Pre-Invasion Warning Intelligence

The United States began sharing intelligence assessments of Russian invasion preparations with allies and publicly in autumn 2021. By January 2022, US intelligence assessments were detailed and explicit: Russia was assembling forces sufficient for a major invasion; specific assault plans had been developed; the invasion was likely. NSC Director Jake Sullivan conducted direct briefings with European counterparts and publicly warned of the invasion risk at a level of specificity unprecedented for pre-war intelligence declassification.

The decision to declassify and publicize intelligence was itself a strategic operation. The Biden administration's theory was that exposing Russia's plans would either deter the invasion (if Putin feared the element of surprise was lost) or pre-empt Russian false-flag justifications (by establishing the sequence of events before they happened). Russia's attempted false-flag scenarios — including a staged "Ukrainian attack" on Russian-backed forces in Donbas — were publicly named and predicted before they occurred.

Ukraine's reception of this intelligence was complex. President Zelensky publicly played down invasion assessments — partly to prevent economic panic, partly due to genuine intelligence community skepticism about Western alarmism. Ukrainian economic activity, bank runs, and population flight would have been strategically damaging if triggered by warnings that proved false. In retrospect, the lack of pre-invasion preparation in some domains (fortifications along the Kyiv axis, pre-positioning of reserves) suggests the intelligence was not fully acted upon at all levels.

Western Intelligence Sharing

The scale of Western intelligence sharing with Ukraine during the war has been described by officials from multiple countries as without historical precedent for a non-allied nation. The sharing encompassed multiple intelligence disciplines simultaneously: imagery intelligence (satellite photos), signals intelligence (communications and electronic emissions intercepts), human intelligence assessments, and finished analytical products.

Intelligence sharing was initially cautious — the US, in particular, was concerned about escalation risks from providing Ukraine information used to strike targets inside Russia. This concern evolved as the war progressed. By 2023-2024, the general framework allowed sharing of operational intelligence used for defensive purposes and strikes on forces within Ukraine, with restrictions on information used for strikes inside Russia that were progressively modified as the war continued.

The practical effect was transformational. Ukraine could see Russian force concentrations, anticipate movements, and identify command nodes using satellite imagery updated at intervals far shorter than Ukrainian national satellites could provide. SIGINT allowed identification of Russian command channels, enabling both counteraction and targeting. The speed of intelligence-to-action cycle was dramatically compressed compared to what Ukraine's pre-war national intelligence capacity could have achieved.

The UK's intelligence contribution deserves specific mention. GCHQ (signals intelligence) and MI6 (human intelligence) maintained particularly deep cooperation with Ukraine based on pre-war partnerships. The UK's willingness to share targeting-relevant intelligence was historically somewhat less constrained than the US position in some periods, providing critical operational support at moments when US sharing was more restricted.

The CIA-Ukraine Relationship

The CIA's relationship with Ukrainian intelligence services — the SBU (Security Service) and HUR (Military Intelligence) — predates February 2022 by years. The New York Times reported in 2023 that the CIA had established a network of 12 listening posts near Russia and in Ukraine from 2015 onward, following the Crimea annexation, providing intelligence collection capability that was deeply informing of Russian military activity.

CIA training programs for Ukrainian intelligence officers have been conducted since at least 2015. These programs covered counterintelligence, covert operations, signals collection, and lethal operations doctrine. The Ukrainians who received this training were among the most capable elements of Ukraine's intelligence community when the full-scale invasion began. The institutional relationships built over seven years allowed intelligence sharing and coordination in 2022 that would not have been possible without that foundation.

The CIA has also provided substantial technical intelligence to Ukraine — including access to imagery from classified satellite systems, signals intelligence products, and the analytical processing that turns raw intelligence into actionable information. CIA Director Bill Burns visited Kyiv several times during the war, conducting direct consultations with Ukrainian intelligence and political leadership. These visits, while not publicly confirmed in advance, signal the depth of the relationship.

There are areas where the CIA relationship has been bounded. Operations inside Russian territory have required US government policy clearances, and there are indications that some Ukrainian deep-strike and covert operations were conducted on information that was not shared from US sources specifically to maintain US deniability. The boundary between what US intelligence supports and what Ukraine does independently is a carefully guarded one.

