# data[].attributes.body
The children of Ukraine are deeply traumatized by the violence. Many families have been separated and lives have been torn

# data[].attributes.attachment_link.readable_text
A year of escalating war has been devastating for families. UNICEF and partners are on the ground providing support for those in need.

The children and families of Ukraine have endured a year of escalating violence, trauma, destruction and displacement. Children continue to be killed, wounded and deeply traumatized by violence that has sparked displacement on a scale and speed not seen since World War II. Schools, hospitals and other civilian infrastructure on which they depend continue to be damaged or destroyed. Families have been separated and lives torn apart.

UNICEF was in Ukraine before the war escalated, and in the months since has stayed and delivered. We stand with the children of Ukraine and will continue working with partners to support them through the war and beyond.

Find out more:

>>> Latest updates and stories

>>> What's happening in Ukraine

>>> How UNICEF is supporting families

>>> What UNICEF is calling for

What's happening in Ukraine?

Ukraine's children are paying an extraordinary price in lives lost and upended. More than 400 children have been killed and hundreds more injured, while some 7.8 million children have been impacted and robbed of their childhood, of time with friends and family, of a peaceful life. They bear invisible scars and trauma that may take a lifetime to heal.

The conflict has caused significant damage to vital infrastructure, severely impacting access to electricity, heating, water and telecommunications. Families' incomes and access to services have been decimated. Hundreds of pre-school, primary and secondary schools have been damaged or destroyed by bombing and shelling, disrupting the education of Ukraine's children, with potentially lifelong consequences.

The upheaval of war has created an even more tenuous situation for displaced children, those living in institutions, and children with disabilities. Millions of people have had to flee their homes, displacement on a scale that could have consequences for generations to come.

Schools and other educational facilities are not only places of learning - they also provide a crucial sense of structure and safety for children. Yet displacement and the destruction of schools have left more than 3 million children accessing learning online or through a combination of online and face-to-face classes. The damage to electricity and other energy infrastructure is only complicating families' ability to access even virtual classes.

At the start of the war and throughout the summer, many families who fled Ukraine opted for online learning instead of attending local schools, hoping to return home quickly. But a year later, 2 out of 3 Ukrainian refugee children still aren't enrolled in host country education systems. The integration of Ukrainian refugee children into national education systems must be prioritized across education levels, especially for early childhood education and primary education - with qualified teachers, learning materials and spaces to support face-to-face learning, development, and well-being.

The war in Ukraine is robbing children of stability, safety, school, friends, family, a home and hopes for the future. The mental wounds of the war could affect children well into adulthood. To avert a generation of children scarred by the conflict, their mental health and psychosocial needs must be prioritised. This should include age-appropriate actions to provide nurturing care, build resilience, and especially for older children and adolescents, give them opportunities to voice their concerns and realize their own agency.

Support must also be provided to parents and caregivers to help them deal with the distressing effects the war and displacement have had on them. This will ultimately equip them to also better support their children's mental well-being.

The war has sparked displacement on a scale and speed not seen since World War II - with far-reaching impact across the region and beyond. More than 8 million refugees from Ukraine have been recorded across Europe, the majority of them women and children.

UNICEF welcomes the international solidarity shown to Ukraine's children and to those across the globe negatively impacted by the war. But as the conflict and displacement continues, support is still needed across the region to ensure refugee children are not left out.

How is UNICEF helping children and families?

UNICEF was in Ukraine before the war broke out, and throughout the past year has stayed and delivered. In countries hosting refugees, UNICEF works with national and local authorities, as well as civil society organizations, to deliver emergency assistance and support services to families fleeing war in Ukraine. Since February 2022, UNICEF and partners have:

Inside Ukraine

Provided learning supplies to over 1 million children and engaged more than 1.4 million children in formal and non-formal education.

Reached more than 3.3 million children and caregivers with mental health and psychosocial support and more than 400,000 women and children with gender-based violence response services.

Enabled access to safe water for more than 5.5 million people living in areas where networks have been damaged or destroyed, and provided sanitation and hygiene supplies to nearly 1.7 million people.

Enabled almost 5 million people to access healthcare with supplies distributed in war-affected areas.

Reached more than 224,000 households inside Ukraine with multi-purpose cash assistance.

In neighbouring countries

Worked with local governments and refugee-hosting municipalities to provide access to formal and non-formal education for more than 1 million refugee children.

Enabled more than 100,000 people to access safe water for drinking and domestic needs.

Supported ministries of health in neighbouring countries to provide access to primary health services to more than 470,000 refugee women and children.

Reached more than 50,000 households with cash transfers.

What UNICEF is calling for

1) Principled and unimpeded humanitarian access.

2) An end to attacks on children and the infrastructure they rely on, including schools, hospitals and critical water and food infrastructure.

3) The avoidance of the use of schools or other facilities in this conflict.

4) Stopping the use of explosive weapons in populated areas, which are directly responsible for killing and maiming hundreds of children.

UNICEF will engage as and where support is needed to reach affected populations, including children.

UNICEF has been in Ukraine for many years and has maintained a principled humanitarian approach in past instances of violence and conflict, to ensure continued access to vulnerable populations. Since the start of this war, UNICEF together with UN partners, has continued to advocate for the respect of humanitarian principles, international humanitarian law, and human rights law, including to end and prevent grave violations against children.

Above all, UNICEF will continue to advocate for an end to hostilities.

Children need sustained peace to regain their childhoods, return to normalcy and begin to heal and recover.

# data[].attributes.attachment_link.title
War in Ukraine: Support for children and families

# data[].attributes.attachment_link.description
A year of escalating war has been devastating for families. UNICEF and partners are on the ground providing support for those in need. The children and families of Ukraine have endured a year of escalating violence, trauma, destruction and displacement.

# data[].attributes.body
Ukraine and Russia are key exporters of wheat, barley, corn, and cooking oil particularly to African and Middle Eastern countries.

# data[].attributes.attachment_link.readable_text
A year after Russia's invasion of Ukraine sparked the largest conflict in Europe since World War II, the repercussions continue to reverberate around the world. Not only has the war in Ukraine set off a geopolitical realignment, but it has caused economic hardship far from the epicenter of the fighting.

The Feb. 24, 2022, invasion has touched off a refugee crisis, as Ukrainians flee the conflict in their homeland and many Russian men seek to avoid conscription. Meanwhile, it has spurred a process toward expanding NATO, with Finland and Sweden pursuing membership after decades of official neutrality.

Ukraine and Russia are key exporters of wheat, barley, corn and cooking oil, particularly to African and Middle Eastern countries. Turkey and the United Nations brokered a deal last summer to allow Ukrainian grain to pass through Black Sea ports, but Russia is reportedly still hindering shipments. Russia is also a major producer of fertilizer and petroleum. Disruptions to the flow of these goods are compounding other supply chain and climate challenges, driving up food and gas prices and causing shortages in places such as Chad, Tunisia and Sri Lanka.

More than 8 million refugees have fled Ukraine in what the World Health Organization describes as "the largest movement of people in the European Region since the Second World War." Many have been involuntarily relocated by Russia. Others have put a strain on resources, as well as schools and hospitals, in Poland and Germany.

A 21st century war in Europe - led by a nuclear power - is pushing the world toward realignment. It has rattled NATO, the European Union and the U.N., forcing countries to take sides in ways that have led to escalating tensions and diplomatic shifts. For example, Turkey, despite being a NATO member, has increased trade with Russia since the start of the war and has thrown up objections to allowing Sweden and Finland into the alliance.

Russia is one of the world's largest producers of oil and fuel. European countries have banned the Russian oil, gas and diesel they relied on, which initially caused a steep spike in prices. However, moves by European nations to lock in alternative sources, along with conservation efforts and a mild winter, have largely alleviated those price hikes. Now prices have returned to pre-invasion levels.

