Introduction

Late in the evening on February 7, 2018, the thunderous roar of a massive aerial bombardment lit up the night sky near the southwestern edge of the Syrian town of Khasham in the province of Deir Ezzor. A few clicks from the eastern bank of the Euphrates River, a contingent of Afghan, Syrian, and Iraqi tribal fighters ran for cover near the town of Marrat. It was the second time that night that fighters with the Russian-backed ISIS Hunters and Syrian 4th Armored Division had tried to cross the line of de-confliction agreed on by the United States and Russia, and this time it appeared they had pressed too far.¹ A hail of missiles fired by the U.S. military ripped through the cool dessert night air, cutting down dozens of fighters loyal to Bashar al-Assad.²

At dawn, the battle damage was apparent. Among the fatalities were Russian fighters affiliated with the Wagner Group, a private-military security contractor (PMSC) contingent, tasked with training, equipping, and deploying with ISIS Hunters and several other pro-Assad militias along key lines of communication in northern Syria. It was a devastating blow for 5th Assault Corps, an amalgam of local pro-government paramilitaries that Wagner and affiliated Russian PMSC detachments began training soon after the start of the Syrian civil war in 2011.

Media and scholarly accounts of the battle initially suggested it marked the first time in decades that the U.S. military directly fired on Russian forces.³ After the American airstrike on the column of purported Wagner fighters, 5th Assault Corps fighters, and other pro-Assad forces, U.S. officials later said that it wasn’t the first Russian-American firefight in Syria and that casualties in Deir Ezzor may have reached as high as 200.⁴ Some news accounts placed the total number of Russians killed in action at more than 100 people. The Kremlin initially claimed none of its citizens were present but Russian-language social media told a different story.

Several user groups, or “clubs,” popular with Russian mercenaries, wannabes, and military veterans on the popular Russian-based social media platform Vkontakte began pinging their members for information about what they may have heard about the battle thousands of miles away in Syria.⁵ Vkontakte buzzed with rumors after Igor “Strelkov” (aka Igor Girkin), a former Russian special forces operator with Russia’s Federal Security Service, or FSB⁶, and pro-Russian separatist leader who fought in Ukraine, indicated the death toll might be as high as 600 fighters. Since by then it was widely known that Strelkov-Girkin had led advance reconnaissance teams for Russia in Crimea and served as chief of security for Russian oligarch Konstanin Malofeev, a key financier of Russian irregulars, the high-casualty claims stuck.⁷ Investigative journalists later confirmed the identities of several Russian citizens whose names appeared on a leaked casualties list, and the Kremlin reversed its denials.⁸

The pitched battle in Deir Ezzor on the line of de-confliction between American-backed Syrian Defense Forces (SDF) and Russian-backed paramilitaries is illustrative of the potential for miscalculation in proxy war and escalation risks. Narratives about who is fighting whom matter as much as definitions and norms in proxy war. On paper, Russian PMSCs appear to be private security providers, but they operate far outside the bounds of international law and widely accepted international industry protocols.

Russian legal prohibitions against private expeditionary forces bind organizations like Wagner closely to a quasi-state shadow network of oligarchs, state enterprises, and security agencies. In form, Russian PMSC operators, such as the Wagner Group, appear to be private actors, operating independent of the Russian military, and ostensibly providing protective security services. In function, Russian PMSCs are often full combat operators who coordinate closely with the Russian military on land and on sea.

If, as Sun Tzu has said, “all warfare is based on deception” and “subduing the enemy without fighting is the acme of skill,” then transmission, control, and perception of information about who is fighting whom and why is the sine qua non of proxy war. Achieving a degree of plausible deniability or, at minimum, ensuring that unacknowledged covert activity in support of paramilitaries does not trigger retaliation as Wagner did in Deir Ezzor or blowback as it did in Ukraine depends as much on sponsors’ behavior as it does on that of the proxies.

