Several social media accounts on Twitter and Telegram have posted documents purporting to be classified US assessments of an expected Ukrainian spring offensive. The documents, first reported by the New York Times, claim to show some classified aspects of the readiness of the Ukrainian armed forces. The documents all carry a March 1, 2023, date. We do not know the provenance of the documents, which bears heavily on how we treat them. They appear to have originated in the Joint Chiefs of Staff. Also, keep in mind that they are images of pages, and no one, as far as I know, has seen the actual documents. It doesn’t mean they aren’t real; it only means there is ample room for shenanigans, as you’ll see below.

Uncertain Provenance

It seems like these documents first appeared on, of all places, a Discord server supporting a Minecraft community.

The Pentagon is investigating social-media posts that purport to reveal highly classified U.S. government documents on the war in Ukraine and other key international topics, in what could be one of the most dangerous intelligence breaches in decades.

Well over 100 images, marked with “Top Secret” and other classifications indicating they represent highly sensitive U.S.-produced intelligence, were posted in the Discord message board of fans of the Minecraft computer game around March 1. While many of them were deleted recently, open-source intelligence researchers have managed to download more than 60 files.
…
Aric Toler, head of research and training with the Bellingcat investigative consortium, said he found the cache of new documents on Friday, a day after at least six purported images of classified U.S. documents were published on the Telegram platform by pro-Kremlin war commentators. At least one of these images had been altered—to lower an estimate of Russian casualties and to inflate Ukrainian losses.

Those and some additional images had been posted on the 4chan messaging platform on Thursday.

On a personal note, this is the first time someone who blocked me for calling them out on their leftist bullsh** has been quoted in the Wall Street Journal.

@AricToler There are a lot more in the server pic.twitter.com/6kCI6emYB7

— BTR ENJOYER (@btr_fan21) April 7, 2023

The documents I’m looking at in this story are the ones referred to in the New York Times story and are the most circulated online. However, they are just the tip of the iceberg.

Other documents contained detailed information on the schedules and routes of U.S. and allied reconnaissance aircraft in the Black Sea; the vulnerabilities of some of the American weapons provided to Ukraine; and the composition and armaments of the nine Ukrainian army brigades being trained by the U.S. and allies for the coming spring offensive. Russian jets forced a U.S. MQ-9 Reaper drone to crash into the Black Sea on March 14, two weeks after these files were posted.

In addition to documents pertaining to the war in Ukraine, the leaked files included purported copies of the daily intelligence report provided to Defense Secretary Lloyd Austin and Chairman of the Joint Chiefs of Staff Army Gen. Mark Milley, Central Intelligence Agency reports on leaders of Israel’s Mossad spy service, and intelligence on discussions within the government of South Korea on sales of artillery ammunition to Kyiv. Most of the documents are dated in February and appear to have been posted online shortly after their creation. Many contain details of future operations.

The documents appear to have been printed out. The creases apparent in the documents hint that they were smuggled out of a secure workspace using the same method as the improbably named Reality Winner (Dear Leakers: Maybe Leaking to Glenn Greenwald’s Intercept Is Not a Good Evolutionary Strategy).

Classified information leaking out on gamer forums is not all that uncommon. The War Thunder forum has had this happen several times. Minecraft seems unlikely. It would be more plausible if they’d appeared on a hentai forum; at least then, we could assume Alexander Vindman was at work.

The Documents

Here are the documents and my commentary.

Slide #1

This slide claims to be a time sequence of training for new Ukrainian units, along with equipment availability for those units. When this slide was supposed to have been created, it showed equipment shortages. The security classification indicates it is SECRET, restricted to cleared US citizens and cleared Ukrainian, NATO, and Five Eyes personnel. I must admit to never having seen “FIN,” but that doesn’t mean it doesn’t exist.

The information on the slide is five weeks old and doesn’t tell us a lot that we can’t find in open source. The only item I found of interest is that artillery assigned to these Ukrainian brigades is towed. If the slide is accurate, this implies they are collecting the self-propelled howitzers into direct and general support units at a higher echelon.

Slide #2

This slide shows key events in training for Ukrainian forces and NATO exercises. Its classification is SECRET and restricted to US citizens (NOFORN). The need for variety on this slide is driven by the inset on the upper right that shows ammunition expenditures. As best as I can read from the image, it indicates that as of March 1, the Ukrainians had expended 952,856 155mm artillery rounds and 9,612 HIMARS rockets (Guided Multiple Launch Rocket System or GMLRS). According to the slide, the Ukrainians had 9,788 155mm rounds and 250 HIMARS rockets on hand. Don’t use them all in one place.

More importantly, it shows no HIMARS rockets and only 30,000 155mm rounds due to Ukraine by March 13.

