Off-course: Disinformation and conspiracy theories in the aftermath of the central Kramatorsk strike
By Pierre Vaux.
This report includes links to graphic footage showing injured civilians and damage to civilian infrastructure.
On Tuesday 27 June 2023, a missile strike on central Kramatorsk left at least thirteen people dead and dozens injured. The attack struck a busy pizza restaurant and hotel complex, which was popular with both locals and visitors, such as journalists and aid workers. Three children were among the casualties.
In the aftermath of this horrific attack, several, at times contradictory, disinformation narratives circulated on social media - chief among them that this was a Russian attack on a gathering of Ukrainian or foreign soldiers; and that this was an accidental misfire by a Ukrainian-launched, British-made Storm Shadow missile. This report will focus on the latter claim, detailing how such a story came to prominence.
To understand the development of these narratives, CIR conducted a chronological analysis of events of that day and found much of the information originated from a separate incident earlier in the day, in which a smaller missile impact was reported to have shattered the windows of a petrol station in south Kramatorsk. Local reports and CIR analysis of the wreckage indicates that this was caused by a US-made guided missile, fired from either an aircraft or an air-defence system on land, going off course.
It was this incident that was presented by Russian state media as an accident involving a British Storm Shadow missile, despite evidence to the contrary.
When the restaurant and hotel in central Kramatorsk were struck, Russian accounts focused on the presence of foreigners, claiming they were active NATO servicemen.
Significantly, a US right-wing conspiracy theorist on Twitter fused the two Russian disinformation campaigns, creating a new narrative that the restaurant was struck by a Storm Shadow. This claim was then shared with over 3.4 million people by David Sacks, a venture capitalist and associate of Elon Musk.
This report details the events, and the responses in the information space, as they developed over the course of the day.
The misfired missile
Hours before the devastating attack on central Kramatorsk, local residents reported the launch and impact of a missile, shattering windows at a petrol station in the south of the city. Fragments of the missile indicate it was a guided missile made in the United States, possibly an AGM-88 HARM or AIM-7 Sparrow.
Timeline of events
Note: All times in this report are given in British Summer Time (UTC+1).
11:58. Local Telegram channel ‘I Love Kramatorsk’ shared an image of a smoke trail “over the old town” reporting “bangs”.
Figure 1: Image posted by ‘I Love Kramatorsk’ on Telegram.
12:17. A follow-up post stated that something had crashed and exploded near Yuzhna street.
Figure 2: ‘I Love Kramatorsk’ post on Telegram.
12:30. ‘I Love Kramatorsk’ gave a breakdown of events and outlined two possible scenarios: that Ukrainian air defence had fired on one of their own aircraft, or that the aircraft had fired a missile that malfunctioned and went off-course.
13:05. Telegram channel ‘Operativny Kramatorsk’ posted an image of a fragment of the munition that had exploded.
Figure 3: The fragment of debris posted by Operativny Kramatorsk.
The “NSN 1420-01…” text visible is the beginning US National Stock Number, indicating that this fragment belonged to a US-made guided missile component.
13:19. RFE/RL’s Ukrainian service, Radio Svoboda, posted more images of debris from the weapon and a video from the scene of the impact, showing broken windows. CIR investigators have verified the location as the Terminal petrol station, just off Pivdenna street:
Figures 4 and 5: Comparison of images from Telegram video (above) with Google Maps image of the Terminal petrol station [48.729968, 37.567753].
Figure 6: Radio Svoboda image of debris found near the Terminal petrol station.
Based on the geometry of the nose cone (which does not have a lens port for infrared or optical seekers), the limited number of radio-frequency guided missiles known to be provided by the United States, and the legible portion of the NSN code, it is possible it was either an AGM-88 HARM anti-radiation missile or an AIM-7 Sparrow. AGM-88 HARM missiles are used on Ukrainian MiG-29s, conducting strikes on Russian air defences and AIM-7 Sparrow have been supplied to Ukraine for use on Buk and Aspide air defence systems.
Figure 7: Image of a training version of an AGM-88 HARM fitted on a US Navy A-7B Corsair II. Photo: biomckill on Flickr.
