{"id":10899,"date":"2021-09-23T10:05:34","date_gmt":"2021-09-23T10:05:34","guid":{"rendered":"https:\/\/dfcme.me\/russian-intelligence-services\/"},"modified":"2022-10-22T18:21:41","modified_gmt":"2022-10-22T16:21:41","slug":"russian-intelligence-services","status":"publish","type":"post","link":"https:\/\/dfc.me\/en\/russian-intelligence-services\/","title":{"rendered":"Russian Intelligence Services"},"content":{"rendered":"\n

Structural reshaping of the international order upon the end of the Cold War caused a redefinition of the Russian Federation’s political position in the new constellation of power and, in a long-term perspective, initiated a revision of the state approach to the Russian foreign policy concept. Feeling of historic humiliation with the events from the end of 20th<\/sup> century, feeling of endangerment caused by the NATO enlargement on the East, together with the exclusion from the post-Cold War European security architecture, incited Russian authorities to opt for the open confrontation with the (pro)Western countries, rather than the peaceful coexistence<\/em>.<\/p>\n\n\n\n

Such an approach to the foreign policy requested defining the new hybrid operation strategy (war) where the borders between the levels of war became blurred. However, its actors remained the same \u2013 Russian intelligence services. <\/p>\n\n\n\n

The intelligence system of the Russian Federation, mostly inherited from the former state system and burdened by the complex organizational reforms, managed to consolidate and grew into the strong system, which, together with the Russian Orthodox Church, media and organizations would become one of the major pillars of the modern Russian foreign policy.<\/p>\n\n\n\n

For years, Russia did not hesitate to use intelligence agencies as an important foreign policy and hybrid operation tool, while affirming the subversive actions as a means to reach its geopolitical goals. Therefore, the intelligence services of the Russian Federation undoubtedly have an important role to renew Russian global influence and strengthen the Russian state. The political appointments of the former members of the intelligence-security system confirm these claims.<\/p>\n\n\n\n

Since the annexation of Crimea in 2014, the subject of Russian intelligence services whose operations are directed abroad, became global. In this context, two institutions stand out \u2013 Foreign Intelligence Service and Military Intelligence Service.<\/p>\n\n\n\n

Foreign Intelligence Service or SVR<\/span> <\/strong>(\u0421\u043b\u0443\u0436\u0431\u0430 \u0432\u043de\u0448\u043d\u0435\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 –<\/em> \u0421\u0412\u0420) <\/strong><\/em>was founded in 1991 by President Yeltsin’s decree, as one of the Soviet KGB’s successors. The legal foundation of the SVR is the Constitution of the Russian Federation, federal and other acts that regulate the work of the federal services. The goals of the intelligence operations of this and other services are stipulated by the Federal Law on Foreign Intelligence (\u0424\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0439 \u0437\u0430\u043a\u043e\u043d “\u041e \u0432\u043d\u0435\u0448\u043d\u0435\u0439 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0435”)<\/em> from 1995. According to the Law, the SVR collects and processes the intelligence information on the Russian Federation’s vital interests being threatened (by the states, organizations, and individuals). The main domains of the service are: political, economic, military-strategic, scientific-technological, and ecological, while the greatest part of the resources is used for foreign policy intelligence work. The Service also represents the evaluative and political force that contributes to the creation of the Russian foreign policy. Its headquarters is in Moscow while its residencies are located in the Russian diplomatic-consular and commerce offices all around the world.<\/p>\n\n\n\n

Military Intelligence Service<\/span><\/strong> or <\/span>GRU<\/span><\/strong> (\u0413\u043b\u0430\u0301\u0432\u043d\u043e\u0435 \u0440\u0430\u0437\u0432\u0435\u0301\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u0301\u043d\u0438\u0435<\/em> \u2013 \u0413\u0420\u0423<\/em>, or \u0413\u043b\u0430\u0301\u0432\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u0301\u043d\u0438\u0435 \u2013 \u0413\u0423) <\/em>was founded in 1921 and represents a strong professional military intelligence organization that performs within the General Staff of the Armed Forces of the Russian Federation. Its legal foundation is also composed of the Constitution, Law on Foreign Intelligence, and other legal and strategic documents of the Russian Federation. The GRU is responsible for the collection of intelligence data referring to the foreign military potentials and military plans of the foreign countries directed towards the Russian Federation. Collecting intelligence data is performed by using electronic systems, observing and investigating the activities of the armed forces of the countries from the immediate environment, observation satellite systems, and applying human intelligence. Generally, the activities and tasks of this service may be classified into two elementary groups: counter-terrorist activities and espionage. Central and Eastern Europe are the main areas of GRU operations.<\/p>\n\n\n\n

The Federal Security Service or FSB<\/span><\/strong> (\u0424\u0435\u0434\u0435\u0440\u0430\u043b\u044c\u043d\u0430\u044f \u0441\u043b\u0443\u0436\u0431\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 – \u0424\u0421\u0411), <\/em>formerly (1994-1995) Federal Counterintelligence Service is a Russian service for the interior security and counterintelligence affairs, founded in 1994 as one of the KGB successors from the Soviet era. It is responsible for the counterintelligence services, anti-terrorism, and supervision of the Army. The FSB is located in the former KGB headquarters on the Lubyanka Square in Moscow. In 1998, Boris Yeltsin<\/span><\/strong> appointed Vladimir Putin for an FSB director, a former KGB veteran who later succeeded Yeltsin as Federal President. Yeltsin also ordered FSB to extend its operations against trade unions in Siberia and fight the right dissidents. As a president, Putin increased the authority of the FSB by including countering the foreign intelligence operations, fighting against organized crime, and suppressing the Chechen separatists in their scope of work. The FSB is the largest security service in Europe and is exceptionally successful in counter-intelligence activities. Even though particular limitations over the FSB activities within the country have been imposed (such as reduced spying on religious institutions and charitable organizations), the FSB as well as other Russian intelligence services is subject to a smaller control of legislation or judiciary.<\/p>\n\n\n

