Russia uses al-Qaeda-style tactics for terrorist attacks in Ukraine, ex-SBU chief says
The scene of the terrorist attack in Lviv. February 22, 2026 (Photo: REUTERS/Anastasiia Smolienko)
Former Security Service of Ukraine chief Valentyn Nalyvaichenko said Russia is behind a series of terrorist attacks in Ukraine, describing them as part of a coordinated campaign to intimidate civilians and destabilize the country, in an interview with Radio NV on Feb. 27.
— What is the SBU warning about? Russia is using a “double-blast” tactic, similar to methods employed by al-Qaida, to carry out terrorist attacks in Ukraine, sanctioned by Vladimir Putin. It reminds me of missile strikes on Ukrainian sites followed by repeat strikes while rescue workers are on the scene. In your view, how can this terrorist escalation by Russia in Ukraine be stopped? Should we have been prepared for this?
— Let’s first apply the correct definition to Russia’s terrorist escalation: it is state terrorism. There are isolated terrorist attacks, there is international terrorism, and there is state terrorism. Russia, as an aggressor state, in addition to its armed aggression against Ukraine and other war crimes, is also committing crimes of terrorism by using terrorist methods and means. The goal is clear — to intimidate and inflict as much harm as possible on civilians, law enforcement and our military.
Should we have been prepared? We are prepared. I would remind you that since 2014 Russia has been trying to apply this kind of terrorism against Ukraine. Recall, at the very least, the terrorist attack in Ukrainian airspace against the Malaysian Boeing, which we investigated. I was the first to go public on the second day and report the results of that investigation — including Russia’s use of weapons for terrorist purposes by its own regular military personnel and intelligence officers.
So my second conclusion, in addition to defining this as Russia’s state terrorism, is that it uses its special services as the organizers of terrorist attacks on Ukrainian territory.
Ukraine’s response must likewise be a state response. We have the Anti-Terrorist Center under the SBU. Under the law on combating terrorism, it has interagency status. All agencies can and must be involved in counterterrorism — law enforcement, financial and analytical bodies, including local authorities.
This is my professional and urgent response to what has already happened, aimed at preventing further sabotage and terrorist attacks by Russia.
— The SBU is currently headed by Yevhen Khmara, formerly the chief of Special Operations Center A.
— I do not know who currently heads the service, but I can stress the following: the first deputy head of the SBU, who is also the head of the Anti-Terrorist Center, must be the key figure. This first deputy, as head of the ATC, leads interagency coordination and organizes counterterrorism efforts across Ukraine.
Another important clarification: in every region there is a regional SBU directorate, and in every region there are interagency units and headquarters with all the necessary forces and means to coordinate and strengthen counterterrorism efforts.
In my view, the counterterrorism regime must be strengthened in every region of Ukraine, regardless of how close or far that region is from the front line.
— Should special artificial intelligence systems be used to scan massive amounts of data? How can attacks be prevented?
— I am not speculating; I know how this is done. I will give a concrete example — practice, not theory.
In 2014, we prevented terrorist attacks in the center of Kyiv. I made the decision to declassify the results of one such case. In December 2014, we showed the public the individual involved — incidentally, a woman recruited by Russian special services — the fragmentation explosives packed into a suitcase, and the exact location in central Kyiv where she was detained before she could carry out the attack. Most importantly, we identified the recruiter from the Russian special services — his name and position — who recruited her, supplied the explosives and directed her to commit the attack. The explosives were neutralized.
First, for truly professional counterterrorism inside the country, every SBU directorate — including the central office — must operate proactive counterintelligence, cyber defense or cyber counterintelligence, and specialized units for the protection of national statehood. This is serious, operational work requiring trained officers and specialists. It includes agent-based, preventive and intelligence work. All of this, insofar as it concerns the SBU, is classified.
But there is no secret in the fact that this work requires professionals, and they must receive clear tasks from the SBU leadership to focus on it — not to be distracted by secondary matters or corruption schemes, especially during wartime. Concentrating forces and resources on security priorities during war is the No. 1 issue — that is my professional opinion.
Returning to prevention, you mentioned communications. Yes, this is one of the weakest links for terrorists. Any platform, including messengers, can and must be monitored by Ukrainian special services. I emphasize that back in 2014, together with American and other partners, we purchased such equipment and began using it to counter Russian armed aggression and Russian terrorist acts or their planning on our territory.
It is crucial to understand who we are facing: Russian special services. Who in Ukraine is authorized, trained and legally empowered to counter them? Ukrainian special services. That means the SBU must operate inside Ukraine. But I have emphasized and will emphasize again: professional intelligence work is also required abroad — to detect and obtain information about preparations for any sabotage or terrorist attack against Ukraine or Ukrainians.
Inside the country, in addition to the SBU and intelligence agencies, the Interior Ministry and the National Police are essential.
