In the days leading up to Lithuania’s 2024 presidential elections, which were held in May 2024, a foreign information manipulation and interference (FIMI) operation developed. It turned out to have been initiated and coordinated by Belarus-related entities.
The operation targeted some of the candidates. The presumed effect was possibly to discredit the candidates and to discourage Lithuanian citizens from voting by presenting the election as meaningless whilst also framing Lithuania as a puppet of the West.
During the week of the first round of voting for the presidential election, interviews with candidates for Lithuanian president aired on the Belarus 1 TV show ‘Inside Out: Puppets’ (Russian — ‘Изнанка: Марионетки’).
This case of FIMI involved the creation of a false persona posing as a journalist from the Russian /English media outlet Meduza. At least one running and one former candidate — Giedrimas Jeglinskas and Arūnas Rimkus — were lured by the fake journalist into online interviews, which allowed their words to be manipulated to fit well-known pro-Russian and anti-Western narratives.
Just before the elections on 12 May, from 6 to 11 May, around 30 pieces of disinformation were published that originated from the deceptive interviews of the candidates. The timing, intentionality and severity of this operation highlights the professional approach of the operation.
Debunk.org’s investigation (article available here) found that the planning of the influence operation started a month before the actual broadcast when the email address ‘meduzaolha@gmail.com’ was created on 8 April as a means to approach candidates’ teams.
Debunk.org team used the ABCDE framework and DISARM Tactics, Techniques and Procedures (TTPs) to describe the FIMI operation and the efforts behind it, highlighting the Belarusian approach. Below we break this approach down to give you a peak under the Belarusian hood.
A – ACTOR
Three key actors could be observed when it comes to understanding who was potentially behind the disinformation campaign against Lithuania’s presidential candidates Giedrimas Jeglinskas and Arūnas Rimkus:
The Belarusian state (with all its accompanying governmental institutions) ensures the creation of a medium which provides the necessary resources to create disinformation.
The TV channel Belarus 1 acts as a medium through which disinformation can be spread and presented.
The ‘journalist’ Ekaterina Tikhomirovna, who acts as the ultimate arbiter of truth, selectively shaping narratives to serve the state and the channel’s agenda.
As the levels of disinformation coming from the state-run channel increased over the years, the channel appeared on the radar of many pro-Western journalists, independent analysts and democracy-focused (and later exiled) non-governmental organisations that have continuously fought against the propaganda of Belarus 1 from offices across different European capitals.
Belarus 1 is a flagship TV channel run by Belteleradio, Belarus’s state television and radio broadcasting company that has been targeted by EU restrictive measures. Various well-documented media investigations show that Belarus 1 often publishes fabricated reports that target the Belarusian opposition, the Baltic states, Poland and anyone who opposes the ideals of the ‘Russian world’.
Belarus 1 ‘journalist’ Tikhomirova has been known to use deceptive and manipulative methods to arrange interviews with prominent political figures. Similar stories have been recorded in the past when Tikhomirova targeted Belarusian opposition activists, among other things redressing and using makeup (e.g., wig, false nose) to disguise her real identity and to trick interviewee into an information manipulation scheme.
Furthermore, people like Tikhomirova work within a hierarchical system where decisions are closely monitored and influenced by higher-ranking officials, including Belteleradio’s sanctioned chairman, Eismant, and potentially Lukashenko himself.
While Tikhomirova’s actions are subject to the regime’s control, which ensures that Belteleradio’s activities remain in line with the government directives, it seems that her own ideological stance also aligns perfectly with the regime’s narrative and bolsters the dissemination of disinformation and anti-Western rhetoric.
B – BEHAVIOUR
Using the DISARM framework, the Debunk.ORG team was able to identify at least 11 TTPs used to execute FIMI activities. The list of TTPs is not exhaustive, and additional methods falling outside the scope of open-source investigation might have been used.
Create personas, use pseudonyms, cross-post narratives
Either Tikhomirova, or the supporting team, created the false identity of a journalist named Olha who supposedly worked at Meduza, a Russian and English-language independent news website headquartered in Riga, Latvia.
The impersonator journalist initially contacted Lithuanian presidential candidates via email, presenting herself as ‘Olha from Meduza’, and expressing interest in making a piece on the prospects of democracy in Russia. During the analysis, it was also determined that the identity of the supposed journalist was coded into the Gmail email, as was the name of the outlet. However, the last name of the supposed journalist ‘Olha’ was not indicated in the email address or the email, which should have been a red flag for candidates not to accept the interview proposal.
It is also crucial to mention that a short check of the official site of Meduza could have prevented the candidates’ communication departments from ultimately falling victim to Tikhomirova’s plan — the team in Riga consists of five individuals and none of them goes under the name ‘Olha’.
Another significant red flag involves the use of a Gmail service provider. While it is common for private individuals to use email addresses ending with ‘@gmail.com’, officially employed journalists usually correspond with potential interviewees using email accounts associated with their organisation. In this case, had the journalist actually been working at Meduza, the email should have mirrored the addresses indicated on the website, possibly containing the name of the private provider such as ‘@meduza.io’.
Create inauthentic accounts
Debunk.ORG’s initial investigation revealed that the planning of the influence operation began a month before the actual broadcast, with the creation of the fake email address meduzaolha@gmail.com on 8 April 8 at 14:11:08 (UTC). The first emails to Jeglinskas, Rimkus and Zalimas’s teams were sent approximately four hours later. Only the latter’s team did not respond to the enquiry.