Operations of the Services as a Foreign Policy Tool<\/span><\/h3>\n\n\n

The doctrine of the contemporary Russian activity is attributed to Valery Gerasimov<\/span><\/strong>, Chief of the General Staff of the Armed Forces of Russia, who published the article titled The value of science in prediction <\/em>in February 2013. The article is considered the most useful articulation of the contemporary Russian strategy. It offers a new theory of modern warfare, representing a combination of the Soviet psychological tactics and strategic military thinking on total war, reminding more of the hostile countries\u2019 hacking, rather than an open, frontal attack (usage of hackers, media instrumentalization, fake news creation, information leak, presence of the businessmen, together with the conventional and asymmetric military tools). The following is written<\/span><\/strong><\/a> in the article: The very \u2018rules of war\u2019 have changed. The role of nonmilitary means of achieving political and strategic goals has grown, and, in many cases, they have exceeded the power of force of weapons in their effectiveness. (\u2026) All this is supplemented by military means of a concealed character.<\/em><\/p>\n\n\n\n

In March 2016, Gerasimov stated that each government ministry, not just the Ministry of Defence, needs to be capable to support hybrid warfare, and that \u201cfalsification of events [and] restriction of activity of mass media\u2026 can be comparable to the results of large-scale use of troops and forces.<\/em><\/p>\n\n\n\n

The application of Gerasimov\u2019s doctrine can best be analyzed on the example of the European countries, with some of them being NATO member countries. In just a couple of months in 2021, it was more than obvious that Moscow did not sit idly. In that period, four GRU actions on the territory of Europe and NATO members (Bulgaria, Czech Republic, Italy, and Germany) were revealed. Russia has been performing actions against the USA and its partners and allies for years, through the services and organizations controlled by the Kremlin. The examples include military support to the separatist republics in the East of Ukraine, a coup attempt and cyber operations in Montenegro as well as the campaigns of influencing in the USA during the presidential election in 2016 and 2020. Electoral interference in France 2017, poisoning of a Russian-British double agent Sergei Skripal in Great Britain in 2018, the hacking attempt of the Organisation for the Prohibition of Chemical Weapons (OPCW) in Hague also in 2018, and many attempts of direct interference into electoral processes in other countries clearly indicate the reach of Russian foreign policy implemented through the secret services.<\/p>\n\n\n\n

Response to such actions usually came down to the expulsion of Russian diplomats and imposing of economic sanctions, which additionally became meaningless with lack of continuity and cohesion between the Western countries and allies. <\/p>\n\n\n\n

Annual reports of the State Department, the EU, and NGOs all around Europe indicate the wide spectrum of techniques that Russia is using to exert its political influence through its power leverages (including SVR and GRU), and offer particular details on the implementation of these activities that are believed to aim at changing European politics and decision making, and therefore \u2013 weakening of NATO and the EU. <\/p>\n\n\n\n

For numerous mentioned reasons, the Western Balkans represents a fertile ground for the implementation of the Russian strategy, since it is very important due to its geographic position. <\/p>\n\n\n

Services in the Field<\/span><\/h3>\n\n\n

For a long time, Russian intelligence services in the region have been engaged in the local propaganda offensives in the media, online and on social media, but also in the field, in order to strengthen the Russian prestige and influence but also to undermine the credibility of the state institutions. The operations performed in this forever-turbulent area have been conceived in order to attract Eurosceptic, anti-American, and ultraconservative social subjects and individuals, to whom Russia is presented as a defender of traditional values and Orthodoxy. <\/p>\n\n\n\n

Moscow openly threatened<\/span><\/strong><\/a> to Montenegro and NATO alliance on several occasions. In December 2015, the Kremlin spokesman Dmitry Peskov<\/span><\/strong> threatened that Russia would know how to fight back if Montenegro joins NATO, and the Russian Parliament threatened to freeze<\/em> all projects with Montenegro. Ignoring these Russian warnings, the then Prime Minister of Montenegro Milo Djukanovic signed in May 2016 the NATO accession protocol, permanently depriving Russia of the only potential ally with maritime access to the Mediterranean. In June 2016, spokeswoman of the Ministry of Foreign Affairs Maria Zakharova stated<\/span><\/strong><\/a> that the then-Montenegrin government would be completely accountable for the anti-Russian stance that it allegedly took.<\/p>\n\n\n\n

The goal of the coup attempt was primarily to stop Montenegro\u2019s accession to NATO but also to install the new government in Montenegro, the one that would be led by the pro-Russian Democratic Front. In May 2019, the High Court in Podgorica sentenced<\/span><\/strong> <\/a>two Russian citizens Eduard Shishmakov<\/span><\/strong> and Vladimir Popov<\/span><\/strong> to 15 and 12 years in prison. The Democratic Front leaders Andrija Mandic and Milan Knezevic were sentenced to five years in prison respectively, while the former Serbian police general Bratislav Dikic<\/span><\/strong> was sentenced to eight years in prison. Predrag Bogicevic<\/span><\/strong> and Nemanja Ristic<\/span><\/strong>, members of the extreme right-wing organizations from Serbia, who were unavailable to the Montenegrin judiciary, were sentenced to 7 years of prison respectively. The driver of the Democratic Front Mihajlo Cadjenovic<\/span><\/strong> was sentenced to one year and six months in prison, Branka Milic<\/span><\/strong>, the citizen of Serbia who escaped to the Serbian Embassy in Podgorica before the very end of the trial was sentenced to three years in prison, Serbian citizen Milan Dusic<\/span><\/strong> was sentenced to one year and a half, Dragan Maksic<\/span><\/strong> to one year and nine months, Srboljub Djordjevic<\/span><\/strong> to one year and a half and Kristina Hristic<\/span><\/strong> got suspended sentence.<\/p>\n\n\n\n

