Britain’s Secret War With Russia

 In China, GDI, Defense, Cyber/ICT, Air, Energy, Environment, Threats, France

The poi­son­ing of a dou­ble agent sparked an intel­li­gence and PR bat­tle between London and Moscow, the details of which are only now emerg­ing.

Tucked away in a drab indus­tri­al estate on the out­skirts of the Swiss town of Spiez lies a mul­ti­sto­ry con­crete office block flanked by a park­ing lot and a soc­cer field. A mod­est gate with a small plaque is all that greets vis­i­tors. A riv­er rolls behind the build­ing, fed from the peaks of the Blüemlisalp mas­sif above. This is the Bernese Oberland, the cor­ner of Switzerland where James Bond met Blofeld in a revolv­ing moun­tain­top hide­away; where Sherlock Holmes plunged to his death.

The build­ing in ques­tion, an out­post of Switzerland’s Federal Office for Civil Protection, might be unassuming—home to just 98 aca­d­e­mics, engi­neers, appren­tices, and technicians—yet its occu­pant, the Spiez Laboratory, is world-renowned. The elite facil­i­ty focus­es on glob­al nuclear, chem­i­cal, and bio­log­i­cal threats, and is one of a lim­it­ed num­ber of sites des­ig­nat­ed by the Organisation for the Prohibition of Chemical Weapons (OPCW) to con­duct research and analy­sis. Safely under the pro­tec­tive cloak of the country’s diplo­mat­ic neu­tral­i­ty, Spiez Laboratory car­ries out its work with lit­tle fan­fare or con­tro­ver­sy.

Over the course of a few months in 2018, how­ev­er, this gen­tle exis­tence was upend­ed, as the lab became caught in a cold war between Russia on one side and the United Kingdom and the West on the oth­er, fought in pub­lic and in the shad­ows, online and in per­son, occa­sion­al­ly flash­ing hot in dead­ly fash­ion. From the attempt­ed assas­si­na­tion of a dou­ble agent in a sleepy English city to the expul­sion of scores of Russian diplo­mats from Western cap­i­tals, this fight would grow and morph, draw­ing in a chem­i­cal-weapons attack in Syria and rolling scan­dals about Russian sports dop­ing.

Related: Russian Trolls Are Hammering Away at NATO’s Presence in Lithuania

Related: To Fight Disinformation, Rethink Counterintelligence

Related: The Magpies and the Cuckoos: A Disinformation Fable

Through it all, Russia and Britain went toe-to-toe in an inter­na­tion­al intel­li­gence and PR bat­tle, one in which each land­ed blows, expos­ing fis­sures in their respec­tive sys­tems and soci­eties. Yet, as NATO lead­ers meet in London this week to dis­cuss the future of the mil­i­tary alliance 70 years after its found­ing, oth­er lessons emerge, with impli­ca­tions for the wider con­test between Russia and the West, which are vying for influ­ence, respect, secu­ri­ty, and raw geopo­lit­i­cal pow­er.

Whereas NATO was found­ed to unite the Western world against the threat of con­ven­tion­al mil­i­tary aggres­sion by the Soviet Union, even­tu­al­ly con­tribut­ing to the Communist bloc’s demise, the alliance is today con­front­ed with a recal­ci­trant Russia that seeks to lever­age pro­pa­gan­da and dis­in­for­ma­tion to sow con­fu­sion and dis­con­tent, and that exhibits a will­ing­ness to use its tra­di­tion­al mil­i­tary force and intel­li­gence agen­cies to expand its influ­ence. It is a Moscow that is able to project dis­pro­por­tion­ate power—despite being dwarfed in eco­nom­ic size and resources by even mid-tier Western countries—thanks to a web of inter­na­tion­al influ­ence, aggres­sion, tac­ti­cal cun­ning, and crim­i­nal­i­ty.

At the same time, NATO and its mem­bers are divid­ed, dis­tract­ed, and shorn of a coher­ent strat­e­gy to deal with Russia’s efforts. The grouping’s super­pow­er, the United States, is led by a pres­i­dent whose com­mit­ment to the alliance’s under­ly­ing prin­ci­ple of col­lec­tive defense is in doubt; its oth­er sig­nif­i­cant mem­bers are con­sumed by domes­tic strife (Britain), ques­tion­ing NATO’s strate­gic future (France), or lack the mil­i­tary might and polit­i­cal will to fill the gap (Germany). And faced with a new array of threats from Russia, the alliance has more than once been caught unawares, at times thanks to its own unforced errors but also in no small part due to a lack of long-term vision to do any­thing oth­er than de-esca­late ten­sions. Despite Russia deploy­ing a chem­i­cal weapon on the streets of a NATO mem­ber (also Britain), the country’s inter­na­tion­al freeze is already begin­ning to thaw, its econ­o­my is grow­ing, and its lead­er­ship, on the face of it at least, remains secure. It has suc­cess­ful­ly expand­ed its influ­ence in the Middle East and has secured its ille­gal land grab in Crimea.

