Content uploaded by Ramon Loik
Author content
All content in this area was uploaded by Ramon Loik on May 14, 2023
Content may be subject to copyright.
16 Diplomaatia • Lennart Meri Conference 2023
A Second Front:
EU-Ukraine
Cooperation in the
Internal Security
Domain
A rising need to protect Ukrainian war refugees
against organised crime networks, investigation
of war crimes, combatting human tracking
and rearms smuggling, and enforcement of
sanctions are the main concerns and cooperation
priorities between the EU and Ukraine in the
internal security domain.
RAMON LOIK
Security Politics Researcher
Estonian Academy of Security Sciences
Russia’s full-scale conventional invasion
of Ukraine marks the second wave of
contemporary strategic warning for the
European Union since the Balkan wars
of the 1990s. The subsequent spread of
international terrorism, as well as the
interdependence of internal and exter-
nal challenges, forced the EU to adopt
its rst-ever European Security Strategy
(ESS).
With this, the EU began to dene itself
as a security actor with global responsibil-
ities and called for a proactive strategic
culture in Europe that could foster early,
rapid, and – when necessary – robust
intervention.
The ESS formulated an ambition that
the EU was tasked to accept as a bold
vision but has not achieved so far in terms
of hard security capabilities. However,
when Russia started its war of aggression
against Ukraine, it met a different, much
more united, and decisive European Union
than it had expected. What the Kremlin
certainly did not expect was that already
in June 2022, the European Council would
grant Ukraine candidate status for EU
membership. The European Union thus
assumed a political obligation and a moral
responsibility to protect the sovereignty
and territorial integrity of Ukraine.
Sanctions
Together with the US, the EU has
imposed ten historic sanctions packages
(as of April 2023). According to the Euro-
pean Council’s data, the EU has frozen
ANALYSIS. Ukraine, EU, Security
Lennart Meri Conference 2023 • Diplomaatia 17
Policecadetsattendingtheirgraduationon12April2023,inKyiv.Zumapress.com/Scanpix
321.5 billion euros worth of Russian state
and private assets and cut bilateral trade
flows by approximately 150 billion US
dollars, banning oil imports by price cap,
sanctioning transportation and exports of
technology, machinery, and electronics.
As for individual sanctions after the
annexation of Crimea, the EU has so far
sanctioned 207 entities and 1 473 persons –
including Vladimir Putin and Sergey Lav-
rov – by imposing travel bans and freezing
assets. Strangely late, on 13 April 2023, the
Council nally decided to add the Wagner
Group and RIA FAN (part of the Patriot
Media Group also headed by Yevgeniy
Prigozhin) to the sanctions list.
There is also a SWIFT ban imposed on
ten Russian and four Belarusian banks,
and the broadcasting licenses of several
outlets, such as Sputnik and RT (formerly
Russia Today), have been suspended.
Sanctioning media channels proven to be
controlled by Russia’s authorities is in line
with European law, which prohibits war
propaganda and the justication of vio-
lence, thus protecting the values of free-
dom and security of information space
in the European Union. I will explain this
further below.
Alarms in the Information Domain
Based on the EU vs Disinfo database, I
identied 236 different communication
platforms in active use that spread anti-
Ukraine false narratives, disinformation,
and war-preparations propaganda during
the six-month escalation period from
1 September 2021 to 22 February 2022.
A year into the full-scale aggression,
NewsGuard has identied over 350 hos-
tile sites, including 182 English, 51 French,
39 German, and 35 Italian language plat-
forms. Many facts testify to the escalation
of information warfare by the Russian
Federation, including systematic inu-
ence activities in the information space
of Western Europe.
In order to prepare and support hostile
information operations, the special ser-
vices of the Russian Federation and their
afliates organised several different types
of cyber operations against Ukraine. The
main targets were the websites, infor-
mation systems, and databases of gov-
ernment agencies (mainly defence agen-
cies), critical infrastructure (including
government communications, banking,
and energy systems), and large media
companies. To facilitate the desired stra-
tegic result, the websites of Ukrainian
local governments were also compro-
mised, with false information about Kyiv
Ukraine, EU, Security. ANALYSIS
18 Diplomaatia • Lennart Meri Conference 2023
having already fallen and signed a truce
with Moscow posted at the beginning of
the invasion.
TrickstoLearnFrom
A noticeable amount of newer malware –
such as WhisperGate, HermeticWiper,
IsaacWiper, CaddyWiper, and Double-
Zero – was used. It had been planted in
the government’s information systems
(and remained “on standby”) several
months before the conventional attack
started. If the initially planned effect had
not been achieved, some follow-up cyber-
attack would be carried out. In order to
better cover their cyber “signature,” Rus-
sians also cooperated with hacker groups
with a Belarusian background.
Importantly, a cyberattack against the
Viasat KA-SAT system (Viasat Outage)
on 24 February 2022 caused a large-scale
communications blackout on the rst day
of the invasion. Contracted to provide
internet service to the Ukrainian mili-
tary and police units, Viasat was unable
to fully restore the system’s operation for
three weeks. That large-scale cyberattack
affected tens of thousands of satellite
modems throughout Europe, including
the wind turbines of the German energy
company Enercon – just one example
of interdependence vulnerability in the
cyber domain.
As a conclusive lesson, during the
rst phase of the invasion, Russia man-
aged to sow some confusion among the
EU member states and disrupt or, to a
lesser extent, slow down the collective
decision-making processes, but not for
too long and to the extent planned. By
now, the Kremlin has been forced to
switch from the initial blitzkrieg tactics
to a longer war of attrition strategy due
to Ukraine’s resistance. The same can be
observed in the information space, where
the centre of gravity of inuencing activ-
ities has shifted more towards controlling
the information eld of Russia’s internal
audience and fostering an anti-Western
coalition among the swing countries in
the Middle East, Asia, Africa, and Latin
America.
