Firehose of falsehood: networks of disinformation in Central and Eastern Europe

The EU has imposed sanctions on Russian propaganda outlets, such as Russia Today and Sputnik News. But the Kremlin-directed official channels are just the tip of the iceberg. There is a large ecosystem of pro-Kremlin and alt-right disinformation websites operating in Central and Eastern Europe.

The European Union has taken steps to block official pro-Kremlin propaganda channels, such as Russia Today and Sputnik News, in response to Russia’s invasion of Ukraine. On 16th December, new sanctions on outlets such as NTV/NTV Mir, Rossiya 1, and REN TV were announced “in order to address the Russian Federation’s systematic, international campaign of disinformation and information manipulation intended to destabilise its neighbouring countries, the EU and its member states.”

Information Warfare is a term coined already in 2008. According to the United Nations Office on Drugs and Crime, its purpose is the distribution, modification, disruption, and degradation of information to gain some advantage over an adversary, who, in the case of the Firehose of Falsehood project, are almost all European citizens. The primary tactics of information warfare are disinformation and conspiracies.Thirteen editorial teams from Central and Eastern Europe gathered in the Firehose of Falsehood project to thoroughly investigate the disinformation ecosystem orchestrated by the Russian state apparatus and echoed in Europe. The project, based on the use of in-depth data and metadata analysis with local insights, is exposing new links and connections between websites operating in Central and Eastern European countries and bringing better insight into how the infrastructure of disinformation is built.

But beyond the official channels, there is a vast ecosystem of pro-Russian and alt-right disinformation websites operating in Central and Eastern Europe. We analysed how these websites mutually correlate and how they spread Russian propaganda and conspiracy theories. Our investigation revealed a web of websites that link directly to Russian propaganda sources and those that evangelise sources like Global Research* and Zerohedge*. We also examined sites that belong to the alt-right scene, such as Breitbart*, and their proxies and friends. Our findings provide an insight into the scale and scope of the pro-Russian and anti-Western disinformation networks operating in Central and Eastern Europe.

The official Russian channels, directed by the Russian state, are just the tip of the iceberg of the pro-Russian disinformation ecosystem.  Alongside, there are many Russian websites which, according to several analyses, are directly linked to the Russian secret services GRU, SVR and/or FSB. Some of them publish their texts in Russian, and some have multiple language versions, for example, News Front, which we investigated in our previous publication.

Besides News Front, the best-known websites include SouthFront, Katehon, Geopolitica.ru,  The Strategic Culture Foundation and New Eastern Outlook. But the list of Russian propaganda sites is far from exhaustive, and when it comes to the current information war, sites like Ruskaya Vesna and many others play a vital role. A particular position belongs to the Global Research site. It has served for years as a gateway for Russian disinformation content to the United States. Today, it is considered one of Russia’s key proxy servers. It creates its content from a mix of disinformation and conspiracy theories. Using open-source tools like SimilarWeb and Ahrefs, we identified other sites popular with the similar crowd. These are mainly sites from the American alt-right scene like Breitbart.

But Global Research is only one in a wealth of similar servers of this type around the world. As our Firehose of Falsehood investigation shows, dozens of local websites operating in Central and Eastern Europe are part of a disinformation ecosystem that distributes or supports pro-Kremlin narratives.

Their content is often made up or manipulated, some websites bring popular conspiracy theories or country-specific conspiracies, and some add nationalist or alt-right narratives. Most often, however, they combine these types of content. They link to each other and form a vast ecosystem of trumpets and echoes of Russian propaganda in individual countries.

We examined the pro-Kremlin, disinformation, conspiracy and alt-right websites in 13 countries (Czech Republic, Slovakia, Slovenia, Poland, Hungary, Latvia, Lithuania, Estonia, Bulgaria, Romania, Croatia, Serbia, and Germany) and the web of amplifiers of pro-Russian disinformation and conspiracies, as well as its proxies. With data analysis and open-source tools, we researched how these are technically interlinked and how they operate in Central and Eastern Europe.

