Information Warfare Is Infrastructure Warfare
Critical infrastructure protection has traditionally focused on tangible risks: physical sabotage, natural hazards, equipment failure and, more recently, cyberattacks and protest action. These threats remain central. However, the war in Ukraine has revealed a parallel reality that can no longer be treated as secondary. Information warfare – particularly disinformation – has become a core component of infrastructure targeting.
In Ukraine, attacks on energy, transportation, water, and communications systems were rarely isolated technical events. They were embedded within broader influence campaigns designed to shape how populations, governments, and international audiences perceive those events.
Disinformation did not simply accompany infrastructure attacks: it prepared the ground for them, magnified their effects, and prolonged their impact.
The integration of physical, cyber, and influence operations represents a shift in how critical infrastructure is contested. It challenges existing protection and resilience models, which often assume that technical restoration equates to recovery. Ukraine’s experience shows that even when systems are repaired, trust, confidence and social cohesion may remain damaged – sometimes irreversibly.
The lessons from Ukraine are not limited to armed conflict. The same techniques are increasingly applied during peacetime crises, natural disasters, industrial accidents, and political instability. For critical infrastructure professionals globally, understanding information warfare is now a prerequisite for resilience.
Disinformation as a Preparatory Tool
One of the clearest patterns observed in Ukraine was the use of disinformation well before infrastructure attacks occurred. Russian-aligned media outlets, social media networks, and proxy voices consistently promoted narratives portraying Ukrainian infrastructure as outdated, fragile, corruptly managed, or on the brink of collapse.
These narratives served several strategic purposes:
First, they normalised failure. By repeatedly asserting that infrastructure collapse was inevitable, disinformation lowered public expectations and reduced the perceived shock value of outages. When attacks occurred, they appeared to confirm preexisting beliefs rather than signal deliberate aggression.
Second, these narratives undermined institutional credibility. Infrastructure operators, regulators, and government officials were framed as incompetent or dishonest. This eroded trust before any incident took place, ensuring that official communications would be met with scepticism during crises.
Third, preparatory disinformation shaped attribution. When outages occurred, audiences were already primed to blame mismanagement or systemic decay rather than external attack. This confusion benefited the attacker by obscuring responsibility and complicating international response.
For infrastructure protection professionals, this highlights an often-overlooked warning sign: persistent, coordinated narratives questioning infrastructure reliability may indicate more than public dissatisfaction. They can be early indicators of hostile influence activity aligned with future disruption.
Exploiting the Moment of Crisis
The second phase of information warfare unfolded during active infrastructure disruptions. In Ukraine, disinformation campaigns were activated almost immediately following missile strikes, cyber incidents, or sabotage.
Within minutes, false or misleading claims appeared across multiple platforms, often repeating similar themes:
• Exaggerated estimates of outage scale and duration
• False causes, including fabricated internal failures or accidents
• Claims that authorities were concealing the truth
• Warnings of secondary threats, such as water contamination or fuel shortages
These narratives exploited a universal vulnerability: the information vacuum that emerges during fast-moving incidents. In the early stages of any infrastructure failure, details are incomplete, assessments are ongoing, and officials may hesitate to communicate prematurely. Disinformation thrives in this uncertainty.
In Ukraine, hostile narratives often outpaced official messaging, becoming the first version of events many people encountered. Once established, these narratives proved difficult to dislodge, even after accurate information became available.
The result was not merely confusion, but operational impact. Emergency services faced increased pressure due to panic-driven behaviour. Infrastructure staff were targeted by public anger fuelled by false accusations. Compliance with emergency guidance declined as trust eroded.
This pattern is not unique to Ukraine. Any infrastructure incident – whether caused by natural disaster, accident, or attack – creates similar informational vulnerabilities. The difference lies in whether adversaries are prepared to exploit them.
The Post-Incident Information Battle
Infrastructure protection often defines success as restoration of service. Ukraine’s experience demonstrates that this definition is incomplete. Information warfare continued long after power was restored, trains resumed operation, or communications networks stabilised.
Post-incident disinformation campaigns focused on delegitimising recovery efforts. Common narratives included claims that repairs were superficial, that reported restoration was fabricated, or that funds allocated for recovery were being stolen. In some cases, restored services were portrayed as unsafe or intentionally compromised.
