A narrative approach to analysis of covert action

Abstract

This article argues that covert action is subordinate to security narratives, with covert action demanded by, empowered through, and used to decisively impact the narratives of security threat that concern a state’s key power-granting audiences. A narrative approach to analysing covert action is developed based on narratology and securitisation. This approach reconciles the paradoxical historical record of implausible deniability with International Relations theory, and challenges other risk-led approaches to understanding covert action. The narrative approach is supported by a class-severity model which updates existing ladder models of covert action escalation, enabling scholars to both detect occurrences of covert action and suggest attribution to an actor – a vital initial step for the study of non-Western covert action in particular. The narrative approach also enables the effectiveness of covert action to be measured in terms of its impact on security narratives, overcoming the limitations of existing approaches. The article employs these tools to analyse Russia’s 2014 annexation of Crimea, delivering new insight and identifying areas for further study for a key non-Western user of covert action.

Video Abstract

On 22 February 2014, Vladimir Putin ordered the annexation of Crimea by Russian forces. Or was it 20 February? The Russian medal awarded for the operation to ‘restore’ Crimea gives a date two days before operations commenced, when Russian troops were observed mobilising on the border but the Kremlin claimed that no decision had been made to invade.¹ This secrecy and misdirection creates a particularly difficult challenge for International Relations scholars studying cover action. In such an uncertain environment, even basic facts about covert action – such as what occurred, who was responsible for it, and how effective it was – are often unclear. This study develops techniques for answering all of these questions using a narrative approach, which builds upon recent academic contributions addressing the under-theorisation of covert action.²

The main contribution of this article is to reframe covert action as subordinate to security narratives, rather than an isolated state activity with narrative effects. This approach enables a fresh approach to a wider range of scholarly questions on covert action and explains paradoxical observations on the characteristics of covert action such as so-called implausible deniability. While it challenges a risk-based approach to studying covert action, the narrative approach is highly compatible with recent scholarship, expanding it into a narrative-driven model and demonstrating it in a non-Western context.

Modern Russian covert action offers an ideal case study for several reasons. First, it is an example of covert action conducted at scale, often by organisations not linked to intelligence agencies. Second, much covert action likely remains undiscovered, due to a lack of available records and possibly also effective obfuscation. Third, it is a complex foreign policy effort for Russia, where tactical mission aims do not reliably indicate the purpose of covert action. Though the ongoing war in Ukraine appears at first to be suitable for testing this framework, the delay in publication of academic research on even the early stages of the war mean means extensive primary research would dominate a study which also makes theoretical contributions. In the 2014 war, academic discussions of covert action only gained place after several years, and the early academic conclusions have been significantly challenged since.³ Examining the 2014 war instead enables rigorous secondary sources to be used to support a case study which can then focus on testing the narrative approach.

The article begins by exploring how narratology and securitisation apply to covert action. It expands the ladder model of escalation with a second dimension which acknowledges different attitudes to foreign interference between states and allows benchmarking of covert action in terms of securitisation and empowered narratives. It then analyses Russian covert action during the annexation of Crimea using this narrative approach, first to detect and attribute plausible examples of Russian covert action, and then to measure the effectiveness of Russian covert action and compare with existing approaches to this task. It situates the narrative approach within current thought on covert action and international relations, in particular how it extends a framework proposed by Cormac, Walton, and Van Puyvelde. Such analysis requires a strong theoretical foundation built upon a narrative understanding of covert action, which forms the first part of this study.

Covert action and narratology

Although the role of narratives in public policy has been acknowledged since at least the 1980s, a narrative turn International Relations didn’t take hold as it did elsewhere in the social sciences.⁴ Instead, narratives were mostly explored from a meta-analytical perspective of paradigms in scholarship such as realism and liberalism.⁵ This trend was not reversed until the 2010s, when the academic study of narratives expanded and unlocked new perspective in several areas of International Relations.⁶ Scholars such as Freistein and Gadinger argued that performative narratives of leadership are a key factor in understanding success and failure in international affairs.⁷ Others argued that security threats are constructed and perpetuated by hegemonic state actors, challenging positivist interpretations of security.⁸ A narrative approach has also been used to analyse foreign policy ‘fiascos’, expanding the understanding of how fiascos emerge.⁹ Nonetheless, narratology has not been explicitly applied to covert action, although, as will be explored later in this study, the recent work of several scholars is highly compatible with a narrative approach.

Some ideas from narrative analysis can be reconciled with the study of securitisation. Securitisation argues that security threats are constructed by political and social actors to gain the power to enact change.¹⁰ Constructing these narratives empowers states to conduct politically sensitive security activities.¹¹ This power, akin to political capital, is always granted externally to the centre of the state, by key audiences which could be electorates, oligarchs, a military and security establishment, powerful corporations, or international bodies such as the United Nations or African Union. This echoes parts of the narratological study of power in International Relations. According to Carstensen and Schmidt, strengthening and shaping a narrative empowers a state to take action.¹² As an issue is securitised, the power of this narrative increases, creating a social contract which demands action is taken against the threat.¹³ This social contract is expanded upon in narratology, where audiences are socially conditioned to expect a satisfying closure to a narrative; the more dramatic the threat, the more decisive the resolution must be.¹⁴ The securitisation process thereby creates both a responsibility to act against a threat and a justification for employing more severe action which violates international norms of non-intervention, empowering the state to use covert action even when that power has been shaped or even entirely constructed by a securitising actor.¹⁵ Power is not always available and must be constructed into narratives and harnessed dynamically. Even a state with overwhelming power can lose the ability to harness it if the supporting narrative is inadequate; the Vietnam War demonstrates how a pre-eminent global military force can lose a war when the narrative behind the war is eroded and military action is no longer supported by key power-granting audiences.¹⁶ A security narrative is therefore essential for states to harness the power to take action, and to empower more severe action a stronger narrative must be developed and reinforced.¹⁷

