Ukraine Military History Institute
The warning came from civilians with phones, not from secret sources
When Rob Lee describes how he read the Russian buildup before the full-scale invasion, the first thing he does is play down his own role. He says plainly that he is not good at geolocating things and not good at scraping social media, and that he had to rely on other people.
What he relied on was remarkably ordinary. Russian rail lines run through cities, so when Russia moved equipment, it moved through places where people live. Civilians filmed the trains and posted the videos on TikTok. Some simply said, in effect, "I live in this city and this is what I am seeing."
A handful of prominent accounts gathered this material. Lee names Girkin Girkin, which posted a large number of those TikTok videos, and Necromancer. The CIT Team was doing similar work. Others read the numbers on the trains to work out where they had come from and where they were going, and Sam Cook adds vehicle markings to the list.
Lee's summary is that it was actually pretty simple. His contribution was assembly: taking what different people were tracking, each covering one aspect, and putting together the picture it formed.
The precedent was Syria, where the analysis came from the people watching
Lee sets this against an earlier case. With Russia's operations in Syria, he notes, much of the analysis did not come from Western specialists. It came from Syrians who were tracking what Russia was doing around them.
The method that worked in the Ukrainian case had the same shape. The people closest to the movement saw it first and published it, and the analytical work was in reading their observations together rather than in obtaining anything hidden.
What made the buildup "nonstandard"
By January, Lee says, it had become clear to him that the buildup was very nonstandard. He is careful about what that meant. In his best-case reading it was still possible Russia was engaged in coercion, but coercion on a scale unprecedented since the Soviet Union collapsed.
He lists the specific indicators:
- The naval component sent to the Black Sea was unprecedented in size.
- The buildup along the border and in Crimea was very much nonstandard, and it was not timed to a big exercise, which removed the usual cover story.
- Russia moved, by his own hedged recollection, something like 85% of its BTGs, the permanent-readiness battalion tactical groups.
- Su-25s were deployed from as far away as Vladivostok.
- When the Eastern Military District began moving in early January, he calls that another really bad sign. Every military district was moving to Ukraine's border.
His conclusion from the absence of an exercise is the sharpest line in the chapter: there was no good justification other than Russia trying to coerce Ukraine or preparing to use military force.
Why the usual war-scare scepticism was the wrong instinct this time
The difficulty, Lee explains, is that there had been war scares before. Since he had been watching, every spring or summer brought an article asking whether Russia was about to launch a full-scale invasion of Ukraine. He cites 2016, 2017 and 2018. Cook pushes the history back further, placing the first such scare around 2003 or 2004.
Lee concedes there was always reason to take the possibility seriously, because Russia had already used force against Ukraine. But in most of those earlier cases there were no objective indicators pointing to a larger-scale invasion. The articles ran on the calendar, not on evidence.
That track record became part of the problem. People kept denying it, saying it was definitely not going to happen. Cook frames the question they were really asking: these scares happen every year, so what makes this one different?
Lee's answer is the analytical point worth keeping. He says he did not previously believe a full-scale invasion was coming. What changed his view was not a mood or a pattern but a set of observations that were objectively different and unprecedented. Scepticism built on years of false alarms was reasonable until the indicators themselves changed, and then it became a way of not looking.
One personal tripwire: forces entering Belarus
Cook adds a practical example from his own decision-making. In December, he told the people at his company that the buildup was a big risk, and he says they told him he was crazy.
He had set himself a specific trigger in advance. If forces went into Belarus, that would mean Kyiv itself was under threat, and that was the point at which he would start moving his people to the west of Ukraine for safety. When he saw the move into Belarus, he says, that was when he acted.
It is a useful model. Rather than trying to predict the whole outcome, he picked a single observable event that would change what the threat meant for him, and committed to acting on it before it happened.
Certainty was never on offer
Lee does not present himself as having known. He says that during the buildup he was uncertain, because on one hand the question was whether anyone would really see a full-scale invasion in Europe in this era.
That hesitation is the honest part of the account. The indicators pointed one way, and the idea itself still seemed hard to credit. What the chapter shows is that the evidence was public, assembled by volunteers, and readable by anyone willing to weigh it against the base rate of false alarms rather than simply defer to that base rate.
What to watch
- Whether a future buildup is timed to an announced exercise. Lee treated the absence of an exercise as the point where the benign explanations ran out. That test can be applied to any large movement near a border.
- Whether civilian video of rail movements still surfaces publicly. The method depended on people filming trains in cities and posting openly. If that stream thins, the same picture gets harder to assemble.
- Whether analysts set explicit tripwires in advance. Cook's Belarus trigger is checkable: a named event, stated beforehand, tied to a specific action.