Monitoring illicit arms flows from the conflict in Ukraine.

Soon after the Russian invasion of Ukraine began on 24 February 2022, weapons started pouring into the country at an unprecedented rate. Alongside the Ukrainian and Russian arsenals, Kyiv’s Western backers sent materiel of an unprecedented volume and sophistication. Fears that this flow of weapons would be susceptible to illicit diversion were quickly raised and, to the casual observer, apparently confirmed.¹ Attention-grabbing reports claimed that weapons from the conflict were finding their way to Finnish gangsters, French rioters, Nigerian fighters and the Mexican cartels. On the dark web, Javelin anti-tank missiles supplied to Kyiv by the United States were available for sale.

Except none of it was true.² Russia’s hand was probably behind some instances of active disinformation,³ but in others the claims appeared to be the result of an eagerness to see a phenomenon that was long-anticipated, but which on closer inspection lacked hard evidence.

Selection of media reports alleging the global trafficking of Ukrainian weapons.

Photos: Euractiv; Voice of America; TFIGlobal

Thus far, there appears to have been no large-scale illicit diversion of weapons from the conflict, for several reasons.⁴ The first is that the very active nature of the conflict is acting as a ‘sponge’ – in other words, the conflict in Ukraine is absorbing weapons, not releasing them. The intensity of the fighting in the east and south has resulted in materiel being used as soon as it arrives, inhibiting the ambit for diversion. In July 2023, a US Defense Department report said that there had been attempts by criminal gangs to steal Western weapons provided to Ukraine in the period to September 2022 – including one attempt involving 60 rifles, and another involving a grenade launcher and machine gun – but that these schemes had been disrupted by Ukraine’s security service.⁵

But history suggests that this will not be a permanent state of affairs. At the time of writing – September 2023 – the Ukrainian counter-offensive was reaching a peak of activity, but past experience suggests that when the intensity of the conflict diminishes, the dynamic will change. With the country saturated with arms, the demand for weapons – and their price – will fall, creating incentives for traffickers to sell their stocks outside of the country on the black market.

Faced with this situation, the key question regarding the future of arms trafficking from the conflict in Ukraine is not ‘if’ but ‘when’. And it is this question that the GI‑TOC’s Illicit Arms Monitor has been set up to address.

Methodology of the Monitor

Monitoring any kind of illicit flow is inherently challenging. Unlike the licit market, available evidence is often fragmentary and highly context specific, making comparisons and trends difficult to ascertain.

The illicit market for weapons also presents its own subset of challenges. Unlike, say, ‘hard’ drugs such as cocaine and heroin, legislation surrounding weapons can vary from country to country in Europe – some have very strict gun controls, others have established processes to acquire them. This patchwork of legislation shapes the nature of both licit and illicit demand and supply, as do cultural norms and the modi operandi of organized crime groups. The profile of the buyer is also important, as is the history of the gun and its condition, together with the type and availability of ammunition.

In order to monitor potential flows of illicit guns stemming from the conflict in Ukraine, the GI-TOC has created a hybrid methodology that combines quantitative data and qualitative analysis. Over time, this project will build a longitudinal evidence base that can serve as an ‘early warning system’ of emerging trends, routes, hubs and modi operandi. As a consequence, policymakers and other stakeholders will be better prepared to respond to the real and destabilizing prospect of heightened arms trafficking in Europe as a result of the conflict in Ukraine.

Price

At the heart of the Monitor is the regular collection of data on prices and availability of a variety of weapons across three key geographical areas (see below). Price is a complicated metric, reflecting the relationship between supply and demand for a commodity. In its simplest permutation, when supply is high and demand is low, the price will generally be low, all other things being equal; conversely, when demand is high and supply is low, the price will increase.

The Monitor will set out to test several hypotheses related to the role price may play in both driving and reflecting the nature of illicit arms flows connected to the conflict. For example, if prices for weapons are higher outside Ukraine than within it, then this may provide an incentive for traffickers to move weapons out of the country. Alternatively, a sudden fall in prices in a country (compared to pre-2022 levels) may indicate a sharp increase in supply due to a new flow of weapons arriving in the country, which may be connected to the war in Ukraine. While prices are usually easy to collect for standardized goods, this is not typically the case for weapons, as there are a large number of unobserved variables that make straightforward comparisons highly challenging (such as the age and condition of the weapon, or whether it has been used to commit a murder). Because of these difficulties in collecting prices along with detailed characteristics, it is not the intention of the Monitor to create a proper database of prices for weapons. Rather, the prices will serve as a means of ‘taking the temperature’ of the illicit arms market in specific countries.