The escalating pattern under which these narratives develop is part of the essence of securitisation. As a security narrative becomes stronger, it empowers a state to take more severe action against that threat.¹⁸ Wæver and others have documented how this is achieved through escalatory speech acts, both explicit and implicit.¹⁹ Actions themselves can also escalate the narrative, including less severe covert action which can escalate a narrative to empower more severe covert action.²⁰ This means that before a severe action takes place, a series of securitising moves would precede it as part of a coherent, escalating narrative. Available evidence supports this pattern: for example, before the 1954 CIA-led coup in Guatemala, the US government released a series of public statements alleging that communists had infiltrated the Guatemalan government, linking this to the growing McCarthyite narrative of a communist threat to US interests, and then at the Inter-American Conference shortly before the coup forced through an anti-communist resolution which further securitised the narrative in return for economic support for Latin American states.²¹ Twenty years later, the CIA employed low-level covert action as securitising moves in Chile, recruiting agents to spread propaganda and funding friendly political groups to develop the narrative of the Chilean government as an unstable and dangerous socialist threat that needed to be removed.²² Visible evidence of securitisation such as these examples demonstrate how even if a covert action is obfuscated there is a large footprint of detectable narrative activity that takes place around it, which can form the basis for narrative-based investigation of the notionally concealed action.

An escalating security narrative can involve both overt and covert activity as securitising moves. This is unremarkable from a narratological perspective but requires reinforcement given that covert action tends to be studied in relative isolation from wider international relations. Recent scholarship argues that the difference between covert and overt action is overstated, and a campaign of security activity often includes both overt and covert actions.²³ This implies substitutability between covert and overt action in escalating security narratives, an idea supported by Hulnick and Poznansky, who both argue that a state chooses to take covert action after a threat has been identified.²⁴ This is evident in the British campaign to counter unfavourable political developments in Chile, which included both overt intervention and the development of a covert agent base to influence the Chilean political process from within.²⁵ A security narrative may therefore feature overt and covert action as both securitising moves and decisive action empowered by the process.²⁶

Despite this substitutability with overt action, covert action interacts with a narratives in some unique ways. Perhaps the defining feature of covert action is its inherent secrecy – even if the effect of the action is visible, the activity that took place to achieve that effect is normally obfuscated or at least deniable, as is the identity of the state which conducted it. This idea has progressed from a traditional concept of ‘plausible deniability’ to a more modern concept of ‘implausible deniability’, recognising that covert action can be successful even when the responsible actor has not ensured that their involvement can be convincingly concealed.²⁷ The historical evidence of implausible deniability conflicts with the supposedly inherent secrecy of covert action. However, from a narratological perspective, an actor must influence the narrative to gain the power to act.²⁸ This makes true secrecy a disadvantage and barely plausible deniability an advantage for covert action, meaning that some degree of attribution is possible even for unacknowledged foreign intervention. While the action itself may be hidden, the securitising process it is part of cannot be hidden or it would not escalate the narrative to empower covert action. This is central to a narrative understanding of covert action: although covert action may be easily obfuscated, the escalating security narrative surrounding it is much more difficult to hide.

This relationship between detectable signatures, narratives, and covert action is key to the power of the narrative approach. It may seem counter-intuitive that a state conducting deniable activity would construct a detectable and attributable narrative around this activity. However, according to a narrative approach states have no choice. Either a narrative is highly securitised and covert action is already empowered by this narrative, or the state must further securitise the narrative to empower covert action. This contrasts with Poznansky’s view that states use deniability to insure against the risk of condemnation and loss of power.²⁹ Carnegie and Johnson have also both argued that secrecy is the primary utility of covert action rather than its narrative effect.³⁰ However, these arguments imply that the intention to conduct covert action arises before the security narrative that demands its use. The risk-led perspective is based on an instrumentalist approach to power which argues that states always have the power to take any action that they are physically capable of, rather than needing to gain power through security narratives which are salient for their power-granting audiences (electorates, security establishments, allied states, etc).³¹ This suggests that states would risk damaging a security narrative by using covert action in a manner deemed disproportionate or unnecessary by key audiences but would also deliberately hide all trace of the action and so gain no benefit with their audiences or securitised narratives. A ‘quiet option’ to deal with a low-level security threat still carries this high-risk, no-reward trade-off when not accompanied by a securitised narrative. Even restricting the arguments of the risk-led approach to attribution only, the same logic applies. Covert action without detectable effect on a narrative is no better than taking no action at all, so regardless of whether attribution is obfuscated, the effects will still be detectable. States do not insure against the risk of narrative damage by obfuscating the effects of covert action as this would diminish its utility, rendering covert action pointless in the first place. Instead, states insure against the risks identified by Poznansky, Johnson, and others by securitising the narrative until such action is considered legitimate by the audience, which they achieve by empowering the action through a chosen narrative and by using the action to further reinforce the narrative.³²

A narrative approach shifts the focus of covert action scholarship away from the action itself to the security narratives surrounding it. This reconciles implausible deniability with narratology and securitisation, giving a theoretical explanation for the paradox that an inherently secretive activity is so often visible – and in cases such as the annexation of Crimea, barely hidden at all.³³ Covert action depends upon narratives to empower the action, insure against the consequences of mission failure or attribution, and resolve the narratives of security threat which drive the use of such activity. According to the narrative approach, a covert action is either contributing to the narrative or attempting to decisively resolve it. In both cases, this requires a process of escalation and securitisation that can empower states to violate international norms and treaties in the name of security while still preserving the power granted to them by the securitised narrative.

