allows for flexible handling of real-time events and deviation from the original plan if warranted.

Finally, initial plans may not always adequately assess all risks. Many interviewees said that even when they saw some indicators of the impending war, they had not anticipated the sheer scale of the invasion. LetsData’s Ksenia Iliuk noted: “We had quite a lot of indicators. But I think personally, when interpreting them as a Ukrainian, I was trying to find reasons why something was not an indicator of a full-scale invasion.”

“We had the facts, and everything pointed to a war. Not just a Donbas war, but a total invasion, including from the north. And people were trying to hide from these facts, immerse themselves in wishful thinking, and come up with all sorts of theories about what was happening,” said PEN Ukraine Volodymyr Yermolenko.

These indicators included a dramatic increase in negative coverage of Ukraine in the Russian domestic media. “A year before the invasion, we observed an increase in the amount of time and the number of messages dedicated to Ukraine, which was portrayed as ‘anti-Russian’,” said Ruslan Deynychenko. “It was a sign that they wanted to create an image of the enemy, not just of Ukraine, but also of the West, the European Union, NATO, and the United States.”

Another important indicator was the number of Russian officials promoting hostile messaging. Multiple Ukrainian experts highlighted the importance of Putin’s pre-invasion article, “On the Historical Unity of Russians and Ukrainians”, which was riddled with false and misleading narratives. The article normalized extremist rhetoric against Ukraine among high-level Russian officials, who repeated similar messages in their own statements.

“We observed attempts to discredit Ukrainian leadership, including messages about the inability of the Armed Forces of Ukraine to repel the Russian army,” said Taras Dzyuba, echoing Gosha Tykhyi’s comments in Lesson 1. “Also, one month before the invasion, Russians started coming up with casus belli almost every day, trying to find a reason to start the war.”

These pre-invasion changes in the tone and volume of messages highlight the importance of monitoring efforts, as previously discussed. Detecting a change in narrative tone or quantity entails establishing what constitutes the norm to begin with and remaining vigilant.

Sometimes, however, changes in tone and volume are not perceived as serious or are simply not taken account until it is too late due to what is known as assessment bias. “We asked the people what they were thinking on the eve of the invasion, and 46% said that they didn’t expect war,” said Petro Burkovskyi, based on a poll from March 2023. “Another 29% said they believed the war could happen, but didn’t want to believe it until it began.” This suggests the significance of assessment bias, which should be mitigated when devising polls. One approach is to prepare for multiple gradations of an incoming emergency, ranging from optimistic options to the most pessimistic ones. This would allow actors to avoid nasty surprises, mitigate chaos to some extent, and gain a head start from the outset.

Although Ukraine is doing a tremendous amount of work, with both the state and civil society dedicating unprecedented resources to monitoring, documenting, debunking, and raising awareness about hostile disinformation through a plethora of channels, there is yet another group of countermeasures against information aggressors: efforts to punish and deter their activities, and limit their capability to cause harm. Some interviewees even considered this line of work the most important.

In 2014, Ukraine banned Russian state TV channels. In 2017, Petro Poroshenko’s administration blocked access to Russian social media VKontakte and Odnoklassniki, to a Russian mail provider and search engine, and to several pseudo-media sites; this measure was later extended by Volodymyr Zelensky. In 2021, Zelensky’s administration banned TV channels plus their information ecosystem (websites, social media channels, direct messaging platform channels), including those that did not directly belong to the Russian state but still spread the same messages. These included channels belonging to pro-Kremlin oligarch Viktor Medvedchuk.

Every single interviewee, whether from the government or civil society, regarded these decisions as highly positive and crucial for protecting the Ukrainian information space. “We not only supported these decisions, we actively lobbied for them,” said Ruslan Deynychenko, executive director of StopFake. Most of the interviewees agreed that had the pro-Kremlin channels still been active during the FSI, Ukrainian resistance would have been much more difficult. “It would have been almost impossible,” added Ihor Solovey.