In February 2021, the Appellate Court of Montenegro abolished the first-instance verdict since, during the procedure, the violation of the criminal procedure provisions was made. . Retrial for attempted terrorism on the parliamentary Election Day in 2016 in Montenegro, which was supposed to start on May 31, was postponed for October 19 due to the strike of Montenegrin lawyers. <\/p>\n\n\n\n

Eduard Shishmakov was traveling to Serbia with a Russian passport under the name of Eduard Shirokov. Under this name, Montenegro issued a red notice through Interpol on February 19, 2017. Montenegrin Special State Prosecutor Milivoje Katnic<\/span><\/strong> said that Shirokov\u2019s real name was Shishmakov, which was revealed thanks to the tip from the Polish partner services<\/p>\n\n\n\n

\"\"
Passports of a Russian intelligence officer suspected of participating in the attempted coup in 2016<\/figcaption><\/figure>\n\n\n\n

Since 2013, Shishmakov was a naval attach\u00e9 in the Russian Embassy in Warsaw. As the most prominent investigative media Bellingcat reveals, Shishmakov took part in the high-level security meeting with the Polish Security Council on January 24, 2014. On the Russian part, the meeting was attended by Deputy Secretary of the Security Council Evgeny Lukyanov<\/span><\/strong> (Deputy of Nikolai Patrushev), as well as the Head of Center for Defense of the Russian Institute for Strategic Studies of the Kremlin<\/em>, Grigory Tishchenko<\/span><\/strong>. In November 2014, Polish media reported that the Russian diplomat was declared persona non grata and expulsed. In March 2017, Polish authorities confirmed<\/span><\/strong> <\/a>to Sky News<\/em> that the diplomat was Eduard Shishmakov. His residential address is in Sankt Peterburg, and according to Bellingact<\/em>, the address belongs to a corporate residential complex owned by GRU.<\/p>\n\n\n\n

\"\"
GRU residential complex where Shishmakov officially resides<\/figcaption><\/figure>\n\n\n\n

Vladimir Popov is another GRU agent who was sentenced to 12 years in prison upon the first instance verdict. Bellingcat<\/em> and Insider<\/em> managed to reveal the true identity of Popov \u2013 Vladimir<\/strong> Nikolaevich Moiseyev<\/strong><\/span>. Moiseyev, a lieutenant colonel or colonel (Belingcat<\/em> could not claim for sure) in the Russian intelligence service, was born on June 29, 1980, the same day as the made-up Popov<\/span><\/strong><\/a>. Bellingcat<\/em> states that in 2009, Moiseyev was given a new identity under the name of Vladimir Popov.<\/p>\n\n\n\n

\"\"
Russian intelligence officer on the Interpol red notice<\/figcaption><\/figure>\n\n\n\n

Just like his colleagues from the GRU Chepiga and Mishkin, who are suspected of poisoning a Russian-British double agent Sergei Skripal and his daughter in Great Britain with a nerve agent, Moiseev has two parallel identities in the Russian databases\u2013 Vladimir Moiseyev and Vladimir Popov. Also, in March 2015, Moiseyev was given an apartment in the same residential building where Mishkin obtained it a couple of months ago. Just like in the case of Mishkin, the apartment is registered in the name of Moiseyev\u2019s wife and children while the GRU agent\u2019s name was not stated in the document on the property. Popov was employed as a photo correspondent<\/em> and journalist<\/em> who worked for the magazine and used this identity to travel around Europe between 2012 and 2016. Claiming to be a Morskoye Strakhovanie <\/em>journalist, Popov traveled to Serbia in October 2016. A couple of days before the parliamentary election in Montenegro, Popov, and Shishmakov met in Belgrade, which is visible in the surveillance camera footage<\/span><\/strong><\/a>.<\/p>\n\n\n\n

\"\"
Eduard Shishmakov and Vladimir Moiseyev in Belgrade<\/figcaption><\/figure>\n\n\n\n

Secretary of the Security Council of the Russian Federation Nikolai Patrushev traveled to Belgrade on October 26, 2016, for the previously scheduled visit. At the beginning of November, the Guardian<\/em> quoted a source close to the Serbian government who said that Patrushev had apologized to the Serbian authorities for, as he described, rogue operation<\/em>. Russia later publicly denied these claims and characterized them as a provocation.<\/em><\/p>\n\n\n\n

Patrushev has a significant role in the creation of Russian politics towards the Balkans. In the period until 2015, Moscow lacked a central authority figure that would significantly contribute to the implementation of the Russian goals in the Balkans. Patrushev, former Director of the Russian Federal Security Service, a close associate to Putin, known for his aggressive and strong stances, was a perfect person to assume that role. As a result, Putin appointed him the key person of the Kremlin for the Balkans at the end of 2015 or 2016 (depending on the source). Patrushev is accused of taking part in the organization of the coup d\u2019\u00e9tat<\/span><\/strong><\/a> in Montenegro. Besides, he was ardently advocating for the construction of the Serbian-Russian Humanitarian Centre <\/em>in Nis, considered a cover-up for military-intelligence operations in Serbia and the region. What particularly instigated claims that it is a Center that Russian intelligence services operate from, is the fact that the official Moscow, on several occasions, sought from Serbia to delegate special status to the Russian staff employed in the Center, through the Agreement on terms and conditions of the residence, privileges, and immunity of the staff. The first Russian intelligence officer, Director of the Foreign Intelligence Service, Sergey Naryshkin, said in an interview given to RTS<\/em> that delegating diplomatic status to the Serbian-Russian Humanitarian Center<\/em> in Nis was not a request but an appeal to Serbia and that it had not been done so far due to the pressure of particular Western countries.<\/p>\n\n\n

