By EUvsDisinfo
Foreign information manipulation and interference (FIMI) operations are a complex and multi-faceted challenge which, as evidenced by Russia’s relentless FIMI operations in the context of its war against Ukraine, must be considered as a serious security issue. Therefore, the European External Action Service has endeavoured to analyse FIMI, develop a collective response, and offer a practical approach to the exposure and attribution of information manipulation operations.
We have already examined the architecture of Russia’s FIMI operations, as exposed in the 3rd EEAS report on FIMI threats. Let’s continue our series of deep-dive articles exploring the findings of the report and zoom in on the network analysis of influence operations.
A galaxy of interconnected threat actors
The 3rd EEAS report on FIMI threats has introduced the concept of the FIMI Exposure Matrix – a systematic approach to classifying and attributing FIMI operations – using the useful visual analogy of an iceberg. The visible part of Titanic’s icy nemesis represents overt FIMI channels like official government communications and state-controlled outlets, while the larger, subaquatic part of the iceberg represents covert FIMI activities conducted by outlets that may be linked or aligned with the state, but the element of state-control is obscured.
However, these four layers do not operate in isolation from one another. They form a unified infrastructure, a network, where different channels, both attributed to Russia and non-attributed, interact with each other to coordinate their information manipulation and influence efforts. We call this network the galaxy of FIMI operations.
From the 505 FIMI incidents sampled in the Report, we could identify 38 000 unique channels, each playing a role in this galaxy of information manipulation. So, in order to have a better understanding of the interconnectedness and modus operandi of these channels, we zoomed in on 2 055 of the most active channels.
With this approach, it becomes clear that there are several special stars in the galaxy presenting the most prolific channels through which information manipulation operations are amplified and coordinated. These include major state-controlled or state-linked outlets like RIA Novosti, TASS, RT, Sputnik Africa, etc. in the case of Russia, and CGTN, Global Times, Xinhua, etc. in the case of China.
A useful way to read this galaxy is to look at the size of the stars as well as the number of connections they foster. The larger the star, the more often these channels have been engaging in information manipulation incidents. Same for the number of connections – the more connectivity, the more frequently these channels have been involved in FIMI incidents and hence the more significant their role in the overall FIMI architecture.
Who are the brightest stars in the FIMI galaxy?
Unsurprisingly, EU-sanctioned, Russian state-controlled, and pro-Kremlin outlets are among the biggest stars, or key nodes, in the FIMI galaxy. However, Russia also uses channels that try to conceal their affiliation with the Kremlin, like the Doppelganger campaign or the African Initiative. This way, the Kremlin tries to diversify its audiences by making the disinformation narratives appear more organic. On top of that, there are channels and nodes that also spread pro-Kremlin narratives but are not attributed to Russia, such as long-running FIMI operations like Portal Kombat and False Façade which mirror, repackage, and launder content for Russian state-controlled outlets.
Similarly, China’s FIMI infrastructure is also build around state-controlled outlets which function as key nodes to produce and distribute content. Notably, Chinese diplomatic accounts serve as booster nodes in the galaxy. This means that they systematically repost and amplify content disseminated by the key nodes, like the CGTN and Global Times channels. But beyond the identified and attributed parts of the galaxy, China also relies on seemingly independent channels to covertly extend its information manipulation activities.
How does it work?
As the galaxy shows, the FIMI architecture is designed to be diverse, persistent, and adaptive to target audiences, so it does not rely on just one platform. It can include accounts on major social media platforms like X (formerly Twitter), Facebook, Telegram, YouTube and TikTok, as well as state-controlled or inauthentic news websites. Likewise, content can be reshaped in different formats – videos, articles, memes, AI-generated content – all to deliver manipulative narratives to receptive target audiences. Furthermore, information laundering is a key technique for hiding the origins of manipulative content.
Let’s focus on one example. We can see that a piece of manipulative content targeting the legitimacy of President Zelenskyy – the sort of thing that the Kremlin pushes on a daily basis – was initially published on YouTube. Then the same disinformation narrative was repackaged in an article created by a False Façade website and amplified via Telegram. In the next step, Russian state-linked channels like NewsFront picked up the story to expand the audience. At this stage the information laundering moved from the covert phase to overt action, with major Russian state-controlled outlets like Sputnik starting to amplify the same disinformation narrative, and the Russian Ministry of Foreign Affairs weighing in to give this fabrication seeming legitimacy.
Who is amplifying whom?
Of course, this information laundering is not a one-way process. Manipulative content can also originate in the overt part of the galaxy and spread out to the more clandestine parts. More importantly, the spread of content is not limited to a specific cluster in the galaxy.
On the contrary, Russian and Chinese clusters often mutually amplify content through cross-promotion by state-controlled media outlets like RIA Novosti, RT, Sputnik, CGTN, and Global Times. This convergence is most evident in common narratives targeting Western institutions and democratic processes often portraying Europe, the US, and NATO as weak, unstable, or engaged in neocolonialism and regional provocations.
Patterns of interaction
Looking at any single star in this galaxy, it may appear that they shine in isolation, but when we look at the whole galaxy, important patterns of interactions begin to become clear. One of the most evident patterns is the coordinated activation of different clusters in the galaxy. It means that multiple channels push the same content at the same time with the objective of flooding the information space. Other significant patterns are content recycling and audience segmentation. In other words, repackaging disinformation originally designed for one audience to infiltrate new regions and audiences.
These patterns of manipulative behaviour can be effective in obscuring the origins of manipulation, evading scrutiny, adapting content to resonate with localised audiences, and influencing public opinion. Understanding them is also key to building resilience against such information manipulation. And zooming out to look beyond single stars of information manipulation to the whole FIMI galaxy is a crucial step toward identifying and understanding these patterns of behaviour.
Don’t be deceived.
By EUvsDisinfo
