Russian Attacks Targeting Ukraine’s Energy Infrastructure

THE WASHINGTON FOREIGN PRESS CENTER, WASHINGTON, D.C. 

MODERATOR:  Hello and welcome to the Washington Foreign Press Center’s virtual briefing.  Today’s briefing is on the findings from a February 29th report by Yale’s Humanitarian Lab detailing Russia’s attacks on Ukraine’s energy infrastructure.  My name is Doris Robinson and I am the briefing moderator.  Our briefers today are Nathaniel Raymond – he is the executive director of Yale’s Humanitarian Research Lab – and Caitlin Howarth – she serves as the director of operations for the Conflict Observatory team based at the Yale Humanitarian Research Lab.   

And now for the ground rules.  This briefing is on the record.  We will post the transcript and video of the briefing later today on our website at fpc.state.gov.  And for journalists on Zoom today, please make sure that your Zoom profile has your full name and your media outlet.  Our briefers will give opening remarks and then we will open for questions.  Over to you, Nathaniel.  

MR RAYMOND:  Thank you so much, Doris, and it’s wonderful to be here, as always, at the FPC.  Olivia, can you – or our colleague – can you pull up the deck, please?  Thank you.  

So this report is significant for two reasons.  One is its findings, but the other is its methodology.  There have been many reports that have sought to document bombardment within the past two years since Russia’s full-scale invasion of Ukraine, bombardment against power generation and transmission infrastructure in Ukraine.  Those reports, while important, have not had a common methodology that has been publicly available.  So what this report represents is the first effort to create a common methodology for assessing these attacks, and to do so in a way that also balances the significant operational security risks of documenting these types of attacks.  Next slide.  

So here are the key findings.  We identified 66 incidents of damage that we were able to verify against Ukraine’s power infrastructure.  And when I say verified, it means that Yale Humanitarian Research Lab, as part of the Conflict Observatory itself, was able to confirm to a high-confidence standard that these attacks did happen.  Additionally, we found 157 other incidents of damage that we could identify but could not confirm to the high-confidence standard of those 66 incidents, and we’re going to get into detail about how we did this.  In total, we had a combined number of 223 identified and verified incidents across 23 of 24 of Ukraine’s oblasts.   

One thing I want to draw your attention to is that 128 of these incidents we identified occurred in oblasts where a frontline was not present at the time the attack likely occurred.  And that’s important because it shows that there may have been many attacks that were not related to frontline engagement, and that’s important from a legal and forensic analysis because it could suggest that these attacks were occurring in a targeted way, specific to attacking power generation and transmission infrastructure.  

There were four attacks identified – and this is from the language of the Geneva Conventions – that had incidents to works or installations containing dangerous forces.  So those can be dams, dikes, and nuclear electrical generating stations.  The time frame here is between October of 2022 – October 1 – and the end of April of 2023.  The largest number of identified incidents occurred in October and November of 2022, and that’s important.  We’ll get to that in depth in a moment.  There were four days in which 10 or more identified incidents occurred, and so that – as you’ll see in a moment, we’re able to show the temporal – so time – distribution of these attacks and their geospatial distribution in terms of location, which we show by oblast.  Next slide.   

Caitlin, can you take it from here in terms of walking through the methodology and the data sources we used to do this report?  

MS HOWARTH:  Of course, and thank you, Nattie.  So our methodology goes through three core stages: first, to identify incidents that occur; to geolocate each incident, to locate it first in time and also in space, so the geolocation and chrono-location; and then to verify all of the various components of each source. 

So first, in identifying that an incident has occurred, this is primarily done through open-source data, and open-source can be any number of different types of sources.  In this report, our researchers went through a huge number of open media.  Those were public-facing reports, anything that came through in social media, anything that came through in print media.  And we – I’m going to get to challenges and limitations on that in a moment.  But any of those details that were shared they used in order to identify, including sometimes even when they were only able to get to sort of the broader strokes around what happened with an incident.   

They then worked to geolocate, to figure out exactly where that would have occurred.  And so they would work to cross-corroborate sources, figuring out, all right, where a incident may have happened, what else would have been present in that location at that time and place, and trying to determine what sort of facilities may have existed, and so on.   