Cyberspace<\/span><\/h3>\n\n\n

Russian activities in cyberspace represent an integral part of the comprehensive framework of hybrid warfare, derived from the Russian understanding of soft power<\/em> and relations among countries, more precisely, the zero-sum game<\/em> of the great powers for the influence in the world. Just like other aspects of the Russian soft power<\/em>, the Kremlin perceives cyberspace in a geopolitical sense.<\/p>\n\n\n\n

Interference in the U.S. presidential elections in 2016 is the most documented case demonstrating the Russian modus operandi<\/em>. This interference included the attacks on the U.S. election infrastructure, collecting, and intentional data leaking of the Democratic Congressional Campaign Committee <\/em>and Democratic National Committee, <\/em>including the emails of Hilary Clinton<\/span><\/strong>, together with the extensive information campaign conducted by the Russian troll factory \u2013 Internet Research Agency (\u0410\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0439<\/em>) \u2013 and related Russian media.<\/p>\n\n\n\n

The actors participating in the Russian cyber activities include both state actors, with a significant role of the intelligence community, and non-state proxies. Aside from the GRU 74455 and 54777 Units, from Montenegro\u2019s perspective, the 26165 Unit is the most relevant, which is behind the activities of the APT28 group (Advanced Persistent Threat 28) <\/em>also known as Fancy Bear. <\/em>Both the investigation<\/span><\/strong><\/a> of the U.S. Special Counsel Robert Mueller<\/span><\/strong> on the possible coordination between Russia and the presidential campaign of Donald Trump and the EU officials<\/a> identified<\/span><\/strong> <\/a>APT28 as a GRU 26165 Unit. APT28 uses sophisticated tools around the world, targeting Kremlin opponents. Even though the security companies such as ESET and FireEye <\/em>have been identifying the activities of this group since 2004, these attacks have become more intense since 2014.<\/p>\n\n\n\n

So far, the Russian activities in Ukraine have been the most complex and the clearest example of the Russian means and methods. Since Euromaidan in 2013 and the Crimea annexation the year after, Ukraine has been the testing ground for many Russian cyber capabilities. Ukraine has also fallen victim to distracting cyber-attacks on its electric energy infrastructure, which caused a power outage for a great part of the population in 2015 and 2016. Another attack on Ukrainian infrastructure occurred in June 2017 when the Ukrainian financial system was broken into; the data from the computers of banks, energy companies, high officials, and airports were deleted<\/p>\n\n\n\n

\"\"
The role of the Russian intelligence services in cyber operations<\/figcaption><\/figure>\n\n\n\n

Georgia is one of the first examples where the military and cyber operations and attacks were simultaneously used when it lost almost 1\/5 of its territory in the 2008 war. The newer example is a massive cyber-attack on Georgia in October 2019, which illustrates the sophistication of Russia\u2019s approach. The attack damaged servers in offices of the Georgian President, judicial system, municipalities, government, and non-government organizations, blocked sites, and disrupted TV stations\u2019 broadcasting. In the Western Balkans, Russian cyber operations were used as an integral part of greater campaigns to obstruct the NATO enlargement process. <\/p>\n\n\n\n

It was revealed that the APT28 was also responsible for attacks on German Bundestag<\/span><\/strong> <\/a>in 2015, French television TV5 Monde<\/span><\/strong><\/a><\/em>, attempted attack on the Organisation<\/span><\/strong> <\/a>for the Prohibition of Chemical Weapons<\/em> (OPCW), Winter Olympic Games<\/span><\/strong><\/a> in Pyongyang in 2018, and Romania<\/span><\/strong> <\/a>in 2017, as well as for numerous operations in Montenegro since 2016.<\/p>\n\n\n

Russian Cyber-operations in Montenegro<\/span><\/strong><\/h3>\n\n\n

Along with Northern Macedonia , Montenegro is the most significant target of cyber-attacks and espionage with Russian signature. These activities became particularly prominent during 2016 and 2017. <\/p>\n\n\n\n

In the period of NATO accession finalization, which coincided with the parliamentary election in October 2016, Russia became significantly active and intensified its presence through disinformation campaigns of the Russian media, embargo on Plantaze<\/em> wine and other products, coup attempt, and the GRU cyber-attacks, i.e., their APT28 group.<\/p>\n\n\n\n

On the parliamentary Election Day in October 2016, Montenegro faced frequent DDoS attacks that targeted the sites of public institutions, pro-NATO and pro-EU parties\u2019 web pages, pages of civil society, and election observers. Due to these efforts, the sites of news portals CdM, Antena M<\/em>, and the Democratic Party of Socialists, inter alia, were taken down. The site of the Center for Democratic Transition (CDT)<\/em>, which monitored the election, could have not been accessed<\/span><\/strong> <\/a>as well.<\/p>\n\n\n\n

Besides DDoS attacks, the citizens were spammed by numerous anti-Government messages on the same day. They were coming from unknown numbers via Viber, Facebook, and WhatsApp. The Agency for Electronic Communications and Postal Services of Montenegro ordered a ban on these applications and similar communication services, which has been addressed to all telecommunication operators in Montenegro during that day. The operators were obliged to implement the measure in accordance with the Law on Electronic Communications, which stipulates that communication for the purpose of direct marketing is not allowed unless the user previously agreed to it. The act of blocking these platforms for several hours was condemned by the public, numerous local and international organizations, including the Reporters Without Borders<\/em><\/p>\n\n\n\n