It is likely that the missile misfired or malfunctioned. On 26 September 2022, an AGM-88B, fired by a Ukrainian MiG-29, struck the fifth floor of an apartment building in Kramatorsk, having possibly malfunctioned.
Russian disinformation campaign capitalises on the missile incident
Using images from the local channels above, Russian state media claimed that this first explosion in Kramatorsk was caused by a British Storm Shadow cruise missile. A concerted campaign to promote this narrative in multiple languages quickly became apparent on social media.
Just over an hour later at 14:29, Ukraina.ru, a Ukraine-focused news site and Telegram channel run by the Russian state-owned Rossiya Segodnya (Russia Today) media group, posted two of the images from Kramatorsk, claiming that a Ukrainian aircraft had fired a British-made Storm Shadow cruise missile, which had gone off-course and struck Kramatorsk:
Figure 8: Ukraina.ru post on Telegram.
It should be noted that there is no indication from the material posted on the local Kramatorsk channels that the missile was a Storm Shadow. The serial numbers on the fragment do not suggest a UK origin, and the damage to the petrol station was minor compared to the catastrophic damage one would associate with Storm Shadow.
Regardless, a concerted effort was made to amplify this deceiving version of events. Before 15:00, posts were already appearing on Telegram, Twitter, and blog comments sections, in multiple languages, including Russian, Polish, English and Indonesian, copying the materials from Ukraina.ru.
Figure 9: Identical posts at the same time in English and Indonesian.
The accidental strike story was also amplified at 16:16 by Rossiyskaya Gazeta, the official newspaper of the Russian government, crediting Ukraina.ru.
The Russian strike on central Kramatorsk
In the early evening of 27 June, a devastating missile struck central Kramatorsk, killing 13 people in total and injuring at least 60. Three of the dead were children, and an eight-month-old baby was among the wounded. Russian state media presented this as a successful strike on military forces, and as video of foreigners emerged (due to the restaurant being popular with journalists and aid workers), the narrative shifted to claims that American soldiers were targeted.
According to Pavlo Kyrylenko, the head of the Donetsk Oblast Military Administration, two missiles struck the Kramatorsk hotel and RIA Pizza Bar at 17:30. Social media evidence reflects this, with the first reports on Telegram appearing at 17:29.
Ukraina.ru first reacted to the news at 17:43:
“There are reports of another powerful explosion in Kramatorsk. Have the Banderovtsy hit themselves with a missile from their aircraft again?”
Russian state propaganda began promoting the narrative that this was a strike on a military target. For example, at 19:46, Ukraina.ru claimed that there was information “in the Kramatorsk chats” that soldiers had been targeted in the attack. The post used a purported screenshot from a Kramatorsk chatroom on Telegram stating “There was a staff party of soldiers there. I went past half an hour before the impact”.
“It’s a strike!” concluded Ukraina.ru. This was immediately amplified by Vladimir Solovyov and Starshe Eddy, whose responses were in turn shared by Ukraina.ru.
At 20:50, Ukraina.ru noted that foreigners were among the casualties and that “one of them has an interesting tattoo on his arm”. A follow-up Telegram post at 22:31 claimed that the tattoo, of a number 3 enclosed in a trapezoid, was a sign that the man was a member of the US Army’s 3rd Ranger Battalion.
On Thursday 29 June, the Russian Ministry of Defence boasted that the attack had been a dramatic success, and claimed to have killed two Ukrainian generals at the site, which was purportedly being used by the Ukrainian 56th Mechanised Infantry Brigade.
US conspiracy theorist fuses the two strikes
Much of the Russian propaganda around the attack would not have achieved significant traction internationally had it not been picked up and incorporated into a wider conspiratorial web by American Twitter users.
At 00:15 a Twitter-verified account called “US Civil Defense News” tweeted:
“Russian Kramatorsk missile strike obliterated a Ukrainian military barracks housing foreign soldiers and mercenaries! The casualties are still being counted and will be very hard due to NATO attempts to cover their troops in Ukraine!”
