The Balan Order
What a Ukrainian military document actually says about pre-invasion preparations in Donbas — a direct examination of the original order, its force composition, and how both Russian state media and Western fact-checkers mischaracterized its contents.
On March 9, 2022 — thirteen days after Russia’s full-scale invasion of Ukraine — the Russian Ministry of Defense published six pages of what it claimed were captured classified Ukrainian military documents proving that Kyiv had been planning an offensive against the Donbas breakaway regions in March 2022, which Russia’s invasion preempted. [04]
Western fact-checkers addressed the document swiftly. PolitiFact rated Russia’s claims “False.” [03] Bellingcat’s Christo Grozev told PolitiFact that Donbas “was not either a prominent part of the document nor stated in an offensive context.” The Ukrainian National Guard told StopFake it was “a standard order to hold regular joint training exercises” with “nothing to do with” an offensive in Donbas. [02] The document’s authenticity was never in dispute — the National Guard itself confirmed it was real. What was disputed was its meaning. With the fact-checkers’ framing accepted as authoritative, the document left serious English-language analysis and became shorthand for “Russian disinformation.”
Both characterizations fail contact with the primary source. Russia exaggerated the document by inserting the word “offensive” where it does not appear. The fact-checkers made claims about the document’s contents that are directly contradicted by reading it: the opening clause names Donetsk and Luhansk oblasts as the order’s purpose, and the force composition is configured for high-readiness maneuver, not routine training.
A scope limitation first: this order covers roughly one battalion from one National Guard brigade — 600–800 personnel of Ukraine’s ~250,000 active military. Its significance lies not in scale but in what its configuration reveals about the operational concept behind broader preparations that remain undocumented in open sources. This analysis presents the document’s own text, in translation, alongside the claims made about it by both sides. The reader can judge which characterization survives contact with the primary source.
The order is classified Таємно (Secret) and runs six pages: a transmittal cover signed by the Chief of Staff, four pages of operational directives, and a distribution log with receipt signatures. The title translates as: “On the organization of preparation of the battalion tactical group of the 4th brigade of operational purpose for the execution of combat (special) tasks in the operation of Joint Forces as part of a brigade of the Armed Forces of Ukraine.”
The classification became part of the fact-checking record. StopFake’s March 9 article carried the National Guard’s initial claim that the document was not classified; StopFake later appended a correction: the NGU clarified the order “had the classification marking ‘Secret.’” The Таємно marking is visible on the document photographs. PolitiFact’s article — which leads with “The document isn’t classified” — was never updated. [02][03]
“With the purpose of executing measures defined by the order of the Commander-in-Chief of the Armed Forces of Ukraine dated 19.01.2022 No. 39/304/78/1, with the purpose of building up capabilities of the grouping of joint forces in the territory of Donetsk and Luhansk oblasts.”
Нарощування спроможностей is rendered “building up capabilities,” but the Ukrainian is more specific: since Ukraine’s 2016 adoption of NATO-style Capabilities-Based Planning, спроможності is a term of art — the operational effects a force can deliver, not its size. Read that way, the clause means expanding the capability set of the Donbas grouping, which is what the attachments in Section 2 do. The analyst is not a native Ukrainian speaker; certified translation of the key passages has been commissioned, and the force-composition analysis below stands independently of this reading.
Two facts are immediately apparent. First, Donetsk and Luhansk oblasts are the stated operational purpose of the order — the reason it exists — which directly contradicts the claim that Donbas “was not a prominent part of the document.” To be precise: building up capabilities in a theater is not, by itself, proof of offensive intent; the opening clause establishes the theater, and the force composition establishes the likely operational role. Second, the upstream directive was issued by General Zaluzhny on January 19. RT reported an instruction from “President Zelensky on January 18” — wrong person, wrong date. [05]
The Starichi point matters because it was PolitiFact’s central argument: the training was in Lviv Oblast, western Ukraine, far from Donbas. But Section 5 of the order directs rail transport of equipment from Starichi to “the area of execution of combat (special) tasks.” The document itself distinguishes the training waypoint from the operational destination. Starichi is also part of the International Peacekeeping and Security Centre at Yavoriv, where US, UK, and Canadian personnel were conducting training programs during this exact period. [01][13]
The BTG is a composite force drawn from at least five separate units across two ministries, augmented with specialist capabilities and provisioned for sustained operations. The standard applied here: not whether this force could conduct offensive operations — any competent force can — but whether its task organization is optimized for offensive maneuver in a way a defensive-purpose force would not be.
Operational subordination to a formation doctrinally optimized for offensive maneuver — the unit type that takes ground, not holds it. The best counter-reading is that air assault brigades also serve as quick-reaction reserves, and that the 80th may simply have been one of the few formations able to absorb a cross-ministry composite unit on a compressed timeline. What the QRF reading does not explain is the schedule: a reaction force unavailable until after February 28, training 800 km from the contact line, is not a reaction force. The month-long pipeline establishes deliberate, planned force generation — not an emergency response to imminent threat.
Two sniper pairs plus a fire-support group of up to 30 service members from a special-purpose company of the 27th Brigade. Not a sniper team with bodyguards: a composite strike detachment configured for contested, forward-moving space — not the observation and early-warning posture of defensive overwatch. The 27th’s actual order of battle should be verified before weighting “special purpose” heavily.