The team of current Lithuanian President Gitanas Nauseda, who was also a candidate in the elections, responded to Debunk.ORG’s enquiry and informed them that they had not received an email from meduzaolha@gmail.com
Prepare physical broadcast capabilities
The link to join the Zoom session was sent an hour before the actual interview. At this point, the attempt to organise the fake interview was going as planned. The invitation to the Zoom session lacked detailed information and would not normally have raised additional red flags to those on the candidates’ communication teams. The link appeared to be typical of a Zoom session and the informal naming of the virtual call room, such as ‘Zoom Meeting Olga’, is often observed in these types of situations.
C – CONTENT
Distort facts, integrate target audience vulnerabilities into a narrative, amplify the existing narrative
Jeglinskas’ appearance on Tikhomirova’s news show should be classified as heavily manipulated. Bits and pieces of the recorded interview were meticulously edited out and fitted in a way that suited the supposed interview questions. The content was crafted to align with anti-Lithuanian and anti-US disinformation narratives. These attempted to reintroduce two key recycled narratives to the public sphere of both Belarusian and Lithuanian viewers.
The first narrative suggested that Lithuania’s economy has been declining since it joined the EU and that the country is showing signs of being a vassal state. This narrative portrays a distorted image of Lithuania, especially by focusing on the supposedly ‘prosperous’ Soviet era, during which Lithuania appeared to possess key signs of a strong economy and industry.
The second narrative distorts the Russia-Ukraine conflict, claiming it is not between the two nations but between NATO and Russia. It portrays NATO as the aggressor and Russia as the victim. This narrative alleges that NATO’s support for Ukraine is a guise for expansionism and frames the alliance’s actions as encircling Russia.
Reframe context, deceptively edit video (cheap fakes)
The modus operandi of Belarus 1’s editorial staff involves changing, twisting and exaggerating existing facts with the hope of constructing a set of narratives that differ from reality. A way to achieve this can be by using images and publishing them at certain moments during the news bulletin to amplify the impact on the viewer.
For example, the news bulletin in question states that Lithuania and Poland are supposedly conducting the policy of ‘selective immigration’ by murdering illegal migrants at their respective borders. The news clip consists of unrelated video edits of corpses and the supposed handling of corpses by Belarusian institutions on the Lithuania’s border.
The interview is also full of examples of tactical reframing. The editorial staff of Belarus 1 purposely removed some of the interview recording from its surrounding context so as to distort the intended meaning. Additionally, the ideas expressed by Jeglinskas during the interview were clearly reframed in a way that may lead the target audiences in Belarus and Lithuania to draw false conclusions about Jeglinskas’ intentions.
Geographic Segmentation
The interviews were AI translated and used to geographically segment target audiences in two languages — Russian and Lithuanian. While both interviews were conducted in Russian, the interviews were later dubbed into Lithuanian and posted on Belarus 1’s YouTube channel.
This tactic is used to reach audiences outside of Russia or those who do not speak Russian. However, the dubbing was not done professionally. Instead, they used less effective measures, such as AI-generated voiceover. The audio contains obvious grammar mistakes and the voice of the narrator sounds very robotic and unnatural. The video descriptions were also not accurately translated.
D – DEGREE
The Debunk.ORG team identified 30 publications between 6 to 11 May 2024 that derived from the interviews which were placed on at least seven Russian and Belarusian platforms (sb.by, yandex.ru, belta.by, ok.ru, Dzen, RuTube, tvr.by) and YouTube, Facebook and Telegram.
The publications reached at least 85,000 people and this includes only the platforms that share their data.
KEY TAKEAWAYS
The disinformation campaign against Lithuania’s presidential candidates Jeglinskas and Rimkus was likely orchestrated by Ekaterina Tikhomirova, aided by Belarus 1, a state-owned and sanctioned media channel. Tikhomirova’s actions served the interests of the Belarusian regime by portraying Lithuania as a puppet of the West, particularly the US, and by distorting facts to align with Russian interests.
The operation involved the creation of false identities posed as journalists to gain access to candidates, the interviews were deceptively edited to fit false narratives and a following disinformation campaign was spread across platforms and languages to maximise impact.
The campaign followed a systematic approach, with coordinated efforts across multiple channels and platforms. Identical narratives targeted specific audiences and content was translated to reach wider demographics.
RECOMMENDATIONS for candidates and communication teams
Robust vetting procedures: implement thorough verification processes for interview requests, including by cross-referencing email addresses and checking the authenticity of media outlets.
Vigilant screening: scrutinise interview requests rigorously, verifying email addresses against official sources and scrutinising the content of requests.
Record the interview: when giving interviews, record them themselves to have evidence of what was said.
Heightened security measures: implement measures to verify the identities of interviewers and secure communication channels.
Secure communication channels: use encrypted communication tools and verify the identities of interviewers before sharing sensitive information.
Collaborate with countering FIMI / disinformation organisations: submit identified cases to organisations that counter disinformation. If these are hard to identify, consult with experts.
Prepared by Debunk.ORG. Article and pictures first time published on the EUvsDisinfo web page. Prepared for publication by volunteers from the Res Publica - The Center for Civil Resistance.