Russia has more nuclear weapons than any other country. Its attack on Ukraine has notably reenergized NATO, with the U.S. and other member states funneling tens of billions of dollars worth of military equipment into Ukraine. Early weapons deliveries included anti-tank rockets such as the U.S.-made Javelin. In the latest moves, the U.S., Germany and Britain have promised to provide state-of-the-art tanks.
NPR's Will Chase, Alex Leff, Pam Webster, Desiree F. Hicks and Nishant Dahiya contributed to this report. The text and graphics build on previous work by Alina Selyukh, Connie Hanzhang Jin and Nick Underwood.

# data[].attributes.attachment_link.title
The ripple effects of Russia's war in Ukraine continue to change the world

# data[].attributes.attachment_link.description
A year after Russia's invasion of Ukraine sparked the largest conflict in Europe since World War II, the repercussions continue to reverberate around the world. Not only has the war in Ukraine set off a geopolitical realignment, but it has caused economic hardship far from the epicenter of the fighting.

# data[].attributes.body
The Ukraine war will hurt economic growth and raise prices. The entire global economy will feel the effects of slower growth & faster inflation. Russia and Ukraine are major commodities producers and disruptions have caused global prices to rise, especially for oil and gas. Food costs have jumped with wheat for which Ukraine and Russia make up 30 percent of global exports.

# data[].attributes.attachment_link.title
How War in Ukraine Is Reverberating Across World's Regions

# data[].attributes.attachment_link.description
The conflict is a major blow to the global economy that will hurt growth and raise prices. Beyond the suffering and humanitarian crisis from Russia's invasion of Ukraine, the entire global economy will feel the effects of slower growth and faster inflation. Impacts will flow through three main channels.

# data[].attributes.body
France donated 125 million euros for energy, water, food, health and transportation. Canada also donated $115 million. The European Union donated 30 million euros to purchase up to 30 million energy-saving light bulbs. The European Union also donated 40 new large generators to provide uninterrupted power to 30 hospitals.

# data[].attributes.attachment_link.readable_text
More than 70 countries and institutions have pledged over 1 billion euros to help Ukrainians through the winter amid the Kremlin's ongoing military attacks on civilian infrastructure, including the electricity grid.

The funding was announced during the "Standing with the Ukrainian People" conference in Paris December 13. It will support Ukraine's infrastructure and improve access to electricity, home heating, water, food, health care and transportation during the winter.

"The entire civilised world has come to support Ukrainians fighting for freedom and their own future," Ukrainian Prime Minister Denys Shmyhal said in a December 13 tweet, thanking French President Emmanuel Macron for hosting the conference.

Since October, Russia's military has repeatedly attacked Ukraine's power grid, causing widespread power outages as the country braces for freezing winter conditions.

The U.S. government announced in late November $53 million in equipment to repair Ukraine's electricity grid, part of which was delivered this week, in addition to $55 million in energy sector humanitarian support for heating and emergency power. The U.S. State Department has also been leading a coordination effort with Group of Seven (G7) and other key allies and partners to identify compatible equipment that can be provided quickly.

Since President Vladimir Putin's full-scale February 24 invasion, the United States has provided over $32 billion in total assistance to Ukraine, including $145 million to help repair, maintain and strengthen Ukraine's power sector.

Russia's military "has chosen a cynical strategy, aiming to destroy civilian infrastructure in order to put Ukraine on its knees," Macron said at the conference, denouncing the ongoing bombing of civilian infrastructure as war crimes.

Among the pledges of assistance to Ukraine:

125 million euros from France for energy, water, food, health and transportation.

$115 million from Canada.

30 million euros from the European Union to purchase up to 30 million energy-saving light bulbs.

40 new large generators from the European Union to provide uninterrupted power to 30 hospitals.

Leaders from the G7 announced plans December 12 to form a partnership to coordinate support for Ukraine, including international funding and expertise for private sector led development.

"We are determined to help Ukraine repair, restore and defend its critical energy and water infrastructure," the G7 nations of Canada, France, Germany, Italy, Japan, the United Kingdom and the United States said in a statement. "We will help Ukraine in meeting its winter preparedness needs."

# data[].attributes.attachment_link.title
Countries rally to help Ukraine through the winter

# data[].attributes.attachment_link.description
More than 70 countries and institutions have pledged over 1 billion euros to help Ukrainians through the winter amid the Kremlin's ongoing military attacks on civilian infrastructure, including the electricity grid. The funding was announced during the "Standing with the Ukrainian People" conference in Paris December 13.

# data[].attributes.body
Most children in Ukraine are going back to school but some are staying home and doing online because the schools have been destroyed by bombs or is close to the fighting. Children are traumatized as the war goes on but the teachers are trying to support them.

# data[].attributes.attachment_link.readable_text
KHARKIV and DNIPRO, Ukraine - The first day of school in Ukraine is a big deal. Known as the Day of Knowledge, there are usually big celebrations - with rehearsed dances, concerts and lots of balloons. Children dress up in traditional Ukrainian vyshyvankas with brightly colored embroidery. Families bring teachers bouquets of flowers - there are usually so many flowers on the first day that the classrooms are bursting with colorful blooms.

This fall, the war with Russia has disrupted - but not destroyed - this beloved tradition in a country that places enormous importance on education.

At a small private school in the city of Dnipro, the day starts with a teacher leading each new first-grader through a hula hoop decorated with ribbons and leaves - initiating them into their school-aged life. Older students cheer while families try and catch every moment on their phones. Because of the war, this is one of just a handful of schools in the city offering in-person classes.

Two older students, Mariia and Varya, both 9, watch from a shared chair in the corner, holding hands and giggling. The friends hadn't seen each other since school shut down in February, when Russia invaded Ukraine. Watching them hold hands, reunited, Varya's mother, Alina Shtefan, remarked that the moment almost felt normal - when so much isn't normal. Her husband, a doctor, is in the armed forces and away from home. Both mom and daughter have been looking forward to this day - to coming to school - for months. After more than six months of staying close to home and rarely seeing friends, the start of school offers a bit of the familiar.

But even walking to school this morning wasn't as normal as Shtefan thought it would be.

"Usually the streets are filled with children and families going to school," she says, "but this morning it was just us."

Nearly 4 million students returned to school in Ukraine this month, despite the war. The majority will do some form of online learning - in some cases, it's because the school has been destroyed by bombs or is too close to the fighting. Schools offering in-person learning are required to have adequate bomb shelters. One thing remains true for all Ukrainian school children: as the war rages on, they're dealing with a lot of trauma. And their teachers are determined to provide support.

"It's the destruction of childhood." Schools continue to be targeted by Russian attacks

Two days before the start of the school year, kindergarten staff in Kharkiv were hard at work cleaning and preparing their brightly-painted school in the center of the city. No students would be arriving - in Ukraine's second largest city, the state-run schools are all online. But the staff wanted to make sure the school was tidy and ready. If the war ended tomorrow, they wanted the toys, the books, the little naptime beds with stuffed animals to be ready to welcome the children.

On that day in late August, two teacher assistants stepped outside to take out the trash when the kindergarten was rocked by an explosion. The shelling damaged classrooms and shattered school windows. The two teacher assistants were badly injured in the blast. They're now both in the hospital, undergoing multiple surgeries. The cheerfully-painted multicolor steps they were standing on collapsed, and their blood still stains the concrete.

"I was scared, but now I'm angry," says Yana Tsyhanenko, the head of school, who was in another part of the building during the attack. "It reaffirmed that we must do school online."

Since the Russian invasion in February, 2,177 education facilities have been damaged, and 284 have been destroyed, according to the Ministry of Education and Science. A new report from Save the Children, a U.S-based humanitarian organization, found an average of four preschools a day have been damaged or destroyed in the war in Ukraine.

It's especially stark in Kharkiv, where more than 40 schools have been damaged by shelling, according to an analysis by the Centre for Information Resilience. Other estimates, including one from the mayor of the city, put that number closer to 100.

Even for schools that are intact, the daily missile attacks and shelling in Kharkiv make offering safe, in-person learning a major challenge. With its proximity to Russia, there are often only a few minutes between the air raid sirens and an explosion. Even if a school had a shelter, there wouldn't be enough time to get children down there.