The peri­od from the attempt­ed mur­der of the for­mer Russian spy Sergei Skripal in March 2018 to a major Western coun­terblow expos­ing Moscow’s behav­ior in October 2018 offers a win­dow not just into these chal­lenges, but also into oth­ers that are only just emerg­ing as tech­no­log­i­cal advances change the very nature of infor­ma­tion war­fare. To under­stand how the bat­tle played out, I spoke with sev­er­al cur­rent and for­mer officials—government aides, com­mu­ni­ca­tions advis­ers, and mem­bers of the intel­li­gence services—as well as politi­cians in London, most of whom would speak only on the con­di­tion of anonymi­ty in order to dis­cuss sen­si­tive intel­li­gence mat­ters. I also con­sult­ed secu­ri­ty, diplo­mat­ic, and cyber experts. (The Russian embassy in London declined to respond to a series of detailed ques­tions I sent them, instead refer­ring me to a state­ment on its web­site in which Moscow denies any involve­ment in the poi­son­ing and claims it was an act car­ried out by the British secret ser­vices.)

Unlike a con­ven­tion­al bat­tle, though in keep­ing with much of mod­ern con­flict, there are no obvi­ous mea­sures to deter­mine who won and who lost. The months-long infor­ma­tion war that Russia fought with Britain was one in which mis­takes were dif­fi­cult to judge and suc­cess hard to imme­di­ate­ly quan­ti­fy.

This is a sto­ry about dis­in­for­ma­tion and spy­craft. It is also a sto­ry that again and again returns to the tiny Swiss town of Spiez.

The details of the Skripal poi­son­ing are well known: On the night of March 4, 2018, the for­mer Russian spy, who was liv­ing in retired exile in Britain, was found along­side his daugh­ter, who was vis­it­ing from Russia, foam­ing at the mouth on a park bench in Salisbury, 90 miles south­west of London.

Eight days lat­er, then-British Prime Minister Theresa May for­mal­ly accused Russia of car­ry­ing out the attack. Britain’s Porton Down mil­i­tary-research facility—which, along­side the Spiez Laboratory, is one of the cen­ters of exper­tise accred­it­ed by the OPCW—had deter­mined that the Skripals were poi­soned with a nerve agent called Novichok. The chem­i­cal weapon, May told Parliament, had been smug­gled into the coun­try by two hit­men work­ing for Russia’s mil­i­tary-intel­li­gence agency, the GRU. In response, Britain and its allies in 28 coun­tries expelled more than 150 sus­pect­ed Russian spies. Russia protest­ed its inno­cence and denounced the Western response. (Skripal and his daugh­ter ulti­mate­ly sur­vived. Another woman, Dawn Sturgess, died, after spray­ing what she thought was per­fume, but was in fact Novichok, onto her wrists, and a police offi­cer was hos­pi­tal­ized while inves­ti­gat­ing the poi­son­ing of the Skripals.)

Details of the infor­ma­tion war that ensued are only now emerg­ing.

By the time May made her alle­ga­tion in Parliament, a Russian cam­paign to dis­cred­it it was already in full swing. In just the first week after the attempt­ed assas­si­na­tion, accord­ing to five British offi­cials who spoke with me, the U.K. gov­ern­ment tracked 11 alter­na­tive the­o­ries about the Skripal poi­son­ing that all orig­i­nat­ed in Russia. A March 2019 report by King’s College London found that Russian-gov­ern­ment fund­ed out­lets RT and Sputnik alone were respon­si­ble for 138 sep­a­rate and often con­tra­dic­to­ry nar­ra­tives about the Skripal poi­son­ing in the four weeks fol­low­ing the inci­dent. These includ­ed claims that the poi­son came from Porton Down; that the Skripals were nev­er, in fact, poi­soned; even that the poi­son­ing was designed to dis­tract from Brexit. Russian media also spec­u­lat­ed var­i­ous­ly that it was a British plot, an American plot, a Ukrainian plot, or a plot to frame Russia. May told mem­bers of Parliament that she had been per­son­al­ly accused of invent­ing Novichok.

