Ukraine's counterattack, wiretapping of Zelensky. What we learned from leaked Pentagon “classified documents”

What has been leaked

These are snapshots of documents supposedly prepared by US intelligence and military agencies and marked with different access classifications, including “secret”, “top secret” and “not for foreign nationals” (SECRET, TOP SECRET, NOFORN).

The documents

The leaked documents are not electronic files or scanned copies, but rather snapshots of printed presentation slides used for classified briefings. Over 50 snapshots of documents dated from February and March 2023 have surfaced on the internet. According to The New York Times, over 100 files have been leaked in total. Some media outlets claim to have obtained additional files that have not yet been released to the public.

The leaker(s)

Bellingcat, an investigative publication, has reported that the leaked files were first detected on a Discord game server in early March. The files were subsequently posted on the forum for anonymous users 4Chan before being disseminated through various platforms, including Telegram, Twitter, and eventually major news outlets. Bellingcat has also suggested that the documents, dated January 2023, may have been posted on Discord at an earlier date. The initial post containing images of four documents, which later spread to the Russian segment of Telegram, was reportedly made on April 5 by a relatively unknown channel called “Donbass Devushka.”

On the day of the initial leak, a post containing images of five documents was shared on the ZVI Poiskovik channel, which is known within the Z-media community. The channel's authors described the images as depicting “a secret plan to prepare and equip nine brigades of the Ukrainian Armed Forces (AFU) for a spring offensive by the US and NATO.” The original post was subsequently circulated among major Z-channels, leading to its wider dissemination.

The identity of the individual(s) who photographed and shared the documents remains unknown. However, the OSINT (Open-Source Intelligence) community has established that several of the photographs were taken using the same desk as background and has even identified various items visible in the frames, which could aid in further investigations.

Takeaways

Among the leaked images, some pertain to an evaluation of the military situation in key areas along the frontline between Russian and Ukrainian forces, including information on the location and makeup of the forces, as well as their relative numbers. Another portion contains a detailed analysis of the preparation and outfitting of AFU units, such as the allocation of equipment, its distribution, and the timeline for training, all of which relates to the anticipated Ukrainian offensive.

If the information from the “leaked” documents is to be believed, Ukraine's air defense system is projected to run out of anti-aircraft guided missiles for the Buk SAM system quite soon, and, by early May, for the S-300 systems as well. This means that at least 40 crucial facilities will be left unprotected.

A total of 12 AFU brigades are being trained and equipped for the counterattack, with 9 of them being prepared outside Ukraine. The equipment being transferred to the AFU includes 253 tanks, 381 tracked vehicles, 480 wheeled vehicles, 147 artillery systems, and 571 HMMWV vehicles.

The Ukrainian forces appear to be at a disadvantage in terms of numbers along the line of contact, according to the leaked documents. In the Kherson direction, the Russian forces are 6-12 times larger than the Ukrainian forces, while in the Zaporizhzhia direction they are 3-5 times larger. The Svatove-Kreminna line also sees the Russian forces outnumbering the Ukrainian forces by 4-7 times. The only area where a relative balance is observed is in the Bakhmut region. Surprisingly, the Russians are advancing in the Bakhmut area while there is a relative calm in other parts of the line of contact. However, it is noteworthy that the documents do not include the Ukrainian units of the National Guard and the Territorial Defense, which are also engaged in combat operations.

The Washington Post reports that according to one of the leaked files, prepared by U.S. intelligence, the possible outcomes of a Ukrainian offensive are assessed as extremely pessimistic due to deficiencies in the training and equipment of the AFU. The document suggests that the operation is likely to result in only “minor territorial gains.”

At the same time, the Americans have a rather sarcastic outlook on the prospects of a further Russian offensive towards Bakhmut. They base their forecast on the slow progress made by the Wagner PMC in the operational area, which has been advancing at a rate of only 2.7 km per month from July 2022 to January 2023. Based on this rate of advancement, the documents suggest that it would take the vanguard units of the Wagner PMC about 11 months to reach Kramatorsk, which would be around early 2024.

The documents contain curious details about an incident in September 2022, where two Russian Su-27 fighter jets intercepted a British RC-135 reconnaissance aircraft over the Black Sea. Reportedly, one of the fighter jets flew within 5 meters of the RC-135, while the other fired a missile at it from a distance.

According to one intelligence report, the Russian General Staff has developed plans to counter Western tanks that may be deployed during a potential counterattack. The report also includes a list of targets in Ukraine, including military facilities, bridges, and power plants, to be hit by missiles and kamikaze drones. Interestingly, the report also shows a similar level of knowledge about the plans of Ukrainian President Zelensky and the AFU command, which suggests that they may have been obtained through wiretapping.