The day after the shelling at the kindergarten, brightly colored children's toys still poked out from the rubble of the damaged kindergarten classrooms and outdoor play area. City workers fashioned wood boards over the broken windows. They cleared out the shards of glass that blasted through classrooms, onto the bookshelves, cubbies and beds.

"It's not the destruction of the building that makes me emotional," Tsyhanenko says, "It's the destruction of childhood."

Before the war, the kindergarten served about 350 students, but now only 14 families remain in Kharkiv. The other families moved to other parts of Ukraine or abroad, but the school is still supporting its students with access to teachers, video lessons and suggestions for parents.

With all that turmoil, Tsyhanenko is worried about her students' mental health. The academics - the math and writing - they'll be able to catch up on, it's the emotional development they'll miss most. And without the safety of school and the comfort of the teachers, students and families are on their own.

"Kindergartens are not supposed to be empty," she says, walking down the brightly painted corridor. "They should be filled with laughter, with the sound of little feet running down the hallway." Every day since the attack, she's come back to the kindergarten, cleaning up the broken glass, and making sure the school remains ready for the children. She promised them she'd reopen, that the school would be there when it was safe enough to come back.

For teachers in schools without bomb shelters, online learning is the only option

Even in parts of the country further from the frontlines, most days don't pass without an air raid siren. Without adequate bomb shelters, schools remain closed for in-person classes.

At a secondary school in the east-central city of Dnipro, the halls are abuzz with the excitement of a new year, despite having no students. Teachers are in their classrooms, many freshly decorated, teaching their live video lessons from their rooms.

On the first floor, Anastacia Volkovynska stands at the front of her first-grade classroom with a computer open on a podium in front of her. She gives her online lesson in front of the chalkboard, which is decorated with letters that spell out "first time to the first grade." Her students may not see her sparkly red high heels on their computer screens, but they certainly catch her enthusiastic personality glittering across the screen.

She calls her students her "little kittens" as the 6-year-olds introduce themselves to the class and share their interests. "I like cats," one girl says.

"Marvelous!" exclaims Volkovynska.

A few doors down, a third-grade teacher tells her online class, "I'm going to play a song, and you have to guess it." As soon as the Ukrainian national anthem starts, Olha Chudnivetz's students join her in singing along.

"We're sad everything is this way," says Olha Morhon, the head of school, "but we won't be discouraged. Our main task is to show the children that we are here and we will persist."

That's especially important because students displaced by violence in other areas of Ukraine, like Kharkiv and Luhansk, have relocated to this city. The school's enrollment is actually up, despite being virtual. Across the country, nearly 90,000 students are internally displaced starting the school year at new schools, according to Yuriy Konenko, who heads the country's office for secondary and preschool education. About half a million students are continuing their schooling from abroad.

"It's better than nothing." Online school poses challenges for families

Across town, on the 6th floor of a Dnipro apartment building, Vera Sheremet, 10, is sitting at the desk in her bedroom, her computer open to her online art class. The teacher calls on her and she un-mutes just as her little brother, Boris, runs past, screaming. Vera slams her door to keep the noises he generates out of her room.

It's a scene familiar to anyone who dealt with remote schooling during the pandemic, including Vera and her family, except that this time, schools are closed because there isn't an adequate bomb shelter.

"I wanted to meet my teachers in person and I was really hoping that we'd go to school," Vera says when she's on a break between classes. "Online school isn't better. You don't get to meet your friends, you can't run around in the backyard of the school. You don't have normal."

Her parents, Serhii and Svitlana Sheremet, are also not thrilled about school being online and they wish their city had invested more time and money into making adequate shelters for the schools.

"This is, I don't know ..." Serhii trails off. "It's better than nothing."

"I think that education in-person would be better for my children," says Svitlana. They researched private schools in the area, a handful of which are in-person, but because the programs are in-demand, the costs have gone up.

They've also thought about leaving Ukraine. "The world is becoming more and more peaceful if we go to other countries," says Svitlana. "Even Vera, she is dreaming about England or the U.S. for education. She wants to see the world."

For now, the family is staying in Ukraine. Svitlana is a doctor, and she feels her purpose is to stay and help at the hospital. She tells us she feels her taxes help the war effort, help her country.

But there are moments when she falters. Sometimes the internet cuts out during Vera's class. During our visit, an air raid siren goes off. Svitlana says this happens frequently, interrupting class. "Let's go to the safety place," she calls down the hall to the kids.

"Here at home is the same danger as there is at school," she says, as she corrals the kids into the front storage closet they've repurposed as a shelter, with pillows, blankets and stuffed animals. "If schools had a great bomb shelter it would probably be more safe than at home. That's why I'm two hands up for in-person school."

Teaching children how to act during an attack or an air raid siren

At a community center in Kharkiv, senior police officer Dmytro Klymenko is standing in front of a whiteboard, instructing 9- and 10-year-olds how to stay safe during the war. He's introducing the topic of the two-wall rule. He draws a diagram on the board, with a circle to represent an explosion on one side, two lines for the two walls in the middle and a stick figure on the other side.

"The first wall will take the explosion," he tells the kids. "The second wall will get the debris from the first wall."

Most students have heard this information before. They know the answer when Klymenko asks what they'll do if a stranger approaches them (tell their mom, tell their teacher) and they know what belongings they should have in their bags when they go to the bomb shelter (their documents, a flashlight, a snack and a power bank to charge a phone).

Across the country, conversations like these are happening in schools and youth organizations. A new initiative from the Ministry of Internal Affairs in Ukraine is sending nearly two dozen security specialists to help students understand how to shelter properly and deal with explosive objects.

In the classroom in Kharkiv, 9-year-old Sasha Zhuravliov is listening to Klymenko intently. He says hates when things are out of order, and lately, with the war, a lot of things have been out of order. "This makes me really uncomfortable," Sasha says. What does he do when he feels this way? "I take three deep breaths and then three normal breaths," he says, just like his dad taught him when the war started. He says the breathing technique has been helping.

Experts say nearly all of Ukraine's more than 5 million children have experienced trauma

Sasha isn't alone. Experts say that nearly all of Ukraine's children have experienced trauma. Since Russia's invasion in February, children have been displaced from their homes, lost loved ones, witnessed violence and in some cases, experienced it firsthand.

The biggest challenge for Ukrainian educators in the coming months won't be academic - it will be in recognizing the effects of trauma and helping children work through it. Doing that virtually - makes it even harder.

Sasha, Vera and several other children told us that even if their teachers or their parents aren't telling them exactly what's going on with the war, they can tell scary things are happening. They say the biggest giveaway at home - is when their parents start to whisper to each other.

Educators in Kharkiv describe children drawing damaged houses in art class, parents say their kids are acting out, are playing more aggressively or are more in need of hugs.

"The trauma of war can present itself in many ways," says Yuliia Luchnikova a school psychologist in Dnipro. "This state-of-being in Ukraine isn't normal."

Over the last six months, she's helped families and students navigate anxiety, depression and anorexia stemming from the war. She recommends families have a kind of go-bag with coping strategies for mental trauma.

"You always have your body with you, you always have your mind," she says, "and those are tools to help you where you are." She tells the students she works with that when they are feeling scared or uncomfortable, they can practice tightening and releasing parts of their body one by one, to feel present. They can count their deep breaths to help calm down their bodies.

Public forums where psychologists offer insights on how to deal with the mental trauma of the invasion have sprung up across the country. Many schools offered teacher trainings with psychologists ahead of the new year. Luchnikova did a virtual training with psychologists in Israel, who shared with her their experience of helping children living through a war.

But the longer this war continues, the more the trauma is being prolonged or exacerbated. Children need a sense of safety, a sense of normalcy. Several caregivers remaining in Ukraine, including Vera's parents, told us if things don't improve soon, they'll have to make some big changes. Living like this, with daily fear, is extremely hard for children and their caregivers.

From the makeshift shelter in the center of their apartment, 10-year-old Vera Sheremet says she and her friends don't talk too much about the war because they're scared. "Lots of us have seen stuff blown up right outside our windows," she says. She's never seen it herself, only heard it nearby.