Then the hard work happens when it comes to verifying each source and each cross-corroborating source.  So all of these different researchers are tasked to different components, so one may be working on geolocation; another is working on source verification.  In open-source verification we always make sure that not only is each source verified, and that goes through multiple steps in order to make sure that the source meets certain credibility standards, which you can see detailed to a much greater degree in our report methodology in the advanced section; but you can also see how we have to use multiple sources in order to establish the high threshold that we utilize in order to determine that an event occurred.   

So if we are only able to find one source indicating that an event happened, that likely did not meet any sort of threshold in order to be included in this report.  That would be of lower quality for us.  In order to be of higher quality, we had to be able to not only verify that we have a very, very high-quality source, but we also then needed to have multiple data points that we could independently cross-verify using, for example, very high resolution satellite imagery, other independent sources, to verify what kind of facility was there, whether damage had occurred, whether any other changes in the environment happen to exist.  So there’s other phenomena that we’re always looking for at that time and in that place.  Next slide. 

There are of course a number of challenges, and many of them are very specific to this exact type of research when we’re looking at power facilities, anything having to do with this type of infrastructure in a conflict, especially in such an active kinetic environment.   

First of all, we as a team do not operate on the ground, so there was no ground data collection or ground verification.  Teams were not visiting any of these sites in person or working with field teams that were conducting that kind of field research.  This is not a representative sample.  We worked very hard to be as comprehensive as possible within the timeframe that is documented in the report; but that being said, we cannot guarantee that it is in fact representative, and it’s not a specific sampling over the oblasts that are documented.  We work to be comprehensive but not necessarily representative.   

There are limitations on our access and reporting from a variety of concerns, and some of those were placed by Ukraine’s government, given that these of course are very high-sensitivity targets.  So there are a number of different things that local officials and journalists do not publish given the sensitivity of the strike locations, the type of infrastructure involved, and the fact that, quite simply, to publish everything in their full detail would be essentially providing an improvement on targeting data for potential strikes.   

So with that in mind, there’s less for us to work on when we are working only with open source, public-facing, and remotely collected data.  It doesn’t mean the task was impossible, but it doesn’t mean – it does mean that there are certain limitations on what can be verified using only these tools.  There’s also fairly widespread mis- and disinformation that is utilized, especially with a lot of user-generated data or data that’s presented through – including through government sources.  And that all has to be taken into account.   

This means that we have a very high inclusion rate across all of our media, and we also have to work that much harder on our verification in order to weed through what could be either misrepresented or potentially falsely planted.  That’s just part of the work that goes into any report like this.  And I think that you see that represented not only in our methodology but in those of comparable investigations.   

There was also limited satellite imagery that was available, and the – both availability of it and the quality varies depending on where the team was working to collect satellite imagery for certain sites.  So again, that’s a fairly normal phenomenon in any report, especially when that’s seeking to be as comprehensive as this in the time period. 

In other limitations we want to look at, we always are extremely careful to think about potential military use, and working to make sure that we are being mindful of not providing actionable military intelligence when we present our findings in the end.  Our objective always is to make sure that we are producing material that it is – it has a net positive net effect for civilian protection.  We believe that we do so in this report, but that does mean that we have to be mindful of that at every stage throughout our investigations and in the final publication.  So that does mean that we have some limitations on what we actually show you here, including in some of the data that’s presented.  Additional findings are available for accountability mechanisms, courts, and other researchers upon request. 

There is some additional capacity that’s lost due to do damaged infrastructure.  There are additionally some things that we have to take into account, such as rapid repair rates.  That can also change the findings that we’re able to locate.  So there are a few different things that can sort of change not only what we find but how we find it, and in what state.  So when researchers are looking both in – not only at the variety of open source, user-generated, and other types of traditional media and reports, but also when they’re looking to do cross-verifications using very high-resolution satellite imagery and other resources, they can find a mix of products, depending on when their corroborating material comes in.  If it’s in the immediate aftermath of damage, then they might find something very accurate.  If their corroborating material only arrived much later, then it may be later. 

I see a question; we are going to take questions at the end.  So if you don’t mind either posting in the chat, or I will address it at the end of the presentation.  Thank you.  Can we go to the next slide, please?  Great. 