Price data is being collected on small arms and light weapons, including Western-made weapons. Types of weapons include hand guns and long guns; ammunition; explosives; and portable anti-tank and air-defence weapons.

Geography, provenance and qualitative information

The Monitor will assess dynamics in three thematic geographical areas – within Ukraine itself (the source country); bordering countries in Eastern Europe (Poland, Moldova, Hungary, Slovakia and Romania) and the Western Balkans, which are likely to serve as transit hubs; and end-user hotspots (Sweden, Netherlands, Belgium and France), although other countries may be added as research develops.

The size of the potential illegal arms market in Europe is relatively small compared to, say, the US, South Africa or Brazil, and is well served by organized crime groups, for whom arms trafficking often serves as a secondary activity utilizing routes and networks used for other illicit business.⁶ As such, the Monitor will not scrutinize the much larger legal movement of weapons that is carried out by logistics companies to purchasing states, often of dubious global standing. To illustrate this mode of business using the context of Ukraine, an investigation by C4ADS in 2013 highlighted how a network of logistics contractors, based in Odesa, was legally transporting weapons out of Ukraine and Russia on behalf of government sellers to end users including Iran, Myanmar, the DRC and South Sudan.⁷

Of course, illicit weapons flows in European countries will not consist solely, or even predominately at present, of weapons associated with the war in Ukraine. The Western Balkans remains a significant source of weapons almost three decades after the end of the conflict in the Balkans, while Turkey was regularly cited by official sources in the course of our fieldwork as an increasingly important locale for weapons, both authentic and counterfeit (of varying quality) that have reached Europe, with our fieldwork team hearing of a counterfeit M16 made in Turkey that was seized in Western Europe.

One of the most challenging aspects of the Monitor will therefore be ascertaining the provenance of weapons on the European black market. Some types of weapon (and their changing price) may have a clearer link to the conflict than others – such as portable anti-tank and air-defence weapons – but for the majority the link must be scrutinized through means other than price. Here, seizure data and interviews with those associated with black market arms flows will help build a qualitative picture that can be used to test and triangulate quantitative findings. To achieve this, GI-TOC researchers are conducting regular fieldwork in the areas under consideration, meeting with organized crime informants, NGOs, investigative journalists, law enforcement and civil society organizations, alongside monitoring developments on the surface and dark webs.

These qualitative investigations may also shed light on other interesting aspects of arms trafficking in Europe, such as what buyers want and why. During the course of fieldwork in 2023, for example, it became clear that a weapon’s ability to kill was only part of the package. Gangsters were reported to want high-grade weapons such as the AR-15 platform, modernized AK or Vz58, along with tactical gear – not necessarily for their greater firepower, but because they evoked the kind of weaponry seen in video games and action movies, and had a more intimidating effect. Soviet-style weapons from the 1990s, by contrast, were seen as old-fashioned and belonging to the previous generation.

The surface and dark webs are also being assessed as ‘geographies’ in their own right. The rise of online platforms such as Telegram and the maturation of the dark web have transformed the modus operandi of arms trafficking: connections between buyers and sellers that in the 1990s may have taken weeks or months to establish can now be made instantly, creating new routes, hubs and flows that may lie outside the traditional avenues. In this, technology may not merely be an accelerant of arms trafficking, but also a transformational tool.

That said, the extreme prevalence of disinformation and outright scams on the dark web may also mean that this more a platform for cybercrime than arms trafficking. Further research is required to ascertain who the serious buyers and sellers are and what is disinformation, propaganda and scams. Our initial research, carried out by Ukrainian and British investigators of dark-web activity, has found that the overwhelming majority of activity is fake. (This trend will be discussed in greater depth in the Monitor’s first annual report in early 2024.)

The same vigilance is required in the physical world, given that Russia is likely to continue to be extremely active in the misinformation space.⁸ It is conceivable, for example, that Russia or Russian-affiliated actors could plant captured Ukrainian weapons in Western Europe in order to create the impression of illegal arms trafficking. As such, verification of evidence is of paramount importance.

An ‘alarm’ system

This information is being used to construct an alarm system that assesses the risk of arms being trafficked out of Ukraine, and the prevailing risk in the country under question. A significant increase in risk will trigger an ‘alarm’.

While the Monitor is continuously collecting and assessing information, it will release its findings in discrete outputs consisting of quarterly trend reports and one annual report (the first of which is due in early 2024), plus one limited circulation report. Over time, these will create an unprecedented body of analysis regarding the movement and drivers of illicit arms out of Ukraine.

The following three stories highlight the work of the Monitor in its first phase of operation, offering an insight into both the status quo of arms trafficking in certain contexts, and potential future developments.

Notes