These narratives had cumulative effects. Over time, they fostered a sense of permanent vulnerability and institutional failure. Each subsequent incident, even minor ones, triggered outsized reactions because public confidence had already been degraded.
For societies dependent on complex infrastructure systems, this erosion of trust poses a strategic risk. Public cooperation is essential during outages, conservation measures, evacuations, and recovery efforts. When trust collapses, resilience collapses with it.
Energy Infrastructure: Visibility and Vulnerability
Energy infrastructure emerged as a primary target of integrated attacks in Ukraine, both because of its strategic importance and its visibility. Power outages are immediately felt across society, making them ideal opportunities for influence operations.
Russian disinformation consistently framed energy disruptions as evidence of state failure. At the domestic level, narratives emphasised government incompetence and inevitability of collapse. Internationally, messaging warned that Ukrainian instability threatened regional energy security, aiming to undermine external support.
The combination of physical damage and narrative exploitation transformed grid attacks into broader political and psychological events. Even limited outages were portrayed as existential crises.
Globally, energy infrastructure shares these characteristics. It is highly visible, politically sensitive, and closely tied to public confidence. Whether the cause is hostile action, extreme weather, or technical failure, energy disruptions offer fertile ground for disinformation.
Resilience strategies that focus solely on redundancy and hardening overlook this reality. Narrative management – ensuring credible, timely, and transparent communication – is a critical defensive capability for the energy sector.
Transportation and Logistics: Perception Versus Reality
Transportation and logistics infrastructure played a subtler but equally important role in Ukraine’s information war. Disruptions to rail networks, ports, and supply chains were frequently exaggerated through disinformation to suggest nationwide paralysis.
In practice, many of these disruptions were localised or temporary. However, narratives portraying systemic collapse created disproportionate psychological impact. They undermined confidence in the state’s ability to function and fuelled perceptions of chaos.
This illustrates a key insight: the strategic value of infrastructure disruption lies not only in material impact, but in perceived impact. Disinformation can amplify limited damage into a crisis of legitimacy.
Transportation systems worldwide share similar vulnerabilities. They are complex, interdependent, and largely invisible until something goes wrong. When disruptions occur, public understanding is often limited, making perception easy to manipulate.
Communications Infrastructure and the Information Paradox
Communications infrastructure occupies a unique position in information warfare. It is both a target and a medium.
In Ukraine, attacks on communications networks were accompanied by narratives claiming total isolation, even when partial connectivity remained. These claims intensified fear and hindered coordination, despite technical realities being more nuanced.
At the same time, intact communications networks were used to spread disinformation at scale. Social media platforms, messaging apps, and online forums became battlegrounds where narratives competed in real time.
This paradox underscores a challenge for infrastructure protection: connectivity increases both resilience and vulnerability. Robust communications enable coordination and recovery, but they also accelerate the spread of false information.
Managing this tension requires proactive planning rather than reactive moderation.
AI and the Acceleration of Influence Operations
Ukraine has also demonstrated how artificial intelligence and automation are reshaping information warfare. Disinformation campaigns increasingly rely on AI-assisted tools to generate content, translate messages, and adapt narratives rapidly.
These tools enable influence operations to:
• Respond to incidents in near real time
• Tailor messaging to specific regions or communities
• Test and refine narratives at scale
• Sustain high-volume campaigns with limited human input
For infrastructure operators and authorities, this creates a speed asymmetry. Traditional communication processes, often cautious and hierarchical, struggle to compete with automated disinformation systems optimised for velocity rather than accuracy.
As AI-enabled influence operations proliferate, the gap between incident occurrence and narrative dominance will continue to shrink.
Countering Infrastructure-Focused Disinformation: Lessons from Ukraine and the International Response
While Ukraine’s experience highlights the risks posed by coordinated information warfare, it also offers important insights into how states and institutions can respond. Over the course of the conflict, Ukraine – often with support from international partners – has developed a set of adaptive practices aimed at mitigating the impact of misinformation and disinformation surrounding critical infrastructure.
