US officials say they’re closely monitoring cyber intrusions, like the attack that hit Ukraine’s government last month. They’re watching not just Russian troops that amass on the border but where they’re positioned, and they’re keeping an eye on what Russia is doing with its equipment like tanks that would be central to any ground invasion.
At the same time, current and former officials tell CNN that ultimately there may not be a clear tip-off for an attack on Ukraine. Like the rumbling of an earthquake, there may be little or no advance warning of an invasion before it’s already underway, officials say.
“If you look at the lower-end options, all of which are executable immediately with little to no warning with the forces that are already deployed — things like a punitive strike or raid in the East, a breakout from the south, a raid from the north—those forces are already in position and in the right number with the right capability,” a Western intelligence official told CNN.
Former Director of National Intelligence James Clapper told CNN that the US may not see the beginning of a whole-hog invasion until they see it. “If he shoots into Kyiv or any other major cities, then you know it’s a real deal,” Clapper said.
The assessment helps explain why President Joe Biden and top US officials have warned that a Russian invasion is imminent — an explanation that angered Ukrainian officials — because the Kremlin may need very little lead time before an attack is launched.
Invasion could happen ‘any day now’
While the White House said it would no longer call a Russian invasion “imminent,” a senior administration official said the assessment that an attack could happen “any day now” remains valid as the Russians have added logistics and sustainment to their forces on the border, as well as additional offensive and defensive weapons.
Officials say there’s a distinction between different potential scenarios, whether Russia attacks Ukraine in a targeted way or whether the Kremlin is preparing for a full-scale invasion of the country to try to overthrow the government in Kyiv. In the latter case, the Russians would need more troops along the border, officials say, and satellite images would capture the continued build-up that the West has watched for months now.
“I don’t think the math is as simple as saying, there’s a magical number of (battalion tactical groups),” the Western official said. “It’s just generally speaking, more than we see now.”
But officials cautioned that Putin could also begin by using long-range artillery to attack Ukraine, where ground forces would not need to be in range.
Still, one of the key things the US is watching is for when a significant number of Russian forces leave their training areas near the border and move within firing range of their targets, which are specific ground positions, one administration official said.
Another signal that US officials are monitoring is the movement of Russian tanks, one US official said. One sign the Russian military could be gearing up for an invasion is if they start moving around tanks on the border, or turning them on or off, the official said, because if they sit there and don’t move for a few days the oil could freeze.
If they are turning them on and off, it prevents that from happening — meaning the tanks would be ready to go quickly. So far, the official said, the tanks are just sitting there, according to commercial satellite imagery.
On alert for cyberattacks
US and Ukrainian officials say there’s a wide expectation that any Russian invasion could be carried out in conjunction with offensive cyber aggression toward Ukraine.
US officials are closely watching for any signs of cyberattacks on Ukrainian critical infrastructure and are in touch with their Ukrainian counterparts on the issue, one US official told CNN. One concern is that Russia could use its hacking prowess to try to erode public confidence in the Ukrainian government.
“Could cyber be used to suggest the Ukrainian government is inept?” the US official said.
Since Russia annexed Crimea in 2014, suspected Russian hackers have disrupted Ukrainian critical infrastructure on multiple occasions, including by cutting power in parts of the country in 2015 and 2016.
“Cyber is an ideal tool for Russia to use prior to an invasion,” said John Hultquist, vice president of intelligence analysis at cybersecurity firm Mandiant, who closely tracks the Russian hacking group accused of the 2015 and 2016 disruptions. “You can use (cyber operations) to be aggressive, to signal (intent) and potentially erode the influence of your adversary before bullets fly or without necessary escalating the situation to war.”
The Western official noted that Ukraine was hit by a cyber operation last month that did not precede a conventional Russian attack.
“This one of the hardest questions to answer it because the baseline level of activity is so high focused on Ukraine — and here I mean hybrid and cyber,” the official said. “A one-off may not be the indicator that we’re looking for that a campaign is beginning.”
CNN’s Kylie Atwood contributed to this report.
