On October 25, a group of Ukrainian hackers known as CyberHunta released a surprise cache of emails allegedly from the official inbox of Vladislav Surkov, one of Vladimir Putin’s top aides. Surkov, an elusive Kremlin spin master often credited as the architect of Russia’s propaganda machine, now advises Putin on the pro-Russian separatist republics that the Kremlin has propped up in Georgia, Moldova, and Ukraine. For Russia watchers, the prospect of a Surkov leak was tantalizing: here was a chance to peer behind the scenes of the Kremlin to see how Moscow manages the “frozen conflicts” it so disingenuously denies involvement in.
Sure enough, the bulk of the emails were soon authenticated by digital forensics experts who combed through the metadata and dug up the juiciest findings. (A second batch was released on November 3 as this piece was being written.) While the released emails did not turn up any bombshells, they did suggest that Russia’s fingerprints are all over the Donbas conflict. Among the emails in Surkov’s official inbox, which was handled by two assistants, were a casualty list that reported dead Russian soldiers in Ukraine, a faked open letter from pro-Russian residents of the Donbas that Kremlin officials circulated with edits before planting in the media, and a list of potential representatives for the Donetsk People’s Republic, to be approved by Moscow.
And then there was something else: a seven-page document outlining a master plan to destabilize Ukraine between November 2016 and March 2017. Unlike the bulk of the emails, which were released along with extensive metadata tracing their origin, the destabilization document appeared separately on CyberHunta’s website, two days ahead of the first email dump. The hackers claim the file was sent by Pavel Karpov, Moscow’s man on the ground in Luhansk, along with a proposal to stir up a separatist movement in Transcarpathian Ukraine. But with only a screenshot to back up the two documents’ authenticity, experts were quick to point out that they could not be authenticated.
The plan’s possible forgery has meant that it has largely been ignored in the press. But the inclusion of a potentially falsified plan to destabilize Ukraine is a story in itself. Evidently, someone in Ukraine thought it would be helpful to circulate a fake “smoking gun” detailing an extensive Russian influence operation within Ukraine. Whoever wrote the document perhaps hoped to show the nefarious hand of Russia behind all of Ukraine’s woes. If the document is from Ukraine, however, it looks like something else: an unintentionally revealing snapshot of the priorities, vulnerabilities, and insecurities of the government in Kyiv.
When read with an understanding of its likely provenance in Ukraine, the document immediately reveals its potential utility to Ukraine’s president, Petro Poroshenko. The plan is essentially a compilation of every criticism levelled at Poroshenko’s government, all recast as part of a treacherous Russian plot. Moscow’s alleged scheme is aimed at systematically undermining the public’s trust in the Poroshenko administration, with the goal of prompting early parliamentary and presidential elections. That is a contingency that the current authorities are clearly worried about: recent polls show that 42 percent of Ukrainians want early elections, while 73 percent disapprove of Poroshenko. The recent revelation of Ukrainian officials’ true wealth, thanks to new mandatory e-declarations, are likely to increase public distrust in government.
In other words, the Poroshenko government has every reason to oppose early elections, and playing the Russia card could be an effective way to do so. The document is filled with instances of this reverse psychology, turning all of the government’s vulnerabilities on their head by making critics of the government into Russian stooges. In effect, the alleged creators of this document may have been aiming at creating a “fifth column” myth, branding all of Poroshenko’s critics as puppets of Moscow seeking to undermine stability. Ironically, this would be precisely the kind of move one could take from the Putin playbook: The Russian President has successfully smeared liberal opponents as puppets of the West for some time now.
The document is quite detailed in naming Poroshenko’s rivals and identifying the many attack lines that they could use against his government. For instance, the first bullet point of the Russian “master plot” calls for “holding negotiations with leaders of the Ukrainian opposition,” made up of the Opposition Bloc, Yulia Tymoshenko’s Fatherland, and Oleh Lyashko’s Radical Party. The ostensible plan is for Russia to work with opposition leaders to start a “Tariff Maidan” protest during the second half of November, timed with the onset of winter and citizens’ receipt of hefty utility bills. With Russian material and financial assistance, the plan goes on, protests over rising costs and subsidy cuts could be replicated beyond Kyiv, with mini Maidans springing up in Ukraine’s biggest cities.
