Russian state-affiliated disinformation outlets try to ‘borrow’ credibility by impersonating legitimate media and government institutions. It is a deceitful information manipulation tactic to spread pro-Kremlin disinformation narratives. The EU took action and now they are exposed.
On 13 June, the French Minister for Europe and Foreign Affairs, Catherine Colonna, issued a statement revealing a digital information manipulation campaign against France involving Russian actors, including Russian government entities spreading disinformation. This revelation was based on a thorough investigation and report by the French agency to fight foreign disinformation (VIGINUM) that sits within the General Secretariat for Defence and National Security (SGDSN) of France. The report exposes a ‘complex and persistent information manipulation campaign’ to impersonate legitimate media outlets and government entities.
Over the past months, the EU has developed tools to address this type of foreign information manipulation and interference (FIMI), and as part of this policy, the EU Member States have now taken action against seven Russian individuals and five entities identified as responsible for an information manipulation campaign designed to distort the information environment in support of Russia’s war against Ukraine. These entities usurped the identity of legitimate national news outlets in several EU Member States. In reality, they have nothing to do with legitimate media. In fact, several of them have been linked to the Russian military intelligence service or the presidential administration.
Impersonation, feigning legitimacy, co-opting fact-checking, rebranding, and masquerading false content as real have been among the most favoured Kremlin tactics to manipulate the information environment. In this article, we take a closer look at some of these manipulative tactics and how pro-Kremlin disinformation actors have sought to use them to manipulate public thought.
The case of Reliable Recent News
These recent restrictive measures were largely triggered by the VIGINUM report which exposes a digital information manipulation campaign called Reliable Recent News (RRN). RRN is known for trying to undermine Western support to Ukraine by spreading narratives that Western populations would allegedly rather support Russia. In truth, of course, around three-quarters of the people living in the EU support Ukraine. But perhaps that is exactly why pro-Kremlin disinformation and information manipulation outlets are continuously targeting Ukraine and its allies while trying to erode this public support.
We have previously written about the Kremlin’s playbook of manipulative narratives deployed to advance myths about Russia’s war against Ukraine. The VIGINUM report takes a different, albeit complimentary, approach and exposes the modus operandi, or the manipulative behaviour, underpinning the RRN campaign in France. According to the findings of VIGINUM, the campaign was set up almost immediately following Russia’s full-scale invasion of Ukraine on 24 February 2022. Ever since, it has been setting up websites with French-sounding names to present themselves as authentic news outlets while spreading pro-Kremlin disinformation designed to polarise European societies and erode support for Ukraine.
Another tactic used by the RRN campaign was to impersonate existing, legitimate French media outlets such as Le Monde, Le Parisien, Le Figaro and 20 Minutes. RRN did all this by creating false domains with domain names that look or sound very close to the real names by using what is known as the typosquatting technique to disseminate pro-Kremlin disinformation narratives about Russia’s war against Ukraine. In an equally notorious fashion, the campaign used the same typosquatting technique to impersonate French government websites and publish false ‘official documents’.
Finally, these manipulative activities were amplified by networks of inauthentic social media accounts, such as a coordinated network of Twitter bots and Facebook pages, as well as Russian diplomatic accounts across various social media platforms. We, too, have written about the Kremlin trend of deploying diplomatic networks on social media to spread disinformation. EU efforts to protect media consumers by restricting the functioning of such a clearly conscious, intentional, and coordinated information manipulation campaign seeking to undermine the credibility of legitimate media outlets are steps in the right direction.
Kremlin doppelgangers
The revelations of the VIGINUM report is not the first time the Kremlin’s tactic of impersonation has been exposed. EU DisinfoLab, an independent, non-profit organisation specialising in investigating and exposing disinformation in Europe, also exposed a Russia-based influence operation that created media clones to disseminate Russian propaganda to unsuspecting European audiences.
The campaign, dubbed ‘Doppelganger’ by EU Disinfolab analysts and investigators, uncovered the use of multiple attempts to impersonate or ‘clone’ legitimate media outlets. They included such well-known and trusted outlets as Bild, The Guardian, ANSA and RBC Ukraine. Similar to VIGINUM’s eventual findings, EU DisinfoLab shed light on impersonation as an increasingly favoured manipulation tactic to feign legitimacy and spread disinformation narratives undermining the Ukrainian government and its statehood, vilifying its people, discrediting its armed forces, and seeking to erode Western support for Ukraine.