A mobile РЕР group and technical reconnaissance platoon. Note the term: РЕР (passive signals collection), not РЕБ (active jamming). Mobile SIGINT has defensive uses — static positions on the contact line were routinely geolocated and shelled — so in isolation this proves nothing. Its significance is cumulative: paired with UAVs and the sniper package it forms an ISR-strike complex — SIGINT finds, UAVs confirm, snipers engage — which serves fluid operations of either character, but not static positional defense.
Combat aviation complex crews transferred from the Guards Aviation Base, and two full combat loads for all weapon types. Double loads can reflect arrival self-sufficiency for any JFO rotation — but standard rotations draw on their parent command’s logistics. Here, transport trailers are concentrated from three separate regional commands, specified down to trailer type and source unit: mobilization-grade planning that exceeds routine rotation parameters.
Section 12 is a combat deployment filter. The BTG is to be formed from COVID-vaccinated personnel, and the order prohibits deploying anyone who:
One caveat must be stated honestly: the JFO was an active combat zone with a documented non-combat casualty crisis, so this screening may have been standard for any JFO-bound rotation. What it establishes either way is preparation for combat-zone deployment — which contradicts “a standard order for regular joint training exercises” with “nothing to do with” Donbas. A training exercise does not require suicide screening. The diagnostic burden then falls on the force composition and logistics posture, which routine rotation protocols do not explain.
The BTG lacks heavy combat engineering, mine-clearing, bridging, and massed organic artillery — the enablers an independent assault on the heavily fortified contact line would require. The composition is most consistent with a lethal ISR-strike package for fluid maneuver. That constrains the range of offensive operations the BTG could independently conduct; it does not settle intent.
The strongest objection: by mid-January 2022, Russia had massed an estimated 70,000–130,000 troops near Ukraine’s borders, and US intelligence was publicly warning of imminent action. Preparing forces for the likely theater is rational — and parts of Ukraine’s leadership assessed the most probable scenario as a localized Donbas escalation rather than full invasion, which alone would justify a Donbas buildup. [08][09][10] The question is whether this specific configuration matches defensive reinforcement. It fails on six grounds:
Each point individually has a rebuttal, and the strongest are acknowledged above. Collectively, the defensive interpretation requires every choice — threat axis, formation, enablers, doctrine, logistics, timeline — to be coincidentally suboptimal for defense while coincidentally optimal for an offensive contact-line operation.
The Balan Order is a downstream implementation document. Zaluzhny’s upstream directive No. 39/304/78/1 would state why — the operational concept. Russia never published it: either it was not captured, or its contents did not serve the narrative. Its multi-segment numbering suggests coordination across multiple commands, implying parallel implementation orders elsewhere in the force — none of which have surfaced. RUSI reporting that Ukraine had roughly half its maneuver brigades in the JFO area before the invasion is consistent with a preparation effort far larger than one BTG. [12]
A chain-of-command detail with real implications: the directive came from Zaluzhny — the military operational chain — not from President Zelenskyy. Whether the political leadership was briefed on the specific force composition and timeline is an open question for the civil–military record of the pre-invasion period.
The Balan Order is an authentic, classified Ukrainian military document describing combat preparation for the Donbas theater. Its contents are more significant than the fact-checks acknowledged, and less conclusive than Russia claimed.
What makes it consequential is what followed publication: the document’s actual text never entered the public record. The claims that displaced it — that Donbas was not prominent, that this was routine training, that the document was unclassified — are contradicted by the document itself. One was corrected by its own source; the correction did not propagate. Both the Russian exaggeration and the genuine content of the order were buried together.
Four years later, the document is publicly archived and its authenticity undisputed. What it says can now be checked by anyone, against this analysis included. What it meant — the operational concept in the unpublished upstream directive — remains the open question this document cannot close.
Provenance. Analysis is based on direct examination of the six-page Ukrainian-language document images, publicly archived (Internet Archive, identifier: nato-ukraine-attack-plan). Chain of custody runs from the Russian MoD’s March 9, 2022 publication to the public domain via archiving. The NGU confirmed the published version’s authenticity to StopFake in March 2022; neither side contests authenticity — the dispute is entirely about meaning.
The original publication is the Russian MoD’s English-language Telegram channel — t.me/mod_russia_en, posts 87–89, 06:10 UTC, 9 March 2022 (post 87 the six document photographs as one album; 88–89 the Konashenkov briefing). The archive.org copy analyzed here is four steps removed: the images passed through the pro-Kremlin blog thesaker.is (which resized them to ~1,000 px), were captured by the Wayback Machine, and were re-uploaded to archive.org on 10 March by an account under a disposable-email address, with propaganda framing in the title. The album’s photo count — six — matches the six pages here, so no pages are missing; but any pixel-level image forensics should run on the live Telegram originals at full resolution, not on the resized archival derivatives.
Translation. All Ukrainian quotations are transcribed from the document photographs and translated by the analyst, who is not a native speaker or certified translator. Independent certified translation of the opening clause, force-composition sections, and screening criteria has been commissioned; discrepancies will be logged as corrections.
Analyst. Director of Security Operations and Research; 20+ years in threat intelligence, including Symantec Security Response and Threat Intelligence Lead, U.S. House of Representatives. This background informs the doctrinal analysis but is not Ukrainian military subject-matter expertise; weigh the doctrinal judgments accordingly.