Some interviewees expressed regret that these decisions had not been taken earlier. “The decision about Medvedchuk’s channels even came too late,” said Anton Gerashchenko, founder of the Ukrainian Institute for the Future and a former Information Ministry advisor. Texty’s Roman Kulchynsky added: “We should have adopted these decisions way sooner.” Alona Hryshko of Internews Ukraine suggested that Ukraine made a mistake even prior to the first invasion in 2014 by allowing Russia to occupy so much of the Ukrainian information and cultural space. Today, she is concerned about the situation in the temporarily occupied territories. “Russia has a monopoly on information influence in these areas because there is no possibility to receive information from the Ukrainian side,” she stated.

The reason for this unanimous support among interviewees for countermeasures that are frequently considered controversial in the West seems to be that all interviewees, regardless of their background, recognized that Kremlin-sponsored media and the channels that help them are not actually media, but propaganda weapons in Russia’s information war. “They are combatants – all the restrictions should apply to them,” said Ihor Solovey.

“The EU saw the information space as a big marketplace where you come, sell your goods, buy other goods, and everybody’s happy. The Russians, on the other hand, treated the global information space as a battleground. It’s not a market where you come to sell your goods. It’s a battlefield where you shoot and you try to avoid being shot,” said Volodymyr Yermolenko.

Olga Tokariuk added: “Not giving a platform to people who advocate genocide against Ukrainians is not a question of freedom of speech, but of protecting human lives.”

Some Russian channels could not be blocked by Ukraine on its own, necessitating cooperation with private-sector digital platforms.

“Google helped a lot; over 170 YouTube channels have been blocked. They sent us a special Google form for government bodies. We sent them a list of channels that we found spreading disinformation and violating our criminal code, and we filled in their form with information on which Ukrainian laws a channel had violated,” a CCD official noted.

Several government interviewees also mentioned that whenever they see malign actors or propagandists involved in activities that might violate Ukrainian law, they alert the relevant authorities. The Security Service of Ukraine (SSU) has also identified and shut down several bot farms and channels involved in spreading pro-Kremlin propaganda.

Outright bans and legal consequences are the most extreme option. Some other disinformation channels are subject to less severe countermeasures, such as naming and shaming. In 2022, a number of Ukrainian ministries and state services, including Military Intelligence and the SSU, published a joint statement on “The protection of Ukraine’s information space from Russian hostile Telegram channels.” They urged the public to avoid channels connected to Russia, publishing a list of 100 such channels. The CCD, in collaboration with other state institutions, later created a blacklist of “information terrorist” Telegram channels. They also compiled a list of international influencers who amplify Russian propaganda.

This activity did not come from the government alone. The Institute of Mass Information released a blacklist of people spreading genocidal Russian rhetoric. Vox Ukraine created a database of Russian propaganda appearing in European outlets. Ksenia Iliuk also noted that social media users also participated, exposing Russian-liked channels on TikTok, among other platforms.

As with other countermeasures, a whole-of-society approach to imposing costs on the aggressor was adopted, whereby certain activities were conducted simultaneously by the state, the media, civil society, and individuals. In this particular context, there did not seem to be that much concern about a possible overlap. Rather, the attitude once again was that it is better to do the same thing two or three times than risk not doing it at all (see Lesson 3 on Overlap). This is similar to how the multitude of actors involved in these activities increase their impact (see Lesson 2 on Numbers).

Another option entails putting public pressure on propagandists. Galyna Petrenko, director of Detector Media, mentioned the case of Garri Knyagnitsky, who used to work for Kremlin outlet NTV and was later hired by Voice of America (VOA). “The Ukrainian journalistic community did not agree with this,” Petrenko said. “We started to write articles about it to draw attention to the problem, and to try to reach out to senior VOA executives.” Knyagnitsky was subsequently dismissed by VOA.

Humorous content is used again and again as a whole-of-society tool by Ukrainian government actors, civil society, activists and influencers. There are at least three reasons why Ukrainians use humour to counter Russian propaganda: to raise awareness beyond typical audiences; to build resilience among one’s own audience; and to impose costs on the reputation of the aggressor.