The narrative approach to covert action builds upon a growing body of scholarship which challenges traditional approaches to the field. Cormac and Daddow recognise the role of narrative in shaping perceptions of success and failure in foreign intervention.³⁴ Sobel compares covert action directly to theatre, emphasising how it resembles performance and storytelling rather than military-style operational activity.³⁵ Cormac, Walton, and Van Puyvelde note the role of narratives and counter-narratives in the perception of success in covert action.³⁶ Carson and Yarhi-Milo highlight the signalling effect of covert action in communicating severity and resolve, which can in turn reinforce security narratives.³⁷ Most recently, Cormac refers to the role of narrative several times throughout How to Stage a Coup, asserting that states ‘get away with’ covert action by controlling the narrative. Among others, Cormac offers the example of CIA intervention in the 1948 Italian election, which was empowered through a highly salient narrative of defending democracy in Europe.³⁸ While the intersection of narrative, escalation, and covert action is increasingly recognised, many theoretical gaps remain, including the utility of escalatory security narratives in analysing covert action. To effectively analyse covert action from a narrative perspective, the theoretical gap between narratology and covert action escalation must be bridged.

Analysing escalation in covert action

Escalation in covert action has been studied since the 1960s, adapted from military theory and strategic studies.³⁹ Military theorists argue that escalation is a conscious choice aimed at achieving specific policy objectives rather than being inherent to conflict.⁴⁰ Similarly, some covert actions are more severe and escalatory than others. Significant political power is required to violate the non-intervention principle, hence the requirement for security narratives to empower any covert action. The perceived severity of a covert action is linked to its scope: actions with greater impact are considered more escalatory.⁴¹ The range of possible covert foreign interventions and their normative severity have allowed scholars to rank them on a ladder of escalating severity. The ladder model, first proposed by Kahn in 1965, has been expanded upon by scholars such as Johnson and is now a benchmark for classifying covert action.⁴² Recent amendments by Brantly include cyber activities, now a common tool of foreign intervention, at appropriate points in the ladder (Figure 1).⁴³

Figure 1. The ladder of covert action escalation(Brantly, ‘Cyber actions by state actors’).

A ladder of escalation helps benchmark the severity of covert action, aiding the analysis of escalating security narratives. It enhances a narrative approach by providing practical definitions which support abstract concepts such as levels of severity and power and shows what level of securitisation is needed to conduct specific covert actions. This helps to predict what types of covert action might occur in a more or less securitised environment and highlights how highly escalatory actions can electrify a security narrative – or flounder if they have not themselves been sufficiently empowered by the narrative.

However, the ladder model has shortcomings, such as its strict linearity, which can constrain analysis. While the generally increasing trend of severity is well established, the numerical escalation is far harder to verify. For instance, in this model the low-level funding of friendly groups overseas is more severe than computer network exploitation, which is near-impossible to prove. Using broader thresholds for escalation offers and reduces the risk of highly specific conclusions based on unverified assumptions.

The ladder model also needs revision to improve its applicability beyond Western states. The USA has dominated the understanding of covert action due to its unique combination of transparency and frequent action.⁴⁴ This has influenced the perception of escalation in the ladder model. Johnson himself notes that the CIA has traditionally used propaganda more extensively than other types of covert action, suggesting that information activities may be considered less escalatory by the USA.⁴⁵ Treverton has also suggested that for at least the last 20 years, the USA has disproportionately favoured paramilitary operations over other forms of covert action.⁴⁶ All states are influenced by cultural norms for perceived severity, some of which are very different to those of the USA. For example, in modern Japan a strong culture of state pacifism, or at least anti-militarism, contributes to a significantly more restrained pursuit of foreign interventions, which also suggests a radically different attitude to use of covert action than the USA.⁴⁷ Grouping covert actions into related categories would help to adjust analysis for states with different cultural norms, making it more effective for analysing non-Western covert action.

To properly analyse non-Western covert action, categorisation is therefore essential. Several scholars have attempted to categorise covert action, often using bottom-up approaches that group different actions by common features. Cormac and Wiant as well as Lowenthal have proposed such categories.⁴⁸ Johnson proposed categorising based on the type of effect, suggesting propaganda, political covert action, economic covert action, and paramilitary operations as four major categories.⁴⁹ Given the overlap between covert action and overt action, a system that is independent of specifically covert techniques would be useful, aligning with Johnson’s type-of-effect approach. A top-down model for categorising the instruments of state power is published in NATO doctrine, which classifies actions into diplomatic, information, military, and economic groups.⁵⁰ This closely matches Johnson’s categories, narrowing ‘political’ to ‘diplomatic’ while broadening ‘propaganda’ to ‘information’, and grouping paramilitary alongside military activity to reflect the increasingly blurred lines between purely military and purely paramilitary operations.⁵¹ Therefore, covert action can be categorised into diplomatic, information, military, and economic action in line with broader models for state action.

Reviewing the traditional ladder model using these four classes reveals a relative lack of examples of diplomatic covert action compared to the other three classes. The relative discretion of diplomacy makes examples of diplomatic covert action less visible compared to the other classes. Gentry proposes several diplomatic covert actions that are not included in the ladder model, including influencing foreign political leaders, covertly signalling intentions, and influencing the policy of a third-party state.⁵² Among several examples of these provided by Gentry is the 1954 Lavon Affair, in which Israeli intelligence officers conducted diplomatic covert action inside Egypt in an effort to alter British foreign policy towards Egypt to better suit the Israeli security narrative.⁵³ Diplomatic covert actions such as those highlighted by Gentry provide useful additional detail for the diplomatic class of covert action.

A two-dimensional revision of the ladder model allows for nuanced analysis of how the escalating security narratives empower specific covert actions. It recognises that while the upward trend of severity is international norm, perceptions of severity by audiences vary according to state-level cultural norms. Decoupling from strict numerical escalation offers flexibility, which is crucial to studying such a secretive field. This revised class-severity model of escalation provides a robust yardstick for narrative analysis of covert action (Figure 2).

Figure 2. The class-severity model of covert action (author’s own work; Kahn, On Escalation; Johnson, Secret Agencies; Brantly, ‘Cyber actions by state actors’).