When she feels scared, she watches YouTube videos about people traveling. "I just watch people live a peaceful life, not like this." Vera doesn't try and tell herself she's safe because she knows she's not, but she tries to relax or get lost in a good book.

Her mom, who is listening down the hall, nods. "She's a very smart girl," says Svitlana Sheremet, "this situation is very intense for her. But she's really trying to just be a kid."

Hanna Palamorenko and Polina Lytvynova contributed to this report.

# data[].attributes.attachment_link.title
Traumatized and displaced but determined, kids in Ukraine head back to school

# data[].attributes.attachment_link.description
KHARKIV and DNIPRO, Ukraine - The first day of school in Ukraine is a big deal. Known as the Day of Knowledge, there are usually big celebrations - with rehearsed dances, concerts and lots of balloons. Children dress up in traditional Ukrainian vyshyvankas with brightly colored embroidery.

# data[].attributes.body
About 4 million students are returning to schools, even with civilian areas continuing to be hit. 51% of schools in Ukraine are reopening to in-person education, with an option to study online if the parents prefer.

# data[].attributes.attachment_link.readable_text
MYKHAILO-KOTSYUBYNSKE, Ukraine (AP) - It was the first day of school in Ukraine on Thursday but children weren't sharing memories of fun vacations with their families. Their stories were of surviving war. For many, their last day of school was the day before the Feb. 24 Russian invasion of their country.

At least 379 children have been killed since the war began, while the whereabouts of 223 others are unknown, according to Ukraine's General Prosecutors office. Another 7,013 children were among Ukrainians forcibly transferred to Russia from Russian-occupied areas.

Six months of war damaged 2,400 schools across the country, including 269 that were completely destroyed, officials said.

Civilian areas and schools continue to be hit, and children keep being killed. But after the first months of shock, 51% of schools in Ukraine, despite the risk, are reopening to in-person education, with an option to study online if the parents prefer.

But safety remains the priority. At schools that don't have quick access to shelters or are located close to the borders with Belarus and Russia, or near active military zones, children will only study online.

That's the case for the seventh graders in Mykhailo-Kotsyubynske, just 20 miles (35 kilometers) from the Belarus border, who gathered at their badly damaged school this week to pick up textbooks for studying online.

"We haven't seen each other for such a long time. You all have grown so much," said their teacher, Olena Serdiuk, standing in a corner of the classroom, where windows were covered with thick black polythene instead of glass.

Oleksii Lytvyn, 13, remembers very well the day Russian missiles hit the school twice. It was March 4, and he was in the school's bomb shelter with his family and dozens of other people.

Just minutes before the blast, he had been playing with a friend. After the loud explosion, the walls began shaking and he couldn't see anything but a huge cloud of debris. One person was killed, a woman who worked at the school.

"We were sleeping in the corridor, and there was a corpse of a dead person behind the wall," Oleksii recalled. His family stayed one more night before fleeing town, though they have since returned for the start of the school year.

Oleksii's classmates shared similar stories about that day and the monthlong Russian occupation that followed.

"When I'm at school, I think about the person who died in the debris. I feel deeply sorry for her," 12-year-old Mykola Kravchenko said.

Their school is still badly damaged. Debris fills the second floor, and the roof and heating system need to be repaired - money the school doesn't have.

Even though they will be studying online, the students had to undergo security training. Serdiuk told the class to follow her to the same bomb shelter where many survived the blast in March.

In the dimly lit shelter were water supplies and long benches with labeled seats for each classroom. When the children took the seats assigned to their class, Serdiuk told them they had to go there whenever they heard a siren.

She said many parents tell her their children are begging to return to school, but for now that isn't allowed because of the danger of being so close to the Belarus border.

"It does become kind of the new normal for children," UNICEF Executive Director Catherine M. Russell, told The Associated Press. "That's not the way children should go through life, thinking that they are going to get attacked at any moment."

Schools in the Kyiv and Lviv regions were among those welcoming students back to classrooms Thursday, including more than 7,300 displaced students forced to flee their hometowns.

In a neighborhood of Irpin, north of Kyiv, still bearing the scars of war, with destroyed homes and shrapnel-marked fences and walls, first-grade children lined up excitedly for their first day of classes in their newly renovated school.

Hit by a missile during the early days of the war, Irpin School Number 17 was rebuilt with the help of UNICEF, the faint smell of fresh paint still lingering as the students walked into their classrooms hand-in-hand.

"This year is different to the others. We are in a war situation," said first grade teacher Olga Malyovana. "We were really worried about the children and their safety, but we fixed all the facilities, we have a shelter."

First order of the day was an evacuation drill, with a fire alarm going off and all the children lining up to head to the basement bomb shelter or designated safe - and windowless - areas in the corridors.

Oleksandra Urban came to drop off her 6-year-old daughter, Veronika, the normal trepidation of the first day of school mingling with worry about classes during wartime, even though strikes on Kyiv and nearby areas are now rare.

She's explained to Veronica how to evacuate to a bomb shelter, she said. "She is worried only when I am worried. That's why I am trying to be calm."

Urban and her husband discussed distance learning for Veronika, but decided physical presence in school was essential, both for contact with other children and with the teacher.

"I believe that school will save the life of my kid," Urban said.

Murat Sahin, UNICEF representative in Ukraine, agreed.

"Two years of Covid and ... six months of war, it is having disastrous impact on children's growth and learning and mental health," Sahin said. "So we need to bring that normalcy."

In Kramatorsk in the Donetsk region, there's no hope for schools to open their doors - the city has been under constant shelling since the beginning of the war.

In one school, the first-grade classroom was all ready: tables, chairs, a clean blackboard, the alphabet and numbers hanging on the wall. The only thing missing was the students.

Seated in the empty room was Oleksandr Novikov, the school's director for 12 years and a teacher for more than 20.

"It is very depressing, it is very unpleasant to feel that you come to an empty school," he said. "There will be no children laughing at school."

While Ukraine tries to defend itself from the Russian invasion, Novikov dreams of better times.

"I would like a real first bell, a real meeting with children and teachers, a real lesson, when eyes look at you with inspiration, trust and a desire to hear something new, to learn something new."

"This is what I would like to see," he said.

___

Fisch reported from Kramatorsk, Ukraine. Associated Press writer Elena Becatoros contributed from Irpin.

____

Follow Arhirova at https://twitter.com/h_arhirova

___

Follow AP coverage of the war in Ukraine at https://apnews.com/hub/russia-ukraine

# data[].attributes.attachment_link.title
It's back to school in Ukraine - but far from normal

# data[].attributes.attachment_link.description
MYKHAILO-KOTSYUBYNSKE, Ukraine (AP) - It was the first day of school in Ukraine on Thursday but children weren't sharing memories of fun vacations with their families. Their stories were of surviving war. For many, their last day of school was the day before the Feb. 24 Russian invasion of their country.

# data[].attributes.body
Russia previously used cyberattacks against Ukraine to destroy or damage infrastructure and data and attempted to do so again in 2022. Russia intended to stop services and install destructive malware on Ukrainian networks including phishing, denial of service, and taking advantage of software vulnerabilities.

# data[].attributes.attachment_link.readable_text
June 16, 2022

This is a preliminary review of cyber operations in the Ukraine conflict based on publicly available information. Ukraine was not the first "cyber war"-the term itself makes little sense-but it was the first major conflict involving large-scale cyber operations. The so-far inept Russian invasion, where cyber operations have provided little benefit, raises questions about the balance between defense and offense in cyberspace, the utility of offensive cyber operations, and the requirements for planning and coordination. Better-than-expected Ukrainian defenses seem to be one hallmark of this invasion and the primary reason why Russian cyber efforts have had limited effect.

It is likely that Ukraine, forewarned by Russian cyber actions that began as early as 2014, was better prepared as a result. It was also assisted in its cyber defense by friendly countries and private actors with whom it had developed cooperative relationships before the conflict. This preparation allowed it to deflect many Russian offensive cyber operations, suggesting that a well-prepared and energetic defense can have the advantage over offense in cyberspace.