First, humorous content reaches wider audiences than “boring” content. In a contest where adversaries vie for attention, this might be the most important reason. According to Gosha Tykhyi: “It’s a powerful tool for getting the message out, because we realized that a meme can strike a target that an MFA press release would miss.”

“Humour is a tool that allows you to reach audiences outside of your usual bubble. Audiences that might not know much about the subject, and that might not be very interested in Ukraine. But humour, irony, satire and memes can reach those audiences and mobilize support from people who would otherwise be neutral or indifferent. Humorous content is the most likely to go viral,” said Olga Tokariuk.

The second reason is more inwardly oriented: humour helps build the morale of Ukrainian citizens. People that can laugh at their enemy are more resilient to the aggression they are facing. “Whenever something bad happens, I see an increased number of memes. When people laugh, it helps them feel better,” said Artem Starosiek. According to Evgenia Genova, “Videos about how we’re winning, some memes, pictures, numbers from the General Staff. Anything that boosted optimism was cool. People decided that somehow they needed it.” Olga Tokariuk added, “It can help prolong the feeling of empathy and support by opening up another emotional channel, so that people don’t just feel desperation and negative emotions connected to what is happening in Ukraine; they also feel hopeful and confident that Ukrainians can win.”

Third, humour helps to discredit, ridicule and mock the enemy. It undermines the credibility of the Kremlin and its propaganda channels, which effectively limits the audiences that Russia can reach with disinformation. “Humour and satire work very well. When we make Russian propagandists and their messages look stupid and funny, people like it and share it. We destroy the reputation of the Russian media as a source of information,” said Ruslan Deynychenko of StopFake. “We troll Russians, we humiliate our enemy,” said Liubov Tsybulska. “We diminish the influence of our enemies in other countries by showing how laughable they are.”

The same tool can be used not only against the Kremlin leadership and their most visible channels, but against smaller channels as well. A CCD official described how many Ukrainians, who are traditionally sceptical of government messaging, put a great deal of trust in “insider” channels that claimed to have inside information on what was happening behind the scenes, and shared it anonymously with the audience.

“The Russians built a network of these insider channels; they were spreading a lot of fakes and it wasn’t possible to debunk everything. So the best way out of this was when Ukrainian Telegram channels, focusing on memes and jokes, started to make fun of these channels, making ironic jokes about insiders and the cases they were highlighting,” the CCD official said.

Many Ukrainian interviewees also appreciated the help that they were getting in this regard from the international community, especially from the already notorious NAFO “fellas.” As in previous examples discussed in this report, the number of actors involved in an activity and the amount of material they produce is of great importance.

The use of humour in Ukraine’s fight against disinformation has received a lot of attention in the post-FSI period, but it is worth pointing out that Ukrainians were active in this regard even before 2022. Ukraine’s official Twitter account made headlines in the biggest American media even during Petro Poroshenko’s administration, when it used a Simpsons GIF to mock Russia’s imperialist tendencies to appropriate Ukrainian history. One of the people who used to be responsible for this communication channel, Yarema Dukh, continues making fun of Russian propaganda to this day.

The main difference between the pre-FSI and post-FSI periods lies in the numbers. As already mentioned, after February 2022, the number of people involved in the fight for the information space increased significantly – including among those actors who actively use humour. Moreover, fiercer competition is yielding better results.

Yet despite all the positive effects of humour in countering disinformation and propaganda, concerns remain about some undesirable side effects. “Most of these anti-propaganda channels that you can find on Ukrainian YouTube don’t check the facts, they just mock Russian propaganda. They say that Russians are stupid and evil. But there’s a danger that they will make you lose touch with reality. They can lead you to underestimate the enemy and propagate their wishful thinking. Of course it’s good that they provide an antidote to the meddling, but whether they really teach you critical thinking, that’s a big question,” said Volodymyr Yermolenko.

