Ukraine doesn’t just have to worry about Russia at sea or the eastern Donbas.
Kremlin spies are coming to Kyiv en masse, if they are not already in the capital, as Russia steps up clandestine activities amid heightened alert over the Nov. 25 assault by Russia’s Federal Security Service, or FSB, on Ukrainian sailors near the Kerch Strait.
United Kingdom-based investigators and international experts believe that Russian operatives are using sham Ukrainian-owned companies to gain long-term residency in Ukraine. The phony employment serves as a cover for espionage and subversion.
Investigators and security experts claim that the number of agents in Ukraine working for the Russian GRU main intelligence directorate has increased during recent months and may number in the hundreds now.
‘Fire-starters’ in Ukraine
The Ukrainian government imposed limited martial law across 10 regions of the country on Nov. 26 after Russian special forces attacked Ukrainian navy vessels in neutral waters, arrested 24 sailors and illegally seized three of their boats during the Nov. 25 FSB operation in the Kerch Strait, a narrow body of water that connects the Black and Azov seas.
Now, GRU “fire-starters” across Ukraine – but mostly in Kyiv – are tasked with exploiting the crisis to spread disinformation, incite chaos, spark protests and influence the upcoming March 31 presidential election, according to expert observers.
Christo Grozev, an expert on the GRU and lead investigator for the London-based investigative agency Bellingcat, believes that Russian spies are now shifting their operational focus from eastern Ukraine to Kyiv.
Grozev estimates, based on Bellingcat’s gathered evidence, that up to 20 percent of the GRU’s operational assets could now be assigned to covert operations in Ukraine.
Bellingcat’s online sleuths have already gained notoriety for their investigations into Russian involvement in the July 28, 2014 downing of Malaysian Airlines flight MH17 over Donbas, killing all 298 people on board. They also recently exposed the identities of GRU operatives who allegedly deployed Novichok in Salisbury, England and attempted to orchestrate a failed coup in Montenegro.
Now they’re starting to turn their attention and investigative resources to how the GRU is stepping up its interference in Ukraine.
According to Grozev, “a minimum of 200” Russian GRU agents are operating outside of the Russian-controlled areas of eastern Donetsk and Luhansk oblasts.
‘Chaos’ is objective
“The objective is chaos,” Grozev told the Kyiv Post in an interview. “I think at this point, Russia has realized it cannot orchestrate order – it can only orchestrate chaos. It’s much cheaper and easier.”
Grozev believes that the GRU is tasked with creating crises that can eventually lead to a more “Russia-friendly” regime taking power in Kyiv.
Grozev said that intelligence analysts can expect to see the GRU use a combination of its tactics from their playbook here in Ukraine but that, ultimately, their endgame is likely to be widespread protests and even another revolution that the Kremlin could quickly take advantage of.
Cheaper and more efficient than funding an additional war effort in Ukraine’s east, causing disruption online and eventually on Ukrainian streets would be an effective way for Russia to strengthen their “national mobilization” against Ukraine, Grozev said.
“It could look like some kind of manifestation of popular will or a grass-roots movement, like EuroMaidan” he said. “But it might not be.”
Some observers also think that Russia, frustrated with its inadequate hold over relatively small areas of eastern Ukraine, will turn to more creative forms of unconventional warfare throughout the country.
“The paramilitary forces and thugs under Kremlin control… this strategy, it hasn’t really worked,” said Bob Seely, a British member of parliament, former military officer and Russian warfare expert who labels GRU operatives as “fire-starters” that use “paramilitary and non-conventional warfare” to kick-start unrest and small-scale conflicts that they can exploit.
“We have to remember that (the GRU) wanted to overthrow local government in a bunch of areas, including Odesa, Mykolaiv, Kharkiv, Donetsk and Luhansk – but they only really succeeded, partially, in two. I think that’s because they didn’t count on the energy and vitality among Ukrainians to fight back,” Seely told the Kyiv Post.
GRU in sham firms
Grozev and other Bellingcat investigators in Vienna, Kyiv and London are in the early stages of examining how GRU spies use sham companies in Ukraine to mask their real activity here. Drawing on his initial analysis and what Bellingcat has uncovered in other countries, Grozev describes the GRU strategy that’s in play.
“What we’ve identified so far are service companies that don’t need a very large amount of capital that has to be explained,” said Grozev. “Insurance companies are a perfect example.”
“Companies that have a good network across different cities are their priority… they have to have some profile, but not too big,” he told Kyiv Post, adding that such firms would be used by Ukrainians on an everyday basis and likely have some degree of Ukrainian ownership.
Using such companies as a smokescreen, Russian spies are creating a facade of legitimacy in the corporate world here in Ukraine: they attend business conferences, roundtable meetings and conduct deals, all the while reporting back to Moscow about opportunities and weaknesses that can be exploited.