Whether sponsors use surrogate forces to communicate resolve to competitors, to lower costs, manage escalation risks, to delimit the bounds of conflict, or all of the above, the goal of employing proxies is often to influence an adversary’s behavior. Proxies signal reach and a determination to deter threats and deny access by asymmetric retaliation for perceived adversarial breaches. The success or failure of such a proxy strategy is bound up in the degree to which sponsors are willing to or are forced to acknowledge covert connections.⁹ Deception is a key component in shaping narratives around the logic of conflict and shaping an adversary’s threat perception. It can also be important in influencing alliances; when so-called “dirty tricks” and covert military operations are exposed, alliances can shift and with them, the strategic balance.¹⁰

For sponsors like Russia, then, controlling narratives around covert connections and command responsibility for operations is critical to containing costs and preventing escalation.¹¹ Paradoxically, however, the need for secrecy—when provided via proxy warfare tactics of using surrogates—greatly complicates sponsors’ ability to insulate themselves from escalation risks. As seen, for instance, with Russia’s use of PMSCs in Syria and in Ukraine alongside pro-Russian separatist forces, the pressure to conceal can greatly complicate the command structures and impose limits on sponsors’ ability to exert control over proxies.¹² Extensive reporting on the Deir Ezzor clash and the downing of MH17, a Malaysian Airlines commercial plane that was shot down by Russian-backed forces as it flew over Ukraine airspace in 2014, are examples of how proxy strategies can result in exposure that leads to blowback. The shootdown, which killed 298 people, was ultimately attributed to Russian-affiliated forces as a result of open source information found largely through online social networks, which in turn prompted stringent sanctions against Russia.¹³

Both incidents illustrate the high risks of deploying proxy forces as a signaling strategy. They also indicate how the digital age is transforming secrecy, and along with it proxy war. After the battle of Khasham in Deir Ezzor, the Kremlin was cagey, at first denying any of its citizens had been killed, then ultimately admitting that at least four Russian veterans had been killed and several others wounded along with a little more than two dozen pro-Assad Syrian fighters in the clash with American forces.

The pitched battle in Deir Ezzor on the line of de-confliction between American-backed SDF and Russian PMSCs has since emerged as a central thread in competing narratives spun by Moscow and Washington. To the extent that anything is concretely known about how PMSCs like the Wagner Group operate there are many more known unknowns.¹⁴ Officially, Putin denies any Kremlin link to PMSC operations.¹⁵ Unofficially, however, the Kremlin has done little to publicly contravene the now dominant media narrative portraying Putin’s favorite caterer, Yevgeny Prigozhin, as the puppet master behind the Wagner Group and efforts by the St. Petersburg based Internet Research Agency (IRA) to promote disinformation about Russian PMSC activities.¹⁶

In fact the only known public Kremlin response to allegations of Prigozhin’s links to the IRA and the Wagner Group beyond attempts to portray the group as purely private actors surfaced in October 2019 after the U.S. Treasury Department levied a raft of sanctions against jets and yachts Prigozhin allegedly used to ferry himself from one warzone deal to the next.¹⁷ But, even in that instance, it was not entirely clear whether it was the U.S. asset freeze against Prigozhin specifically that triggered threats of Kremlin retaliation since the sanctions also named IRA employees as well; it was the third time Prigozhin’s businesses had come under U.S. scrutiny in as many years.¹⁸

Debates rage over who controls Wagner and whether Wagner’s operations and the disinformation campaign surrounding their activities are indicative of a new form of hybrid warfare. Given reports of political meddling by the IRA in places where the Kremlin seeks to project power, there does seem to be a pattern that lends credence to that view. The Mueller report on Russian interference in the 2016 U.S. elections certainly backs up allegations that Prigozhin has largely acted with informed consent from the Kremlin.¹⁹

Much of what is known today about Prigozhin, the Wagner Group, and other PMSCs is a direct result of the work of intrepid journalists and researchers who have collected digital data on members of Russian-backed paramilitary groups and the oligarchies that support them. The most notable among these are Bellingcat, the Conflict Intelligence Team, C4ADS, the Dossier Center, and StopFake.org, a Ukraine-based citizen driven organization that promotes transparency and combats disinformation.²⁰

It has been reported that the Russian PMSC fighters killed in Deir Ezzor were attempting to seize control of a Conoco gas plant near the banks of the Euphrates River on behalf of a Prigozhin linked company called Evro Polis.²¹ So far, however, no direct line has been traced between Prigozhin and the events that took place that fateful day in February 2018 in northeastern Syria. Whether the Russian men cut down by the U.S. airstrike there were acting entirely of their own private volition, working for Kremlin insiders, or were servicing the Russian state remains debatable. But that may be by design. Focused attention on one part of the sprawling networks that facilitate PMSC operations diverts attention away from other parts of the network, providing strategic value to Russia, Russian PMSCs, and their clients.

The ambiguity surrounding the battle of Khasham in Deir Ezor raises puzzling questions about the strategic value of allowing narratives about the Wagner Group and Prigozhin to go unchallenged and uncorrected. What objectives are served by obfuscation in the Wagner case? Why has the Kremlin seemingly endorsed the spread of disinformation about other “fake” PMSCs?²² What does Moscow gain from the "ghost army fights hybrid warfare" narrative surrounding the Wagner Group?