This information does not square with what we know from other public documents. The United States has provided Ukraine with over 1.5 million 155mm rounds. Other NATO nations, like Germany, have also given 155mm ammunition to Ukraine. Ukraine has been shooting about 20,000 rounds per day. If the graphic is correct, the Ukrainians would have been out of ammunition by the time the slide came off the printer. But there was no reported slackening of artillery fire.

I could be reading the slide wrong, and it is counting something other than total rounds, and I’m open to that possibility. However, if my reading of the slide is correct, then there will be no Ukrainian spring offensive because there isn’t enough artillery ammunition to support such an event.

Slide #3

Slide #3 is supposed to show the combat status and location of Russian and Ukrainian forces in Donetsk. It is classified as Top Secret and compartmented. The identifiers HCS-P (compartmented product), SI-G (signals intelligence from a subprogram, G, of the classified GAMMA program), TK (imagery from a specific surveillance satellite type), FGI (Foreign Government Information), RSEN (risk-sensitive), ORCON (originator controlled), NOFORN (No Foreign Distribution), FISA (information derived under the Foreign Intelligence Surveillance Act). The last code means that information collected via a FISA warrant is in the document. This strikes me as odd because the slide’s content contains nothing that would have been collected by surveillance of a Trump campaign staffer US person. In my experience, which could be outdated, the FGI marking should be followed by the country code of the country owning the information. A possible explanation is that this slide was part of a more extensive presentation that included materials from all those categories, and someone labeled each slide to reflect the highest classification.

This is one slide where known shenanigans exist. They are in the box titled “Total Assessed Losses.”

When secret U.S. slides leaked out yesterday, Russian propaganda channels quickly reposted them — but after a little photoshop. Suddenly, 43.5k 🇷🇺 fatalities turned to 17.5k, while 17.5k 🇺🇦 KIA became 71.5k. Russian vehicle losses shrank from 6,004 to 600. Spot the differences. pic.twitter.com/8lyoWaKcwj

— Yaroslav Trofimov (@yarotrof) April 7, 2023

If you look at the number of Russian ground vehicles destroyed in the two images, you can spot where the comma was made to go away. Over 6,000 Russian vehicles have been individually verified as destroyed on video, which means the true number is higher, as you can only count losses caught on images. Likewise, the claim that Russia has had 17,500 KIA while Ukraine has had 71,500 is just nonsense.

You’ll also note that Russian fixed- and rotary-wing aircraft losses have been edited from 72 and 82, respectively, to 7 and 8. Images and video document the 72/82 number, which, again, is the minimum loss.

Another point that makes me very skeptical about this slide is the extreme classification level when it just isn’t terribly detailed. Not that DOD and the JCS are any strangers to over-classification, but this seems excessive even by the high bar set.

Slide #4

The only reason I can think of Slide #4 being classified is contextual. By inserting it in a slide deck focused on the war in Ukraine, you’ve pointed out possible windows of operation.

Slide #5

Slide #5 is an unclassified slide showing unit locations outside Donetsk City. I think we should treat it as of doubtful authenticity, if for no other reason than it shows Russian units in greater detail than Ukrainian. Giving strength as “10,000 — 20,000” of the army you are training and supplying doesn’t fill one with confidence. It would’ve been more credible to say “some — a lot.”

Real — Not Real

We know there are at least two copies of some of the slides circulating because there was a motive for people to alter them. At this point, it is difficult to assess the legitimacy of the original documents. I’m not sure why someone would photograph rather than scan the images unless they are trying to use the photography to lend credibility to the documents. Also, posting them on a Minecraft Discord, where they were apparently unnoticed for over a month, seems strange.

The reaction of the Biden White House was also curious.

Biden officials were working to get them deleted but had not, as of Thursday evening, succeeded.

This is almost as if to underscore the recent Twitter Files and Jim Jordan’s “weaponization of government” committee’s work, as well as draw attention to the documents.

Yeah, you can totally delete things from the Internet – that works perfectly and doesn’t draw attention to whatever you were trying to hide at all

— Elon Musk (@elonmusk) April 7, 2023

Is this an elaborate prank? Why did the documents take over a month to move from the original location to social media? Are the documents real and leaked by a pro-Russian staffer in the JCS? Are the documents the cyber equivalent of Operation Mincemeat? Are the documents real, and are the altered images an attempt to discredit the leak? Your guess is as good as mine.

Impact

I don’t know about the other documents, but the five that we have are inconsequential. All the information here is already known to Russia if it still has a functional intelligence service operating in Poland, Germany, and Ukraine. Moreover, even accepting they are legitimate, the documents are dated March 1 and show the state of play as of late February.

On the whole, assuming the documents we have seen are real, I don’t think they provide any material aid. Knowing unit status on March 1 is interesting, but I’m not sure how it helps.