The onslaught of such sto­ries in the weeks and months after the Skripal attack—and their suc­cess in reach­ing a wide and recep­tive audience—emerges in lists of the most viral social-media con­tent from that peri­od. This data was gath­ered for The Atlantic by the online mon­i­tor­ing com­pa­ny NewsWhip, which tracks how many “inter­ac­tions” a par­tic­u­lar news sto­ry has gar­nered on social media sites like Facebook, Twitter and Pinterest—measured by the num­ber of likes, shares or com­ments it has received. In some cas­es, there appeared to have been gen­uine orches­tra­tion of these efforts, but oth­er instances show oppor­tunism, with Russia-friend­ly out­lets jump­ing on appar­ent con­tra­dic­tions in Britain’s pub­lic state­ments.

Moscow’s goal, accord­ing to U.K. offi­cials tasked with mon­i­tor­ing and coun­ter­act­ing the Russian pro­pa­gan­da war, was sim­ply to flood social media with false nar­ra­tives and infor­ma­tion that would cast doubt on the estab­lished British and Western posi­tions, not with the goal of offer­ing one par­tic­u­lar alter­na­tive expla­na­tion, but sim­ply to mud­dy the waters suf­fi­cient­ly to make peo­ple ques­tion their own gov­ern­ment. Russia denies the alle­ga­tion and accus­es the U.K. gov­ern­ment itself of manip­u­lat­ing the media with leaks and cen­sor­ship.

This Russian strat­e­gy is weari­ly famil­iar to for­mer Soviet satel­lite states in Eastern Europe (as well as the United States, dur­ing the 2016 pres­i­den­tial elec­tion), offi­cials and experts I spoke with said. And ear­ly in the sum­mer of 2018, there were con­cern­ing signs for London that it was hav­ing some effect. Internal gov­ern­ment polling car­ried out in the months after the poi­son­ing showed that a sig­nif­i­cant pro­por­tion of the pop­u­la­tion did not believe the British government’s asser­tion that Russia was behind the attack, accord­ing to an offi­cial briefed on the data, with the most skep­ti­cal being those aged 18 to 24. A September 2018 gov­ern­ment memo, shared with The Atlantic, that dis­tilled the results of polling showed that the “per­cep­tion of Russian cul­pa­bil­i­ty” stood at just 55 per­cent. This was down from a peak of 65 per­cent at the end of March—the month of the attempt­ed mur­ders. (One of May’s aides told me that this lack of trust in gov­ern­ment is now a major struc­tur­al chal­lenge when deal­ing with inci­dents of nation­al secu­ri­ty.)

Some of those I spoke with insist­ed that such set­backs were only tem­po­rary, but all large­ly agreed that Russia react­ed quick­ly and effec­tive­ly. “There was a pri­vate admis­sion that we had lost the infor­ma­tion bat­tle,” one senior U.K. gov­ern­ment offi­cial involved in the British coun­ter­at­tack told me. “We had ced­ed the ground. The Russians were just real­ly quick off the mark.”

Numerous sto­ries by out­lets such as RT and Sputnik pro­mot­ed duel­ing the­o­ries as to who car­ried out the Skripal poi­son­ing, but when it comes to sow­ing con­fu­sion, one sto­ry stands out, and Spiez was at the cen­ter of it.

On April 14, 2018, RT pub­lished an arti­cle that would go on to become the most viral news sto­ry in 2018 about the inci­dent as mea­sured by online inter­ac­tions, NewsWhip data shows. According to RT, Russian Foreign Minister Sergey Lavrov said that a “Swiss lab” had dis­cov­ered that a dif­fer­ent tox­in was used to poi­son the Skripals—not Novichok, but BZ, which was, as RT put it, “in ser­vice” in the United States, Britain, and oth­er NATO coun­tries.

The report would go on to be shared on social media by RT as well as by accounts such as the WikiLeaks Task Force, which describes itself as the “offi­cial @WikiLeaks sup­port account,” ver­i­fied with a blue check­mark on Twitter. The sto­ry would rack up 137,360 social-media engage­ments, still the most of any sto­ry pub­lished on the Skripal affair.

And yet the arti­cle was entire­ly mis­lead­ing. Spiez was indeed one of a small num­ber of inter­na­tion­al cen­ters cho­sen by the OPCW to con­firm the con­clu­sions reached by Porton Down, and it did find a dif­fer­ent tox­in from Novichok. But that was part of the process: After receiv­ing sam­ples from the Skripal poi­son­ing from the U.K., the OPCW, fol­low­ing pro­to­col, added a new sub­stance into the batch for qual­i­ty control—a test, in effect, to ensure that Spiez’s and oth­er lab­o­ra­to­ries’ results were accu­rate. If they did not find the added ele­ment, then what­ev­er else they found could not be trust­ed. The tox­in added by the OPCW was a deriv­a­tive of BZ.