One of the most important developments has been the deliberate integration of strategic communications into infrastructure resilience and crisis management. Ukrainian authorities increasingly treated public communication as an operational necessity rather than a secondary or reputational concern. During major attacks on the energy system, for example, government officials and grid operators provided frequent, transparent updates on outages, repair timelines, and system stability – even when information was incomplete. This approach reduced uncertainty and limited the space available for hostile narratives to dominate the information environment.
Energy sector coordination has been particularly notable. Ukraine’s transmission system operator and energy ministry worked closely to ensure that technical messaging, public guidance, and security communications were aligned. Consistent terminology and shared situational awareness helped prevent contradictory statements that could be exploited by disinformation actors. Similar coordination was observed between rail operators and government authorities following attacks on transportation infrastructure, ensuring that service disruptions were explained accurately and proportionately.
Ukraine also made extensive use of trusted intermediaries. Municipal authorities, emergency services, and local infrastructure operators were empowered to communicate directly with communities, reinforcing national messaging with localised, context-specific information. This distributed communication model proved more resilient than reliance on a single centralised voice, particularly when adversaries sought to discredit national institutions.
At the international level, Ukraine benefited from intelligence and information sharing with partner governments and multilateral organisations. Early warning of coordinated disinformation campaigns – particularly those linked to major infrastructure attack waves –allowed authorities to anticipate false narratives and prepare counter-messaging in advance. Diplomatic engagement also played a role, with partner governments publicly rebutting false claims aimed at international audiences regarding Ukrainian infrastructure stability and energy security.
Cooperation with technology platforms formed another layer of response. While not eliminating disinformation, collaboration improved the identification and disruption of coordinated inauthentic behaviour, particularly during periods of intense infrastructure disruption. This included rapid takedowns of networks amplifying false claims about nationwide grid collapse or fabricated secondary hazards.
Beyond Ukraine, a broader international response is emerging. Several countries have established dedicated counter–foreign information manipulation units within national security or communications structures, many of which now explicitly include critical infrastructure within their remit. Regional organisations and alliances have expanded information-sharing mechanisms focused on disinformation trends related to energy, transportation, and emergency response, reflecting recognition that influence operations often target multiple states simultaneously.
Importantly, these efforts underscore a growing consensus: countering infrastructure-focused disinformation is not solely the responsibility of media regulators or technology companies. It requires sustained collaboration among infrastructure operators, security agencies, regulators, emergency managers, and communicators. Technical resilience and narrative resilience are increasingly understood as interdependent.
Rethinking Resilience: Practical Implications
Ukraine’s experience points to a fundamental shift in how critical infrastructure resilience must be understood.
First, disinformation should be treated as an all-hazards threat. It can amplify the impact of any disruption, regardless of cause. Risk assessments that ignore the information domain underestimate vulnerability.
Second, crisis communications must be integrated into infrastructure protection planning. Communication is not merely a public relations function; it is an operational capability that influences safety, compliance, and recovery.
Third, cross-sector collaboration is essential. Disinformation campaigns rarely target a single sector in isolation. Energy, transportation, water, communications, and government institutions are often targeted simultaneously. Information sharing across sectors improves situational awareness and response.
Fourth, leadership awareness matters. Executives, operators, and incident commanders must understand how their actions, statements, and silences can be exploited. Training should include information threat scenarios alongside technical exercises.
Finally, coordination with public authorities and international partners enhances resilience. Influence operations often operate across borders, requiring shared understanding and collective response.
Protecting the Invisible Layer
The war in Ukraine has revealed that critical infrastructure has an invisible layer: public trust, institutional credibility, and shared understanding of reality. This layer is neither purely technical nor purely social, yet it underpins the functioning of every infrastructure system.
Information warfare targets this layer directly. By manipulating perception, adversaries can turn infrastructure incidents into strategic crises without increasing physical damage.
For critical infrastructure protection professionals worldwide, the implication is clear. Resilience is not achieved solely through stronger defences or faster repairs. It also depends on the ability to recognise, anticipate, and counter hostile narratives.
Ukraine’s experience offers a stark lesson – but also an opportunity. By learning how information warfare operates in conjunction with infrastructure attacks, societies can strengthen resilience before future crises occur. The alternative is to repair systems repeatedly while the foundations of trust continue to erode.
By Natasia Kalajdziovski, PhD, Senior Fusion Threat Intelligence Analyst, SecAlliance
