Ukraine: Lessons from Spider Web. The Value of Counter-Intelligence Dominance

On June 1, the Ukrainian Internal Security Service (SBU) announced that it had carried out Operation Spider Web, a series of drone attacks on several airports located on Russian territory.

This operation, which stunned observers for its boldness and exceptional tradecraft, sparked a flood of reactions and analyses seeking to understand its scope and effects. However, what Spider Web reveals above all is an invisible fact: the current dominance of the Ukrainian counter-intelligence services (CI) over the Russian CI. It is on the basis of this invisible fact that the real scope of the operation should be assessed and that the implications for the Ukrainian conflict and for Europe should be studied.

The Facts

The attack, which had been planned for 18 months, was carried out by more than 100 drones, which were snuck into Russia and concealed in containers loaded onto semi-trailers pre-positioned near military airfields. As they were released close to their targets, the drones were able to evade Russian defensive measures.

The coordinated strikes simultaneously targeted four air bases in several regions of the Russian Federation: Belaya in the Irkutsk region, Olenya in the Murmansk region, Dyagilevo in the Ryazan region, and Ivanovo, 250 km northeast of Moscow. As the targets were located deep inside Russian territory and widely dispersed (five time zones apart), the Ukrainian services were able to strike airfields located at a great distance (2,000 km for Olenya, 4,000 km for Belaya) from the current front line.

Beyond the military toll, the symbolic value of the operation is hugely significant: the aircraft that were hit belonged to the air force that bombs Ukrainian territory and civilians on a daily basis. It is thus a spectacular form of retribution by the weak against the strong, which has temporarily succeeded in reversing the balance of power established by Russia.

Interpreting the Facts: a Russian Pearl Harbor?

The analogy with the Japanese attack on Pearl Harbor on December 7, 1941, quickly emerged in discussions about the attack, particularly because it allowed to strike a comparison mobilizing powerful images already present in the collective imagination.

The attack on Pearl Harbor refers to several spectacular ruptures: the United States, for the first time (since the War of 1812), was attacked on its own territory; it was attacked by a nation that was not technically at war with it (the declaration of war was delivered several hours after the attack, hence the image of “treachery” attached, in the American collective memory, to the infamy of December 7); the United States was taken completely by surprise (we know now that its military actually had a series of intelligence reports that were not properly assessed or transmitted and that could have alerted the country in advance).

However, while it is interesting in terms of the communications war, the analogy with Pearl Harbor is not really relevant:

• The Japanese attack was an initial act of aggression that kicked off a series of military operations. In contrast, the Ukrainian operation is part of the war that began in February 2022 (in 2014 if we include the hybrid campaign that led to Russia's annexation of Crimea).
• The attack on Pearl Harbor was an attack carried out by an aggressor on the territory of a non-belligerent state. In contrast, the Ukrainian attack is aimed at its aggressor (Russia), which invaded Ukraine in 2022 (2014 if we again establish a continuum with the operation in Crimea).
• The military effects of the air raid on Pearl Harbor were ultimately very limited. While the operation was intended to put the US Pacific Fleet out of action, few ships were actually destroyed. Of the 21 US vessels hit in the attack, 18 were fully repaired, and most of them (16) were operational again by the following year. In contrast, even if we take only the lowest estimate of 13 aircraft destroyed and around 20 damaged,  given Russia's limited capacity to rebuild its potential, the Russian bomber fleet is unlikely to quickly return to its pre-June 1 level.