It would be sur­pris­ing if Lavrov was not aware of this dis­tinc­tion. On April 11, the OPCW, of which Russia is a mem­ber, con­firmed the British find­ings in a report that named the con­trol sub­stance. Was it a sim­ple mis­step on the for­eign minister’s part? How did he know that Spiez had done the test­ing? That the Swiss lab was among those cho­sen by the OPCW to con­firm Porton Down’s con­clu­sions was kept con­fi­den­tial as per the OPCW’s secu­ri­ty pro­to­cols, a rule seen as “sacro­sanct,” accord­ing to one of the U.K. offi­cials who spoke with me. Andreas Bucher, a spokesman for Spiez, told me that the research facil­i­ty did not even know which oth­er sites were used to test the find­ings. The Russian embassy in London declined to com­ment on the inci­dent when I asked them about it.

Unsure of how to respond with­out con­firm­ing that it was one of the lab­o­ra­to­ries cho­sen by the OPCW, some­thing it was not allowed to do, Spiez ini­tial­ly pub­lished a tweet say­ing that it could not com­ment on Lavrov’s asser­tions, and then lat­er released anoth­er say­ing that it had “no doubt Porton Down has iden­ti­fied Novichok.” Lavrov claimed to be quot­ing from Spiez’s report on its tests, but Bucher said he had false­ly cit­ed the report. “We don’t write prose,” he said. “We write for­mu­las.”

The U.K. gov­ern­ment itself did not respond to Lavrov’s claims. The Spiez tweet par­tial­ly cor­rect­ing the sto­ry received only about 1,000 retweets—less than 1 per­cent of the engage­ments record­ed by the orig­i­nal RT sto­ry. Regardless, the claim was out there, being shared across the world, even though the OPCW itself had said that its lab­o­ra­to­ries had con­firmed Britain’s orig­i­nal find­ings.

If the most viral Skripal-relat­ed sto­ry illus­trates how Moscow’s pro­pa­gan­da machine looked to active­ly plant dis­in­for­ma­tion, the sec­ond on that list high­lights how Russia was able to take advan­tage of unex­pect­ed open­ings as well.

The Independent, an online British out­let, on April 3 pub­lished a sto­ry based on an inter­view giv­en to Sky News by Gary Aitkenhead, Porton Down’s chief exec­u­tive. Aitkenhead said that the British facil­i­ty had con­firmed that the tox­in used in Salisbury was Novichok, but that its sci­en­tists “have not iden­ti­fied the pre­cise source” of where it came from. Just days ear­li­er, though, then–Foreign Secretary Boris Johnson had claimed that Porton Down had con­firmed that the nerve agent orig­i­nat­ed in Russia.

The appar­ent con­tra­dic­tion explod­ed into life online, with the Independent sto­ry get­ting picked up and pro­mot­ed by Kremlin sup­port­ers, as well as by the Russian embassy in Skopje, North Macedonia, an RT jour­nal­ist in North America, and even a Facebook account, “San Diego For Bernie Sanders 2020,” even­tu­al­ly receiv­ing 93,999 inter­ac­tions on social media, accord­ing to NewsWhip, a high fig­ure even for a sto­ry that was dom­i­nat­ing the news. Britain rushed to repair the dam­age after a 10 Downing Street rapid-response unit, which mon­i­tors web traf­fic and works close­ly with the nation­al-secu­ri­ty com­mu­ni­ca­tions team, noticed the sto­ry gain­ing trac­tion online. (One secu­ri­ty offi­cial told me that gov­ern­ment analy­sis of social media showed that Salisbury-relat­ed posts made up 12 per­cent of the entire U.K. dig­i­tal con­ver­sa­tion on April 3, the sec­ond-high­est fig­ure dur­ing the entire cri­sis, after the day May blamed Russia for the attack.)

Later that day, Porton Down tried to clar­i­fy Aikenhead’s remarks, tweet­ing that the facility’s “experts have pre­cise­ly iden­ti­fied the nerve agent as a Novichok. It is not, and has nev­er been, our respon­si­bil­i­ty to con­firm the source of the agent.” Security offi­cials con­tact­ed jour­nal­ists to explain the dis­crep­an­cy, with calls made to Sky News in par­tic­u­lar with a request for a pub­lic clar­i­fi­ca­tion. A week lat­er, the U.K. released a let­ter sent from May’s nation­al-secu­ri­ty advis­er to the sec­re­tary-gen­er­al of NATO, which for­mal­ly laid out the charges against the Russians.