SIGINT and Signals Intelligence

Russia's signals security failures have been among the most consequential intelligence-related aspects of the war. Russian forces used commercial cellular networks and Russian-supplied encrypted radios that Western signals intelligence agencies had spent years developing the capability to monitor. The result was remarkable: intercepts of Russian military command communications were available to Ukraine and Western partners in near-real time throughout much of the war.

Ukraine's SBU intelligence service has published hundreds of intercepted calls — Russian soldiers speaking to family members, officers discussing operational problems, troops reporting their positions and circumstances. These intercepts serve dual purposes: operational intelligence (locating units, identifying commanders) and information warfare (demonstrating Russian atrocity evidence, demoralizing Russian soldiers who know their calls are monitored).

The most consequential SIGINT exploitation was at the operational-strategic level: identifying Russian command post locations, communication patterns preceding offensive operations, and logistics movement signatures that indicated upcoming operations. Western SIGINT organizations — NSA, GCHQ, and partner agencies — processed this material at industrial scale, with products shared with Ukraine through agreed intelligence-sharing mechanisms.

Russia adapted progressively, shifting to more secure communications, changing patterns and frequencies, and reducing reliance on predictable channels. But adaptation takes time, and in the war's critical early periods — the Kyiv defense, the Kharkiv offensive, the Kherson liberation campaign — Ukrainian forces' ability to anticipate Russian operations provided critical tactical advantage.

Satellite Imagery and Targeting

Commercial satellite imagery — now available at resolutions and revisit rates that were government-classified capabilities just ten years ago — dramatically changed the intelligence landscape of the Ukraine war. Companies like Maxar, Planet Labs, and Capella Space provided near-daily imagery of the entire Ukrainian theater of operations at meter-scale resolution. This imagery was available not only to governments but to journalists, think tanks, and open-source analysts globally.

Ukraine received substantial satellite imagery from both government sources (classified US/UK/French intelligence satellites with higher resolution and specialty capabilities) and commercial providers whose products were made available through government-arranged contracts. The combination provided comprehensive, frequent updates on Russian force positions, logistics infrastructure, air defense deployments, and damage assessment after Ukrainian strikes.

Space-based intelligence was instrumental in several specific high-profile operations. The identification of the Russian Black Sea Fleet's patterns and positions supported anti-ship strike planning. Identification of Russian logistics buildup patterns before offensives provided warning. Damage assessment of Ukrainian attacks enabled battle damage analysis and follow-on targeting. The targeting of specific command and logistics nodes deep in Russian-occupied territory required imagery intelligence of a precision that only dedicated targeting-support satellite systems could provide.

Ukraine also invested in its own space-based capabilities during the war — both through domestic Ukrainian satellite programs and through agreements for dedicated access to commercial satellite constellations. The development of Ukraine's Space Agency and government partnerships with commercial space companies reflects the long-term institutional capacity building that the war drove.

HUR (Ukrainian Military Intelligence) Successes

Ukraine's HUR (Holovne Upravlinnia Rozvidky — Main Intelligence Directorate of the Ministry of Defense) emerged from the war as one of the most capable and active military intelligence services in the European theater. Under the direction of General Kyrylo Budanov — who became one of the most publicly prominent intelligence directors in Ukrainian history — the HUR executed operations that would have been extraordinary for any intelligence service.

The HUR's portfolio encompasses traditional military intelligence (order of battle, force movement), counterintelligence (identifying Russian agents and infiltration), and covert action — including operations inside Russia and occupied territories that have targeted Russian officials, supply chains, and military infrastructure. Operating under wartime conditions with active Russian counterintelligence opposing it, the HUR has shown both operational effectiveness and institutional resilience.

General Budanov's public profile — giving media interviews, making specific predictions about Russian operations, addressing foreign audiences — has been unusual for an intelligence director and reflects a deliberate strategy of using the intelligence service's credibility as a public communication asset. Several of Budanov's public predictions about Russian operations proved accurate, enhancing his credibility as a source of strategic assessments.

The Moskva Sinking: An Intelligence Operation

The April 13-14, 2022 sinking of the Moskva — the flagship of Russia's Black Sea Fleet, a Slava-class guided missile cruiser — was among the most significant military intelligence operations of the entire war. The Moskva was not just a warship; it was the command ship of Russia's Black Sea Fleet, a symbol of Russian naval power, and the vessel that had issued the famous ultimatum to Snake Island garrison (to which Ukrainian border guards replied with their two-word instruction).