Facebook stated that this company was familiar with the disruption that affected the access to it in Montenegro, which occurred in October 2016 during the election. Four days after the election, on October 20, 2016, another phishing attack on the Parliament of Montenegro occurred; the group Fancy Bear<\/span><\/strong><\/a><\/em> probably was behind it again.<\/p>\n\n\n\n

More intensive DDoS attacks (than those on the elections) occurred in January, February, and June 2017, disrupting the web services of the Government and state institutions, as well as some pro-Government media. Montenegrin Ministry of Defence also reported that they were the target of phishing attacks through e-mails that seemed to have been sent from the EU and NATO with attachments and provide hackers with an opportunity to install the malware Gamefish<\/em> to the computers of the Ministry of Defence, which is a method that the APT28 uses. Gamefish<\/em> is a Trojan <\/em>that offers to a hacker good access to the targeted computer, including the exfiltration of data, access to the logs, and other surveillance options. <\/p>\n\n\n\n

The Government stated back then that the scope and diversity of attacks, but also the fact that they were performed at the professional level, pointed out synchronized action<\/span><\/strong><\/a>. Three cyber security companies \u2013 FireEye<\/em>, Trend Micro,<\/em> and ESET <\/em>concluded that the attacks came from APT28. The U.S. intelligence data additionally indicate that the group had connections with the Russian military intelligence service GRU and was financed by the Kremlin<\/span><\/strong><\/a>. After many attacks at the beginning of 2017, Montenegro sought help from NATO and the U.K., which helped to successfully stop two attacks at the end of the same year. <\/a><\/p>\n\n\n\n

Analysis of the cyber threats to Montenegro published by the Ministry of Public Administration and presented in the Cyber Security Strategy <\/a>of Montenegro 2018 \u2013 2021<\/strong><\/span><\/em>, pointed out that the number of cyber-attacks rose in 2017, or, that it coincided with the final phase of Montenegro\u2019s accession to NATO, which certainly does not imply that all of them were from Russia. During the first nine months of 2017, there were 385 reported incidents out of which 335 concerned malware and attacks on sites and state institutions. In comparison, there were only 22 attacks in 2013.<\/p>\n\n\n\n

Since the attacks have become more frequent, Montenegro tightened defense measures and formed 31 local teams, in charge of cooperating with the members of the national Computer Incident Response Team (CIRT), <\/em>concerning the protection from computer security incidents online.<\/p>\n\n\n\n

CIRT said for the DFC that the number of attacks rose in comparison to 2017 but they are becoming more and more sophisticated, therefore, it is very difficult to trace perpetrators. CIRT worked on the investigation of DDoS attacks that occurred in 2016 and 2017, however, it could not determine for sure the accountability of any hacker group (contrary to the mentioned cyber security companies), during, and shortly after the attacks, since they were very complex, unlike the regular DDoS attacks. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Due to the previous events, at the beginning of October 2019, members of the U.S. Cyber Command arrived in Podgorica at the invitation of the Government of Montenegro in order to investigate the signs of Russian penetrating the networks of the Montenegrin government, but also to have an insight into the adversary cyber threats before the then-upcoming 2020 U.S. and Montenegrin election.<\/p>\n\n\n

GRU Online Operations in Montenegro<\/span><\/h3>\n\n\n

Online operations are focused on the creation of fake media websites, bot accounts, and distribution of propaganda content harmonized with the official state narrative and goals, and they represent a par excellence example of the Russian modus operandi.<\/p>\n\n\n\n

Among the data that Facebook submitted to the U.S. Senate Select Committee on Intelligence (SSCI) in 2019, there are clear and precise indicators and proofs of the ways that GRU and their APT28 used between 2014 and 2019 in order to create think tanks, alternative media, and avatar accounts on various social media in many countries, including Montenegro. This demonstrated that Russia had had an active role in the 2016 Montenegrin election and its attempted sabotage.<\/p>\n\n\n\n

Modus operandi was simple \u2013 anti-NATO and anti-Western content from the GRU-created alternative media was supposed to be spread as much as possible, using fake Facebook, Twitter, and even Medium accounts, using adequate hashtags related to the Montenegrin elections and NATO accession, such as #NeUNato, #STOPMILO, etc.<\/p>\n\n\n

Crna Gora News Agency<\/span><\/strong><\/h3>\n\n\n

Out of 33 Facebook pages (all of them were deleted in 2018 in accordance with the Facebook inauthentic behavior policy) that were delivered to the U.S. Board, one of the fake media Crna Gora News Agency<\/em> particularly stands out. CGNA’s Facebook page contained 1,530 posts. The page shared the content in Montenegrin (around 90% of the posts) and English (around 10%) with three related sites \u2013 cgna.info<\/em> (does not exist), crnagoranevs.vordpress.com<\/em> (does not exist), and cgna.me<\/em> (in the moment of writing \u2013 porn site). The articles usually aimed at discrediting President Milo Djukanovic and NATO, and represented another step forward in the Russian aggressive media campaign.<\/p>\n\n\n\n

\"\"
Home page of Crna Gora News Agency (CGNA)<\/figcaption><\/figure>\n\n\n\n

Russian and pro-Russian Bulgarian media frequently republished the articles from CGNA, such as fake news on the European Commission\u2019s fears that the electoral fraud <\/em>would occur in Montenegro in 2016, which was another attempt of discrediting.<\/p>\n\n\n\n

\"\"
Russian media using CGNA as a source<\/figcaption><\/figure>\n\n\n\n

Besides mentioned topics, this fake Russian medium and Facebook page shared<\/span><\/strong> <\/a>stories about Syria and supported Assad in its reporting (which coincides with the Russian official attitudes), followed by the anti-Hillary articles and numerous conspiracy theories.<\/p>\n\n\n\n