The Ukrainian experience has demonstrated that disinformation and propaganda campaigns are ineffective when the situation on the ground is all too real. Since the beginning of the FSI, Russian actors have insisted that their armed forces only target military sites rather than civilians. This statement has been proven false on multiple occasions. When people saw or experienced missile strikes, air raid alerts, and atrocities, they quickly understood how Russian claims carried no weight. “The best debunk was a missile that each of us saw from our window,” Ksenia Iliuk noted. After the FSI, any mention of “brotherhood” in Russian propaganda was no longer effective because it directly contradicted the reality on the ground and Ukrainians’ lived experiences. During wartime, the only way for some lies to succeed is when the target audience is already cut off from the information space.

At the time of publication, most of the destruction and fighting is taking place in southeastern Ukraine, where some people were more sympathetic towards pro-Russian politicians before the invasion. Russia’s approach to inflicting destruction in those regions quickly led to an extreme decline in pro-Russian attitudes. “The Russian atrocities changed the attitude of potentially pro-Russian Ukrainians,” said one source from the intelligence community. According to Olga Tokariuk: “Everyone has a friend or relative who is serving in the armed forces, a source of information on the ground, on the front lines. There was no shortage of credible sources of information.”

The image of Russian “saviours” was shattered after Russian forces retreated from northern Ukraine and Ukrainian forces entered the liberated cities and villages. The Russians left behind torture chambers, evidence of extrajudicial killings, and a trail of other human rights abuses and war crimes. When journalists reported from liberated settlements, they uncovered what had occurred under Russian occupation, duly deflating any remaining superficial Ukrainian attitudes regarding Russian troops. “When we saw what they had done and showed it to the world, it was a huge blow to the Russian information campaign. They made the whole Ukrainian nation their enemy,” said Taras Dzyuba.

Russia attacked civilian infrastructure in an apparent attempt to pressure Ukrainians to protest against the government and end further resistance. These attempts backfired, however. “The Russians would bombard or try to destroy critical infrastructure, causing disruptions in the electricity supply, and assuming that hitting people would make [them] angrier [at their own government]. But this was not the case; they turned their anger against Russia and not against the central government,” said Petro Burkovskyi.

The actions of other countries also helped debunk Russian disinformation. Russia promoted a narrative that Ukraine had been abandoned by its allies, that no help was coming, or that support would be limited to statements. These messages collapsed when neighbouring countries began hosting Ukrainian refugees, imposed sanctions on Russia, and delivered military and humanitarian aid. “One of the objectives of the Russian disinformation campaigns was to undermine the trust of Ukrainians in foreign aid, in partners,” Gosha Tykhyi explained. “So we communicated extensively on how the international coalition in support of Ukraine was being built, how more countries were joining, how more support was coming, how they were making statements, and how they were applying sanctions.”

Those who became refugees or internally displaced persons also acted as sources of information on external support for Ukraine. Their experience and communication with relatives who remained in Ukraine helped to paint a positive picture of other countries providing them with support, which differed from the claims made via Russian disinformation channels. In addition, visits by foreign officials to Ukraine in the midst of the war demonstrated international support for the Ukrainian people, further countering narratives suggesting that Ukraine no longer had any allies.

Nonetheless, it should be noted that the Russians were somewhat successful in spreading disinformation in regions where they managed to cut the population off from objective sources of information. Russia targeted residents of occupied territories with stories about Ukraine’s alleged retaliation. According to Maria Avdeeva, such claims were more likely to resonate because “This was the only information people got, so they didn’t know what was happening. They might not have known what was happening in Bucha; they didn’t see such atrocities because of the lack of information.”

In the months following the 2022 invasion, many outlets and experts rushed to claim that Ukraine was winning or had already won the information war, simply because it was more effective at social media and had employed communication tools to outclass Russia. While the majority of our interviewees agreed that Ukraine was far more effective in the first year of the war than Russia, none of them believed that the information confrontation was over; rather, they emphasized the importance of alertness and the work that remained to be done. Several even highlighted that there is no such thing as an “end” or a “victory” when it comes to information warfare. An information confrontation does not have clear boundaries and often extends beyond armed conflict. “The information war won’t end with the kinetic one – it’s impossible to win an information war,” an SSU official noted.