The class-severity model adapts an established framework to recognise the diverse nature of covert policy instruments and the different cultural contexts in which they are used. It bridges the gap between covert action escalation and narratological techniques by giving structure to concepts of escalation and severity. This model can be used to analyse covert action in several ways, but for this study the most relevant use is to support the detection of plausible covert action, and where action has occurred to support the attribution of covert action to a state. The next part of this study will demonstrate how a narrative approach can be practically employed to detect and attribute covert action.

Detection and attribution of covert action

As described above, the inherent secrecy of covert action makes its detection and attribution a significant challenge. By its very definition, some degree of ambiguity will always exist in covert action, and the natural academic discomfort with analysing something so uncertain is understandable. However, this hinders study beyond Western states, where the ready availability of primary sources and a press that is legally shielded from reprisal for reporting on secretive government activity have made it easy to ground analysis of covert action in already provable and established facts. To effectively use the narrative approach for non-Western covert action, sound academic judgement, rigorous analytical techniques such as those proposed in this article, and a good evidence base identified using those analytical techniques are all required. When searching for concealed activity across the vast amount of information that is available, a structured method to narrow down the search is of great value. No tool or approach is a silver bullet for attributing covert action, but the main challenge for non-Western covert action is detecting it in the first place without leads from the press or government. Here, the narrative approach offers new contributions: first, suggesting how an actor’s cultural norms might impact its use of covert action; second, identifying what covert action might plausibly have taken place in a given narrative of security threat; third, providing a more robust justification for suggesting that covert action might have taken place; and fourth, offering evidence that supports the attribution of covert action to a given actor. Outside Western states, official confirmation of covert action cannot be expected, and even within Western states it may not be forthcoming. After all, the British government denied the existence of a 177-metre tall telecom tower in central London for decades and redacted its name to ‘Tower 23’ in court documents.⁵⁴ Tools that can attribute covert action with some degree of confidence are thus crucial for studying non-Western covert action.

Using a narrative approach for this purpose is based on the importance of the securitising narrative in empowering a state to conduct covert action. This link can be traced in both directions to detect and attribute covert action. When a sudden change occurs in a narrative, perhaps a shift in perceptions of the severity of a threat or the power of an actor to act against it, the effect of this on the security narrative can be traced back to an action. If the action is overt, it should be evident, and the narrative effect can be attributed to it easily. However, the absence of an overt action suggests that covert action may have taken place instead. The narrative approach alone does not provide confirmation of covert action, but it does enable scholars to make reasoned judgements about the potential existence of covert action and offers tools to narrow down the otherwise daunting search for undetected covert action.

While the action itself may be concealed, the effect it has on the narrative makes it possible to identify. This can be applied in three ways. One method is to start with a suspected covert action, such as suspicious bombings with the hallmarks of false flag attacks in Crimea, and trace the effect outwards to understand whose security narratives are benefited by this effect. Attribution is possible when there is a clear benefit to a state’s security narratives. Attribution may never be conclusive, but the narrative approach adds weight to an assertion by demonstrating the benefit a covert action has provided. Another method is to start with the effect on the narrative. The escalating process of securitisation, shown plainly by Russia intensifying its rhetoric and ultimately invading another country, provides a rich environment to detect covert action. It is not difficult to detect the use of covert action around the annexation of Crimea based on the escalation of a security narrative: for example, the sudden desertion or defection of several senior Ukrainian military commanders in Crimea around the invasion clearly reinforced Russia’s preferred narrative as defined below and enabled a swifter takeover of the peninsula.⁵⁵ With no evidence of overt Russian action but a strengthening of the Russian security narrative, a covert action can in this case be plausibly attributed to Russia. A final method is to identify a security narrative itself by analysing what the narrative effects of a covert action may contribute towards. By extrapolating from a suspected or identified covert action, conclusions can be drawn about which narrative an actor sought to affect. All three of these methods support the detection and attribution of covert action using a narrative approach.

Around the annexation of Crimea, the Kremlin launched an information offensive considered by many to be highly effective in narrative building. Scholars have extensively studied these narratives, simplifying the task of identifying and analysing them to detect and attribute covert action. Even if multiple sub-narratives exist, an overarching security narrative must be identified to enable further analysis. Hagmann argues that such a narrative will articulate a threat, construct it in terms of security (as opposed to expansionism, national interest, or some other motivator), and specify who is being threatened, by whom, and why.⁵⁶ These elements can be identified relatively easily from existing studies of Russian narratives surrounding the invasion of Crimea.

The NATO Strategic Communications Centre of Excellence identified several key themes in the Russian narratives around Crimea. These themes emphasise ethnic and national identities, present Ukraine as central to ‘Eurasianism’, depict Ukrainian leadership as incompetent, and highlight a ‘Nazi’ or ‘fascist’ threat.⁵⁷ This suggests that Russia did not push a single dominant narrative but rather a series of related themes. Nonetheless, the narrative approach predicts that an underlying narrative of security threat will be present throughout Russian securitising moves and should become apparent from the available information. Reviewing the narratives identified above, it is difficult to determine the underlying threat immediately. These are better considered as messages rather than narratives, individual soundbites generated from information activities than in turn feed a core security narrative. Indeed, Russia used deniable state and state-linked media outlets in Crimea and other European countries in 2014 to spread these messages.⁵⁸ Thornton’s analysis of Russian information activities suggest that Russia’s overarching narrative aimed to avoid a NATO response by operating below the threshold for intervention.⁵⁹ However, Russian media activity portrayed Ukraine as a battleground rather than as an aggressor, suggesting that malign Western influences in general and NATO in particular were treated as the source of this threat. Furthermore, Russian-aligned media painted ethnic Russians in Ukraine as the victim instead of the domestic Russian population.⁶⁰ An initial characterisation of this Russian security narrative presents NATO as a threat to ethnic Russian populations.