The archived version<\/span><\/strong><\/a> of the CGNA website reads that Crna Gora News Agency is the first syndicated multimedia news service and strives to be the source of reliable and credible news on government, politics, economy, markets, business, sports, and lifestyle<\/em>. The unclear and linguistically disputable structure of the sentences implies that the persons editing the content of the portal were not native speakers.<\/p>\n\n\n

Avatar accounts<\/span><\/strong><\/h3>\n\n\n

Besides pages, fake accounts of non-existing persons were created in order to make additional content and distribute the existing one on social media. <\/p>\n\n\n\n

All fake accounts had particular similarities \u2013 they all claimed to be either independent and free journalists or students of postgraduate studies and published articles in the right-wing blogs\/media that do not exist today such as Inside Syria Media Center<\/em> (ISMC), The Informer,<\/em> and Crna Gora News Agency<\/em>. Likewise, many of them only published on one topic and had only one photo taken from the Russian VKontakte social media.<\/p>\n\n\n\n

One of the important accounts in the context of Montenegro is Milko Pejovic<\/span><\/strong>, which was one of the few that shared the CGNA content, and one of five that followed the CGNA Medium<\/em> page. On his Medium<\/em> page, it is stated that he allegedly studied at the Faculty of Political Science in Podgorica. He published the articles about Montenegro on the pro-Russian site Globalresearch<\/em>.<\/p>\n\n\n\n

\"\"
Medium account of Milko Pejovic<\/figcaption><\/figure>\n\n\n\n
\"\"
Milko Pejovic\u2019s account being removed from Medium <\/figcaption><\/figure>\n\n\n\n

Jelena Rakocevic<\/span><\/strong> is also one of the few who published the CGNA posts and wrote articles for the alternative media that do not exist today, while she used the stolen photo of a real person from the VK network. In September and October 2016, she was very active on the site Forum-CG<\/em> with the Russian domain (http:\/\/www.forum-cg.ru\/=<\/strong><\/span><\/a>) where she only shared the CGNA content with hashtags #STOPMILO, #NEURAT, and #STOPNATO, and afterward, she completely stopped posting.<\/p>\n\n\n\n

\"\"
Photo of Jelena Rakocevic taken from VK<\/figcaption><\/figure>\n\n\n\n

Also, there were Twitter accounts promoting the CGNA and anti-NATO content, created in 2016, and two of them, @lekovic_mont and @MilkoPejovic, stood out. <\/p>\n\n\n\n

\"\"
Twitter account @lekovic_mont being suspended <\/figcaption><\/figure>\n\n\n\n
\"\"
Twitter account of Milko Pejovic being suspended <\/figcaption><\/figure>\n\n\n\n

Milko Pejovic shared links for votemontenegro.eu <\/em>platform created by Marko Milacic\u2019s Movement for Neutrality<\/em> where the citizens were able to vote online, using their Facebook profiles. In this case, it is indicative that the News Front<\/em>, an FSB medium, shared<\/span><\/strong> <\/a>posts and information on the referendum, presenting Marko Milacic as a courageous and brave guy whom the voters trust.<\/em><\/p>\n\n\n\n

\"\"
Sharing of the votemontenegro.eu platform<\/figcaption><\/figure>\n\n\n\n

The other account frequently posted #NEUNATO, #ANTINATO, and #STOPMILO posts. After Facebook had recognized inauthentic behavior on their accounts on the platform, the accounts were deleted, and Twitter soon did the same.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"
Some of the suspended accounts from the fake accounts network<\/figcaption><\/figure>\n\n\n\n

Crna Gora News Agency <\/em>and a joined network of fake accounts offer another view on the way that Russia updates and uses its influence mechanisms in the digital era. These data reveal the GRU’s attempts to insert Russian narratives in the Montenegrin media environment, even though their reach was very limited.<\/p>\n\n\n

Established Russian Media at the Disposal of the Services<\/span> <\/strong><\/h3>\n\n\n

One of the channels used for spreading the Russian influence is the media that operate together with the services. Russian security services actively operate through the media, and they are no strangers to the creation of media outlets in order to spread the Russian narratives. The FSB, the GRU, and the SVR all manage the media network that made it to Montenegro as well. <\/p>\n\n\n

LifeNews<\/em> and FSB<\/span><\/strong><\/h3>\n\n\n

LifeNews<\/em> is a pro-Kremlin media organization launched in 2009, which has strong connections with the Federal Security Service. It is used<\/span><\/strong> <\/a>for all purposes, such as the mudslinging of Kremlin opponents and planting disinformation. This media is headed by Aram Gabrelyanov<\/span>,<\/strong> described by Lenta.ru<\/em> as a man who abruptly succeeded from the provincial tabloid editor to one of the most influential Russian media moguls. Throughout 2011, Gabrelyanov was also the Chairman of the Board of Directors of Izvestia<\/span><\/strong><\/a>. <\/em>He publicly calls the Russian President the father of the nation<\/em>, and Putin recognized his contribution to Russian propaganda in Ukraine in May 2014 and awarded him the Order of Honor for objectivity and professionalism in covering events in the Republic of Crimea.<\/em><\/p>\n\n\n\n

\"\"
Russian disinformation and propaganda ecosystem<\/figcaption><\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

In the context of Montenegro, this medium is interesting since the leader of the True Montenegro Marko Milacic appeared on LifeNews<\/em> television on May 21, 2016, on the occasion of celebrating the Independence Day of Montenegro, who strongly criticized<\/span><\/strong> <\/a>the then Montenegrin government. Equally, LifeNews<\/em> published articles on the Democratic Front campaign against Montenegrin accession to NATO and their reaction to the coup attempt and addresses to Sergei Lavrov.<\/a><\/p>\n\n\n