Russia had previously used cyberattacks against Ukraine to destroy or damage infrastructure and data. It attempted to do so again in 2022. Based on publicly available information, Russia launched a broad cyber campaign shortly before the invasion (see the appendix for a list of known events). Some reporting showed a huge increase in exploits on the first day. The intent appears to have been to create disorder and overwhelm Ukrainian defenses. Russia sought to disrupt services and install destructive malware on Ukrainian networks included phishing, denial of service, and taking advantage of software vulnerabilities. One company identified eight different families of destructive software used by Russia in these attacks. The primary targets were Ukrainian government websites, energy and telecom service providers, financial institutions, and media outlets, but the cyberattacks encompassed most critical sectors. This was a wide-ranging attack using the full suite of Russian cyber capabilities to disrupt Ukraine, but it was not a success.

Russia's most significant cyber success so far was the disruption of the Viasat Inc's KA-SAT satellite. This created significant damage that spread beyond Ukraine but ultimately did not provide military advantage to Russia. The attack may have been intended to be part of a larger, coordinated cyberattack that proved unsuccessful, or the Russians may not have expected the rapid restoration of service that was provided with outside assistance. The metric for Viasat and for other actions is not whether a cyberattack is effective in terms of network penetration or the disruption of services or data, but whether its effect helps achieve in this case, the occupation of Ukraine and the elimination of its elected government. By this metric, the Viasat attack was not a success.

A well-prepared and energetic defense can prevail over offense in cyberspace.

Most of these attacks have been attributed by Ukrainian and Western sources to Russian government entities-chiefly the GRU, Russia's military intelligence service, which has a history of using disruptive cyberattacks. In a few cases, proxy groups (such as the leading ransomware group Conti) were also involved, and in one reported instance, a Brazilian hacker group supportive of Russia attacked Ukrainian universities. All these hacking efforts, whether by the GRU or not, seem to have been poorly coordinated with Russian military actions in Ukraine.

The Value of Cyber Operations

In conflicts involving modern militaries, cyberattacks are best used in combination with electronic warfare (EW), disinformation campaigns, antisatellite attacks, and precision-guided munitions. The objective is to degrade informational advantage and intangible assets (such as data), communications, intelligence assets, and weapons systems to produce operational advantage. The most damaging actions would combine precision-guided munitions and cyberattacks to disable or destroy critical targets. Cyber operations can also be used for political effect by disrupting finance, energy, transportation, and government services to overwhelm defenders' decisionmaking and create social turmoil. Russia has been unable to achieve any of these objectives at meaningful scale.

It may offend the cyber community to say it, but cyberattacks are overrated. While invaluable for espionage and crime, they are far from decisive in armed conflict. A pure cyberattack, as most analysts note, is inadequate to compel any but the most fragile opponent to accept defeat. No one has ever been killed by a cyberattack, and there are very few instances of tangible damage. "Logical" damage from attacks on software and data (such as the Iranian action against Aramco) are frequent, but these attacks usually do not create strategic advantage-which can be defined as forcing an opponent to make changes or concessions it would not have otherwise made-since they have not been used at scale and in a sustained manner, but rather in an uncoordinated and sporadic fashion. Sustained and systematic efforts are required to damage an opponent's ability to resist.

Cyberattacks are overrated. While invaluable for espionage and crime, they are far from decisive in armed conflict.

It takes real effort to make a cyberattack more than a dramatic annoyance. This requires planning, tool development, and reconnaissance, integrated with other offensive capabilities (as with the Israeli airstrike on Syrian nuclear facilities). The test of effectiveness lies in the results, measured by the extent of damage and whether the cyber operation forced an opponent to change plans or make concessions. Also, unlike a successful attack using a kinetic weapon, cyberattacks do not assure destruction (a radar hit by a missile can be seen to be a smoking ruin, but from the outside, a successful cyberattack on a radar may not look different from one that fails, and any damage may not be permanent).

Cyber operations in conflict are very useful to conduct espionage, to gain advance knowledge of opponent planning and capabilities, and to mislead. There was reportedly a surge of Russian action to penetrate North Atlantic Treaty Organization (NATO) networks at the onset of the conflict, a sensible precaution from the Russian perspective, given its fear of the possibility of a NATO intervention. An attacker must weigh the loss of the benefits of espionage against the potential gain from a disruptive attack. In many cases, the benefits of espionage outweigh those of attack. ¹

One apparent weakness of Russian cyber operations has been the seeming lack of coordination between cyber and conventional attacks. At a tactical level, cyberattacks provide benefits when combined with other weapons, including conventional delivery systems, precision-guided munitions, unmanned aerial vehicles, and electronic warfare. This combination can cripple command networks and advanced weapons systems and contribute to the attrition of opposing forces. However, when used in an ad hoc manner, or when uncoordinated with air and ground actions, cyberattacks prove less useful. Coordinating cyber and kinetic actions requires a high degree of planning and staff work that Russia either chose not to do or was incapable of doing. The timing of some Russian cyber operations suggests they were intended to support conventional operations but were unsuccessful.

Cyberattacks can be used to produce or amplify political effect, but it's important to recognize that attacks are as likely to harden defenders' will to resist as they are to sow panic. The most effective cyber tactic is to use hacking and misinformation (as was done in 2016 against the United States) to create confusion and inflame existing discontent, thus distracting governments by creating domestic social and political turmoil. Russia does not seem to have made serious efforts at this in Ukraine-sending texts and emails containing generic threats is juvenile. Unlike Russian actions in 2016, there does not appear to have been advanced planning and work to prepare the ground in Ukraine for political disruption. This is puzzling, given the attention in Russian doctrine to incorporate "pre-conflict" political preparation into attack planning and may indicate a somewhat spontaneous decision to invade Ukraine without careful preparation.

Russian communications were inadequately secured. Corruption may have played a role in Russian communications weaknesses, with funds intended for secure communications equipment diverted to personal use. While Russia's special operations forces have access to sophisticated tactical communications gear using strong encryption (judging from earlier operations in Ukraine), these were in short supply for other units in this invasion. Some Russian units relied on inadequately secured mass-market Chinese equipment. Others relied on Ukraine's commercial telecommunication infrastructure. This reliance creates two major difficulties. First, when the Russians destroyed Ukrainian telecommunications infrastructure, whether inadvertently or intentionally, this hampered their own communications. Second, relying on an opponent's communications system creates numerous possibilities for exploitation. Many speculate that one reason for the high casualty rate among Russian senior officers was that their vulnerable communications allowed their location to be pinpointed.

Preparing Cyber Operations

Carrying out successful cyber operations creates a heavy burden for an attacker's workforce, planning, and intelligence support. In this, Ukraine helps highlight one strength of the U.S. military: its capacity for planning and staff work. The creation, decades ago, of regional combatant commanders who control naval, air, ground, and cyber forces can provide a coordinated assault (or defense) informed by long experience. One reason for U.S. losses in the Battle of the Coral Sea (1942) came from having two command structures that did not coordinate to provide adequate reconnaissance. The United States learned from this. It takes planning and preparation to maximize the return on a cyberattack, and this is best achieved when cyberattacks are integrated with other offensive capabilities. The emphasis on joint operations that began with Goldwater-Nichols is another strength that can give the United States an advantage in the use of offensive cyber operations. Success is derived from the ability of a commander to deliver effect, inflict damage, and force an opponent to retreat, change plans, or surrender. Cyber operations can play an important part if they are used to prepare the ground and in coordination with other capabilities, something that requires staff work, intelligence support, and planning.