CCD interviewees highlighted a similar idea: “It [information war] is a never-ending process, and there’s no moment when you can just say ‘We won’,” one of them explained. The process exploits new events from an endless news cycle, applying tried and tested propaganda techniques to manipulate facts in narrative weapons. “The Russians take a kernel of truth and wrap it up in fancy wrapping paper,” Texty editor-in-chief Roman Kulchynsky stated. The Kremlin’s information operations also continue to evolve. “We’re finding countermeasures, but the Russians are looking for new tools,” said an SSU official. The potential range of tools, topics, and platforms is constantly growing, making the cycle indefinite while deepening it.

Even the idea of measuring success in information warfare is highly problematic. For instance, from the perspective of an observer outside Ukraine, it might seem that Russian narratives have not had any effect on Ukrainian public opinion. But many topics used by the Russians are in line with popular grievances. “Some operations are pretty successful, especially those that are designed to divide us, when they use our internal vulnerabilities, and when we don’t understand who is behind the threat or campaign,” said Liubov Tsybulska. Such campaigns blur the line between significant domestic problems and smaller ones successfully amplified by Russian propaganda. This makes measurement even more problematic.

Researchers cannot be certain about what Russia considers success without knowing its informational objectives, which can be gleaned from narrative patterns but otherwise only truly known by their authors in Moscow. Furthermore, the idea of effectiveness in an information war is quite murky. Some campaigns and messages might be evaluated against engagement metrics, such as views, shares, reactions, and comments, making the most “viral” publications stand out at first glance. But these figures do not necessarily directly reflect actual influence, rendering the measurement of information warfare’s impact on people’s behaviour uncertain. “Russia’s criterion is the scope and reach regarding how many people read the news,” said Ihor Solovey. “But it’s impossible to measure whether a news item reached the reader and influenced them.”

Interviewees did point to some indicators of success, however, such as when Russian disinformation operations are amplified by other actors, both within Ukraine or abroad, or when Russian threats are used as an excuse not to provide Ukraine with the necessary support, in order to avoid provoking Russia.

Some Russian messaging efforts have been successfully propagated via the international media, and this factor alone could count as a success for some of the campaigns. “In mainstream media, some analysts or even journalists questioned Russia’s responsibility for this war crime,” Olga Tokariuk said when discussing Russian atrocities in the town of Bucha. “They said, ‘But are we sure that the Bucha massacre wasn’t staged by the Ukrainians?'” The mere presence of “bothsidesism” in media coverage fails to distinguish between true and false versions of an event, ultimately sowing confusion and damaging Ukraine’s credibility among its audiences.

The answers to the questions about Russia’s success are inconclusive. On the one hand, many interviewees claimed that Russia is ineffective because the West is still sending aid to Ukraine. On the other hand, when discussing Western support in further detail, many interviewees – including some who had expressed scepticism regarding the impact of the Russian operations – admitted that Russia had achieved some tactical successes. “I think Russia’s biggest success was not stopping the aid, but postponing it,” said Molfar’s Artem Starosiek.

An additional layer is agenda-setting – attempts to influence topics being discussed in different societies. While any message in isolation has a low probability of changing opinion, ongoing chatter about specific issues might lead some people to change their way of thinking.

“Russia is capitalizing on all the old myths that it must not be provoked. And of course, if Russia keeps the United States thinking that it could escalate and this prevents the United States from giving Ukraine what it needs to win, then yes, Russia is succeeding in this direction. But, of course, this information influence is notoriously difficult to quantify,” said Alya Shandra of Euromaidan Press.

Finally, Russia has a long history of influence campaigns and active measures through periods of hot and cold conflicts. The trajectory of this influence often moves towards the intensification of active measures. Not all are successful, but some may yield significant results, such as Operation Infektion, in which the USSR used proxies to promulgate the conspiracy theory that the US government had intentionally developed HIV/AIDS as a bioweapon. While some might argue that the Russians lost the first phase of the current war, “It does not mean they have stopped,” noted Ihor Solovey. “They will continue working and try to get better.” An SSU official echoed a similar sentiment: “Despite the lack of Russian success, they cannot be underestimated because they are smart and skilful in this field and they have been creating a network for the covert promotion of Russian disinformation in the world for years.” StopFake’s Ruslan Deynychenko agreed. “Russians are constantly learning from experience. They are flexible. They started with one set of messages, and when they realized that these messages were no longer working, they changed them completely,” he said.