The episode is seen by those inside Britain’s secu­ri­ty com­mu­ni­ca­tions team as the most seri­ous mis­step of the cri­sis, which for a peri­od caused real con­cern. U.K. offi­cials told me that, in hind­sight, Aikenhead could nev­er have blamed Russia direct­ly, because that was not his job—all he was qual­i­fied to do was iden­ti­fy the chem­i­cal. Johnson, in going too far, was more dam­ag­ing. Two years on, he is now prime min­is­ter.

The after­math of the Skripal poi­son­ing illus­trat­ed not only a PR offen­sive waged by out­lets sym­pa­thet­ic to Moscow, but also the breadth of the Russian state’s capa­bil­i­ties and efforts to include its diplo­mat­ic corps as well as its intel­li­gence agen­cies.

At the same time the media blitz was tak­ing place, the Russian embassy in London was writ­ing let­ter after let­ter to the U.K.’s Foreign Office with scores of detailed ques­tions that British offi­cials argued were designed to tie up their time and atten­tion. From March 6—two days after the Skripal assas­i­na­tion attempt—to February 18, 2019, the embassy fired off dozens of note ver­bales, or offi­cial diplo­mat­ic cor­re­spon­dence, with 41 requests and 57 ques­tions. (The Russian embassy has pub­lished a list of these demands.) Inside the U.K. gov­ern­ment, an offi­cial told me, this bar­rage was referred to as a “diplo­mat­ic DDoS attack,” a ref­er­ence to the cyber­strike in which a serv­er is shut down sim­ply by over­whelm­ing it.

At the same time, a surge in malign Russian bot activ­i­ty was detect­ed online, in which social-media accounts were acti­vat­ed to ampli­fy and spread mes­sages. In the six weeks fol­low­ing the Skripal poi­son­ing, through to the April 13 air strikes on Syria launched by the U.K., U.S., and France in response to Syrian President Bashar al-Assad’s use of chem­i­cal weapons, British offi­cials say they cal­cu­lat­ed a 4,000 per­cent increase in this type of activ­i­ty.

The GRU, the same orga­ni­za­tion that dis­patched the two hit­men to Salisbury, also played a role, and, once again, Spiez was at the heart of it.

In May, 2018, OPCW facil­i­ties around the world received an email appar­ent­ly from the Spiez Laboratory invit­ing them to a con­fer­ence for spe­cial­ists in chem­i­cal and bio­log­i­cal war­fare. The con­fer­ence itself was real, the third such meet­ing orga­nized by the Swiss research site, and the email was sent in the name of the Swiss Federal Department of Defence, the gov­ern­ment agency respon­si­ble for the lab­o­ra­to­ry. Attached was a Word doc­u­ment that pur­port­ed to con­tain infor­ma­tion about the meet­ing.

There were, how­ev­er, small give­aways that all was not right: The shade of red on the Swiss flag in the top left cor­ner of the doc­u­ment was slight­ly off, and some for­mat­ting in the let­ter­head was wrong (the abbre­vi­a­tion FOCP—for Federal Office for Civil Protection—was used on the wrong line). In fact, the Word doc­u­ment con­tained mal­ware that would embed itself into any com­put­er that opened the file. But it would take weeks for any­one to notice, and only in July 2018 did Spiez issue a warn­ing on its Twitter account that an email had been sent in its name with­out its knowl­edge, one that was actu­al­ly a sophis­ti­cat­ed spear-phish­ing attack, a cyber Trojan horse known as an advanced per­sis­tent threat, in which a com­put­er is accessed by stealth­ily giv­ing attack­ers full con­trol of the com­pro­mised host’s net­work.

Who was behind the attack—and what they hoped to achieve—has nev­er been con­firmed. The Russian embassy declined to address this spe­cif­ic case when I asked them about it. Kaspersky, a cyber­se­cu­ri­ty firm that ana­lyzed the inci­dent, told me that it did not know for cer­tain who the hack­ers were, whether they had been suc­cess­ful, or even what their goal was.* In the shad­owy world of spy­craft, it’s almost impos­si­ble to be sure about what is a false flag and what is real, the com­pa­ny said.

Britain’s National Cyber Security Centre is less cir­cum­spect, how­ev­er, assess­ing “with high con­fi­dence that the GRU was almost cer­tain­ly respon­si­ble.”

Through a spe­cial “link door” from 10 Downing Street, deep inside the Cabinet Office in cen­tral London, lies the U.K. government’s main emer­gency-response cen­ter: Cabinet Office Briefing Room A—or Cobra. This is the British equiv­a­lent of the White House Situation Room. It is where emer­gency meet­ings are held at times of cri­sis, to coor­di­nate strat­e­gy in the most secure envi­ron­ment.