However, this narrative of threat does appear to be restricted or focused in some ways. Unlike the Global War on Terror, where the Bush administration stated that only the total destruction of threat organisations such as Al-Qaeda would resolve the security threat, Russian narratives in this period do not demand the annihilation of NATO.⁶¹ Russian speech acts during this time were identified by Lange-Ionatamišvili to have a clear regional focus, on the so-called near abroad of Russia.⁶² Thornton’s analysis of Russian narratives also shows an effort to avoid Cold War-style escalation that would invite a NATO response. Instead, Russia emphasised its ability to intervene in its near abroad and highlighted the lack of response from NATO.⁶³ Reversing these speech acts and considering them from a perspective of external threat rather than internal strength, the underlying narrative is focused on NATO influence and intervention in the former Soviet Union states which border Russia – in this particular case, Ukraine. This refines Russia’s core securitising narrative during the invasion of Crimea to: ‘NATO influence in Russia’s near abroad poses an existential threat to the security of ethnic Russian populations’. With this narrative characterised, securitising moves and escalation can be compared to the class-severity model to determine the severity of actions Russia could take based on this narrative. Here, the second axis in the model becomes important, as Russian norms for the use of covert action differ from the US norms which the original ladder model was based on.

A comprehensive analysis of Russian norms for covert action in the 2010s could form the basis of its own study. For this purpose, a brief examination of Russian norms across the four classes will suffice. Bertelsen et al. offer a useful breakdown of Russian norms in a comparison with their Western equivalents. For instance, while Russia views overt diplomatic action similarly to Western states, for covert diplomatic action Russia routinely uses ‘force, bullying, and intimidation’ – major actions in the class-severity model.⁶⁴ For information activities, the United States Intelligence Community published a 2016 reporting noting that ‘Moscow’s influence campaign followed a messaging strategy that blends covert intelligence operations – such as cyber activity – with overt efforts by the Russian Government agencies, state-owned media, third party intermediaries, and paid social media users’, which the Atlantic Council found compelling evidence of in Ukraine, the UK, the USA, France, and Germany between 2014 and 2017.⁶⁵ The widespread and prolific nature of these activities suggests that they are not limited to highly securitised issues. As such, traditionally more escalatory information actions would be used more routinely by Russia around the invasion of Crimea.

Russian attitudes to covert military action, particularly at the more escalatory end, differ depending on whether the target is considered domestic or foreign. This does not necessarily align with state boundaries. For example, there is compelling evidence that in the few years to 2017, Russia conducted at least 15 assassinations abroad, mostly targeting Russian citizens considered threats or traitors by the Kremlin.⁶⁶ Such extreme covert military action is rarely observed outside the Russian diaspora and near abroad, reflecting enduring post-Soviet attitudes to ‘domestic’ security as well as the wide remits of Russian intelligence agencies regarding such ‘internal’ matters.⁶⁷ When evaluating covert action during the annexation of Crimea, this normalised approach to extreme military action suggests that key audiences for Russia may have felt less need for narrative empowerment of highly securitised action. Benchmark evidence for Russian covert economic action is harder to find, but the 2007 cyberattacks on Estonian economic infrastructure offer one example. This ‘consisted of a concerted series of online vandalism, botnet attacks, and denial-of-service attacks’, which impacted banks, businesses, ATMs, and email servers, effectively switching off the Estonian economy.⁶⁸ Although this is considered extreme by the class-severity model, a lack of well-studied evidence of economic covert action beyond isolated examples such as this prevents a reliable understanding of Russian attitudes, beyond acknowledging that Russia is capable of and willing to conduct extreme economic covert action. To summarise the Russian norms for the use of different types of covert action, Russia has demonstrated that it is willing to routinely conduct major diplomatic covert action and extreme information covert action and, in its near abroad or against Russian citizens, conduct even extreme military covert action. Using the second axis of the class-severity model offers more nuanced insight into potential use of covert action than the traditional ladder model.

Applying the narratological concept of empowerment to the benchmark of the class-severity model suggests that many Russian covert actions during the invasion of Crimea may remain unidentified. Within the thresholds established above are several types of covert action which would have been empowered by Russia’s highly securitised narrative. For example, the narrative approach predicts major diplomatic covert action focused on the Russian narrative of malign Western influence in the Russian near abroad. In the build-up to the Euro-Maidan protests of 2013, Russia’s loud objections as Ukraine attempted to sign a trade deal with the European Union suggest a securitising process was occurring and raise the possibility of a narrative power deficit.⁶⁹ Notably, at the latter end of this period the Ukrainian Prime Minister Mykola Azarov and President Viktor Yanukovich had a sudden change of heart. On 21 November 2013, they almost overnight reversed direction away from the European Union towards Russia and began to repeat phrases about improving ‘relations with CIS countries’ while Putin began publicly referring to an ‘integration project’ on the exact same day.⁷⁰ These indicators appear sudden from a policy perspective but not from a narrative perspective, and these effects could be explained by extreme diplomatic covert action such as the use of covert threat to force policy change or the recruitment of diplomatic secret agents. In the absence of traditional evidence such as archival records, the model offers a compelling start point for further investigation of Russian diplomatic covert action during the annexation of Crimea, giving conceptual weight to a hypothesis that Russia employed covert threat to force policy change from Ukrainian officials. To increase the confidence of this attribution further, primary research is generally required; the contribution of the narrative approach is to guide the search for such examples and provide an indication of its plausibility based on the level of securitisation at the time.