Katehon<\/em> and Geopolitica.ru<\/em><\/span><\/strong><\/h3>\n\n\n

Katehon<\/em>, a think tank organization and news portal with headquarters in Moscow, is in charge of spreading anti-Western disinformation and propaganda, and it is led by individuals associated with the Russian intelligence services. Board of Directors comprises Sergey Glazyev<\/span><\/strong>, former economic advisor to President Vladimir Putin; Andrey Klimov<\/span><\/strong>, Deputy Chair of the Federation Council Committee on Foreign Affairs; Leonid Reshetnikov, retired Lieutenant-General of the Russian Foreign Intelligence Service; and Alexander Makarov<\/span>,<\/strong> retired Lieutenant-General of the Russian Federal Security Service.<\/p>\n\n\n\n

During 2015, Katehon<\/em> published numerous articles and tried to conduct a campaign against Montenegro\u2019s NATO accession. The analysis showed a link between pro-Russian news portal IN4S<\/em> and Katehon<\/em>. The IN4S<\/em> republished many articles from Katehon<\/em>, usually targeting NATO, which was characterized as a private club of war criminals,<\/em> and during 2016, the IN4S<\/em> republished<\/span><\/strong> <\/a>Katehon\u2019s<\/em> weekly geopolitical forecasts twice.<\/p>\n\n\n\n

Also, in October 2016, Katehon<\/em> republished the interview with general Leonid Ivashov<\/span><\/strong>, which Igor Damjanovic carried out<\/span><\/strong><\/a> in Moscow for the IN4S<\/em> news portal. Katehon<\/em> thanked Damjanovic and the IN4S<\/em> news portal for the provided material. The interview was republished by the news portal Geopolitica.ru, <\/em>also recognized as a platform for spreading disinformation, propaganda, and ideas of an ultranationalist Russian philosopher Alexander Dugin.<\/p>\n\n\n\n

However, the interview with Ivashov was not the only Damjanovic\u2019s contribution to Katehon<\/em> and Geopolitica.ru<\/em>. These news portals also contain his articles stating that the media in Montenegro were mudslinging Russia, that Montenegrins would not allow accession to the anti-Russian Alliance, and that the party of Milo Djukanovic was rigging the elections. Katehon<\/em>, IN4S,<\/em> and Geopolitica.ru<\/em> were labeled in the U.S. Department of State\u2019s Report as a part of a so-called propaganda ecosystem<\/em> of the Russian disinformation campaign.\n\n<\/a><\/p>\n\n\n

SouthFront<\/span><\/em><\/strong><\/h3>\n\n\n

In the context of Russian media that are close to the security sector and launch disinformation, it is important to mention the news portal Southfront<\/em>, focused on military and security issues. SouthFront<\/em> is a site for spreading disinformation, registered in Russia, undertaking the FSB\u2019s tasks. SouthFront<\/em> tries to influence the military enthusiasts, veterans. and conspiracy theorists while it also tries to hide<\/span><\/strong> <\/a>its links to the Russian intelligence service. Even though they try to hide their Russian roots in all possible ways, the news portal is registered in Moscow and their PayPal address has a Russian domain. Also, the owner or founder of this media is not known in public, but officer Viktor Stoilov<\/span><\/strong>, a Bulgarian marketing expert that manages a marketing company in Sofia, is mentioned as a part of its managing committee.<\/p>\n\n\n\n

However, besides SouthFront<\/em>, the name of Stoilov can also be found on Katehon<\/em> and Geopolitica.ru<\/em>, the news portals that he also writes his analyses for. It is also indicative that the pro-Russian news portal IN4S<\/em> was also listed as a part of the SouthFront<\/em> media network, which was removed from the SouthFront<\/em> website in the period between October 31 and November 6, 2018. However, what was not removed from the website were the articles republished from IN4S.<\/em><\/p>\n\n\n

InfoRos<\/span><\/em><\/strong><\/h3>\n\n\n

Along with the abovementioned news portals, the connection was found between the IN4S<\/em> and the news portal InfoRos<\/em>, which is allegedly initiated by the GRU\u2019s Main Intelligence Information Center (GRITs), also known as the 54777 Unit. GRITs<\/span><\/strong><\/a> is a Unit within the Russian Information Operations Troops, identified as Russia\u2019s military force for conducting cyber espionage, influencing, and carrying out offensive cyber operations.<\/p>\n\n\n\n

In 2018, the Washington Post <\/em>labeled InfoRos<\/em> and the Institute of the Russian Diaspora<\/em> as the most significant organizations acting within the 54777 Unit, which was described as the center of the Russian military\u2019s psychological-warfare capability. InfoRos<\/em> used the network of websites, including declaratively independent web locations for spreading false narratives on conspiracies and disinformation promoted by the GRU officials.<\/p>\n\n\n\n

In July 2020, the U.S. officials identified InfoRos<\/em> as a platform that, along with managing the websites InfoRos.ru<\/em>, Infobrics.org<\/em>, and OneWorld.press, <\/em>spreads disinformation on the COVID-19 pandemic. Denis Valeryevich Tyurin<\/span><\/strong> and Aleksandr Gennadyevich Starunskiy<\/span><\/strong> were identified as high-level members of InfoRos<\/em>, who used to work for the GRU. And, according to the U.S. officials\u2019 statements<\/span><\/strong><\/a>, they still maintain close ties with the GRU Unit where they worked as specialized military-psychological intelligence officers.<\/p>\n\n\n\n

In its report from June 2020, the EU DisinfoLab<\/em> analyzed connections between InfoRos, One World<\/em>, and Observateur Continental<\/em> on one side and the Russian intelligence service \u2013 GRU on the other side. The report says that the InfoRos is evolving in a shady grey zone, where regular information activities are mixed with more controversial actions that could be quite possibly linked to the Russian state\u2019s information operations.<\/em><\/p>\n\n\n\n