Attached to Cobra are a num­ber of board­rooms where offi­cials can lis­ten in to what their min­is­ters are dis­cussing inside. Throughout the spring and sum­mer of last year, a group of some of the most senior gov­ern­ment com­mu­ni­ca­tions offi­cials, dubbed “Comms Cobra,” met dai­ly to dis­cuss how to respond to the Russian dis­in­for­ma­tion blitz. They were in full cri­sis mode—not only was the Russian cam­paign over­whelm­ing in its scope, but Russia seemed to be one step ahead of the U.K. as well.

Among the mea­sures the group took was to tight­en the cir­cle of who was in the know. At one point in the sum­mer, the num­ber of peo­ple, gov­ern­ment depart­ments, and agen­cies involved in respond­ing to the Salisbury case was huge. The Department for Environment was lead­ing the cleanup and the Home Office was deal­ing with secu­ri­ty, while London’s Metropolitan Police, Britain’s intel­li­gence ser­vices, and the local police force were inves­ti­gat­ing. Salisbury’s local coun­cil, the Foreign Office, Downing Street, and the Cabinet Office were involved too.

New process­es were put in place, rais­ing the lev­el of offi­cial secre­cy on some com­mu­ni­ca­tions and result­ing in often cum­ber­some pro­ce­dures. Instead of hav­ing a sin­gle phone num­ber for meet­ing par­tic­i­pants to dial in to, for exam­ple, the Metropolitan Police—which leads Britain’s nation­al coun­tert­er­ror and secu­ri­ty operations—began hold­ing con­fer­ence calls by dial­ing each indi­vid­ual sep­a­rate­ly, one after the oth­er, infu­ri­at­ing offi­cials who were left wait­ing on the line for half an hour before dis­cus­sions could start.

On September 5, 2018, Britain final­ly made its move. May told the House of Commons that the two Russian spies respon­si­ble for the Skripal poi­son­ing had been iden­ti­fied, news that, because of the tight­ened com­mu­ni­ca­tions, only a select num­ber of cab­i­net min­is­ters were even aware of. She out­lined which flight the pair had arrived on, when and how they vis­it­ed Salisbury, when they arrived at the Skripals’ house, and which flight they took back to Russia. CCTV footage was released of the two at var­i­ous stages of their trip. Traces of Novichok were even found in their shared hotel room, May said. Hours ear­li­er, the Metropolitan Police had held a “lock-in” with secu­ri­ty jour­nal­ists to brief them on the find­ings. (The Russian embassy claims the CCTV record­ings of the two Russians “only con­firm the fact of their vis­it to Salisbury and do not point at any wrong­do­ings.”)

The effect of the sur­prise infor­ma­tion bar­rage was dom­i­nance online. Only two of the 10 most viral sto­ries in the weeks fol­low­ing the announce­ment were sym­pa­thet­ic to Russia, accord­ing to NewsWhip. Finally, offi­cials recalled, it felt as though the U.K. was the aggres­sor. “This was all kept secret to put the Russians on the hop,” one told me. “Their response was all over the place from this point. It was the turn­ing point.”

Amid an appar­ent fail­ure to counter the British case, the accused hit­men appeared on Russian state media claim­ing that they had vis­it­ed Salisbury on a sight­see­ing trip. Inside the Cabinet Office in Westminster, an offi­cial said, Britain’s secu­ri­ty com­mu­ni­ca­tions team sat “glued to the tel­ly” watch­ing their claims but ulti­mate­ly decid­ed not to react—across Europe, satir­i­cal TV shows and web­sites were pick­ing up the sto­ry and mak­ing fun of it.

If September was the month Britain wrest­ed con­trol of the Skripal nar­ra­tive, October was when it rocked Russia with a sig­nif­i­cant blow of its own, one that was months in the mak­ing.

On April 10, a month after the poi­son­ing, four men arrived in the Netherlands on diplo­mat­ic pass­ports. Three days ear­li­er, Assad, a key ally of Russia, had launched a chem­i­cal-weapons attack on a sub­urb of Damascus, and the OPCW, which is based in The Hague, was tasked with inves­ti­gat­ing not only the Skripal poi­son­ing but also the Syrian chem­i­cal-weapons attack. The men, all Russian intel­li­gence offi­cers, had been assigned a hack­ing oper­a­tion in which they were to tar­get the OPCW’s net­works by sneak­ing in via Wi-Fi con­nec­tions.

