CRISIS LENS | Weaponising social media: a threat to lives and national security?
On 21 March 2022, news spread around the world that the Retroville shopping centre in Kyiv had been struck by a precision missile launched by Russian forces the previous evening.1 Sadly, what was initially a shocking attack has since become part of the grim reality of everyday life during the war. One particularly significant detail is that, before the missile strike on 21 March, a local social media influencer had filmed Ukrainian military vehicles parked near the shopping centre and shared the footage on TikTok.2
Eight people were killed in the subsequent attack, and an entire neighbourhood suffered extensive damage, leaving several residential buildings uninhabitable. This is just one of many examples of how seemingly innocent, everyday social media activity, whether posting videos or creating content to earn an income, can become a matter of life and death. In this case, the consequences included both the loss of human lives and damage to morale. Moreover, carelessly filming military installations, equipment or positions can pose a serious threat to national security.
More than a year later, in April 2023, leaked US Department of Defense documents circulated on social media, revealing a number of embarrassing and highly sensitive details. Beyond information about military operations in Ukraine, the documents exposed how American intelligence agencies had been monitoring close allies and the extent to which US intelligence had penetrated Russia’s security and intelligence services. The leak also revealed the United States’ ability to warn Ukraine of planned Russian missile strikes and provided insights into the state of the aggressor’s military capabilities. In short, it was one of the most extensive leaks of intelligence-related information since WikiLeaks.3 At the same time, the incident exposed an age-old human weakness: the desire of someone within a system to be recognised, or at least to feel important, perhaps even respected, whatever the cost.
Image 1. Kyiv’s Retroville shopping centre following the attack reportedly triggered by information shared on social media.
Although the scale, platforms, content and individuals involved differ, both incidents share a common denominator: social media. These two incidents, both of which occurred away from the front line, have also raised serious concerns at government level. Ukrainian authorities, for example, have repeatedly warned people against sharing certain types of information on social media. Penalties for disclosing non-public information were also introduced through legislation adopted in the very first days following the start of Russia’s full-scale invasion. The speed with which Ukraine addressed the issue is itself an indication of just how seriously the risks associated with social media are taken in wartime.
At the heart of the problem lies the fact that a large proportion of both civilians and military personnel use some form of smart device, with many also maintaining at least one active social media account. We have seen this countless times in footage emerging from Ukraine, where numerous personal recordings of military operations have been captured using these very devices.
In wartime, this means that any soldier or civilian with a mobile signal and internet access can publish content, whether text, photographs, videos or audio recordings, often accompanied by geolocation data. As a result, what they see and experience can be shared online with precise location information, usually unintentionally but sometimes deliberately. Such content may reveal military positions, operational plans or even clues about the location of a missile strike that has missed its intended target.
Nor should we forget that the enemy is also present in cyberspace. Russia’s specialised information warfare units (Russian: информационные войска) possess both the expertise and the means to exploit readily available information in pursuit of their objectives. According to Ukrainian security institutions, as much as 80% of the intelligence gathered comes from open sources.4
Image 2. Careless use of social media is like holding a live grenade.
At the same time, social media is primarily used as a platform for quickly obtaining and sharing information, including in situations where traditional communication channels may no longer function. It therefore plays an important role in helping people stay in touch with family and friends during difficult circumstances. However, it is essential to remember that, alongside its benefits as a means of communication, social media also exposes users to disinformation, which in certain circumstances can prove life-threatening. For example, in Mariupol, Russian forces created fake ‘green corridors’, using social media posts to direct civilians towards supposed evacuation routes that did not actually exist.4 Those who followed these routes subsequently came under aerial attack.5
So, what can be done when it becomes clear that the dangers posed by social media extend well beyond influencing public opinion and can directly threaten human lives and national defence capabilities? Ukraine’s strategic response so far has included informing the public about acceptable and prohibited behaviour on social media, amending criminal legislation, and developing and using social media platforms and specific applications to gather intelligence with the assistance of civilians.6
Meanwhile, Russia continues to refine its intelligence-gathering methods, including exploiting children through smartphone games that encourage them to collect information about Ukrainian military positions. This raises an uncomfortable question: which is more cruel and despicable – a teddy bear concealing a grenade left beside a children’s sandpit, or a seemingly harmless mobile game that inadvertently leads to a drone strike on an entire military squad? Both are acts of warfare that reflect the ruthlessness of the aggressor. Yet both are risks that can be mitigated through systematic awareness of the dangers involved.
Image 3. The article was published in the print edition of the military magazine Kaitse Kodu!
The weaponisation of social media we are witnessing today is merely another stage in the continued development of Russia’s information warfare capabilities. Information warfare has a long tradition in Russia, both in theory and in practice, with its origins as a field of scientific study dating back to at least 1942.4 Russia’s current use of information warfare operations is essentially a modern, internet-age adaptation of established Soviet-era tactics aimed at creating an alternative reality. Indeed, Russia has openly acknowledged that information technology can be used in future conflicts.
One of the most significant developments, however, followed Russia’s invasion of Georgia in August 2008, particularly in response to domestic criticism. Although Russia had won the conventional war, it was widely perceived to have lost the information war. This ultimately contributed to the establishment of specialised information warfare units.4
Ukraine had been exposed to Russian information warfare techniques even before 2014, when such operations helped lay the groundwork for Russia’s annexation of Crimea and its intervention in Donbas. Although Western countries have also experienced Russian information warfare tactics, their peacetime experiences cannot be compared with those of a country engaged in active conflict.
It is therefore vital that we continue to support Ukraine in every possible way, including in cyberspace, and learn from its experience of social media warfare. Raising awareness among civilians and military personnel about the risks associated with social media use before an armed conflict begins can help prevent damage to infrastructure and essential supplies, injuries to civilians and even loss of life.
Social media, originally conceived as a means of bringing people together, has become a kind of virtual landmine through which the enemy seeks to exploit civilians to improve its targeting and confirm successful strikes. Careless behaviour by a civilian can therefore have consequences extending far beyond criminal liability: without even realising it, an individual may effectively become an enemy artillery spotter or an unwitting contributor to hostile military operations.
The Retroville incident, which occurred during the early stages of the war, offers a painful lesson not only for Ukraine but for Europe as a whole. It also raises legitimate questions for the institutions and organisations responsible for national security: how can such threats be mitigated? And are we prepared to deal with them?
Images: Retroville (Kyiv City Administration, 2022); woman holding a social media grenade, article cover page and Crisis Research Centre researchers (Crisis Research Centre, 2026).
_after_shelling_on_20_March_2022_(10).jpg){kind=link}
🟠 The analytical article by Sofiia Kostytska and Hannes Nagel was previously published in the Estonian Defence League’s magazine Kaitse Kodu!, issue 7/2023, pp. 42–45.
🔺The use, distribution, modification or publication of text, video and images is permitted only with the prior written consent of the NGO Crisis Research Centre. Any unauthorised use is strictly prohibited.
Sources
2 Романенко, B., 2022. Силовики затримали тік-токера, який виклав у мережу фото техніки ЗСУ у Києві [Security forces detain TikToker in Kyiv for posting images of Ukrainian Armed Forces equipment]. 21.03.2022, Українська правда.
Jaga postitust: