Bureaucratic Spam in the Service of the Kremlin: How Russian Security Services Attack Ukraine with Spam via the Law on Citizens' Appeals

On behalf of Ukrainians, state bodies and law enforcement agencies receive hundreds of appeals with complaints about corruption, mobilization, servicemembers, and sensational events. Some of these “applicants” are created using other people’s personal data, and the mailings themselves are part of a Russian operation called “Pochtalion.”

Why this benefits Russia and how they use it against Ukraine — in a report by RBC-Ukraine.

Since around May, strange letters-appeals have begun arriving systematically in the inboxes of various state bodies. In them the senders describe a sensational story — such as explosions at warehouses in Vyshneve as a result of a Russian attack, pressure on a company, the destruction of a gas station in the Sumy region, or an alleged poisoning of Lindsey Graham — and ask the authorities to urgently look into it.

What is unsettling about these and other similar letters is not so much their content. Appeals from different people to different institutions show an almost identical textual “handwriting.”

After the word “STATEMENT” there is a description of the problem and a lengthy conclusion about its threat to the state and society. After a phrase like “I have no other way… except to address you,” an identical formulation is written: “Guided by the Law of Ukraine ‘On Citizens’ Appeals’, I REQUEST.”

Next comes a list of demands to government representatives, including urgent intervention and response. And at the end — everywhere — a request to notify in writing about the result to the specified email address.

Such stylistic similarity is atypical for people of different ages, professions, from different regions, and with completely different problems.

Moreover, in a significant portion of the appeals the names of the applicants do not match the names of the contact mailboxes from which the letters were sent. An applicant who identified himself as “Sviatoslav Podlensky” sent an appeal from a mailbox under the name “Vera Savelieva.” From the same mailbox a letter from “Stanislav Karpenko” was received. Such anomalies repeat.

Analysis of the entire set of these letters shows signs of a coordinated campaign. According to RBC-Ukraine, these appeals are part of a Russian operation against Ukrainian state bodies and the military codenamed “Pochtalion.” It involves IPSO units of the Russian armed forces, the GRU, and the FSB.

How “Pochtalion” works: other people’s names and real problems

Unlike typical information campaigns aimed primarily at mass audiences, in this case the object of the “attack” is the Ukrainian state system itself.

The mechanics of the operation are built around a fully legal instrument — the citizen’s right to appeal to authorities.

The law allows appeals to be submitted electronically and does not require a qualified electronic signature. They must include the applicant’s name and place of residence, the substance of the issue, and an email address or other means of contact — a properly formatted appeal must be reviewed by state authorities and a response provided. If it is impossible to establish who submitted it, the appeal is considered anonymous and is not subject to review.

How do the Russians use this? At the first stage they create a pool of “applicants.” According to RBC-Ukraine, enemy units collect Ukrainians’ personal data, form databases of real and fake citizens, and select contact details and email addresses.

This information can be found in open sources, database leaks, hacked accounts, or documents people previously submitted through insufficiently protected channels.

Former Deputy Chief of GUR of the Ministry of Defense, Major General Illia Pavlenko, calls this an old intelligence method that has acquired modern digital tools.

“Previously, intelligence officers would go to cemeteries and copy data about the deceased to operate under real people’s identities. Now the Russians search the internet for all the necessary information,” he explains.

According to him, the enemy cannot recruit hundreds of people to write such complaints. It is much easier to use a person’s identity without their knowledge — or to construct a believable claimant based on real personal data. Thus, an appeal or complaint supposedly from a real person is sent to a Ukrainian authority, and it is formatted so it cannot be easily ignored.

Photo: Viktor Yahun (video screenshot)

Another component is the subject matter of the submitted appeals. RBC-Ukraine reports that Russian operatives track sensational stories, conflicts, and topical issues already present in the information space, because they do not require a complicated cover story. Those are used as the basis for preparing complaints.

A real conflict, a sensational tragedy, stories about illegal mobilization, a corruption scandal, or a deterioration of the security situation in a community — these already provide enough material for a plausible appeal.

Unconfirmed details or desired interpretations can be added to a real fact, causation can be altered, or a much broader conclusion can be drawn than the original circumstances warrant.

Former Deputy Head of the SBU Viktor Yahun believes that this principle — combining truth, exaggeration, and distortion — increasingly defines modern Russian information operations.

“The most effective Russian disinformation today is far from always a hundred percent lie. A far more dangerous method is to take a real Ukrainian problem, conflict, or mistake, rip it out of context, repeatedly amplify it through a controlled network, and lead the audience to a predetermined conclusion,” Yahun describes the change in Russian information warfare tactics.

Why Russia needs the appeals

According to RBC-Ukraine sources, just in June and July Russian units involved in this special operation organized the mailing of over 500 such complaints and appeals.

Recipients included the Ministry of Defense, the General Staff of the Armed Forces, the Office of the President, the Cabinet of Ministers, law enforcement and anti-corruption agencies, members of parliament, and regional administrations.

Moscow is trying to force Ukrainian state bodies to react to an artificially created signal. RBC-Ukraine’s sources say the Russian operatives literally set themselves the task of creating additional bureaucratic burden and diverting administrative resources to secondary tasks.

A formally correctly formatted appeal must be accepted, registered, assigned to a competent unit, forwarded if necessary, the stated facts verified, information requested, and finally a reply provided.

However, that does not mean every Russian letter successfully triggers this mechanism. The head of the Center for Countering Disinformation, Andriy Kovalenko, confirms that such fake appeals do indeed reach Ukrainian institutions, but he assesses the tactic’s effectiveness much more modestly.

“These fake requests do arrive in mailboxes, but they are usually legally poorly written. And, honestly, many of them do not comply with any legislation that would obligate a response. So in this case the story is ineffective,” Kovalenko says.

Thus there is a significant difference between the operation’s concept and its practical result. The Russian side may count on the appeal forcing a state body to expend resources, but some letters, according to the CCD’s assessment, may be filtered out due to errors before they can cause a serious bureaucratic reaction.

At the same time, RBC-Ukraine’s materials show that a portion of the mailings does get past this barrier: in June and July Russian operatives received slightly fewer than a hundred replies from Ukrainian institutions.

One such letter will not paralyze state bodies. However, appeals that meet formal requirements and contain enough real details already require at least initial processing. On the scale of hundreds of letters, this potentially diverts resources from handling real citizens’ appeals.

Another function of such appeals, also identified by RBC-Ukraine as an opponent’s goal, is to create an artificial public demand and simulate protest potential.

A hypothetical Russian Telegram channel accusing the Ukrainian authorities is easily recognized as a possible propaganda tool. It is much more convincing when the same or similar theses are supposedly raised independently by a farmer from the Sumy region, a pensioner from Kirovohrad, or a citizen from the Lviv region — each with their own “personal” story.

Photo: fake appeals are sent to Ukrainian institutions (Getty Images)

At the same time, the task is not necessarily to convince a specific official reading the statement. Far more important can be the fact itself that the thesis Russia wants has entered the Ukrainian state system and document workflow.

An appeal can be forwarded between agencies, generate additional requests or checks, and ultimately receive an official response. Thus the information injection moves from the realm of “someone wrote something on the internet” into the realm of real administrative activity of the state.

If there are dozens or hundreds of such appeals, it creates the impression that dissatisfaction, anxiety, or demand for intervention is arising organically and simultaneously in different regions and social groups. This technique is called astroturfing — simulating public activism that appears spontaneous and independent.

According to Yahun, this principle is increasingly used in other Russian information operations. The desired narrative is launched not from an obviously Russian resource but through Ukrainian-language accounts posing as servicemembers, locals, regional pages, or independent media. This creates the illusion that the information originated inside Ukraine and Russian propaganda merely “quotes” it.

“Russian information confrontation is becoming less visibly ‘Russian,’ much more technological, and far better adapted to internal Ukrainian discussions. The adversary’s task is not to make a Ukrainian believe a Russian propagandist. The task is to make the Ukrainian hear the narrative the Kremlin wants from a person or resource he is inclined to trust, and ideally — to have him subsequently spread it himself. That is one of the main dangers of Russian IPSO today,” Yahun explains.

In “Pochtalion” this logic is transferred from social networks to official communication with the state: the carrier of the thesis Russia needs becomes not a fake Ukrainian account but an allegedly real Ukrainian applicant.

A separate target — the Ukrainian military

A separate set of appeals within “Pochtalion” concerns the Ukrainian Defense Forces. The topics of such statements largely overlap with traditional Russian narratives: corruption and embezzlement of money or property donated by volunteers to the military, loss of positions or control over certain territories by units of the Armed Forces, mistreatment of subordinates, violations of servicemembers’ rights, high rates of death and disease among personnel. Some appeals related to illegal mobilization and missing servicemembers.

Such appeals can have not only informational but also practical effects — becoming a pretext for inspections or investigations into military units and their command.

According to RBC-Ukraine’s sources, the Russian side in its internal reports linked some such appeals to the initiation of checks regarding Ukrainian commanders. It was not possible to independently confirm that causal link.

In addition, the outlet reports that the enemy separately identified 17 Ukrainian units with high morale and concentrated efforts on discrediting their command. Among them are units of the Ground Forces, Air Assault Forces, Unmanned Systems Forces, the Navy, the National Guard, and one assault regiment.

“The Russians find a military unit with high morale, effective commanders, and combat successes, and start working against it. For this they look for personal data of servicemembers from that unit or their relatives; if they cannot find them — they use fake documents — and send complaints to law enforcement agencies: the SBI, the Military Police’s prosecutor oversight, prosecutions, the Security Service, etc.,” Pavlenko describes.

If a specific unit is targeted, even an unfounded inspection results in additional requests, documents, explanations, and time spent. At the same time, the accusations and checks themselves can create additional tension within the unit and affect trust in the command. For Russian IPSO this is an especially beneficial combination: the psychological effect is compounded by the administrative one.

Photo: Illia Pavlenko (RBC-Ukraine)

The scheme can give the adversary results even when the initial accusation is not confirmed and turns out to be fabricated. In Russian military terminology this is called diverting resources to an “unsuitable object,” Pavlenko says.

“There might not have been any violation described in the appeal at all, but the military unit is still subjected to an inspection. In this way the goal is achieved: the unit is distracted from its main activities and its command is discredited. Sometimes during such inspections a real violation may be found, even if different from what was described in the complaint, but all of that is then used in informational work,” the former deputy chief of GUR explains.

If the appeal does trigger a reaction, a kind of closed loop can arise: the Russian side creates a pretext for an inspection, the Ukrainian system reacts to it, and the result of that reaction can become new raw material for the next information campaign.

The Russians try to divert the Defense Forces’ resources not only through complaints and inspections. In one letter reviewed by RBC-Ukraine, the author — allegedly a Ukrainian citizen — reported coordinates of Russian troop positions on temporarily occupied territory and suggested using that information.

The applicant’s name did not match the name listed in the email account from which the letter was sent. Moreover, RBC-Ukraine’s sources say the coordinates given in the letter were fake — there were no Russian troops there.

In this case the goal is no longer to force a state body to prepare a written response or launch an inspection within a unit. The Ukrainian side receives an alleged intelligence signal that must be assessed, verified, and compared with other sources.

Even if false data are filtered out, time and resources have already been spent on verification. If the false signal is not recognized in time, in the worst case it can lead to the expenditure of forces or even munitions on a target that does not exist at the given coordinates.

Pavlenko says the adversary can also use personal data of real residents of occupied territories, including information from databases that fell into the hands of Russian structures. From the names of such people, fake messages can also be sent to Ukrainian chatbots and channels intended to collect information on enemy movements or locations.

“In this way they distract our resources. First you need to assess the received information, pass it on, go to the position, prepare, conduct a strike, and leave the area. And if our forces spend time and means on a false target, the enemy can act against real targets during that time. This is another direction of work for Russian military IPSO units,” the former deputy chief of GUR says.

What the Russians gain from replies — and how to block this channel

For Russian operatives the replies to appeals are important not only in number but also in the fact of reaction. Given that not every appeal receives a response, their accounting can be a way for Russian operatives to understand where their campaign works and where it does not.

The Russian side can effectively probe the response of the Ukrainian state apparatus: who processes which types of appeals, where they are redirected, which agencies respond, which topics provoke reactions, and which complaints can trigger official checks.

Sources say the enemy plans to increase the number of appeals specifically to institutions that have already responded to previous letters. This suggests that an official reply for the operation’s executors is not a side effect but an indicator that a specific scenario worked.

Pavlenko explains that the system of such operations works cyclically. Executives report on the event and attach supporting materials: the appeal itself, the received response, information about the start of a check or its result.

Photo: Illia Pavlenko (RBC-Ukraine)

If, after a fabricated complaint, an inspection of a military unit is launched and, for example, a disciplinary decision is made against a commander, this can already be presented as a successful result of the operation. After that the method is recommended to be continued or scaled up.

However, this dependence on the Ukrainian side’s reaction also indicates “Pochtalion”’s weak point. For the scheme to work, a state body must at least initially accept the applicant as a real person. Therefore one of the simplest countermeasures, according to Pavlenko, is additional verification of the applicant’s identity in cases where the appeal raises suspicion.

For example, a state body can contact the person at the provided phone number and confirm whether they actually submitted the appeal. If the number’s owner hears about the letter for the first time, this is already a signal that the appeal may be fake and requires a different verification algorithm.

A parallel solution could be strengthening personal data protection, faster sharing of information about compromised databases between law enforcement agencies, and greater informational caution among citizens themselves, especially relatives of servicemembers.

According to Pavlenko, in the future additional identification of the applicant could be considered, for example via Diia, BankID, or another secure tool.

A similar mechanism works for electronic petitions: to create or support them, a user undergoes electronic identification through the state ID.GOV.UA system. This does not deprive a citizen of the right to petition but makes it harder to use another person’s identity.

“A person could undergo identification when submitting a request or appeal: if identified — they receive a response; if not — no response is provided. In this way you can deprive the adversary of the database needed to conduct such cyclical operations. These operations are ongoing now, and as far as is known, their plan is laid out through the end of the year,” the former deputy chief of GUR says.

The right of a person to contact the state without unnecessary barriers is one of the basic civil freedoms. Excessive complication of the procedure could primarily harm real citizens.

Right now Russia is effectively trying to use the openness of the Ukrainian state as a vulnerability. Therefore the task is not to abandon an open system of appeals but to increase the reliability of identification where the cost of error is high.

Questions — answers:

– What is the “Pochtalion” operation?

– It is a Russian operation in which fabricated appeals and complaints are sent to state bodies and law enforcement agencies on behalf of allegedly Ukrainian citizens. According to RBC-Ukraine, it involves Russian IPSO units, intelligence, and the FSB.

– How do the Russians create fake claimants?

– They can use real personal data of Ukrainians or construct believable personas based on that data. For the appeals themselves they often use real conflicts, tragedies, or other sensational stories, adding accusations and interpretations needed by Russia.

– Why does Russia send such appeals en masse?

– One goal is to create additional burden on Ukrainian institutions and force them to respond to artificially created signals. Another is to simulate public dissatisfaction and insert narratives the Kremlin wants directly into Ukrainian document workflow.

– Why are Ukrainian servicemembers a separate target?

– The Russian side tries to use complaints against military units and their command, counting on inspections and extra administrative burden. Russian materials separately listed 17 Ukrainian units with high morale.

– How effective is this scheme?

– Not every letter works. The CCD says many such appeals are legally inept, but in June and July Russian operatives still received slightly fewer than a hundred replies from Ukrainian institutions.

– Why do the Russians track replies from Ukrainian institutions?

– A reply shows that a specific scenario managed to get through the state system. According to RBC-Ukraine’s sources, Russian operatives plan to increase appeals to institutions that already responded to previous letters.

– How can “Pochtalion” be countered?

– One option is additional verification of the author’s identity for suspicious appeals and, in the future, using secure electronic identification. At the same time, such mechanisms should not create excessive barriers for real citizens who contact the state.