Writings by Russian authors suggest that they know that cyberattacks can disrupt logistics and communications (this was part of their planning for conflict with). Such attacks provide military advantage, and better planned or better executed Russian attacks on Ukraine's logistics and communications could have used cyber means to disrupt Ukrainian command and control, interfere with air defense systems and logistics, and inject uncertainty and doubt into commanders' decisionmaking (on troop location or on supply status, for example). The failure (so far) to disrupt Ukrainian operations, logistics, and communications probably reflects the haphazard nature of Russian planning, flawed assumptions about the reception Russian forces would receive, and the strength of the Ukrainian cyber defenses. As with the ground invasion, there was a miscalculation about the strength and effectiveness of Ukrainian resistance. Russia may be reconsidering the use of cyber offense as it adjusts its initial and flawed strategy. However, if Russian forces now move to strategies similar to what they used in Grozny or Syria-indiscriminate bombardment to level civilian and military targets-this may make cyberattacks, which are less destructive and less certain, a lower priority.

Russia has shown how not to use cyber operations to gain advantage in armed conflict, but its efforts highlight best practices. The most obvious lesson is the need for adequate preparation to generate coordinated, simultaneous strikes on critical targets. The second is to achieve cyber superiority by crippling cyber defenders. The third is to prepare the battlefield politically and psychologically and to control the public narrative of the campaign as much as possible.

Hacktivism

One dilemma for analysis is the tendency to confuse the symbolic actions of hacktivists for actual strategic effect. While celebrated in the media, the various cyber actions against Russian websites by private actors had no effect on Russian military operations, its military capabilities, or, as far as anyone can tell, Putin's strategic calculations. The results of the activities of "hacktivists" and their efforts against Russia are exaggerated. Russia did not change course or alter plans as a result of these hacktivist efforts, nor was the Russian capability to engage in offensive operations, spotty as it may have been, degraded by hacktivist action. Russian public opinion, largely supportive of the war, seems unaffected by hacktivism. By these measures, hacktivism is irrelevant to the course of the war.

The various cyber actions against Russian websites by private actors had no effect on Russia military operations.

At the onset of conflict, thousands of volunteers engaged in cyber actions against Russia and to defend Ukrainian network targets. The most difficult problem with an "army" of thousands of civilian volunteers is coordination. The mechanisms and infrastructure for coordination require advance preparation. Estonia's Cyber Defense Unit is an example of how such groups can be organized to be effective. Estonia assisted Ukraine before the invasion, and it is possible that some of the volunteer cyber defenders were organized in ways that assigned them to priority targets, avoided both duplication of effort and gaps, and made them a more reliable source of auxiliary cyber capability. The lesson for other countries is that volunteers can provide valuable assistance in defense if their efforts are coordinated and a framework for coordination and partnership with government agencies is developed in advance of conflict. Ukrainian civilian efforts to provide intelligence on Russian forces, while dependent on networks, are not exactly "cyber" efforts, but they provided real benefit to defenders.

The conditions under which hacktivism might have an effect vary according to the political situation of the target country. A government that feels vulnerable to attack or invasion may fear that hacktivism is the precursor to more drastic actions, an indicator of opponent intent. A country that is politically vulnerable with a discontented population will be more vulnerable. In contrast, an authoritarian state that is not particularly sensitive to what its population thinks, has well-developed propaganda and social control tools, and is willing to use forceful measures to suppress any opposition will not feel that hacktivism poses much of a threat. It is easy for Western observers to underestimate the success of Russian (and Chinese) media control and propaganda, but these have been successful in building public support and outweigh the effect of hacktivism.

External Targets

Ukraine is not the only possible target for cyber action, and Russia appears to have considered cyber operations against the United States and allies. The United States has not been attacked, as Putin may have calculated that cyber action against it or its allies would broaden conflict without benefiting Russia and make the war even more difficult to manage. This could change as Putin becomes more frustrated with the failure of his initial plans, but the fundamental strategic considerations remain the same-a cyberattack on the United States would be unlikely to advance Russia's goals in Ukraine and would increase the chances of failure. This consideration will likely continue to shape any Russian cyber action.

One element of Russia's initial calculations appears to have been that Western political leadership and societies are risk averse, would choose inaction, and would succumb to threats. This has so far proven erroneous (and explains Russia's need to intensify pressure by uttering nuclear threats). However, Putin may yield to temptation and launch a damaging cyber operation against the United States or its allies. If he continues to follow a risk-minimization approach, this temptation would be to repeat something like the Colonial Pipeline ransomware attack, which panicked American consumers and created political stress for the Biden administration while offering a shred of deniability. Moscow could attribute the action to criminals, deny culpability, and promise to take action against them. This would even support the short-lived Russian effort to renew cyber talks with the United States.

Russia could unleash something like NotPetya, which cost the global economy millions of dollars (without providing benefit to Russia). More damaging attacks against nations in the "near abroad," like Moldova, are also a possibility. The considerations for possible action are to create political turmoil in the victim country, stay below the level of use of force to reduce the risk of retaliation, and provide some degree of deniability, no matter how flimsy. As sanctions continue to uncouple the Russian economy from the West, the cost of such attacks may decrease for Russia, removing a disincentive for cyber action. Wars are not won by playing punishing pranks, even pranks that are expensive for the victim. The key question for any Russian decision is whether it increases the likelihood that Russia will make progress toward its goals in Ukraine. Malicious actions like NotPetya do not.

A disruptive cyberattack against U.S. critical infrastructure probably makes little sense from the Kremlin's perspective. It would not force the United States to stop supporting Ukraine, it would not degrade U.S. military capabilities, and it would create political pressure for a more forceful U.S. response. Russian leaders lost respect for the United States after the defeats in Iraq and Afghanistan (although the Biden administration is beginning to make them reconsider this), but that does not mean they want to start a war with the United States. Russia's preference is to make progress on its goals in Ukraine while avoiding expanded conflict with NATO or the United States. A limited cyberattack against the United States would only make Russia's situation worse by broadening the conflict, and while the Kremlin enjoys the use of bellicose threats, it has been much more circumspect in its actions.

A better tactic for Russia might have been to inflame existing discontent in democratic nations (as was done in 2016) in advance of the invasion, to distract governments by creating domestic problems. The Russians do not seem to have attempted this, and in Europe they face a substantial barrier created by their lack of credibility and the hostility the invasion has engendered in European populations.

Russian official statements are a poor indicator of intent, since they are designed to manipulate Western opinion and appeal to the nationalist sentiments of Russia's domestic audience. They often bear only a tenuous relationship to fact. Russia believes U.S. strategic thinking is risk averse. Its own strategic culture places greater reliance on the use of exaggerated threats. Threats are a Russian diplomatic tactic, and the difficulty in differentiating between ploy and plan increases the uncertainty that is normal in warfare. The concern is that these threats may increasingly reflect a Russian leadership that is willing to consider ideas (nuclear weapons use, cyberattacks on the West) that were once thought taboo or would seem unreasonable to a rational policymaker.

Control of the Narrative

The battle for control of the narrative largely occurs in a digital space and can be shaped by cyber actions. Russian attention to controlling the narrative about the invasion, to deflect criticism and win public support, reflects long-standing Russian doctrine on the importance of the political and psychological context of conflict. It informs both cyber and electronic warfare (EW) operations. This effort has had mixed results and the narrative contest remains undecided. It was unsuccessful in Ukraine and among Ukraine's supporters. Putin has lost in the Western democracies and Ukraine but has won in Russia and is at least holding his own with non-Western audiences in China (abetted by China's own propaganda and narrative control efforts), India, Africa, the Middle East, and some Latin American countries. This success outside of Ukraine is more a reflection of the damage done to U.S. credibility under previous administrations rather than the skill of Russian propaganda.

Putin has lost in the Western democracies and Ukraine but has won in Russia and is at least holding his own with non-Western audiences.

The Russians deployed a number of mobile and relatively modern EW systems in theater that have information warfare capabilities, such as the Leer-3. Leer-3 comes with drones that can be used to jam telecommunications and provide capabilities similar to Western Stingray systems to capture mobile phone traffic and monitor social media for exploitation and psychological warfare (including sending mass text messages to mobile phone numbers it collects).