For identified incidents, the map below shows where incidents were identified.  Now, this is the most inclusive map that you’re going to see; this is where incidents were positively identified by the team.  As you’ll see, there is a fairly high – like, the highest concentration is predominantly in those areas where frontline activity is observed at the time.  However, there are still throughout relatively high concentrations, particularly in Kyiv Oblast, also in some surrounding oblasts Chernihiv, Vinnytsia, and also much further west in Lviv.  And so we take this to be – as Nattie said earlier, one of the things that we are looking for as we are identifying incidents, distance in and of itself is not necessarily indicative that a strike could not be legitimate.  However, it was one of the factors that we looked at in order to try and determine what kinds of strikes were being launched and also at what kinds of facilities.   

We can go to the next slide.  Nathaniel, do you mind if I hand it back to you, just to walk us through these slide findings? 

MR RAYMOND:  Of course.  So what we see here is the breakdown between incidents that occurred in oblasts that were on the frontline during the period of the study and oblasts that were not on the frontline during the period of the study.  And this part is critical for the core finding of the report, is that the data is consistent with a widespread and systematic campaign of bombardment of these facilities.  And the widespread comes from the distribution between frontline and non-frontline areas.  And the systematic finding comes from the fact that this type of infrastructure is being attacked throughout Ukraine, regardless of geographic location.  Next slide. 

So we talked about, in the previous slide, geospacial distribution; this is temporal distribution.  And so as you see, the October and November period has the plurality of strike activity.  But we see it continue, based on our data set, relatively consistently throughout the period of the study, tapering from March where there’s an uptick to April at the end of the winter season.  And so we also need to bear in mind other events that are occurring, such as the Kerch Bridge incident at the start of the study period.  Next. 

So Caitlin showed you the identified incidents map; this is the verified incident map, meaning those that we were able to specifically confirm to the highest standard of confidence possible.  And we see a relatively similar distribution of incidents to the previous map.  Again, you see the swell in frontline and Kyiv, but you also see areas outside of the frontline that are experiencing strikes.  Next slide.   

So as we mentioned at the beginning, there are multiple other assessments, and part of our goal here is not just the data but the methodology, having a common standard for performing these assessments both in Ukraine and elsewhere in the future.  I want to draw your attention specifically to the UN Independent Commission of Inquiry.  Our findings and the Commission of Inquiry’s findings are in concordance with one another, and both on the data side but also on the legal analysis.  Next slide.  

So now let’s go specifically building off of the similarity in findings between our study and the Commission of Inquiry on what these findings say that may implicate international humanitarian law.  So first, widespread geospatial distribution of damage, including areas far from front lines.  That implicates part four of Additional Protocol 1 to the Geneva Conventions, which speaks directly to requirements for proportionality and military necessity.  The distribution of damage away from the front lines does not itself show that the principles of proportionality and military necessity were violated, but it may indicate that when combined with other evidence.  

Article 56 of Additional Protocol 1 includes, as we mentioned before, special protections for objects, including dangerous forces.  And so we found four identified incidents consistent with a potential violation of Article 56.  

Additionally, we have statements from Russia’s officials that have expressed specific intent to commit attacks against infrastructure of a civilian nature to have an effect on civilian security and well-being.  So the Geneva Convention specifically requires parties to conflict to target legitimate military objectives and to not use them as – an attack on civilian infrastructure as retaliation against civilians and to not specifically inflict suffering on civilians.  And so this could be evidence combined with those statements of a potential intent to do so.  Next slide.  

So we see, really, two sets of statements, two categories of statements, from Russia’s Government as it relates to justifying the strikes.  On one hand, they are saying that there is a legitimate military reason, which may in some cases potentially be true; but on the other hand we see statements by Russian officials and Russian-aligned actors that suggest that these strikes are specific retaliation for Kerch Bridge and are specifically to attempt to inflict harm on civilians.  Next slide.  

So here’s two examples, objects of – this is from the minister of defense, Sergei Shoigu – objects of military infrastructure as well as objects that effectively reduce Ukrainian military potential.  Okay.  And then you have a minister of defense statement saying in one set of attacks, infrastructure supported the functioning of enterprises of the Ukrainian military-industrial complex.  Those could be legitimate types of strikes.  Next slide.  

