Ukraine War Plans Leaked

Russia is circulating doctored versions of plans for a Ukrainian counteroffensive.

NYT (“Ukraine War Plans Leak Prompts Pentagon Investigation“):

Classified war documents detailing secret American and NATO plans for building up the Ukrainian military ahead of a planned offensive against Russia were posted this week on social media channels, senior Biden administration officials said.

The Pentagon is investigating who may have been behind the leak of the documents, which appeared on Twitter and on Telegram, a platform with more than half a billion users that is widely available in Russia.

Military analysts said the documents appear to have been modified in certain parts from their original format, overstating American estimates of Ukrainian war dead and understating estimates of Russian troops killed.

The modifications could point to an effort of disinformation by Moscow, the analysts said. But the disclosures in the original documents, which appear as photographs of charts of anticipated weapons deliveries, troop and battalion strengths, and other plans, represents a significant breach of American intelligence in the effort to aid Ukraine.

Biden officials were working to get them deleted but had not, as of Thursday evening, succeeded.

“We are aware of the reports of social media posts and the department is reviewing the matter,” said Sabrina Singh, the deputy press secretary at the Pentagon.

A bizarre situation, indeed. Rather clearly, this is an authentic leak of highly classified war plans. Otherwise, the administration would neither be investigating the leak nor trying to get them taken down. (The point of the latter at this stage is not obvious.) And, yet, it appears that the Russian government doctored them for propaganda purposes before posting them to social media.

The documents do not provide specific battle plans, like how, when, and where Ukraine intends to launch its offensive, which American officials say is likely coming in the next month or so. And because the documents are five weeks old, they offer a snapshot of time — the American and Ukrainian view, as of March 1, of what Ukrainian troops might need for the campaign.

To the trained eye of a Russian war planner, field general or intelligence analyst, however, the documents no doubt offer many tantalizing clues and insights. The documents mention, for instance, the expenditure rate of HIMARS — American-supplied high mobility artillery rocket systems, which can launch attacks against targets like ammunition dumps, infrastructure and concentrations of troops, from a distance. The Pentagon has not said publicly how fast Ukrainian troops are using the HIMARS munitions; the documents do.

Given how long the Russians have had rocket artillery, one suspects they already had a pretty good idea.

“Whether these documents are authentic or not, people should take care with anything released by Russian sources,” said Michael Kofman, the director of Russian studies at CNA, a research institute in Arlington, Va.

For example, one of the slides said 16,000 to 17,500 Russian soldiers had been killed while Ukraine had suffered as many as 71,500 troop deaths. The Pentagon and other analysts have estimated that Russia has suffered far more casualties, with closer to 200,000 killed and injured, while Ukraine has had more than 100,000 killed and injured.

Nonetheless, analysts said parts of the documents appeared authentic and would provide Russia with valuable information such as the timetables for the delivery of weapons and troops, Ukrainian troop buildup numbers and other military details.

A document labeled “top secret” offers the “Status of the Conflict as of 1 Mar.” On that day, Ukrainian officials were at an American base in Wiesbaden, Germany, for war game sessions, and a day later, Gen. Mark A. Milley, the chairman of the Joint Chiefs of Staff, and Gen. Christopher Cavoli, the supreme allied commander for Europe, visited the sessions.

Another document includes columns that list Ukrainian troop units, equipment and training, with schedules for January through April. The document contains a summary of 12 combat brigades that are being assembled, with nine of them apparently being trained and supplied by the United States and other NATO allies. Of those nine brigades, the documents said that six would be ready by March 31 and the rest by April 30. A Ukrainian brigade has about 4,000 to 5,000 soldiers, analysts said.

The document said that equipment delivery times would impact training and readiness in order to meet the timeline. Total equipment needed for nine brigades, the document said, was more than 250 tanks and more than 350 mechanized vehicles.

The motive of the leaker is unclear. Money, blackmail, or politics are the usual suspects. One certainly hopes they’re caught and prosecuted to the fullest extent of the law.

FILED UNDER: Intelligence, National Security, World Politics, , , , , , , , , ,
James Joyner
About James Joyner
James Joyner is Professor and Department Head of Security Studies at Marine Corps University's Command and Staff College. He's a former Army officer and Desert Storm veteran. Views expressed here are his own. Follow James on Twitter @DrJJoyner.


  1. MarkedMan says:

    Can anyone blame me if my immediate thought that the leaker was one of the Trump Trash still left in government?

  2. Michael Reynolds says:

    If the doc has been altered by the FSB then the FSB got the docs first, which means it wasn’t a leak it was espionage.

  3. MarkedMan says:

    @Michael Reynolds: “Leak” might have been a poor choice of words. “Source” is better. The Russians got it from someone, unless they got it through hacking.

  4. Jay L Gischer says:

    While I take this seriously, and want the source to be found, removed, and punished, I am also suspicious.

    James says that the efforts made by the Administration authenticate the document. Which seems reasonable. Except that if you were trying to float some disinformation of some kind, that would be a thing you would do, right? To authenticate the document. Counterintelligence is a crazy business.

    I think the bottom line is that I don’t know anything about this one way or another. Perhaps more will be known about this at a later date, but there’s a possibility it won’t happen within my lifetime.

    By the way, my best guess for the source is hacking of some form, probably including some social engineering.

  5. Andy says:

    There are two versions floating around – one appears to be original and the other appears to be photoshopped to make the casualty figures decisively in Russia’s favor.