The last lesson learned is different from the previous ones in the sense that it will describe what Ukrainians learned they cannot do, or at least not on their own – and where they need some help from the democratic world. Their first recommendation would be that the West should do what Ukraine has been doing for the past few years.

Several interviewees expressed concern that Western countries are not doing enough to counter Russian disinformation and propaganda channels, or the witting or unwitting agents who are helping them to spread in their own countries, which could ultimately result in diminished support for Ukraine. “It would be really helpful if our partners started working [against] Russian propaganda actors in their own countries. It’s not that we need people here. We need them to work with this threat domestically. We have more or less managed to do this in Ukraine,” said Liubov Tsybulska. Gosha Tykhyi added: “We need our partners to step up efforts to counter Russian disinformation.”

The most elaborate idea was put forward by the Centre for Strategic Communications. “We would very much like to see an international coalition supporting Ukraine in the information space,” said Ihor Solovey. “Based on the analogy with the military Ramstein group [the alliance of nations supplying Ukraine with military aid], we talk about [creating an] Information Ramstein.” The idea and the name originated from Peter Pomerantsev, but the version that the CSC is pushing is different from Pomerantsev’s concept (as the authors confirmed with both Pomerantsev and the CSC).

“Information Ramstein” would bring together two primary groups. One group would include civil society, journalists, the private sector – all the non-governmental parts of the information ecosystem. The other would include governments and their institutions, such as ministries or secret services. “Governments can’t order civil society to do anything in Germany or France. But they can and should shut down Russian channels,” Solovey said, and continued:

“Russians are openly saying they are fighting against the West. And all the TV channels, agencies, social media accounts, politicians and everything else – all this is part of the hybrid war against the West. If you don’t fight against it, you could suffer the same fate as Ukraine; you will be next.”

In early 2023, the Ukrainian Ministry of Culture reached out to Brussels with regard to this project.

Some interviewees would like to see similar measures applied to other actors beyond Russia. “Foreign governments should work with the media and with social media platforms to force them to address the issue,” said Texty’s Ruslan Deynychenko. “We need efforts to de-platform those players, not only Russians, but all those who use or try to use disinformation as a weapon.”

Others would like to see measures that go beyond de-platforming Russian channels. “Investigating Russian influence agents and also various Russian soft power organizations in the West is still a very broad field of work,” said Olga Tokariuk. The investigation of various information campaigns, especially those in which different Western actors spread the same kind of messaging, was also raised during the interview with the SSU: “(…) to expose that these are coordinated actions and Russia is behind them,” one SSU official commented, and continued:

“It’s worth flagging channels that systematically broadcast Russian disinformation (similar to the verification icon on social networks). Then internet users will understand that they are reading material from a hidden Russian information agent. Investigative journalists could analyze their sources of funding and relationships in the dissemination of narratives.”

“We need a special criminal tribunal, and the list must include at least the top Russian propagandists,” added Detector Media’s Galyna Petrenko. Among other measures she mentioned was demonetization. “The big tech companies and major advertisers should not allow propagandist platforms and propagandist media to make money from advertising,” she said. Petrenko also mentioned that Ukraine would need help from Western tech companies with the aforementioned problem: how to deliver dependable information to the people in the temporarily occupied territories.

While Europe has expanded some of its Russian channel restrictions in the post-FSI period, Ukrainian practitioners believed these actions were not enough.

“We analyzed 40 countries, and about 20% of all publications on Ukraine still use Russian state media or Russian-affiliated media as a source of information on Ukraine. That’s huge. And we see that Russia is even expanding on that,” said Ksenia Iliuk from LetsData.

Some opinion polls in Europe have shown that the Kremlin’s disinformation efforts continue to convince up to one-third of the population in various European countries. As the interviewees highlighted in Lesson 9, Kremlin propaganda was probably successful in deterring some countries from supporting Ukraine, or at least in persuading them to postpone some decisions that would have been vital in mitigating Russian aggression. This echoes the findings of some Wester scholars.