Reflecting its larger propaganda failure, Russia was unable to craft compelling content for a Ukrainian audience. A standard Russian tactic is to hack databases or emails and then leak them for damaging effect. Sometimes this stolen data is falsified to amplify effect. This tactic did not work for Russia in its invasion. One lesson is that despite its skill and experience in disinformation, Russia struggled to rebut declassified Western intelligence that rapidly undercut Russian assertions. Nor was Russian propaganda sufficient to hide the undeniable evidence of aggression, violations of international law, and horrific human rights violations that were publicly available from many nongovernmental sources. Propaganda is most effective when it exploits existing beliefs, discontent, or skepticism, but when these preconditions do not exist, even constant repetition is insufficient to have persuasive effect.

Another lesson from Ukraine is that future wars will need to take into account the ubiquity of mobile phone cameras, public access to satellite imagery, and even communications intercepts using online services like WebSDR. These public, nongovernmental sources of information undercut any effort to control the narrative while providing real intelligence advantage. What used to be considered secret intelligence is becoming a publicly available good. Governments have not lost their monopoly of the use of force, but any monopoly they had on controlling information from war zones has largely disappeared. In theater, civilians can provide valuable information on opponent forces. Civilian actors can use digital and mobile technologies to greatly expand the amount of information available to the force they support and complicate efforts to falsify or disrupt it. Only the strictest censorship can hope to control the narrative and many news sources lie outside the scope of censorship. Russian efforts to jam cellular telephony or interfere with internet access in Ukraine were also unsuccessful. Planning how to degrade or control civilian communications spread across a decentralized global network networks will also need to become part of cyber offensive operations.

The use of private messaging services like Signal and Telegram (used by Russians and Ukrainians) can provide a degree of end-to-end encryption to preserve and secure communications. Use of these services gave Ukraine an advantage, both in social cohesion and in tactical intelligence. The Russian inability to deny access to messaging services was a significant intelligence failure and points to a larger issue. Global connectivity means that third-party, non-belligerent services can provide services that are difficult for an attacker to disrupt unless they are willing to attack neutral third parties. This can make key services difficult to deny and strengthen the ability to resist.

What used to be considered secret intelligence is becoming a publicly available good.

Cyber Defense

For cyber defense, the conflict in Ukraine is instructive. Cyberattacks need not be unstoppable for a prepared and determined defender. Russia found itself at a disadvantage because Ukraine appears to have learned from the damaging cyberattacks carried out by Russia in 2014 and 2016. The most important elements of Ukrainian defense were preparation and hardening of likely targets, partnerships and assistance from foreign cyber actors, and rapid reaction to nullify attacks, detected by monitoring of critical networks. Countries large and small can copy this for their own cyber defenses.

Ukrainian agencies played the leading role in defense, but defense did not rely entirely on governmental or even Ukrainian assets. Ukraine had a network of partners (both governments and companies) who were able to provide training and assistance, including remote monitoring and mitigation, before the invasion and after it began. Tech companies provided invaluable assistance. Collective action that blended national and foreign, government and private, gave Ukraine an advantage in monitoring and in rapid reaction to block attacks and repair or eliminate vulnerabilities. Russian attackers were often frustrated in their attempts and even when successful, the success was short lived. The lesson is to develop relationships and integrate partners through actions that go beyond meetings and seminars to include planning and exercises well in advance of any attack.

Ukraine published a national cybersecurity strategy in 2016 and established a degree of redundancy and resilience for data and expanding the use of encryption before the invasion. It implemented some basic cyber "hygiene" measures after 2015. Cyber hygiene before an attack is important, but the most important element of defense is the ability to identify and react quickly. Ukraine (with external assistance) undertook real-time monitoring of critical networks and systems to detect exploits early on and then act quickly to counter them. This requires continuous monitoring, an area where many countries could improve performance. Any network perimeter can be breached, and all software has exploitable flaws. It is the ability to respond immediately and effectively to cyber intrusions that seems to be the key to a successful defense. This requires continuous monitoring, an area where many countries could improve.

Ukraine reportedly used a third-party hosting arrangement to move some data and services outside of the geographic boundaries of the conflict. If nothing else, this complicated and constrained Russian planning. Small countries can design digital infrastructure and data architecture that takes advantage of extraterritorial third-party service providers to minimize exposure, increase resilience, and complicate an attacker's task. The commercial operations behind the internet do not always follow geographic boundaries. This diffusion will increase as governments move to rely on cloud services and other remote services (including software as a service and satellite connectivity). Attacking these remote services located in noncombatant countries poses the risk of repercussion an attacker may prefer to avoid.

Small countries can design digital infrastructure and data architecture that takes advantage of extraterritorial third-party service providers to minimize exposure, increase resilience, and complicate an attacker's task.

Larger countries like the United States could face problems of scale in copying this kind of defense if Russia or China decided to launch cyber operations against them similar to what was attempted in Ukraine. The United States is a "target-rich" environment, and it is not yet organized or resourced to duplicate Ukraine's success. However, this sort of direct attack is still unlikely, while many of the lessons from the Ukrainian conflict are applicable. The most important of this may be to prepare now for cyberattacks against critical infrastructure (an area where the United States has made progress) and crucial data (where it may be less prepared). That makes the issue for the United States how to apply lessons and best practices for national defense learned in Ukraine in situations short of armed conflict.

Preliminary Conclusions

No defense is perfect, but Ukraine's efforts have so far been able to thwart the Russian cyberattacks. This combination of defensive measures is a package that can be duplicated by other nations. The conclusions so far from Ukraine are that for offensive operations, planning for cyber operations must be integrated into broader campaign planning and gauge where and when their use is beneficial. A combined arms approach, where cyber is integrated with other offensive capabilities, will gain the full benefit, since cyberattacks are an imperfect substitute for kinetic action and must be used in a sequence linked to other modes of attack.

As an aside, cyber offense would benefit from increasing the lethality and predictability of cyberattacks to improve their utility in offense. Cyberattacks already perform well in speed, range, and precision (to the extent those variables apply) and may offer greater possibilities for surprise, but their destructive capabilities are still limited. When a missile destroys a power plant, the smoking rubble can be observed. It is more difficult to tell if a cyberattack has succeeded or how permanent the effect will be. This will require emphasizing the use of cyberattacks to focus on disrupting command mechanisms, weapons software, and information as much or more than physical destruction. An attacker's decision to use cyberattacks must calculate whether their use makes the conflict more or less manageable and weigh this against how much use contributes to achieving strategic effect.

For offense, a campaign plan needs to include a realistic and specific assessment of the benefits and costs of cyber operations, including the cost to intelligence collection and the political effect on both combatants and external parties-realistic because of the limitations of cyberattacks, specific because very often a cyber operation will require a tailored quality determined by the nature of the target network and the intended effect. At a minimum, this will require both reconnaissance of the target network and "weapons" design (writing code for use in the attack) well in advance of any attack, along with testing and "refreshing" attack tools.

To the extent that cyberattacks harm civilians, including degrading their access to online services and social media, this will create a degree of repugnance. The international community is less tolerant of collateral damage or deliberate attacks on civilian targets, and these can have damaging political consequences for an attacker. Planning for offense must take into account the politics of cyberattacks over connected civilian networks. Russia did not, and this was another mistake.

The conflict in Ukraine can inform the United States and its allies on how to defend against offensive cyber operations directed against it by opponents, but China or even Iran may have also learned from the Russian experience. For cyber actions, Ukraine is probably not a safe precedent for conflict with any possible attack by China. China is better equipped and likely to have better planning. The United States may also not want to count on ineptitude among these opponents, even if they share authoritarian (and thus potentially idiosyncratic) decisionmaking.