Two minutes later, the tweet was edited to remove the word “Russian” at the start. Finally, at 00:19, US Civil Defense News amended their tweet drastically to match the language used in the original Ukraina.ru claim:
“Ukraine fighter jets accidentally launched a missile attack on Kramatorsk! An hour later, the Ukrainian jets tried to strike again, but something went wrong. Storm Shadow missile suddenly changed trajectory dramatically, hitting Kramatorsk obliterated a Ukrainian military barracks housing foreign soldiers and mercenaries! The casualties are still being counted and will be very hard due to NATO attempts to cover their troops in Ukraine!”
The claim that men were seen wearing 101st Airborne Division t-shirts, based on a low-resolution screenshot, had begun circulating on Twitter and 4chan the night before. The earliest example seen by CIR was a Spanish-language tweet at 22:37.
Meanwhile, the claim about US Black Hawk helicopters evacuating personnel from Kramatorsk stemmed entirely from a tweet by a Twitter Blue subscriber called ‘CheburekiMan’:
Figure 10: Screenshot of CheburekiMan’s tweet about the Black Hawk.
Examining the FlightRadar track for that helicopter revealed that it flew from a site near the Bulgarian village of Mokren, west of Burgas, and landed at Constanta in Romania, around 529 miles from Kramatorsk. The aircraft did not fly anywhere near the Ukrainian border and the crew did not disable their transponder during flight.
US Civil Defence News, “verified” by Twitter, uses the name and logo of the US Civil Defence service, which was absorbed into the Federal Emergency Management Agency (FEMA) in 2006. The logo is still used in a simplified form in FEMA branding. It is important to note that this account is not connected to the US government.
Twitter’s policies on their notorious “blue ticks” have changed frequently and without detailed explanation since the social network was acquired by Elon Musk in October 2022. For a while, a user who clicked on the tick after a screen name would see if that account had been verified by the company as legitimately belonging to a public figure or institution, or whether they had paid $8 to subscribe to a service then known as “Twitter Blue”. However, at the time of writing, a click on “US Civil Defense News” states that the account is “verified”, which is highly misleading.
Figure 11: US Civil Defense News verification notice on Twitter
The fused conspiracy theory presented by US Civil Defence News was shared with a vast audience by David Sacks, an American venture capitalist and close friend of Twitter owner Elon Musk. Sacks’ reply to the US Civil Defence News post, which took the information at face value, received over 3.4 million views.
Figure 12: Screenshot of David Sacks’ interaction with US Civil Defence News on Twitter.
CIR has been able to identify, using open-source methods, an individual who very likely runs the US Civil Defense News account. While CIR is not disclosing their name publicly as they are not a public figure, CIR has reason to believe they are a US citizen living in California with no apparent past or present government experience. They do not appear to have any connections to the Russian state, but do espouse views and use language indicative of believing in elements of the QAnon conspiracy cult. This is important to stress, as it means that this is not in itself a Russian information operation, but a new conspiracy theory born of merged elements from various Russian disinformation campaigns and broad assumptions on the nature of the conflict.
Interestingly, there are two other “Civil Defense News” accounts on Twitter that were created recently. The first has an identical username and profile pictures to the one discussed above, but with the handle ‘@ScottBoolm39878’ which is apparently dedicated to cryptocurrency promotions.
Figure 13: @ScottBoolm39878 on Twitter.
The second, created just after the Kramatorsk strike, is called ‘Civil Defense International News’, and has so far replicated the Kramatorsk conspiracy from US Civil Defense News verbatim.
Figure 14: ‘@civildefnews’ on Twitter.
This case study demonstrates the way in which Russian disinformation campaigns, deliberately distorting true events and amplifying them in a concerted manner in multiple languages, can bear fruit when Western conspiracy theorists combine elements of them with other information. At no point did the Russian campaign link the strike on the restaurant with the distorted claim about a Storm Shadow misfire. This association was generated entirely by US Civil Defense News, who swiftly added in further conspiracies such as the Black Hawk helicopter track, to produce an exciting narrative.
That this was then picked up and disseminated to an audience of millions by David Sacks is testimony to the importance of basic media literacy and the significant flaws of Twitter’s new verification system.