“The Russians have been selling fear for years. They were able to scare NATO into not admitting Ukraine and Georgia in 2008. They were able to scare many people into many things. And one of the things we are teaching the West right now is to stop fearing Russia,” Gosha Tykhyi concluded.

This report discussed lessons learned by Ukrainian practitioners in Ukraine’s fight against Russian disinformation, which EU and NATO countries could gain insights from and draw upon. The described measures are only a part of the Ukrainian resistance against Russian aggression. As discussed in Lesson 8, actions in the physical world are of paramount importance, but the information environment can also shape what happens in the kinetic domain, making the battle for the information space an important part of the resistance.

To sum up the first lessons learned by Ukrainian practitioners for this report: It is crucial to dedicate sufficient energy to basic tasks such as monitoring, refuting, and debunking lies, and to ensure that these tasks are performed properly and without any gaps. Likewise, considerable resources are required in the information arena along with a large number of different actors and activities. To this end, governments cannot rely solely on their own resources. They need to involve civil society and the private sector, and actively cooperate with them.

Developing such a system, and the network of connections that undergirds it, will demand time and the sustained efforts of numerous people. Ukrainians have been building a system for a decade, ever since the Euromaidan protests and the annexation of Crimea. A vibrant civil society took the lead to begin with, with the government subsequently becoming more active. The numerous counter-disinformation projects and initiatives that were activated between 2014 and 2022 were crucial for the period after February 2022. According to the Ukrainian practitioners interviewed for this report, the primary takeaway for any other country would be to start dedicating significant resources to this fight sooner rather than later, because building a nation’s information resilience calls for the dedication and vigilance of many people and organizations over many years.

In all likelihood, Russian disinformation, propaganda, and information aggression will continue, even after the kinetic warfare comes to an end. The investments made in resisting malign influence will pay off for many years to come.

Jakub Kalenský is the Deputy Director of the Community of Interest on Hybrid Influence at Hybrid CoE, where he focuses on disinformation and ways of countering it. He has previously worked on this topic for the European Union, where he and his colleagues launched the EUvsDisinfo campaign, and at the Atlantic Council. He has published reports on Russian disinformation in Ukraine and on countermeasures against disinformation. Before specializing in disinformation, he worked as a journalist in the Czech Republic.

Roman Osadchuk is a Research Associate for the Eurasia region at the Atlantic Council’s Digital Forensic Research Lab (DFRLab), where his research focuses on disinformation in Ukraine and neighbouring countries. He is the author of multiple investigations and reports on disinformation and computational propaganda, which uncover the tactics and techniques of malign actors. Roman is also currently a senior lecturer at the National University of Kyiv-Mohyla Academy.

Hybrid CoE Research Reports are thorough, in-depth studies providing a deep understanding of hybrid threats and phenomena relating to them. Research Reports build on an original idea and follow academic research report standards, presenting new research findings. They provide either policy-relevant recommendations or practical conclusions.

This Hybrid CoE Research Report is a joint effort with the Atlantic Council’s Digital Forensic Research Lab (DFRLab). Founded in 2016, the DFRLab pioneered the study of online disinformation. Their work exposes falsehoods and information manipulation, documents human rights abuses using open-source information, and builds digital resilience worldwide. For more information, please visit dfrlab.org.

The mission of the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) is to strengthen its Participating States’ security by providing expertise and training for countering hybrid threats, and by enhancing EU-NATO cooperation in this respect. The Centre is an autonomous hub for practitioners and experts, located in Helsinki, Finland.

The responsibility for the views expressed ultimately rests with the authors.

Jakub Kalenský and Roman Osadchuk, “How Ukraine fights Russian disinformation: Beehive vs mammoth,” Hybrid CoE Research Report 11, European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) and the Digital Forensic Research Lab (DFRLab), January 24, 2024, https://dfrlab.org/2024/01/24/how-ukraine-fights-russian-disinformation-beehive-vs-mammoth.