From their arrival, how­ev­er, the group (sub­se­quent­ly iden­ti­fied as belong­ing to GRU Unit 26165) was being mon­i­tored by the Dutch secu­ri­ty ser­vices, and on April 13, the four were arrest­ed. Two of them had left their equip­ment in the trunk of a rental car parked out­side the OPCW’s head­quar­ters. For the Dutch, British, American, and Swiss secret services—all of which were involved in the operation—they had obtained a trea­sure trove.

The aban­doned equip­ment revealed that the GRU unit involved had sent offi­cers around the world to con­duct sim­i­lar cyber­at­tacks. They had been in Malaysia try­ing to steal infor­ma­tion about the inves­ti­ga­tion into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne, Switzerland, where a World Anti-Doping Agency (WADA) con­fer­ence was tak­ing place as Russia faced sanc­tions from the International Olympic Committee. Britain has said that the same GRU unit attempt­ed to com­pro­mise Foreign Office and Porton Down com­put­er sys­tems after the Skripal poi­son­ing.

The arrests were not imme­di­ate­ly made pub­lic, though. On October 4, the U.K. pub­lished a list of trans­gres­sions by the Russian state and specif­i­cal­ly the GRU unit that was caught. That morn­ing, the British ambas­sador to the Netherlands joined the Dutch defense min­is­ter at a press con­fer­ence in The Hague where they lift­ed the lid on the attempt­ed Russian hack of the OPCW. In the after­noon, the U.S. Department of Justice announced charges against sev­en GRU agents linked to the Dutch inves­ti­ga­tion, accus­ing them of hack­ing into WADA and the OPCW, and of cyber­at­tacks aimed at a U.S. nuclear-ener­gy facil­i­ty. Security offi­cials in London told me that every­thing was care­ful­ly coor­di­nat­ed and timed to coin­cide with the U.S. indict­ments. A joint state­ment from the British and Dutch prime min­is­ters was released to ram home the mes­sage. The Russian embassy declined to com­ment on the oper­a­tion or the U.S. indict­ment.

During the week of the OPCW press con­fer­ence just one of the top 25 most viral sto­ries was from a pro-Russian outlet—and even this was a rel­a­tive­ly straight­for­ward piece from RT. “There were some signs that we had land­ed a blow,” one senior secu­ri­ty offi­cial told me.

The OPCW was not the only tar­get on the unit’s itin­er­ary on its trip through Europe. According to the U.S. indict­ment, also in the GRU team’s pos­ses­sion on the day they were arrest­ed were train tick­ets to Basel, Switzerland. American author­i­ties allege that they would have then trav­eled onward—to Spiez.

Having been at the fore­front of the inter­na­tion­al PR bat­tle with Russia, the U.K. feels that it is now well placed for any future bat­tles. It has cre­at­ed a nation­al-secu­ri­ty com­mu­ni­ca­tions team based at the heart of gov­ern­ment in 10 Downing Street and the adjoin­ing Cabinet Office. Communications strat­e­gy is now seen as being part of nation­al-secu­ri­ty strat­e­gy.

Nina Jankowicz, a fel­low at the U.S.-based Wilson Center spe­cial­iz­ing in dis­in­for­ma­tion who has advised the Ukrainian gov­ern­ment on how to com­bat the Russian threat, told me that the U.K. effort was “leaps and bounds ahead of what we had seen before.” British offi­cials did a good job of high­light­ing “all the absurd claims” com­ing out of Russia, she said. “The fact the U.K. sys­tem was able to respond under such stress shows the sys­tem was work­ing as it should,” she added, point­ing in par­tic­u­lar to Britain lead­ing the coor­di­nat­ed expul­sion of diplo­mats. “We’ve not seen any­thing like it since the Cold War. The U.K. is fill­ing in the lead­er­ship gap where the U.S. now cannot—or will not.”

Still, if Britain won a vic­to­ry, it was tac­ti­cal, not strate­gic. Officials say the prob­lem for Western coun­tries is that while Russia might be a rel­a­tive eco­nom­ic min­now, it has con­tin­ued to fund its nation­al-secu­ri­ty state to super­pow­er lev­els while NATO has become more and more reliant on the U.S. for its defense since the end of the Cold War. Russia is also aid­ed and abet­ted by a will­ing­ness to ignore inter­na­tion­al law, norms, and conventions—and the West’s appar­ent refusal to do the same in return. (Russia’s inter­ven­tion into British pol­i­tics remains a live issue, after the U.K. gov­ern­ment refused to pub­lish a report into Moscow’s infil­tra­tion before Britain’s elec­tion this month.)