To the extent possible, this report seeks to answer those questions. It combines open source investigative techniques with an interrogation of the historical record to elucidate the broader framework under which Russian PMSCs operate and explain the underlying strategic aims that guide their activity. We have attempted to decode what is known and unknown about the role of Russian-backed irregulars in current conflicts and separate myth from fact about how Russian-backed contract paramilitary proxies fit into twenty-first century Russian grand strategy.

Our analysis traces the evolution of Russian PMSCs from small scale domestic providers to the tip of the spear of Russian military intervention and influence. We focus primarily on the Greater Middle East and its periphery because it has long been central to how successive generations of Russian leaders have formulated military doctrine and diplomatic approaches to power projection. However, it is important to note that Russia has also begun to use PMSCs to extend its influence in Africa and Latin America, in addition to Ukraine and Syria.²³

In this study, we examine the factors that precipitated the growth of Russia’s private security industry, and that shaped Russian PMSC operations more specifically in Syria. ²⁴ In doing so, we have drawn on a review of primary and secondary sources in Russian and English, two field research trips to Ukraine, and more than 70 expert interviews.²⁵ In addition to a review of primary and secondary sources and expert interviews, we excavated online sources to gain deeper insights into Russia’s private security industry.²⁶

Much of that work corroborated insights inferred from fine-grained analysis of a database of the online social media accounts of more than 300 individuals killed in Syria who reportedly previously fought in Ukraine. Additional findings were culled from a database of roughly 80 individuals who identified themselves as “soldiers of fortune” in an online forum dedicated to the Wagner Group PMSC and indicated that they had served officially at one time with Russian military units. Data culled from those sources will be the subject of further, forthcoming analysis as part of New America and Arizona State University’s Future of Proxy Warfare project.

The Kremlin has not surprisingly suppressed or classified a considerable amount of information about Russian military activities in these locations, raising barriers to verification. Detailed public records on the contracting practices of Russian PMSCs and specific arrangements with their client base are scant. These limitations naturally constrained our ability to make claims about the full scope of PMSC operations. Where possible, however, we have attempted to connect the dots between the informal and formal state networks that have fueled the growing prominence of PMSCs, like the Wagner Group, in Russia’s proxy war strategies, with a special emphasis on Syria.

This study is divided into seven parts, including this introduction. Section two explains the challenges posed by how Russia defines PMSCs and differentiates between state-commanded military expeditions and state-backed military enterprises. The third section evaluates the Cold War foundations of Russia’s use of PMSCs and the impact of successive phases of military modernization on the outgrowth of the market for private force in Russia that gave rise to both Russia’s PMSC industry and the strategic interests it helps Russia pursue. Section four traces the genealogy of the Russian PMSC industry and the Wagner Group and its affiliates in light of that history. Section five examines the evidence that Russian PMSCs have taken on offensive military roles in support of longstanding Russian strategic interests. The sixth section analyzes what the data on Russian PMSC activity indicates about their role and takes a critical look at current debates over hybrid warfare and the role of PMSCs in Russian military doctrine under the watch of Gen. Valery Gerasimov, Russia’s Chief of Army Staff. Finally, section seven concludes with an assessment of the implications of Russian PMSC operations for current and future proxy wars and the risks of escalation in the digital age.

The publication of this report coincides closely with the five-year anniversary of the downing of MH17 over the Donbas region of eastern Ukraine in 2014. Since then, stories about Russian PMSCs have given birth to a cottage industry of speculative reporting. Wagner Group fighters have even been reportedly sighted as far away as Venezuela. In Libya, its mercenaries have reportedly provided key support to the forces of Gen. Khalifa Haftar.²⁷ In the Central African Republic, mysteries still abound about the July 2018 murder of three Russian investigative journalists who were fatally ambushed while trying to track the Wagner story down.²⁸

The degree to which the Kremlin controls PMSCs such as the Wagner Group is a matter of dispute. But, asking and answering questions about who is involved in the Wagner Group and what they are doing only tells part of the story. When evaluating the nested networks of Russian PMSCs and their sponsors, it’s not the “what” that matters most—it’s the “why” and “how.” Denials aside, the 2018 Deir Ezzor battle and MH17 shootdown put the lie to Moscow’s plausible deniability. Both incidents illustrate the criticality of narrative control in proxy warfare and are classic case studies of what happens when principals sponsor proxies who violate the laws of war and operate covertly outside of accepted norms.