Ukraine struck the Moskva using two domestically developed Neptune anti-ship missiles. The operation required precise location data — the Moskva was operating at sea, not at a fixed location. Ukrainian military intelligence played a direct role in tracking the vessel's movements and providing targeting coordinates. US intelligence, according to subsequent reporting, also provided information about the Moskva's location through surveillance assets — though US officials stated they were not informed in advance of the specific strike and denied providing direct targeting assistance.

The intelligence aspects of the Moskva operation established a pattern for subsequent Ukrainian anti-ship operations. Russia's Black Sea Fleet was progressively degraded through a combination of anti-ship missiles, naval drones, and intelligence-enabled targeting that made the previous Russian naval dominance tactically untenable. By 2024-2025, Russia had withdrawn its Black Sea Fleet from Sevastopol to Novorossiysk — a direct consequence of Ukrainian intelligence-enabled strikes making Crimean naval basing untenable.

Deep Strike Intelligence Operations

Ukraine's campaign of strikes on Russian territory — airfields, oil refineries, ammunition depots, command facilities, and infrastructure across dozens of Russian oblasts — requires intelligence support that goes well beyond identifying targets on published maps. Successful deep strikes require route planning around air defenses (requiring real-time understanding of Russian air defense radar and missile system positions), precise target location to metric accuracy, battle damage assessment, and the ability to identify follow-on targets based on reconstitution patterns.

Ukraine's drone program — which has produced both one-way attack drones and longer-range reconnaissance variants — provides some of this intelligence organically. Ukrainian-developed reconnaissance drones conducting pre-strike observation missions over Russian territory have provided targeting intelligence that is less dependent on Western sharing. This domestic capability development is important for Ukrainian operational autonomy in the political space where Western-shared intelligence comes with constraints on how it can be used against targets in Russia.

The targeting intelligence for deep strikes inside Russia — oil refineries in Saratov Oblast, airfields in Pskov, radar installations in Krasnodar Krai — nonetheless represents intelligence operations of considerable sophistication. Whether this intelligence derives from Ukrainian clandestine human intelligence networks operating inside Russia, technical collection from unmanned systems, open-source analysis of public imagery and infrastructure data, or some combination, it represents a systemic intelligence capability that Russia has found difficult to protect against.

Russia's Intelligence Failures

Russia's intelligence apparatus — the FSB (domestic), SVR (foreign), and GRU/GU (military intelligence) — suffered catastrophic failures before and during the Ukraine invasion that deserve detailed analysis because they help explain how Russia's military campaign went so badly wrong.

Pre-invasion FSB assessments of Ukraine's political readiness to resist were fundamentally wrong. The FSB's Ukraine desk had reportedly provided analyses predicting rapid Ukrainian political collapse — the government would flee, a pro-Russian alternative would be installed, and resistance would dissipate. These assessments were wrong on every dimension. Ukrainian political will to resist was vastly underestimated; Western response speed was underestimated; Ukrainian military capability, despite significant deficiencies, was underestimated; the global information environment response was not anticipated. Whether these failures reflected genuine analytical failure or a culture of telling Putin what he wanted to hear is debated by analysts.

Russian pre-war infiltration of Ukraine was extensive but apparently less effective than it appeared. Ukrainian counterintelligence operations in the years after 2014 had systematically degraded Russian human intelligence networks — identifying, turning, or neutralizing FSB and GRU assets that Russia believed were in place. The apparent confidence with which Russia planned rapid campaign success was therefore based partly on intelligence that was outdated, corrupted, or deliberately manipulated by Ukrainian counterintelligence.

Russian operational security during the war has been persistently poor. Commanders have communicated over monitored channels, troops have used consumer smartphones, and operational plans have been captured along with soldiers. The GRU's tradecraft in the opening phase of the war — teams of officers riding in civilian vehicles to Kyiv hotels to coordinate "administration" of a city that had not fallen — was exposed and its implications were intelligence gold for Ukraine. Russia adapted, but never fully closed the operational security gaps that Western intelligence exploitation had identified.