A significant portion of the leaked information does not pertain to the war in Ukraine, but instead contains sensitive information that was previously unknown. It includes reports attributed to the CIA that provide details about various regions and issues around the world. We have learned of the following, among other things:

• An attempt by the Wagner PMC to buy weapons in Turkey for operations in Africa and Ukraine by going through Mali;
• Concerns of the Ivorian authorities about the potential destabilization of their country as a result of the Wagner PMC's actions in Mali and Burkina Faso;
• The Wagner PMC's contacts with the Haitian government regarding possible contracts to combat local organized crime;
• An operation carried out by the FSB-linked hacker group Zarya against Canada's gas infrastructure, as a result of which hackers gained control of gas distribution station automatics and the ability to disable them;
• Calls by the leadership of the Israel's Mossad for their employees and Israeli citizens to participate in protests against the judicial reform initiated by the Netanyahu government;
• The Republic of Korea's hesitant response to the U.S. request to supply artillery munitions to Ukraine;
• Egyptian President Al-Sisi's plans to secretly supply munitions to Russia;
• Alleged intentions of Nikolai Patrushev, Russia's Security Council Secretary, and Valery Gerasimov, commander of the so-called SMO and head of the General Staff, to sabotage the Russian offensive by taking advantage of President Vladimir Putin's chemotherapy course scheduled for early March.

To be fair, the latter is stated with reference to Verkhovna Rada deputy Elizaveta Bogutskaya, which raises huge doubts about the reliability of this information, given her earlier statements.

Is it accurate?

It is certain that certain snapshots that have been circulating widely on the internet are intentionally falsified. For instance, the Poiskovik ZVI posts contain a photoshopped representation of the losses of the Russian Armed Forces and the AFU, with the figures indicating 16,000-17,500 killed by the Russians and 61,000-71,500 killed by the Ukrainians. In the original photo, the AFU's losses are 16,000-17,500, while the losses of the Russian Armed Forces are 35,500-43,500.

According to some pro-Russian Telegram channels, the documents have been leaked on purpose. For instance, the Military Chronicle channel, with over 250,000 subscribers, claims that the location of Russian units and formations appears to be based on publicly available sources, the data on the 0% readiness of several AFU units is not credible, and the distribution of heavy equipment seems unusual. The Military Chronicle suggests that “the document which purports to be a secret plan” is a part of a disinformation campaign aimed at downplaying the actual number of combat-ready AFU formations deployed for an offensive.

The Military Chronicle also notes the information regarding the shortage of Soviet-made anti-aircraft guided missiles for air defense systems and Western-made IRIS-T and NASAMS air defense systems. They specifically point out the name “NASAMS” misspelled as “NASAM” and the odd mixture of NATO and Russian designations for these weapons and military equipment. For example, the document uses the transliteration from Russian “S-300/BUK” instead of the NATO designations of SA-10/SA-11.

According to the investigative resource Molfar, Ukrainians have also expressed doubts about the authenticity of the documents. Molfar considers the documents to be a “fake” because they estimate the loss of weapons and military equipment in a similar manner to the data available on the open-source intelligence resource Oryx. Additionally, the documents contain errors in date formats and measurement units, while the leak itself was “boosted” by pro-Russian Telegram channels.

At the same time, the Conflict Intelligence Team (CIT) analysts, while commenting on the original version of the “leaked classified Pentagon document” (in quotation marks), which contains the assessment of losses of the AFU and the RF Armed Forces, called it “plausible” and “similar” to a summary for the U.S. Joint Chiefs of Staff. In its recent report, the CIT, dropping the quotes, recounts some of the stories that have become known from the files themselves and have been reported in major Western media outlets.

Response

According to CNN, the U.S. Departments of Justice and Defense have initiated a formal investigation into the leak, but the full extent of the leak and its impact is still being assessed by the Pentagon. U.S. officials reportedly claim that the leak has compromised important sources of information and damaged relationships with key allies such as the Republic of Korea, Israel, and Ukraine.

Mykhailo Podolyak, advisor to the Ukrainian President's Office, wrote on Telegram that the documents were fabricated by Russian special services. Nevertheless, CNN points out, citing a source close to President Zelensky, that the AFU changed its military plans because of the leak.

Dmitry Peskov, the press secretary for the Russian President, stated that the leaked documents illustrate the level of involvement of the United States and NATO in the events in Ukraine.

Bottom line

It is unclear whether the release of classified US intelligence information was an accidental “leak,” an intentional disinformation operation, or a combination of both, potentially involving authentic information mixed with falsifications. Regardless, this is the largest incident of its kind during the entire conflict in Ukraine, and it is likely that much of the information is authentic. According to The Economist, this may be the most significant breach of information security in a decade.

Bellingcat correctly points out that much of the information in the documents had already been reported in open sources. However, the way the data was compiled provides insight into the US perspective on the military situation in Ukraine, which is asymmetrical, with less detailed or intentionally hidden information about the Ukrainian Armed Forces. This suggests a level of distrust towards the Zelensky administration as an official partner. Additionally, the documents suggest that the U.S. has sources of information within the Russian Ministry of Defense and/or General Staff.