It would certainly help Poroshenko to prove that Moscow’s hand was behind the populist movements that oppose him, but in fact, the problem comes from within Ukraine. A populist “Tariff Maidan” protest was organized last year by the Radical Party, and rumors have been brewing that a repeat could happen this year, with Tymoshenko’s party joining the fray. By associating these populist protests with Russia, the document’s author is seeking to preemptively discredit them—and, unintentionally, revealing that populist movements pose a real threat to Poroshenko’s rule.
The document abounds with similar insights into the government’s insecurities. For instance, the alleged plan advises large-scale corruption investigations into Poroshenko and his team, to be led by members of the “American lobby” of Mustaffa Nayyem, Serhiy Leshchenko, and Svitlana Zalishchuk. Those three MPs, officially members of Poroshenko’s bloc, are beloved in Washington for their anti-corruption crusades and are seeking to establish their own power center apart from Poroshenko in the Democratic Alliance party. Writing them off as Kremlin pawns would be a useful exercise for a government that wants to maintain its own credibility.
Throughout the document, accusations of corruption are seen as a consistent vulnerability for the government. The plan proposes financing foreign investigations into Poroshenko’s business empire and offshore companies, in a nod to the damaging Panama Papers revelations that surfaced earlier this year. It also calls for creating fake videos, audio recordings, and text messages among Poroshenko’s team to display their corrupt links and ongoing lobbying of their own business interests. Many of the names mentioned are close allies of Poroshenko who have already come under scrutiny for such ties: his “grey cardinal” Ihor Kononenko, his former chief of staff Boris Lozhkin, and the Prosecutor General Yuriy Lutsenko, to name a few.
Beyond corruption, public disillusionment with the war in the east is a recurring theme. A crucial component of the supposed Russian plan is nurturing the sense that the government has abandoned the armed forces to a futile fight. The plan recommends highlighting the number of deaths on the frontlines, running stories about corruption in the army, and making use of left-wing forces and Russian minorities to convince Ukraine to lay down its arms.
If the document was indeed forged by actors in the government, it reveals a remarkable self-awareness about Kyiv’s own failings. At times, the plan reads like an extended exercise in self-excoriation, laying out plausible attack lines against the current government. “Old Europe no longer wants to support Kyiv” is one line. “Oligarchs, whom Poroshenko promised to fight, continue to blackmail the government and the people” goes another. And, perhaps, most ominous of all: “Ukraine is on the verge of a social explosion. The Third Maidan will be for bread and heat in apartments.”
To be sure, there are still more questions than answers surrounding the Surkov leaks. The timing of the data dump has led to some speculation that the hacks are part of the promised U.S. retaliation following Russia’s alleged hacking of the DNC and support of WikiLeaks. The Ukrainian hacktivists involved deny any support from the United States, but it is easy to imagine such a scenario playing out. The U.S. could have hacked Surkov and used CyberHunta as a proxy to send a message to Russia, not knowing that the Ukrainians would tack on a crude forgery of a “destabilization plan” in a misguided attempt to make the leaks look more damaging.
If, as signs suggest, the document is fake, it is unclear who in Ukraine might have written it. CyberHunta and the three other Ukrainian hacker groups involved are made up of nominally independent hacktivists, not state actors. Some suspect the Security Services of Ukraine (SBU), but if they are involved, they are not all on message: two sources within the SBU said they had doubts about the authenticity of the documents, even as they confirmed the larger email dump. Even though the document reads like a Poroshenko wish list, there is no evidence tying the Ukrainian government to its creation. Perhaps the author was simply a low-level bureaucrat seeking to help higher-ups without their knowledge.
The Surkov saga may not be over yet. CyberHunta claims that it hacked additional Surkov emails from 2015 and 2016, which it has handed over to Ukraine’s intelligence services. Ahead of the release of the second batch, the hacker RUH8 promised more leaks to come, saying that they had “published only a small part” of Surkov’s emails.
In the murky word of cyberwarfare, the true author of the destabilization document may never be known. But the message many will likely take away from it may not be the one its author intended: that a government with serious vulnerabilities and low public trust has use for a scapegoat.