Then we have statements that suggest a non-legitimate intent, such as Putin’s statement saying it was retaliation for Kerch Bridge and that – Viktor Sobolev’s statement from the Duma defense committee saying they were a response to purported shelling in Donetsk.  Those are not legitimate reasons for strikes.  Next.  

And then we have these statements, such as former president of Russia, Dmitry Medvedev, who said Ukraine needs to recognize Russia’s legitimate demands in the context of the special military operation, then the lights would work again.  That is a statement that’s consistent with an intent to harm civilians through these strikes.  And we see a similar statement here from Dmitry Peskov, the press secretary.  They will – quote – they will sit there without gas and without electricity and without everything because if the Kyiv regime has chosen the path of war criminals, they must both freeze and rot there.  That would be a illegitimate intent.  Next.  

So going forward, these types of studies using a common method are important.  We need to collect ongoing attacks for future accountability, and we need to continue to analyze attribution, which this report did not do, but who performed a specific strike and to understand the chain of command that authorized them.  That is critical in terms of any future accountability.  Next slide. 

And now we are at the end and ready for questions.  I know that was a lot of information in great detail, but it’s important to get down to the nitty-gritty.  So over to you, Doris, for questions. 

MODERATOR:  Great.  Thank you so much for those remarks.  We’ll go directly to questions.  I believe Alex Raufoglu has a question.  Alex, if you want to unmute yourself. 

QUESTION:  Yes, Doris.  Good morning.  Thank you so much for doing this.  This is Alex Raufoglu from Turan News Agency.  I appreciate all the speakers for being here.  I have three questions.  Let me throw all of them at you at once so it doesn’t take much time; I’ll be respectful to my colleagues’ time as well. 

We woke up to the British defense ministry’s latest update this morning on the ground which indicate sort of continuation of the crimes that you are featuring here.  They say recent strikes by Russia had – I’m quoting – “highly likely damaged Ukrainian power plants and electrical substations.”  I was hoping you could help us put that into context in terms of the continuation of this crime. 

Second question:  Given the scope of Russian brutality, can you please speak to the importance of your report, its findings in the context of holding Russia accountable?  I’m asking because I did raise this question at the State last week and their response was, well, wait, haven’t we done enough to punish Russia.  So why do you think it’s important to pay particular attention to this particular angle?  And, of course, the obvious follow-up to this question is whether do you think it’s – this crime constitutes more of sort of a type – other types of crimes against humanity or do not – or is it a sign of genocide. 

And final question, if I may:  The State Department just put out a media note about your report an hour ago, and they said that – there’s a quote there saying that the threat to civilian lives, livelihoods in Ukraine is entirely of Russian making.  But we also know that – Nathan, particularly I know you have been focusing on this angle – that Russia has been turning to other countries to beef up its offensive capabilities to be able to commit this crime.  Can you speak to also how much your finding was able – how much you were able to focus on Russian enablers, Iran and others, that have provided certain technology that have been used to conduct this crime?  Thank you so much again. 

MR RAYMOND:  So I’m going to start with the last question first.  As we said earlier, we did not do attribution.  As part of that, we did not do munitions analysis, so I can’t answer your fourth question unless we had done specific munitions analysis across all strikes, which in many cases was something that we didn’t have the data to do.  So I can’t speak to that.  The study didn’t cover that. 

In terms of the State Department’s statement about effect on civilian lives and civilian livelihood, we were not able to in this report specifically – in the absence of meter data from specific facilities to be able to do a type of impact analysis on certain civilian populations.  But the fact of the matter is, especially in Ukraine in the winter, electrical power is essential to what is used – in international law the term is means necessary for survival.  And so the important point – and this will go to your second question – in terms of what’s – what does this show in terms of an international humanitarian law violation, and then you also said crimes against humanity, genocide, et cetera.   