And I will say this clearly to all citizens: help the National Police. You see far more, far more often — someone carrying a suspicious suitcase, something left in a trash bin, an unfamiliar person arriving from a bus station with bags who clearly does not belong there. People, I urge you: assist law enforcement. Immediately inform the nearest police officers if something seems suspicious.
Do not hesitate or think, “What if I am mistaken?” Preventive information will be checked in any case by Ukrainian police officers.
The basic principle in combating terrorism inside Ukraine is public support for law enforcement — support through information, signals and suspicions. During wartime, this will help the National Police be on the front line of detecting and preventing terrorist attacks in Ukraine.
— A person who is planning something leaves not just an information trace, but an information trail. Even an ordinary person who is not planning anything leaves a great deal of information behind. This brings me back to modern technologies. I fully understand that you cannot seat an SBU officer behind every single information message to analyze it — that is simply unrealistic. How far have we come in counterterrorism in terms of using specially trained artificial intelligence systems to scan this entire volume of data and flag highly problematic cases or incidents that SBU officers should pay attention to?
— I will give only one answer, so as not to teach terrorists how to evade detection. I apologize if there are no specific details. I know them, but I will speak in terms of directions.
First and most important — what I know firsthand because I personally organized it in 2014, after the Revolution of Dignity, and helped restore it — are the cyber defense units within the SBU, which we rebuilt together with international partners. These units, equipped with appropriate software, analysts and now also artificial intelligence programs, are capable of analyzing, detecting and preventing threats when something suspicious appears on social media, in the internet space and online in general.
I say this seriously and stress right away that there are no limitations on working and analyzing whether terrorists use iPhones or any other devices. These are serious capabilities.
Moreover, every six months these technologies advance. It is critically important for Ukraine and for the Security Service of Ukraine to maintain constant partnerships with American partners, because that is where cutting-edge systems are produced and where the keys exist to monitor and uncover virtually any communication.
Second, we started this work with British partners, and they continue it. The British have serious analytical programs for analyzing social media — including with artificial intelligence — from Facebook to Threads and all other new platforms.
There are very important elements there that I will never name, but they are used. This is the first warning line, when communication is only beginning or when a person expresses an intention to make money by committing any crime — not only a terrorist act, but any crime.
The second line — serious and professional, and as a professional I remain a strong advocate of it — is what Ukrainian special services must do: agent-based work, operational work, operational-technical measures and much other classified activity that, for professionals, is the alpha and omega of preventing a terrorist act.
Having your own sources is essential. Ukrainian special services have information on GRU and FSB officers and their accomplices who have ever been involved in terrorist or other criminal activities. International cooperation is also extremely important here, because foreign intelligence services of partner and NATO countries have extensive databases on such “terrorists in Russian uniforms.”
Third is another crucial professional block: cooperation between the National Police of Ukraine and Interpol, Europol, and counterterrorism police units in European countries. In many countries there is no security service like the SBU; instead, police or specialized police units are authorized to combat terrorism. For police services in other countries to assist us, it is vital for the National Police to maintain such international cooperation and information and data exchange.
Police officers are the first to investigate crimes on the ground. This includes the type of explosives used, specific characteristics, clothing, behavior patterns, connections, movements and other logistics. For a serious professional in the National Police, this is not minor information — it is key to identifying suspects, detaining them and ultimately preventing the use of such technologies and methods in the future.
I have outlined the three most important blocks of action needed to prevent terrorist attacks in Ukraine against our citizens, police officers and national security.
— How effective is public vigilance? Today I heard that the SBU and the National Police are countering attempts to recruit Ukrainians through the “Expose an FSB agent” information campaign via a chatbot. More than 18,000 reports have already been recorded. How can this public vigilance be organized so that it works against terrorists?
— First, my direct appeal to everyone: do not lose vigilance, report what you see. I reject the claim that large numbers of reports are a problem. That is not true. There are computer programs that analyze reports not by quantity, but by quality. You see far more on the ground — and far better — than any special service. Report any suspicious activity: surveillance, planting explosives, suitcases and the like — to the nearest police officers, chatbots or hotlines. This will strengthen our law enforcement agencies and the Security Service of Ukraine in the fight against terrorism. My call is the opposite: not to lose vigilance, but to intensify it.
The military war may be swinging in our favor, but the information war continues.
Just as an army needs soldiers, so does a free society need its journalists to ensure that people have access to honest, trustworthy voices to understand the world around them.
For the past five years, The New Voice of Ukraine has been working tirelessly to push back against Russian narratives and defend democracy. But we cannot do it alone.
Please consider supporting us on Patreon for just $5 a month – your donation does directly to supporting journalists and ensuring that this front of the infowar says solid and defended.
Thank you.
Follow us on Twitter, Facebook and Google News