Calibration refines the class-severity model where information on cultural norms is available, but such calibration is not essential. Nonetheless, plenty of calibration evidence is available for the Crimea case study and so firmer conclusions can be drawn from the model. Based on the highly securitised narrative perpetuated by Russia and the eventual use of some of the most extreme military actions available, the model suggests that major economic covert action was likely to have taken place in Crimea. This would include significant funding for friendly organisations, manipulation of financial markets, and disruption of money transfers among other actions. In this way, the class-severity model can guide the detection of previously unexplored types of covert action even without a full calibration for non-Western norms. For economic action, evidence of manipulation of financial markets abounds, although much of this has already been firmly attributed to Russia. To some extent, any indicator of covert action against Ukraine’s industrial base which might have contributed to the 4.7% decline in industrial output in 2013 could be explained away by Russia’s overt programme of economic sanctions rather than specifically covert activity.⁷¹ However, some specific examples are less easily explained. A 7.1% drop in manufacturing output, 25% drop in fertiliser production, and 13.2% drop in machine building all stand out against the averages, despite being sectors not specifically targeted by sanctions.⁷² Each of these examples is a potential indicator of Russian economic covert action. The model also identifies other covert actions which would have been empowered by Russia’s security narrative at the time. In particular, evidence of covert funding for friendly organisations is widespread and is interspersed with indications that Russia not only funded but also provided personnel to pro-Russian vigilante and militia groups.⁷³ Russia’s funding and arming of militia groups in Crimea as described by Thornton draw attention to other, lower-level economic actions which have not been reported, such as the covert acquisition of intellectual property.⁷⁴ The narrative approach can be used to inform and direct a search for evidence of covert action, narrowing down a wide and clouded range of activity to particular areas of Ukrainian industry which may have been targeted by sabotage or disruption, and giving weight to attribution of covert Russian support to paramilitary groups. While the inherent secrecy of covert action will always provide a challenge to scholars, a narrative approach offers a more methodical and reasoned basis for attributing events such as these to covert action, rapidly narrowing down a huge area of study to enable highly focused research, increasing the likelihood of successfully detecting and attributing covert action.

There are challenges to using a narrative approach for detection and attribution of covert action. First is the difficulty of inference which avoids undue speculation. The narrative approach guides research and discovery and offers insight into how a narrative could have plausibly empowered specific types of covert action from the wide range of options available. It does not replace rigorous analysis of available information but guides and focuses this analysis to lessen the challenge of searching blindly for evidence of activities which are inherently secretive. This is particularly important for non-Western covert action, which may never be detected by the press or citizen journalism, especially when such activities are suppressed by governments, and are far less likely to be acknowledged tacitly by states themselves. The narrative approach allows scholars to conduct more effective research to detect and attribute covert action in environments where already-reported evidence cannot be relied upon as a guide. Another challenge is the risk of falling prey to well-constructed covert information activities even while studying such action. As demonstrated above, an underlying securitised narrative is sometimes revealed only through extensive analysis of a wide range of speech acts and information actions. A successful covert action by a third party could be indistinguishable from other narratives such as these and in theory could construct an entirely false narrative that would lead to false scholarly conclusions. To overcome this, a wide lens and an open mind are both required. As well as analysing how an action may contribute to a state’s security narrative, it is always worth examining how this may also contribute to the narratives of adversaries, which frequently share many of the same characteristics but in reverse. High-profile issues such as Taiwanese independence, which has been highly securitised by both the USA and China, can lead to situations where both actors benefit from the same securitising move, especially where their underlying narratives concern a different type of threat posed in the same environment.⁷⁵ While this risk cannot be eliminated completely, it is certainly worth identifying opposing narratives which may also be benefited from a given action. In cases where multiple actors might have benefited from an action, further evidence may be required to distinguish between them. A final challenge is the potential to attribute covert action where it has not taken place and an empowered narrative and effect are merely unfortunate coincidences. This underscores the importance of not relying solely on the insight of the narrative approach to attribute covert action. The approach works best when it guides further research to uncover corroborating evidence, and the absence of further evidence may sometimes be an indicator that a coincidence is just that. These challenges highlight that the narrative approach must be used with care, corroboration, and sound judgement. Nonetheless, it is greatly useful to give insight into the plausibility of covert action based on the degree of securitisation and the severity of the action for each actor, enabling detection and attribution without an initial prompt from high-profile primary evidence. To demonstrate the full utility of the narrative approach for analysis, the remaining task is to apply it further to judge the effectiveness of covert action once it has been detected and attributed.

Measuring the effectiveness of covert action

A narrative approach can be used to measure the effectiveness of covert action. Compared to detection and attribution, measurement of effectiveness has received more scholarly attention. It is particularly useful in comparative analysis to compare covert action over time periods or between actors or different types of covert action used by the same actor. There are three broad approaches to measuring the effectiveness of covert action, the most common of which is the mission-success approach. Arguably, the most intuitive goal of covert action is achievement of its defined mission, which is probably why mission success has so often been used to measure effectiveness. This can be thought of as success in the eyes of the mission leader. Lowenthal argues that more successful covert action is tied to well-defined tasks and specific policy outcomes.⁷⁶ Daugherty takes an even more reductive view, arguing that a ‘successful outcome is one in which … objectives sought by the President are obtained’.⁷⁷ The main advantage of this approach is its simplicity, as it allows for straightforward measurement of effectiveness for actions which have clearly defined and well understood mission goals.

However, the mission success approach has several flaws. It doesn’t account for tactical successes with other negative consequences or tactical failures with other positive consequences. This problem is demonstrated by the CIA’s international organisations programme, which ran from the 1940s to the 1960s. The mission was to emulate Soviet-controlled international non-governmental organisations (INGOs) such as the World Peace Council, the World Federation of Democratic Youth, and the World Federation of Trade Unions with INGOs that produced pro-US propaganda.⁷⁸ The mission was achieved; several CIA-controlled INGOs became viable, most notably the National Students’ Association (NSA), and began producing propaganda targeting the Soviet Union. However, the revelation of CIA control in 1966 damaged both CIA-sponsored and independent anti-Soviet INGOs, significantly harming the credibility of all of these groups.⁷⁹ By mission-success standards, these covert actions were effective, but this approach prevents wider context being taken into account. Widening the definition of the mission defeats the purpose of using it in the first place and can lead to imbalance if covert actions are measured by completely different criteria. This presents a dilemma: adding to the mission criteria creates disparity, while relying on mission goals alone ignores the wider impact, making it a poor option in either regard. The ready availability of US examples highlights another pitfall, that this approach is not easily applicable beyond the USA, where missions are often well defined and stated publicly. For many covert actions, the defined mission objective may never be confirmed, limiting the use of this approach in many contexts.