The EU DisinfoLab<\/em> presented the secret connections between InfoRos<\/em> and web page Observateur Continental<\/em> that spreads disinformation and pro-Russian narratives in France, but also with One World<\/em>, which reported<\/span><\/strong> <\/a>on the 2020 parliamentary election in Montenegro. InfoRos<\/em> is the news portal that republished<\/span><\/strong> <\/a>a piece of news from the IN4S<\/em>, referring to the number of people that attended the processions during 2020, and back in 2015, they published an article by Igor Damjanovic titled Fear of uncontrolled people\u2019s uprising \u2013 Montenegro’s accession to NATO puts an end to economic development.<\/em><\/a><\/p>\n\n\n

Strategic Culture Foundation<\/span> <\/strong><\/h3>\n\n\n

Strategic Culture Foundation<\/em> is a medium and a think tank registered in Russia in 2005 and according to the State Department\u2019s Report, Pillars of Russia\u2019s Disinformation and Propaganda Ecosystem<\/em>, it is under the authority of the Russian Foreign Intelligence Service<\/em> and maintains close ties with the Ministry of Foreign Affairs of the Russian Federation. The basic tactic of this medium is to publish the statements of the Western intellectuals and conspiracy theorists, thus trying to hide its Russian origin, but also to reach the Western target audience. The General Director of the Strategic Culture Foundation<\/em> is Vladimir Makimenko<\/span><\/strong>, who used to be the Director<\/span><\/strong> <\/a>of the Russian Unity<\/em> Foundation, whose goal was to promote a positive image of Russia and Russian culture abroad<\/em>, especially among the so-called Russian compatriots. President of the Foundation is Yuri Prokofiev<\/span><\/strong> who was the Moscow Communist Party chief from 1989 to 1991 and a member of the Soviet Politburo but also one of the founders of the Russian Organization for Assistance to Special Services and Law Enforcement Authorities<\/em> (ROSSPO). ROSSPO closely cooperates with the Russian security services in order to offer support to the Russian policies, facilitate the cooperation between state institutions and the civil sector, and provide social protection of the employees in intelligence services and law enforcement bodies. English version of the media focuses on world politics and security issues but it says nowhere that the news portal is registered and managed from Russia. It is evident that they are attempting to hide Russian origin and connection with the security services, but the Russian narratives<\/span><\/strong> <\/a>on topics of Russian interest give them away. Here are a couple of examples The Skripal Case is a NATO False Flag Operation<\/em>, The European Union was created by Nazis, Russians have Excellent Weapons,<\/em> and similar.<\/p>\n\n\n\n

It is indicative that this media in Russian reports on significant social and political events in Montenegro, such as NATO accession, processions, and elections. Based on the successful recipe, the following narratives are frequently pushed: after NATO accession, Montenegro is facing its end<\/em>, the Law on Freedom of Religion or Beliefs from 2020 was an anti-church law<\/em>, the Church in Montenegro is being persecuted<\/em>, atheist Milo Djukanovic is creating<\/em> his own<\/em> church on the basis of Ukrainian scenario<\/em>, Montenegro is trying to get rid of the criminal regime<\/em>, mafia as a guarantor of the Euro-Atlantic integration<\/em>. In 2019, this news portal republished the news that True Montenegro leader Marko Milacic set the NATO flag on fire as a protest against colonial politics of the Alliance.  Strategic Culture Foundation<\/em> had its subsidiary in Serbia but seven years after the website had been created, it stopped working<\/span><\/strong><\/a> in December 2017. The news portal IN4S<\/em> extensively republished the articles of the<\/em> Strategic Culture Foundation <\/em>glorifying Russia and emphasizing the significance of Russia-Serbia relations while presenting NATO as an instability factor in the Balkans, that plans to put the whole Balkans in its pocket<\/em> and then attack Russia. In 2015, the Strategic Culture Foundation<\/em> carried out an interview with the then Bishop of Budimlja and Niksic Joanikije, and the topic was the situation in Montenegro. A former associate at the Ministry of Education, Science, Culture and Sports and then editor of the news portal Princip<\/em> Vladimir Vukovic, previously mentioned in the analysis, was one of the speakers at the conference Balance of the Western Import of Democracy to the Territory of SFRY from 1990 until Today, <\/em>organized by the Strategic Culture Fund<\/em> in 2016. On that occasion, he emphasized that Montenegro was the best example of a country on the ex-Yugoslavia territory that was made upon the pattern of the Western democracy, that the citizens of Montenegro living in the totalitarian democracy were still waiting for the promised fruits of independence, while the tradition was being ruthlessly trampled upon, and historical relations with Russia were being deleted.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Structural reshaping of the international order upon the end of the Cold War caused a redefinition of the Russian Federation’s political position in the new constellation of power and, in a long-term perspective, initiated a revision of the state approach to the Russian foreign policy concept. Feeling of historic humiliation with the events from the […]<\/p>\n","protected":false},"author":1,"featured_media":10907,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","footnotes":""},"categories":[37],"tags":[],"class_list":["post-10899","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-our-work"],"_links":{"self":[{"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/posts\/10899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/comments?post=10899"}],"version-history":[{"count":0,"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/posts\/10899\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/media\/10907"}],"wp:attachment":[{"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/media?parent=10899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/categories?post=10899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dfc.me\/en\/wp-json\/wp\/v2\/tags?post=10899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

The Russian concept of information warfare and role of the cyberspace in it is exposed in the strategic policy documents such as the National Security Strategy<\/em> (2015 and 2021), Foreign Policy Concept <\/em>(2016), Doctrine of Information Security of the Russian Federation<\/em> (2016), Military Doctrine of the Russian Federation<\/em> (2014), as well as the works and publications of the Russian military strategists.<\/a><\/p>\n\n\n\n