For Russia, the information war is also being played out in Europe. And all means are good to discredit the enemy: on the fake Guardian website, the Boutcha massacre is described as a “bloody provocation” prepared by the Ukrainian army and intended to accuse Russia of mass murder. This false information was part of a large propaganda network on the war in Ukraine carried out from Moscow. Alerted by the research laboratory specializing in digital DFRLab, Meta, the parent company of Facebook and Instagram, announced, Tuesday, September 27, its dismantling.
Launched last May, the operation mainly targeted Germany, but also France, Italy, Ukraine and the United Kingdom, explained David Agranovich, a manager of Meta, during a press briefing with journalists. The network was gigantic and active all summer. Their modus operandi consisted in imitating the recognized media sites – about sixty are concerned according to the report put online by Meta – including the German newspapers Spiegel and Bild, the English daily The Guardian or the Italian agency ANSA. In France, our colleagues from 20 Minutes were victims of these attacks, with the creation of the fake site “www.20minuts.com”. Even less visible, the web address of the major German media Süddeutsche Zeitung has been transformed into “www.sueddeutsche.me” instead of “www.sueddeutsche.de”.
The Russian network used these platforms to host articles criticizing Ukraine and Ukrainian refugees, or supporting the Kremlin, before sharing them on YouTube, Facebook, Instagram, Telegram, Twitter or online petition sites (Change.org, Avast). But German investigative journalists began to question the authenticity of these sites, prompting Meta to launch its own investigation. Does this network go back to the top of the Russian state? The researchers said they could not link it directly to the government, while ensuring that a role was played by Russian diplomats. Moreover, the multinational is surprised by the sophistication of these imitations of existing sites, requiring a “significant technical and linguistic investment.”
The spread of articles on social networks has mainly been done through the purchase of advertisements or fake accounts that are not very successful, often automatically detected by Meta alert systems. In total, the Californian company says it has blocked 1,633 accounts, 703 pages and a group on Facebook, as well as 29 accounts on Instagram. Counterfeiters spent the equivalent of around $105,000 on advertising on Facebook and Instagram, mostly in US dollars and euros. The think tank DFRLab, an NGO that fights against fake news, also identified advertisements bought with Hungarian forints and revealed its findings in a post published on September 27.
Depending on the country targeted, the propaganda implemented by this pro-Russian network differs in order to adapt to the local context. The objective: to press on subjects which have a highly corrosive potential. While Russian hackers are talking more about the issue of sanctions in Germany (and its consequences for the German economy), the network piloted by Moscow is attacking, in France, the shipment of weapons to Ukraine. The hackers are calling through numerous messages to stop their delivery, on the pretext that France could be involved in war crimes allegedly committed by Ukraine.
DFRLab identified three pages on Facebook named “Lowe Guzman”, “Gilmore Stanton” and “Estes Pineda” who shared a link to a petition on Change.org to stop the shipment of weapons to Kyiv. Gilmore Stanton and Estes Pineda’s posts were written in French, while Lowe Guzman posted in grammatically incorrect Italian. Indeed, our transalpine neighbors are also targeted by this type of message, because the sending of weapons to Ukraine is unpopular within part of the population and the subject exploited by far-right parties such as Lega Nord and the 5 Star Movement.
The hackers also aim to undermine the credibility of European leaders. Starting with Ursula von der Leyen, President of the European Commission, accused of nepotism in an article on the usurped site 20minuts.com. When German Chancellor Olaf Scholz visited Canada for talks on the supply of liquefied natural gas on August 21, 2022, five pages of the network published, in the following days, a cartoon representing Europe, in the form of a character named “Dr. EuroReich”, cutting off Russian gas to a patient representing the German economy.
Faced with this flow of disinformation, how to spot the touch of the Russians? Incorrect grammar is a common indicator in Russian influence operations previously identified by DFRLab. The errors identified attest to people who have probably used an online translator or do not have a thorough knowledge of the languages in question.
If the operation dismantled by Meta is important, Russian propaganda continues to be in full swing in Eastern Europe since the start of the invasion, especially in the countries formerly attached to the Soviet Union (USSR). In the lead, Slovakia or the Czech Republic. “As of January, there has been a massive increase in disinformation aimed at justifying Russian aggression against Ukraine,” Bohumil Kartous, a spokesman for the Czech Elves, told L’Express at the end of February. a network of hundreds of vigilantes who monitor the web. By trying to misinform Europeans, the Russians confirm that digital technology remains a major weapon in their war machine.
Moreover, the dissemination of this false information highlights the flaws and difficulties of social networks in combating the Kremlin’s conspiracy theories. Note that Meta had already been the subject of numerous criticisms in recent years for failing to effectively combat the spread of disinformation on its platforms. In 2016, researchers discovered that Russia was using Facebook and other major social media platforms to lure Donald Trump into the White House. With the war in Ukraine, social networks seem to be groping their way.