Conventional wisdom of the mission-success approach holds that a goal must be defined by a narrow outcome, typically referring to a single covert action against a single policy objective.⁸⁰ In Crimea, the mission was arguably the transfer of political control of Crimea to Russia. Lanoszka notes that during the annexation, foreign-influenced political elements in Ukraine were portrayed as a threat to ethnic Russians in an escalating pattern.⁸¹ Thornton provides a detailed chronology of this securitisation process, showing how low-level information activities gradually escalated to full-scale invasion by de-badged forces.⁸² The securitising narrative has enabled an invasion of Crimea, a clearly defined mission goal which might suggest that the mission-success approach would be useful here. However, Cormac et al. criticise this approach, arguing that ‘it captures only a slice of the many other aspects linked to success, such as legality and values … it further assumes a rational state that defines clear and measurable policy objectives and links them to covert actions before conducting them’.⁸³ Renz adds that much scholarship of Russian covert action in Ukraine ‘implies a coherence of effort and level of strategic foresight that is simply unrealistic and risks making Russia and its leadership look stronger than it actually is’.⁸⁴ The mission-success approach obfuscates a much more complex picture by suggesting that all Russian activity built towards a single goal rather than developing organically. Measuring the effectiveness of Russian covert action by this final state would lead to false conclusions based on a flawed assumption of coherence. Between the limitations of an overly narrow scope, difficulty reconciling tactical and strategic level consequences, and problems accounting for covert actions with unclear or obfuscated mission goals, it is apparent that the mission success is inadequate for measuring the effectiveness of covert action. The mission goal is not irrelevant to academic study, but there are simply too many drawbacks to adopt a mission-success approach to measuring effectiveness, and an alternative must be identified.

Another approach focuses on the threats a state faces by arguing that covert action is more effective when it reduces the threat by a greater amount. This fits well with the language of securitisation from which the narrative approach is derived. Reducing or eliminating an identified threat could be considered a universal goal of covert action, or as success in the eyes of the referent object – the audiences who the securitising actor claims are under threat. This ‘stated threat’ approach would also provide a common benchmark to compare the success of multiple covert actions without needing to standardise mission aims or uncover the true parameters of individual covert actions. However, while covert action is often legitimised by linking it to a threat, successful covert action may not reduce that threat. For example, covert political activity to influence the opinions of a third actor or discredit a target may increase the threat in the short term but still be successful if it facilitates or empowers further action. During the annexation of Crimea, Russia was repeatedly accused of ‘false-flag’ activity which escalated tensions and strengthened the Russian grounds for an invasion.⁸⁵ This false-flag activity enabled further action, but its success cannot be effectively measured by solely considering their impact on the stated threat, especially given that an increase in the threat may have been the aim. There is also risk of ‘blowback’, as noted by Johnson, when considering the stated threat approach.⁸⁶ Russian activity in Crimea created disinformation narratives which muddied the information environment and overwhelmed other organic narratives such as that of an independent Crimea without Russia.⁸⁷ Measuring the effectiveness of covert action using Russia’s stated threat constricts subsequent analysis to the frame of Russian narratives and ironically reinforces Russian information activities in academic forums. For Russian covert action during the annexation of Crimea, the stated threat approach describes the narrative itself more than the goal and is vulnerable to information activities, making it less than ideal for measuring the effectiveness of covert action.

The phenomenon of enabling covert actions as mentioned above illuminates a more robust option for measuring effectiveness. Enabling activities aim to create additional capital for some other use. In the context of securitisation, the goal is to empower more severe action by the securitising actor.⁸⁸ As noted above, covert action can serve as a securitising move but also as a resolving action against a threat. In both cases, the ultimate effect of covert action can be measured in narrative terms. This approach views the narrative itself as the object of change, rather than focusing on intermediate changes in the environment as the mission-success approach does. Instead of success as perceived by the mission leader or the referent object, this approach takes the broadest view, evaluating success with respect to the construction and use of power by states. The narrative approach allows for the full range of state activity, eliminating the need for an identifiable tactical-level goal as well as the requirement for the level of public, legislative, or press scrutiny that would be required to identify a mission aim and which is not forthcoming outside the Western world. It also aligns the measurement of effectiveness with the desired effect, overcoming the inherent secrecy of covert action by measuring effects, which are typically observable, rather than methods, which are often concealed. Finally, this approach compares like with like, using security narratives – which are always present – as a means of comparison between covert actions, even when conducted by very different actors.

The narrative approach has many advantages compared with the previous approaches, but it does have limitations. First, it does not balance between actors of varying size and power, although this can be easily mitigated on a case-by-case basis. Another challenge is aligning actions to their corresponding security narratives, especially where the narrative link to a covert action may not be obvious. However, the purpose of a security narrative is to be perpetuated and grow, meaning that states will generally reveal this narrative when using it to empower covert action. The narrative approach suggests that when states lack the power to conduct a desired action, they must make securitising moves to empower the action. Just as narratives help to detect and attribute covert action, narrative effects can also be used to measure the effectiveness of covert action using a narrative approach. The impact that a covert action has on a state’s empowering security narrative is a universal indicator of its effectiveness. This gives scholars a reliable benchmark for measuring the effectiveness of covert action.

