Russia’s quest to sabotage Ukrainian forces’ internet access by targeting the Starlink satellite operations that billionaire Elon Musk has provided to Kyiv since the war’s earliest days appears to be more advanced than previously known, according to a classified U.S. intelligence report obtained by The Washington Post.
Moscow has experimented for months with its Tobol electronic warfare systems in a bid to disrupt Starlink’s transmissions in Ukraine, the top-secret assessment, which has not been previously disclosed, contends.
The document, among a cache of sensitive materials leaked online through the messaging platform Discord, dates to March and does not indicate whether any of Russia’s tests have been successful. But the intelligence finding is striking nonetheless as it appears to affirm what observers had only hypothesized previously: that a program ostensibly designed to protect the Kremlin’s satellites can be employed instead to attack those used by its adversaries.
SpaceX, the firm that owns Starlink, declined to comment. Last spring, Musk briefly addressed the Kremlin’s attempts to target the technology, writing on Twitter in May that while Starlink had demonstrated its resilience against such “jamming & hacking” attempts, the Russians appeared to be intensifying their efforts.
The Pentagon did not address questions about the leaked assessment. “These systems constitute an important layer in Ukraine’s communications network,” said Maj. Charlie Dietz, a Defense Department spokesman. The department’s focus, he added, “remains on getting the Ukrainians the satellite capabilities they need.”
Kostiantyn Zhura, a spokesman for the Ukrainian Defense Ministry, said that officials in Kyiv are aware of Russia’s efforts and “taking measures to neutralize them.” The Russian Embassy in Washington did not respond to a request for comment.
Starlink has proved vital to Ukraine’s military, which relies on the small portable terminals to communicate across the battlefield and relay intelligence. Russian forces have had success disabling the Ukrainians’ ability to use other communications equipment, including radios and cellphones, but the satellite signals are harder to disrupt.
Last fall, Musk faced backlash from Ukrainian leaders after putting forward a plan to end the war that critics deemed overly favorable to Russia. Weeks later, the business mogul was criticized again when he threatened to halt funding for the emergency Starlink service. The blowback caused him to quickly reverse course.
It is unclear whether Starlink outages that have been reported in Ukraine were the result of Russia’s Tobol experiments or other jamming capabilities used by Russian forces, such as the truck-mounted Tirada-2 system. Ukrainian troops reported having experienced disruptions in October, as they moved toward Russian positions during successful counteroffensives in the south and east. Ukrainian officials suggested at that time that SpaceX had restricted internet access in those areas to prevent the Russians from using the service, according to a report in the Financial Times.
Analysts have identified at least seven Tobol complexes in Russia, all of which are located next to facilities used to track satellites, according to a report released this month by Secure World Foundation, a privately funded group focused on space security and sustainability. Some of the sites are headquarters for mobile jammers, analysts said.
1/5
Satellite interference can happen in two places: in space, by targeting the satellites directly, and on the ground, where weapons can target receivers, according to the Secure World Foundation. The interference that happens in space, what’s known as uplink jamming, blends a signal with the original broadcast, which distorts the information all users of that satellite receive. Tobol almost certainly works in this way, according to Bart Hendrickx, a researcher who has followed the program closely.
The ground-based method, known as downlink jamming, transmits a signal on the same frequency as the satellite, which prevents connected devices from receiving the legitimate signal. That method has a smaller area of effect because it depends on a jammer getting relatively closer to systems it intends to disrupt.
Musk said last year that a software patch helped overcome Starlink terminal interference. It’s unclear whether that is a reference to downlink jamming. Tobol is designed to disrupt the signal itself on its way to the terminal.
The leaked document describes “Russia’s ongoing military operational experiment to target the Starlink satellite communications system over Ukraine with Russia’s Tobol-1” and identifies three locations within Russia where the tests were conducted. The “estimated center” of where they were directed, near Bakhmut in Ukraine’s eastern Donetsk region, has seen the war’s heaviest fighting so far this year.
Russian Tobol complexes that attempted
to jam Starlink
200 MILES
EST.
RUSSIA
Pionerskiy
LAT.
Shcholkovo
LITH.
Moscow
RUSSIA
Where Russia
has tried
to jam Starlink
connectivity
BELARUS
POL.
Kyiv
UKRAINE
SLVK.
HUNG.
Russian-held
area
ROM.
Armavir
CRIMEA
Illegally annexed by
Russia in 2014
BULG.
GEORGIA
Black Sea
Sources: Locations from the Secure World Foundation.