    I’ve looked at the images online, and I think they are genuine. If they are fakes, then they were made by someone who has very detailed knowledge of these types of products and the SCI compartments referenced. Since the US government is acting like these are real, then I tend to be skeptical of claims they are faked.

    This is a serious breach as the documents reveal potential sources and methods, the fact that the US is collecting on Ukraine, and the readiness levels of the new Ukrainian units. As an analyst, it’s all very interesting to me and it’s very useful to get some insight into the Ukrainian side that isn’t filtered through the propaganda of Twitter and the media, but at the same time it’s damaging to the Ukrainian effort in a number of ways and also the US, NATO and Ukraine partnership. A lot of details on the new units Ukraine is building is stuff the Russians probably already know or suspect, but this will be confirmation and will likely provide important OOB details and especially timelines for unit readiness.

    It also helps resolve some of the debates about Ukrainian losses, especially regarding tanks and APC’s. There’s been a debate on if Western tanks were going to be backfill to replace UKR losses, but this makes clear those losses have already happened and western tanks are needed to complete these new units. It also shows that the promised tanks are not enough as there are still gaps in the OOB and that is with brigades that are already – on paper at least – understrength in terms of equipment. This is bad because it suggests that once these new units start fighting in the coming spring offensive, there are no available reserves to replace lost equipment, especially tanks and APC’s. It’s clear now why Ukraine has been so strident about getting armored vehicles from the west – they really do desperately need them and now.

    So we get back to the question I’ve been discussing here for many months – the question of sustainment. Losses happen, attrition happens, accidents happen – this type of war burns through ammunition and equipment and Ukraine can’t replace it as fast as the Russians can, although the Russians face the same problem.

    The US and NATO are now going to pull a million artillery shells out of stockpiles (because we can’t make them fast enough) to support Ukraine’s offensives this year. A million sounds like a lot, but it goes quickly when you are shooting tens-of-thousands of rounds per day supporting offensive operations.

    Anyway, I think this supports the idea that the next few months could be decisive to the outcome of this war. Russia’s offensive gained little and is culminating soon if it hasn’t already. Ukraine will have the opportunity for its own offensive and a lot will be riding on that because Ukraine probably probably only has the assets for one or two major pushes this year before they will have to reconstitute, and for that, they will need even more Western support and equipment. So an offensive that doesn’t make significant gains will mean a return to the kind of attritional fight that doesn’t advantage Ukraine.

    The West, particularly Europe, has been slow to respond and increase production capacity to the level necessary to support the war in Ukraine. That means Western governments will have to face the choice of dipping deeper into stockpiles or taking equipment from their own military forces to give to Ukraine to replace the inevitable Ukrainian losses. This is the product and consequence of Europe’s multi-decade underinvestment in defense and reliance on the US.

  6. Neil Hudelson says:

    The way these were leaked were…just what you’d expect in 2023: a guy in a flame fight on 4chan posted screenshots of status maps in order to win a fight. He has since revealed he got those maps…on a Discord server devoted to Minecraft, presumably also posted there to win a flame war. Where did poster get them? Why from a WowMao discord server of course. Where did the WowMao discord poster get them? Who knows, the WowMao server was deleted a few weeks ago.

    Assange has spent 10+ years in prison (real and self-imposed) for a business model made obsolete by trolls on meme creator servers. (And also the rape thing. Can’t forget he’s in prison for the rape thing. And the fleeing to escape justice for the rape thing, thing.)

  7. Andy says:

    I also want to note this ties into things I’ve discussed here before – namely a VIP culture and really crappy information and classified security.

    These are printed documents, in color on nice big sheets of paper, and they are high-level products made for senior leader briefings. The fact that these were printed, and have no tracking or accountability information on them, is egregious, but unfortunately, is typical since VIP’s like paper documents. The problem, of course, is that these documents do not have any formal accountability system – they are technically working papers to be shredded once used. But it’s easy for these to get “lost” and because there is no formal accountability, probably no one knows they are lost.

    It’s this same sort of lazy security practices that resulted in classified documents sitting in Pres. Biden’s garage and other places, and which allow allowed Trump to take documents without anyone knowing about it.

    So again, I really hope Pres. Biden addresses this problem, but I bet, as has happened in the past, that nothing with change, and the demands for convenience by senior leadership will continue to trump good security practices.

  8. Andy says:

    @Neil Hudelson:

    Thanks for the link to Toler’s thread – Toler is the real deal and a credible analyst.

  9. Andy says:

    Jesus, it’s not just the three documents I’ve seen:

    All paper documents. All were photographed and uploaded in early March. What a fucking shit show. Heads are going to roll.

  10. Mikey says:

    @Andy: From the fold lines it looks like they were all printed out at once and the stack of papers was folded and presumably stuffed in the individual’s pocket, then later unfolded and photographed.

    I hope whoever did this is found and put away for a very long time.

  11. Thomm says:

    It seems, according to the nyt:
    That more have been found online including middle east and China strategies. Seeing that I was reminded that Mike Flynn’s brother (who also had a bit of a role in Jan 6) is still on the job as a general somehow. Nah..the brother and uncle of straight up traitors that are friends of Putin would never…

  12. Andy says:


    From the fold lines it looks like they were all printed out at once and the stack of papers was folded and presumably stuffed in the individual’s pocket, then later unfolded and photographed.

    Nice catch!

    They caught Reality Winter because classified printers often print subtle patterns that can be traced back to a specific printer – they might be able to do that if the original images are high enough resolution.