An Invisible Factor: Spider Web or the Effects of Counter-Intelligence Dominance

In order to carry out this type of operation, it was necessary to combine the following components:

• A network for infiltrating equipment (explosives, drones, containers), and therefore the ability to evade border controls.
• A clandestine network of agents  providing inside knowledge of customs controls in order to operate the above network.
• A viable cover to support and legitimize the presence of Ukrainian operatives on Russian territory.
• A clandestine infrastructure enabling a network of agents to operate within Russian territory (in particular for assembling container+drone vectors) without triggering detection by Russian intelligence services.
• A network of agents dedicated to positioning the semi-trucks to the vicinity of target structures. This network was the most exposed and for this reason it was likely composed of unwitting Russian sources. Their recruitment and manipulation also required a legitimate cover allowing SBU operatives to approach and manipulate them into action without causing suspicion. This required optimal human intelligence tradecraft on the part of SBU officers, and detailed knowledge of the cover environment, and therefore, once again, prior infiltration work.
• A secure communication system to coordinate the various segments of the combined operation.
• All of this was wrapped up in operational security (OPSEC) impervious to the enemy.
• All of the above over a span of more than 18 months.

It should be stressed that for an intelligence service, successfully protecting an operation of this magnitude for 18 months, while developing a clandestine network in an enemy country in such a large operational area, spectacularly reveals Ukraine’s level of dominance in the field of counter-intelligence.

Consequently, what Spider Web is telling Russian decision-makers is that the SBU can operate anywhere on Russian territory. It is also telling them, above all, that it currently dominates the FSB in its ability to conduct clandestine human operations on Russian territory and, first of all, in its capacity to guarantee counter-penetration.

What Will Change: the Lasting Effects

Spider Web's strikes will not change the course of the war, but they weaken Russia's offensive capabilities on two levels: beyond the immediate attrition of its bomber fleet (corroborated by the June 6 bombing, in which the Russian army deployed TU-160s to drop cruise missiles, which may signal a shortage of older TU-95 and TU-22 models traditionally used for this type of mission), the Russian army will now have to devote a larger portion of its resources to defending its own military infrastructure on its territory.

Politically, the galvanizing success of the operation has bolstered Ukrainian society's resilience at the outset of the negotiation rounds in Istanbul (thus alleviating the probable failure of any ceasefire agreement). The operation has also had a major impact on Kiev's allies, because it once again thwarted narratives about Ukraine's inability to “stay in the fight” and strengthened Western motivation to support its fighting forces. This is crucial for Ukraine because since the beginning of the invasion, for Ukraine the center of gravity of the war is the support of its allies for its war effort.

Psychologically, Spider Web generated a series of lasting effects.

From an information warfare perspective, the operation targets the second front (the inner front), since the attack and its damage cannot be hidden from the Russian population. They contradict and therefore delegitimize the Russian government's propaganda about Ukraine's capabilities, while spectacularly demonstrating the shortcomings of the regime's security services. President Zelensky is aware of this, having publicly exposed that one of the clandestine bases of Ukrainian agents was located in the immediate vicinity of the local FSB offices.

At the same time, they generate further loss of credibility for the Russian military command, which failed to protect its bombers or somewhat naïvely believed that their distance from the front line offered in itself sufficient protection.

What Will Change: Lessons Learned

Like any innovative tactical setup, the Ukrainian operation will become an integral part of the arsenal of state and non-state actors. For this reason, the success of Spider Web will trigger a form of asymmetric arms races, stimulating both the development of defensive countermeasures and operational innovation to maintain offensive capabilities by refining the methods initially used by the SBU.

It should be noted that the main breakthrough achieved by Spider Web is not a technological innovation (the only invention strictly speaking is the remote-controlled containers) but the operational concept of integrating a set of components that are already widely used: clandestine agents, cover identities or companies, remote-controlled military drones, and political objective. It is the integrated concept of the operation that is the key to its success and that generated its exceptional operational and  political value.

In this way, the Ukrainian operation is a useful reminder that intelligence is best defined not as a certain type of information, but as a certain type of action, most often in the context of a maneuver against the upstream side of the threat.

Finally, while the military success of Spider Web was ultimately dependent on counter-espionage, we should be reminded that its role is not defensive but offensive in nature, since only the possession of human sources within the opposing forces can guarantee the operational security necessary to conduct and/or neutralize the type of attack Ukraine conducted. More than ever, therefore, offensive penetration is fundamental.

Copyright image : Genya SAVILOV / AFPA
Ukrainian soldier prepares a Magura drone in the Donetsk Oblast on April 29, 2025.