But unlike the VIGINUM report, EU DisinfoLab did not make a conclusive and specific attribution, merely noting that the campaign appears to be sustained by operators based in Russia.
False magazine covers
Another increasingly prolific information manipulation tactic that seems to enjoy the favour of known pro-Kremlin disinformation actors, particularly on Telegram, is using fake covers of highly recognisable European or Western magazines and newspapers. The goal is almost always to deride and denigrate Ukraine, such as by accusing President Zelenskyy of stealing European wealth, denying Ukraine’s sovereignty, or ridiculing the Armed Forces of Ukraine.
Needless to say, none of these legitimate outlets have ever published any of these magazine covers. But this information manipulation tactic essentially tries to ‘borrow’ the legitimacy of real and credible outlets and to masquerade completely false content as truthful. In fact, the EEAS exposed this manipulative tactic in the 1st report on Foreign Information Manipulation and Interference (FIMI) threats, which devotes considerable attention to analysing impersonation techniques by Russian disinformation actors targeting Ukraine.
Fake war on fakes
Kremlin-affiliated information manipulators have also deployed the tactic of impersonation beyond targeting legitimate news media outlets. From the onset of Russia’s full-scale invasion of Ukraine, a similar impersonation tactic has been used to co-opt and spoof legitimate fact-checking outlets.
The most visible example was the notorious pro-Kremlin outlet WarOnFakes, which was set up with the alleged goal to ‘counter disinformation about Russia’s special military operation’. Yet, there was nothing legitimate or objective about this outlet. It consistently pushed pro-Kremlin disinformation narratives disguised as fact-checking and defended the Russian military and its war against Ukraine.
Moreover, this notorious tactic of portraying disinformation as truthful fact-checking also seeks to erode the credibility of legitimate fact-checking outlets such as StopFake, MythDetector, Debunk.org, and many others.
The launch of this outlet and pro-Kremlin disinformation actors’ affinity for its content raised many red flags. A thorough and timely investigation by Logically established that WarOnFakes is a pro-Kremlin information manipulation project. And the man behind it, Timofey Vasiliev, is a close associate of one of the most prolific and bellicose pro-Kremlin propagandists, Vladimir Solovyov. Hardly a group of ‘reliable fact-checkers’.
Constant evolution
Impersonating legitimate media outlets is not the only information manipulation tool in the Kremlin’s arsenal of deceit. Due to the growing international understanding of the challenges Russian state-affiliated outlets can present in any given information environment, some pro-Kremlin outlets have also tried to re-invent their own brands.
Such is the case of R7 Media in France, eerily similar to the EU-sanctioned Russian disinformation outlet RT/Russia Today. And it even cloned itself under the different monikers of R8 Media and R4 Media. All three share the same fonts and visual identities. Despite the visual rebranding, all of these channels continue to spread pro-Kremlin disinformation narratives.
Another example is the evolution of Sputnik, a notorious EU-sanctioned pro-Kremlin disinformation outlet. It too underwent a cosmetic change, its global outlet emerging from its sputniknews.com chrysalis as sputnikglobe.com. And again, the content it peddles does not diverge one iota from carefully managed Kremlin disinformation directives.
Finally, these information manipulation and disinformation outlets migrate across platforms. A case in point was the transformation of RT en Español and its clone actualidad.rt.com into seemingly new projects and the launch of their channels on YouTube as Sepa Mas and Ahi les va to maintain their audiences. But ties to their real identities were quickly revealed when it became apparent that their studio equipment still bears the RT logo and colours.
All of these tactics and techniques of impersonation are manipulative and deceitful. Pro-Kremlin disinformation outlets are adept at changing, pretending, and deceiving. Smoke and mirrors has always been their game. But thanks to many frontline defenders in the information space, the Kremlin information manipulation tactics are exposed for the world to see. Don’t be deceived.
Article and pictures first time published on the EUvsDisinfo web page. The article was prepared for publication by volunteers from the Res Publica - The Center for Civil Resistance.