“It’s complicated stuff,” said Grozev. “But it’s cheaper than another Crimea.”
Grozev said that in-depth analysis and research has allowed Bellingcat to begin identifying such sham corporate structures in other countries and they’ve begun to identify the patterns the GRU is now using in taking over companies that can hide their operatives in Ukraine.
When they’re confident they have enough evidence, Bellingcat will name and shame the companies, as well as their “employees,” Grozev said.
“The Russian GRU are very clever about what they’re doing and how they’re trying to achieve it,” said Colonel Richard Kemp, former commander of British armed forces in Afghanistan in 2003, later assigned to the British government’s Joint Intelligence Committee in Downing Street.
“They have a strong strategic instinct and a bold audacity that will help them to get what they want,” Kemp told the Kyiv Post. “Unfortunately, there is also a Western vacuum when it comes to defiance of Russia.”
“But it’s not just happening in Ukraine,” he said.
According to Kemp, now an intelligence and security expert who advises at the highest levels, the GRU strategy in Ukraine is deeply concerning – but it’s also textbook.
He says they’re doing it elsewhere too, thanks to “phenomenal penetration” of countries throughout Europe and the West, as well as techniques and tactics inherited from the Soviet traditions of espionage and subterfuge.
According to him, Ukraine and its Western allies need to respond robustly, and quickly, before it’s too late.
Will SBU and West react?
As fighter jets and helicopters circled over the Kerch Strait on the evening of Nov. 25, it quickly became clear this was an unprecedented and direct FSB special operation against the Ukrainian navy.
What wasn’t clear, as Ukrainian lawmakers moved towards declaring a crisis and implementing martial law, was how strongly the West would respond.
On the surface, the response from allied nations has appeared underwhelming: Tweeted statements of condemnation and calls for de-escalation. But behind the scenes, Western intelligence agencies could be helping to coordinate a stronger response.
Kemp says that American, British and other European intelligence officials are already focused on Kyiv, helping the Ukrainian State Security Service, or SBU, to manage their response and better counter aggression and espionage from the FSB and GRU.
“I can’t go into too much detail, but the answer is yes: they’re helping,” he told the Kyiv Post, adding that Western intelligence officers will already be coordinating with their Ukrainian counterparts on intelligence liaison, as well as providing “advice, assistance and support.”
“Some of what’s happening, we cannot see,” says Grozev of Bellingcat. “But Ukrainian intelligence can see it, and we have to hope that they are tripling their working hours at the moment,” he added.
“We’re not sure (the SBU) have the capacity to react in real time to new threats and that’s why we’re happy to do our job and publish what we uncover,” he said.
“We know that the SBU has a backlog of cases related to the war and Flight MH17, as well as alleged violations of criminal law and other stuff too. But hopefully they have this (the GRU) under control… we know they’re working heavy hours, doing analysis to determine patterns and identify threats.”
Deport the spies
With the Nov. 26 implementation of limited martial law across Ukraine, the country’s security services could be seizing an opportunity to be tougher on suspected foreign agents, especially at the borders.
On Nov. 27, 47 Russian citizens en-route to Ukraine from Minsk, Belarus, were denied entry to the country at a Kyiv airport for unknown reasons where security officials immediately put them on a return flight.
Although he admits there is no information about the identities of those deported, Grozev says that the SBU might be exercising extra caution as GRU officers travelling to their assigned destinations have been frequently routed via Minsk.
“It’s the sort of action that’s needed,” says Colonel Richard Kemp. “Other countries are taking the same measures too,” he added.
In March 2018, after the United Kingdom accused Russia’s GRU of deploying the deadly nerve agent Novichok in Salisbury, the British government expelled 23 Russian officials, labeling them known intelligence operatives.
The UK’s Western allies followed suit, expelling more than 100 Russian officials, 60 of those from the United States: a bold move that British Prime Minister Theresa May called “the largest collective expulsion of Russian intelligence operatives in history.”
Ukraine, at the same time, expelled an additional 13 Russian officials. But some experts are convinced it was not enough and the threat remains.
In a recent interview with the Daily Telegraph newspaper, the new head of the British Armed Forces, General Mark Carleton-Smith, said that Russia poses by far the greatest threat to Britain’s national security, even more than ISIS.
“Russia has embarked on a systematic effort to explore and exploit Western vulnerabilities,” he said. “We cannot be complacent about the threat Russia poses or leave it uncontested.”
“He is a man who has access to the highest levels of intelligence and an in-depth understanding of what’s happening… so we should listen to what he says,” said Kemp.
But the real question, according to Kemp, is whether any Western or European leaders currently have the stomach to “take on” Russia in a serious way.