A final example using the Crimea case study demonstrates how the narrative approach can be used for comparative analysis as well as analysis of individual actions, in this case evaluating the effectiveness of Russian efforts in Crimea across different classes of covert action. Adjusting the class-severity model to account for the Russian norm of extreme covert action in its near abroad suggests that extreme information and military covert action was empowered at this time, and there is plenty of evidence of both of these types of action.⁸⁹ Russian use of social media and mass media outlets was a masterclass in enhancing a narrative through information activities not attributable to the state. Russia’s most popular TV shows were ‘actively involved in framing opinions about the situation in Ukraine from the very beginning of the crisis’.⁹⁰ The NATO STRATCOM Centre of Excellence highlights the early adoption of troll farms by Russia to create an organic-seeming information environment to reinforce their narrative. Extreme information activities such as interference in the democratic functions and domestic security narratives of another state are now considered to be key features of Russia’s invasion of Crimea. NATO considers this activity to be Russia’s early validation of extreme covert information action as the core of its doctrine for regional foreign policy.⁹¹ Russia’s military covert action is perhaps the most iconic symbol of the annexation of Crimea. The use of de-badged military and special operations forces is well reported and considered a great success of the annexation of Crimea.⁹² These so-called little green men conducted kinetic activity and allowed for concentration of force at key centres of gravity and are credited with allowing Russia to annex part of another country effectively bloodlessly.⁹³

In the class-severity model, both the information action and the military action are considered extreme. Both had a significant impact on Russia’s security narrative of threat to ethnic Russian populations in its near abroad. Tracing the effects of these covert actions using the narrative approach, two contrasting arguments can be made. One argument is that the ambiguity of the military forces was critical to Russia’s subsequent annexation, making covert military action the most effective part of Russia’s invasion of Crimea. Another argument is that Russian covert information action was critical to enable subsequent action, acting as a force multiplier for the empowered narrative. The narrative approach allows these different types of action to be compared for their relative effects on the overall narrative. The military covert action was arguably the penultimate step in Russia’s securitisation process. It resolved the security narrative with a satisfying conclusion, demonstrating that Russia can employ its military might in its near abroad and showing NATO power in the region to be ultimately ineffective against Russia’s decisive protection of its people. Conversely, the impact of Russia’s information covert action can be judged based on its role as a securitising move, although still in terms of the narrative. Though the military action was highly impactful on the narrative, it could not have taken place without a level of empowerment that was provided by the campaign of extreme information action. The narrative approach shifts the focus of this comparison towards the narrative effects, changing the question from ‘which actions achieved the mission?’ to ‘which actions had a more decisive impact on the security narrative?’ A compelling case can be made for both classes of action, as they both affected the narrative in significant ways. However, the campaign of information activity had a dramatic escalatory effect on the narrative which ultimately empowered military action that would have been unthinkable mere months before. Therefore, it may be argued that Russia’s information covert action was more effective than its military covert action because of the critical empowering function it served for the subsequent resolving action.

A related approach to measuring effectiveness was proposed recently by Cormac, Walton, and Van Puyvelde. Their model includes three dimensions for success, including a variant of mission success, success against policy objective, and a third dimension for second-order effects such as improving the electoral prospects of an actor conducting covert action.⁹⁴ They measure effectiveness by combining insight across all three dimensions with a distinctly narrative-focused lens:

A covert action is successful when salient observers judge that an operation met the goals that proponents set out to achieve; when these judgements have stuck; and when there is minimal criticism of the way the state achieved this and of the political consequences.⁹⁵

Such an approach acknowledges that covert action has narrative effects, part of the growing consensus within which this article is situated. There is plenty of overlap between their approach and the narrative approach proposed here. Both recognise the importance of factors other than the mission itself in determining success. Cormac et al. choose perception rather than narrative as the fundamental factor but still argue that perception of success is more important than mission success, and that strategic benefits are gained from a narrative of tactical success, in common with this study.⁹⁶ Their approach also offers an opportunity to contrast existing approaches with a primary contribution of this article, which places the narrative at the centre of analysis rather than the action itself. The narrative approach argues that effective covert action can only take place when sufficiently empowered by a security narrative and measures effectiveness solely in terms of the impact on that narrative. This aligns with Cormac et al.’s use of narrative to judge the effectiveness of covert action but extends this concept significantly by discounting the achievement of the mission as a factor entirely, and by placing these ideas in the context of a narratological perspective on empowering the use of covert action, and a securitisation perspective on the manner by which the narrative escalates and develops. Developing the ideas of Cormac et al. further and placing them in this wider context will continue their work in resolving the under-theorisation of covert action.

Conclusions

Placing the narrative at the heart of analysis is key to overcoming the inherent difficulties of studying covert action. Recognising the role of securitising processes in harnessing the power inherent to narratives, and developing this concept in the context of covert action, the narrative approach can be used as the basis for a wide range of analytical techniques. In this particular case, it has highlighted that the undercurrent of Russian activity during the invasion of Crimea was a security narrative which focused on the foreign threat to ethnic Russians in Russia’s near abroad. It identified plausible examples of Russian economic covert action against the Ukrainian economy, narrowing down a vast search to specific sectors and providing a basis for further investigation in these areas which may produce sufficient corroboration to provide firm attribution. The narrative approach also offered a mechanism for attributing sudden changes in the narrative to Russian covert action and through the class-severity model suggested particular types of covert action which had been empowered to take place by the Russian narrative at that stage. It then argued that the significant role of information activities outweighed even the final military action in its effective contribution to the Russian security narrative.

A narrative approach to covert action challenges the conclusions of some risk-focused approaches but does not discount the observations and logic of such arguments, only placing them in a wider context to reveal how their interactions with larger security narratives change the way that covert action can be viewed. It builds upon many recent contributions to this field, particularly those which recognise the importance of narrative and audience in states’ use of covert action. Perhaps most importantly, the narrative approach links two prominent concepts in International Relations theory to the major ongoing effort to resolve the under-theorisation of covert action. By adopting a narrative approach, scholars can take advantage of several new tools which shine a light on one of the most secretive areas of state activity.