Estimated target area from U.S. classified documents.
Russian Tobol complexes that attempted to jam Starlink
200 MILES
EST.
RUSSIA
Pionerskiy
LAT.
Shcholkovo
Moscow
LITH.
RUSSIA
Where Russia
has tried
to jam Starlink
connectivity
BELARUS
POL.
Kyiv
UKRAINE
SLVK.
Bakhmut
Dnieper
Russian-held
area
HUNG.
ROM.
Armavir
CRIMEA
Illegally annexed
by Russia in 2014
BULG.
GEORGIA
Black Sea
Sources: Locations from the Secure World Foundation. Estimated
target area from U.S. classified documents.
Russian Tobol complexes that attempted to jam Starlink
Pionerskiy
LAT.
Shcholkovo
Baltic
Sea
Moscow
LITH.
RUSSIA
RUSSIA
BELARUS
POLAND
Where Russia
has tried to jam
Starlink connectivity
Kyiv
Lviv
UKRAINE
Bakhmut
SLOVAKIA
Dnieper
Russian-held area
HUNGARY
Odessa
ROMANIA
Armavir
CRIMEA
Illegally annexed
by Russia in 2014
Black Sea
BULGARIA
GEORGIA
200 MILES
Sources: Locations from the Secure World Foundation. Estimated target area from U.S. classified documents.
The experiment, launched in late September, was meant to last 25 days, the U.S. intelligence assessment says, but more than five months had elapsed since the start of the tests and when the leaked document was prepared for senior U.S. officials. The briefing slide does not say why the experiment had gone on so long, if Russia had encountered any problems, or whether the operation had had its intended effect.
Although Russia’s positioning of Tobol complexes across the country could suggest they are being used for defensive purposes, the three sites disclosed in the U.S. intelligence assessment — one outside Moscow, a site near Crimea and another in the western Russian exclave of Kaliningrad — are the closest facilities to Ukraine, making them suitable for an offensive operation. Their coverage area seems to envelop all of Ukraine, said Brian Weeden, director of program planning at the Secure World Foundation.
“The public documentation that we have talks about it being a defensive system, in that Tobol would be used to detect somebody else trying to jam or interfere with Russian satellites. It would analyze those interfering signals, and then broadcast a counter-signal that would try to negate the interference,” Weeden said.
“But if you can do that,” he added, “you can probably use those same capabilities to offensively interfere with somebody else’s satellite.”
There are only faint hints and disclosures publicly available about the Tobol program, referred to in Russian documents as 14Ts227, and its capabilities have been a mystery for years. Researchers said the program appears to have started about a decade ago.
Hendrickx, a Belgium-based amateur researcher whose uncovering of Russian procurement and court documents has yielded most of the limited public information available about the Tobol program, initially concluded that the system was defensive in nature, according to his 2020 analysis published by the Space Review. But further analysis, underpinned by court documents describing “specialized complexes for the electronic attack of space assets,” led to fresh revelations, and he predicted last year that Tobol can be used offensively.
Starlink satellites pass over the earth low enough such that Tobol is likely able to beam interference signals at them, Hendrickx said in an interview. But challenges remain.
“The problem with Starlink,” he said, “is that you have an awful lot of satellites there. It’s kind of difficult to jam them all, or even a large number.” Hendrickx acknowledged, though, that disrupting even some could help Russian commanders by throwing Ukrainian troops into disarray.
David L. Stern in Mukachevo, Ukraine, and Christian Davenport in South Padre Island, Tex., contributed to this report.
In exclusive interviews with a member of the Discord group where U.S. intelligence documents were shared, The Washington Post learned details of the alleged leaker, “OG.” The Post also obtained a number of previously unreported documents from a trove of images of classified files posted on a private server on the chat app Discord.
How the leak happened: The Washington Post reported that the individual who leaked the information shared documents with a small circle of online friends on the Discord chat platform. This is a timeline of how the documents leaked.
The suspected document leaker: Jack Teixeira, a young member of the Massachusetts Air National Guard, was indicted on six charges in the investigation into leaks of hundreds of pages of classified military intelligence. The Post reported that the individual who leaked the information shared documents with a small circle of online friends on the Discord chat platform. Here’s what we learned about the alleged document leaker.
What we learned from the leaked documents: The massive document leak has exposed a range of U.S. government secrets, including spying on allies, the grim prospects for Ukraine’s war with Russia and the precariousness of Taiwan’s air defenses. It also has ignited diplomatic fires for the White House. Here’s what we’ve learned from the documents.