Even more fun­da­men­tal­ly, in the absence of any coor­di­nat­ed Western strat­e­gy to force­ful­ly respond to a cri­sis sparked by lim­it­ed forms of Russian aggres­sion, Moscow has been able to achieve a sig­nif­i­cant expan­sion of its influ­ence. By mov­ing quick­ly, Russia changed the rules of the game on the ground before the West could react. Whether in Syria, Crimea, or else­where, Russia has filled a vac­u­um left by American with­draw­al or indecision—in some cas­es lit­er­al­ly, by mov­ing troops to occu­py ter­ri­to­ry aban­doned by the U.S.—meaning that any sub­se­quent retal­i­a­tion from Washington comes with an even greater risk than before, lead­ing to fur­ther inac­tion. The effect, as in Syria, is to hand vic­to­ry to Russia for as long as it can sus­tain the cost of Western sanc­tions or diplo­mat­ic iso­la­tion.

A sim­i­lar sto­ry played out in Britain, where the full reac­tion to the Skripal assas­si­na­tion was slow-mov­ing, tak­ing months to play out. The cost imposed on Moscow—the loss of spies and net­works around the world, as well as the dam­age to the Russian intel­li­gence service’s rep­u­ta­tion for effi­cien­cy and skill—was seri­ous, but appears to have been absorbed. Moscow may have gone rel­a­tive­ly qui­et about Skripal (an October tweet by the Russian embassy in London link­ing to a Guardian sto­ry about Donald Trump express­ing skep­ti­cism that Moscow was behind the poi­son­ing is a rare recent inter­ven­tion), but it has not changed its behav­ior.

And yet, the West has already been show­ing signs that it wants a thaw in rela­tions. In August, the lead­ers of the world’s most pow­er­ful Western coun­tries, the G7, met in Biarritz, France, where Trump sug­gest­edthat Russia could be allowed back into the club. And he’s not alone in seek­ing to soft­en his country’s stance. The same month, French President Emmanuel Macron gave a speech say­ing that it was time for Europe to “paci­fy and clar­i­fy our rela­tions with Russia,” argu­ing that push­ing Moscow away would be a “pro­found” strate­gic error, and set­ting out oppo­si­tion to any fur­ther eco­nom­ic sanc­tions on Russia. He has since repeat­ed that mes­sage in an inter­view with The Economist and again last week in the run-up to today’s NATO sum­mit.

Those sanc­tions (which, along with Russia’s expul­sion from the G8, were the result of the country’s annex­a­tion of Crimea) hit the Russian econ­o­my, but far from stran­gled it. In 2018, Russia’s GDP grew 2.3 per­cent. While growth is pro­ject­ed to slow in 2019 and 2020, Russia’s econ­o­my is nev­er­the­less expect­ed to con­tin­ue to expand, accord­ing to the International Monetary Fund.

Since the October announce­ment, the U.K. has seen the Russian threat ease off, only for it to be replaced by oth­er for­eign-pol­i­cy pri­or­i­ties: The future of the 2015 Iranian nuclear deal is uncer­tain and Tehran is test­ing the West’s col­lec­tive patience; North Korea has resumed bal­lis­tic-mis­sile tests; and months of pro-democ­ra­cy protests in Hong Kong have raised the specter of China tak­ing more aggres­sive steps there.

But despite alleged British confidence—and clear Russian ama­teurism on occasion—it is clear that Moscow land­ed real blows in its 2018 com­mu­ni­ca­tions bat­tle with London. The U.K. was at times blind­sided, fell into traps, made mis­takes, and saw a wor­ry­ing sub­sec­tion of pub­lic opin­ion run toward con­spir­a­to­r­i­al skep­ti­cism. It is beyond doubt that Russia had some suc­cess mud­dy­ing the waters of blame through­out the sum­mer of 2018.

That may well have been enough for the GRU. With cam­paign­ing for the 2020 U.S. pres­i­den­tial elec­tion now well under way, the focus of Russian dis­in­for­ma­tion efforts might once again shift to the United States. Is it pre­pared for what is to come? What did Moscow learn from its six-month pro­pa­gan­da war with Britain?

“No mat­ter what action you take against Russian intel­li­gence ser­vices, they are going to put a mas­sive amount of resources into a diver­gence cam­paign,” said Bill Evanina, the head of coun­ter­in­tel­li­gence for the U.S. gov­ern­ment. “Vladimir Putin’s most amaz­ing trait is his abil­i­ty to deny that today is Thursday, and to con­vince peo­ple of that.”

In Spiez, they know what that is like. “These peo­ple had us in the crosshairs,” Bucher told me. Who’s next?

Mike Giglio con­tributed report­ing.

Source: Defense One

Recommended Posts

Start typing and press Enter to search