This data by itself cannot prove any of those potential crimes.  But the way to think about it is that this is like in a potential homicide – say in a police department on a local jurisdictional level, this would be like an analysis, a ballistics analysis that, combined with other information, as we’ve shown in the quotes, et cetera – other information of intent together can help bring a case.  So we are not in a position with this data to say it is X crime or Y crime.  We are saying – and this is a specific legal term – it is probative.  It is evidence consistent that a crime may have occurred.  And so we’re just basically bringing one forensic element to the table. 

Then to start at the beginning about the British statement that these attacks continue to occur, I think this report when it came out was not headline news, and – but the – I think this report will be one of the most important reports the Conflict Observatory every produced.  Why?  Because both for Ukraine and for other contexts where there are campaigns going on of bombardment of civilian infrastructure and people are documenting those campaigns through open source information combined with remote sensing data such as satellite imagery, we need a forensic standard in order to evaluate those assessments both in the court of public opinion and in literal actual courts.  Up until this report everyone who had – has done these types of assessments have done it very different ways, often not publishing the methodology, often not publishing the results, and often not creating in the literature the ability for these results to be aggregated and to be interoperable.  And I think that this represents a – though no one is particularly surprised by the findings of this report, the report itself represents a technical achievement in the effort for everyone to document these attacks in Ukraine and elsewhere.  Over. 

QUESTION:  Thanks so much. 

MODERATOR:  Great, thank you.  I will take a submitted question.  The question is:  “Have we seen Russian cyber attacks on Ukrainian energy facilities, or has it only been airstrikes?” 

MR RAYMOND:  This report cannot evaluate fiber activity, because we are looking at physical evidence of damage to facilities.  So that would be consistent with some form of munition.  In the case of what is known as a SCADA attack – basically attacking power generation by affecting the ability of software and titration systems that move power between facilities in the grid – we would not be able to detect that through the data we examined.   

That said, there has been reports from early in the war, both from the Ukrainian Government and others, of attempted or successful SCADA-type attacks.  But that would require an entirely different methodology with an entirely different data set that we did not have access to. 

MODERATOR:  Thank you for that.  I’m seeing no further questions.  Nathaniel and Caitlin, I’m going to throw it back to you for closing remarks. 

MR RAYMOND:  So I want to make two points and – just to close – that I think are the most important here to take away.  One is that we have been able to mathematically show that there was widespread and systematic bombardment of Ukraine’s power generation transmission infrastructure in frontline and non-frontline areas in the critical period of bombardment from October 2022 to April 2023.  That is now a fact that can be submitted with reproducible methodology to courts.  So that is the headline.  And it is done to the highest standard.  So as you’ll notice, our differentiation between verified and identified incidents, that, I think, is something that when you write about this subject, you need to bear in mind, is that we are holding ourselves at Yale’s Humanitarian Research Lab and Conflict Observatory to the highest, most conservative standard.   

The second point is that unfortunately, we live in a world where both in Ukraine and elsewhere right now we are seeing systematic attacks on multiple types of civilian infrastructure by multiple actors.  The ability to assess those attacks at scale with open source and commercially available data is unfortunately only growing.  And the importance of these methods are not just about accountability – and this is the point I want to end on – it’s also about assessments for reconstruction purposes after the guns fall silent.  These assessments also can inform other types of assessments of needs happening throughout the response cycle during a conflict by the international community, and most importantly, domestic responders.   

And lastly, this method can be applied to other types of infrastructure in addition to power generation and transmission.  That includes hospitals; that includes other types of protected under the Geneva Convention civilian objects.  And so this is not just about the data; it’s about the method.  

Caitlin? 

MS HOWARTH:  I don’t like trying to close after such a compelling one.  So I think we’ll leave it with that.  The only last thing that I really have to add is that, as Nattie noted, this is a reproducible method.  And as we note for so many of our reports, our investigations are ongoing.  We’ve obviously just been going – we’re still in the midst of the winter period, as bombardment has been ongoing and continued attacks on energy infrastructure.  So this remains a topic of significant concern, especially for the impact that it has on civilians, and it’s another issue that we want to continue to see improvement and rapid advancement when it comes to the validation and verification of these strikes so that more material is able to be processed and moved forward for broader accountability. 

And with that, I think we’re closed. 

MODERATOR:  Yeah.  Thank you both for taking the time to talk to us today about the report.  And this concludes today’s briefing.  Thank you.