ProtectingUkrainianWarRefugees
Russia’s military aggression and large-
scale violence against the civilian popu-
lation have caused an extensive human-
itarian crisis and sent a huge wave of
refugees eeing from Ukraine. By today,
approximately 4 million people have
temporary protection status in the EU.
According to the European Migration
Network data, most refugees have settled
in Germany (25.3%), Poland (25.1%), and
the Czech Republic (11.3%). The ratio of
war refugees per 1 000 inhabitants (as of
2022) is the highest in Ireland (0.9), Esto-
nia (0.9), and Poland (0.8).
In addition to other worries, the sta-
tus of many refugees from Ukraine is
undened. According to European Union
Agency for Law Enforcement Coopera-
tion (Europol), many opportunistic crimi-
nal networks exploit them for human and
weapons trafcking, money laundering,
terrorist activities, and war crimes. The
European Border and Coast Guard Agency
(Frontex) focuses on tackling cross-
border organised crime, especially human
trafcking and rearms smuggling.
In January 2023, Frontex and the State
Border Guard Service of Ukraine signed
a 12-million-euro grant agreement to
supply professional equipment. In addi-
tion to regular coordination with the EU
Advisory Mission Ukraine and the EU
Border Assistance Mission to Moldova
and Ukraine, the Frontex exchanges sit-
uational information with the UNHCR
and the IOM and shares its reports with
INTERPOL. Early warning, timely infor-
mation exchange, and intelligence shar-
ing between the EU and Ukraine are the
key to disrupting transnational organised
crime.
On 7 March 2022, nine EU Agencies
cooperating within the Justice and Home
Affairs Agencies’ Network (JHAAN) issued
a Joint Statement declaring the commit-
ment to provide assistance to Ukraine.
From the main operational agencies, the
European Union Agency for Criminal Jus-
tice Cooperation (Eurojust) is focused on
core international and war crimes com-
mitted in Ukraine and the enforcement
of EU nancial sanctions on Russian and
Belarussian entities.
War Crimes
Eurojust supports the deployment of an
International Centre for the Prosecution
of the Crime of Aggression (ICPA), whose
main purpose is to enhance investiga-
tions by securing evidence and facilitating
case-building for the Joint Investigation
Teams (JIT) on Ukraine. Eurojust is also a
member of the Freeze & Seize Task Force
established by the European Commission
to ensure coordination of member states’
activities in enforcing EU sanctions and
to explore other legal measures.
Europol engages with Ukrainian law
enforcement through the Ukrainian
Liaison Officer stationed at the agen-
cy’s headquarters. There are three main
operational lines with Ukraine: investiga-
tion of war crimes, the enforcement of
EU sanctions, and combating cybercrime,
extremism, and human trafcking. Inves-
tigations of war crimes in Ukraine are
supported by the Analysis Project Core
International Crimes (AP CIC). Also, an
Operational Taskforce of OSINT experts
was established to support those inves-
ANALYSIS. Ukraine, EU, Security
Facts testify to the
escalation of information
warfare by the Russian
Federation, including
systematic inuence
activities in Western
Europe.
Russia managed to
sow some confusion
among the EU member
states and disrupt or
slow down the collective
decision-making
processes.
Sanctioning media
channels proven to
be controlled by Russia’s
authorities is in line with
European law, which
prohibits war propaganda
and the justication
of violence.
Lennart Meri Conference 2023 • Diplomaatia 19
tigations. Europol reports that more than
7 000 photos and video footage have been
taken, more than 540 witness statements
collected, and more than 150 suspects
identied. To enforce the EU sanctions,
the Operation OSCAR – to crosscheck
sanctions lists against operational data
between 41 participating countries – has
been launched.
It is important that Western countries
do not let ‘war fatigue’ take over their
political decisiveness and continue to
UkrainianrefugeeslivingatarefugeecentreinNadarzyn,nearWarsaw,on14February2023. AP/Scanpix
Ukraine, EU, Security. ANALYSIS
Early warning, timely
information exchange,
and intelligence
sharing are the key to
disrupting transnational
organised crime.
The “Second Front” of
law-and-order cooperation
between the EU and
Ukraine must intensify.
support Ukraine to the maximum extent
possible. The results of the war in Ukraine
can lead to two main development paths
for the EU: either a more unified and
decisive strategic self-definition than
ever before or a bitter acceptance that
Europe’s security interests cannot be suf-
ciently guaranteed.
Priorities
The imposition of sanctions has revealed
a greater dependence on Russia than
we might have expected. Despite this,
it is necessary to move forward with a
well-targeted sanctions policy and to
allocate signicant additional funds to
their effective enforcement.
Furthermore, learning from Ukraine’s
experience, the EU must pay more
attention to protecting its information
and cyberspace, as well as other critical
infrastructure, and continue providing
cooperative assistance to Ukraine in
these areas on a larger scale.
As identied, a rising need to protect
Ukrainian war refugees against organ-
ised crime networks, investigation of war
crimes, enforcement of sanctions, and
combatting human trafcking and re-
arms smuggling are the main concerns
and cooperation priorities between the
EU and Ukraine in the internal security
domain. The “Second Front” of law-and-
order cooperation must intensify so that
Ukraine wins and joins the European
Union – sooner rather than later.