Cyber operations failed to advance Russian goals-the occupation of Ukraine and the replacement of its elected government. Some of the mistakes that Russia made are becoming clear. Ukraine was not the first cyber war nor was cyberattack particularly useful to the Russians. The Ukrainian defenders and their partners did a good job of reacting quickly to deflect Russian efforts to disrupt networks. They do not appear to have faced a well-thought-out plan of attack integrated into broader campaign planning. This may be the most important lesson for cyber warfare from Ukraine: preparation and planning on how to integrate cyber operations with other modes of attack to achieve maximum effect makes cyberattacks useful.
James A. Lewis is senior vice president and director of the Strategic Technologies Program at the Center for Strategic and International Studies in Washington, D.C. This report is made possible by general support to CSIS. No direct sponsorship contributed to this report. This report is produced by the Center for Strategic and International Studies (CSIS), a private, tax-exempt institution focusing on international public policy issues. Its research is nonpartisan and nonproprietary. CSIS does not take specific policy positions. Accordingly, all views, positions, and conclusions expressed in this publication should be understood to be solely those of the author(s).© 2022 by the Center for Strategic and International Studies. All rights reserved.
Appendix: Cyber Incidents against Ukraine²

October 2021: Hackers created the IssacWiper malware on or before October 19, 2021, according to the code's timestamp, which they then deployed to Ukrainian government networks in February 2022.

November 2021: Hackers began development of cloned Ukrainian government websites with malware embedded in links on the fake sites. Researchers linked this activity to actors with ties to the Russian GRU and believe this activity has a connection to the second distributed denial-of-service (DDoS) attack in February 2022 against the Ukrainian banking sector and government websites.

December 2021: Hackers developed the HermeticWiper malware, according to the code's oldest timestamp, used in a February 2022 attack against financial organizations and Ukrainian government contractors.

December 2021: A hacking group targeted the State Migration Service of Ukraine with a phishing attack. In November 2021, the Ukrainian Security Service linked members of the group researchers believe carried out this attack to the Russian Federal Security Service (FSB).

December 2021: Hackers with suspected ties to the Russian GRU began development of malware used in March and April phishing attacks.

December 2021: A group with suspected ties to the Russian FSB compromised the network of a nuclear safety organization. Hackers stole data from this organization through March 2022.

February 2022: Hackers targeted the Ukrainian banking sector and government websites with a series of DDoS attacks, temporarily taking the websites offline. The United States, United Kingdom, and Australia attributed the attacks against financial institutions to the Russian GRU.

February 2022: The Times reported that Chinese hackers targeted vulnerabilities in over 600 critical infrastructure institutions and the Defense Ministry in Kyiv in an attempt to compromise data and disrupt services. Their source claims to be from the Ukrainian Security Service, but the service denies this attribution.

February 2022: Hackers targeted websites belonging to the Ukrainian banking sector and the Ukrainian government with a DDoS attack, rendering some sites inaccessible. This was the second DDoS attack against Ukrainian banks and government websites in two weeks.

February 2022: Hackers deployed a file encryptor on the network of an agricultural company. Researchers assessed this was likely to target grain production in Ukraine and attributed the attack to a group with suspected ties to the Russian GRU.

February 2022: Hackers targeted the Kyiv Post with a DDoS attack, forcing its website offline. The Kyiv Post published news on social media platforms until connectivity was restored.

February 2022: Hackers deployed a destructive malware (IsaacWiper) on a Ukrainian government network.

February 2022: Hackers targeted European government members involved in coordinating logistics of refugees fleeing Ukraine with a phishing attack. The actors used a compromised email belonging to a Ukrainian armed service member.

February 2022: Hackers targeted satellite communications company Viasat with destructive malware, disabling modems communicating with Viasat Inc's KA-SAT satellite. The attack impacted connectivity across Ukraine and Europe, as the satellite provides internet access to customers in multiple countries. The United Kingdom, United States, and European Union attributed this attack to Russia.

February 2022: Hackers targeted a Ukrainian border control station with destructive malware that forced officials to process people fleeing into Romania manually.

March 2022: Hackers targeted at least 30 Ukrainian university websites. Researchers believe this attack came from a Brazilian-based group that publicly supports Russia.

March 2022: Hackers targeted telecom provider Triolan on March 9 and February 24, impacting network connectivity. A source from Triolan claimed the hackers reset the company's computer settings to factory level and some equipment required physical access to restore, which was difficult due to the ongoing crisis.

March 2022: A suspected Russian-linked hacker targeted a major broadcasting company with a destructive malware (DesertBlade).

March 2022: Hackers targeted charities, nongovernmental organizations, and other aid organizations providing assistance for Ukraine with malware intending to disrupt services.

March 2022: Hackers targeted Ukrainians with a phishing attack to deploy malware that compromises user data. The email promised payment "in the amount of 15,000" from the government as support during "this difficult time."

March 2022: A suspected Russian-linked hacker targeted a Ukrainian research institution. False Russian weapons conspiracies featured this institution in the past.

March 2022: A suspected Russian nation-state actor stole data from a nuclear safety organization.

March 2022: Hackers targeted the Vinasterisk network according to the operator, impacting connectivity in western Ukraine.

March 2022: Hackers targeted the systems of Ukrainian state authorities with a phishing attack. According to CERT-UA, the attack came from a group associated with the Luhansk People's Republic (LPR).

March 2022: Hackers deployed a destructive malware (DoubleZero) targeting Ukrainian enterprises.

March 2022: Hackers targeted the Ukrainian Red Cross website, forcing it to suffer an outage for several hours.

March 2022: Hackers targeted a transportation and logistics provider based in western Ukraine. Researchers linked this attack to a suspected Russian GRU-affiliated group.

March 2022: Hackers used WordPress sites to target 10 websites with DDoS attacks, including Ukrainian government agencies, think tanks, and financial sites.

March 2022: Hackers targeted Ukrainian organizations and individuals with a phishing attack. The scam email claimed to be from the Ministry of Education and Science of Ukraine, and the malware gives the hacker access to sensitive data and user identification information.

April 2022: A group targeted several Ukrainian media organizations in an attempt to gain long-term access to their networks and collect sensitive information. Microsoft took control of seven internet domains the group used to mitigate these attacks. The group has connections to the Russian GRU.

April 2022: Hackers targeted a Ukrainian energy facility, but CERT-UA and private sector assistance largely thwarted attempts to shut down electrical substations in Ukraine. Researchers believe the attack came from the same group with suspected ties to the Russian GRU that targeted Ukraine's power grid in 2016, using an updated form of the same malware.

April 2022: Hackers targeted Ukraine's national post office with a DDoS attack, days after releasing a new stamp honoring a Ukrainian border guard. The attack impacted the agency's ability to run its online store.

April 2022: Hackers created a fake Ukraine 24 Facebook page, prompting users to enter their personal data and payment information.

April 2022: Hackers used a compromised Ukrainian government email in a phishing attack. CERT-UA linked this attack to hackers with suspected ties to the Russian GRU.

April 2022: Hackers targeted Ukrainian state authorities with a phishing attack.

May 2022: Hackers launched a phishing attack allegedly on behalf of CERT-UA with malware that compromises user data. CERT-UA attributed this attack to actors with ties to the Russian GRU.

May 2022: Hackers launched a phishing attack to gain access to authentication data. The email warns recipients of an impending chemical attack to convince users to open its malware-ridden attachment.

June 2022: Hackers targeted Ukrainian state organizations with a phishing attack.

June 2022: Hackers targeted media organizations in Ukraine with a phishing attack. CERT-UA attributed the attack with an "average level of confidence" to a suspected Russian GRU-linked group

# data[].attributes.attachment_link.description
Download the Report This is a preliminary review of cyber operations in the Ukraine conflict based on publicly available information. Ukraine was not the first "cyber war"-the term itself makes little sense-but it was the first major conflict involving large-scale cyber operations.

# data[].attributes.body
Agricultural products are Ukraine's most important exports. Ukraine is normally the world's top producer and exporter of sunflower meal, oil, and seed. Ukraine totaled $27.8 billion in 2021, making up 41% of the country's $68 billion in exports.

# data[].attributes.body
The Ukraine- Russia conflict has caused destruction, forcing people to flee their homes. As a result, millions of refugees from Ukraine have crossed borders into other countries, while many more have been forced to move inside the country. A refugee response is being carried out in support of the refugee-hosting countries.

# data[].attributes.attachment_link.description
Site Mapping and Monitoring is a multi assessment exercise aiming to provide humanitarian actors with reliable data on the status and needs of the refugee accommodation sites