As we found out, some of the websites link directly to Russian propaganda sources. Another subset consists of domains that these pro-Russian domains themselves evangelise as their sources and friends, such as Global Research or Zerohedge. Furthermore, we analyzed the sites that belong to the alt-right scene such as Breitbart, and their proxies and friends.

The below map shows links between websites representing the disinformation, conspiracy and alt-right scene in thirteen Central and Eastern European countries and their connections to pro-Russian and alt-right websites around the world. (See the methodology and categorisation explainer at the end of the article for details).

The visualisation of how the analysed websites link to each other in different ways clearly shows the centrality of pro-Kremlin disinformation sites and US alt-right sites for all of Central and Eastern Europe.

Sites like Breitbart, Zerohedge and Global Research are shared in almost all countries directly or through other local websites. The visualisation also shows that Russian disinformation sites are more prevalent in Bulgaria or the Baltic countries. On the other hand, Slovenia or Croatia are closer to the alt-right scene. Central European countries such as Germany, the Czech Republic or Slovakia feature a combination of both pro-Kremlin propaganda and alt-right propaganda.

After Russia invaded Ukraine, Poland, Estonia, Lithuania, Latvia, Czech Republic, Slovakia, and Romania were among the EU member states that blocked access to Russian news sites and channels in a move intended to limit direct spread of Russian weaponised propaganda in the countries.

This action was only partially effective. Activists in Romania, Poland, and Slovakia raised legal concerns warning that the governments might misuse the measures for their political purposes.

Despite the blockade by the Polish Internal Security Agency, some of the websites trumpeting Russian propaganda are back operating in Poland. Some are accessible only via VPN, while others took down their websites and remain active only as social media and Telegram channels. The content is in multiple formats: video, articles, and blogposts. A disinformation-spreading organisation that positions itself as a “legal services centre” uses its own mobile application.

About a week after the Russian attack on Ukraine, Slovak authorities began blocking websites spreading false pro-Kremlin propaganda under new but temporary legislation. As a result, four websites classified by the government as disinformation were banned by the end of June (among them the most popular ones – Hlavné správy, Infovojna, Hlavný denník). However, these sites’ traffic bounced back once the temporary legislation expired. Some of the actors also managed to build up a significant presence on Telegram in the meantime.

While the disinformation scene in Slovakia remains fragmented and is generally unable to create new topics of social and media discourse, “alternative media entities” have succeeded in gaining the support and interest of a relatively large group of readers, according to the latest annual report by the Slovak secret service. Traffic on some of these sites can reach several million a month, equal to some of the most prominent Slovak online mainstream media. These numbers are also supported by the strong connection between the Czech and Slovak disinformation scene (as the page link chart shows.). The interconnectivity is so strong those two clusters can be considered a unified disinformation ecosystem.

The latest surge of disinformation sites in the Czech Republic is related to the Russian invasion of Ukraine. Some of the long-existing sites adopted the pro-Kremlin narrative about the legitimacy of this invasion and reinforced the Russian state-created image of Ukraine. The first official response to this content was the removal of eight disinformation websites from the DNS records kept by the national registrar CZ.NIC. The Czech Military Intelligence subsequently asked Internet service providers to block access to additional sites.

While blocking those websites initially led to a drop in traffic, it ultimately boosted the largest sites’ visitations as they transited to new URLs, which the government and Internet Access Providers could not re-block.

Despite blocking Russian news sites and channels in Estonia, at least two sites, Baltnews and Baltija EU, are still up and running and spreading the pro-Kremlin narrative to the Baltic states and vice versa.

In Latvia, most of the media spreading pro-Kremlin disinformation are not local; they originate in Russia. They were freely available before the war in Ukraine. Latvian electronic media regulator has since banned their rebroadcasting and censored over 100 websites on national security grounds. Most of the blocked domains are .ru, but some are local. Their blocking does not make them inaccessible. People continue to watch Russian propaganda channels via Illegal Satellite TV Receivers or access the sites via VPN.

Although the EU imposed sanctions on RT’s broadcasting activity in early February 2022 “until the Russian Federation and its associated outlets cease to conduct disinformation and information manipulation actions against the EU and its member states”, RT Germany is still active. While internet providers have since struck off some RT Germany websites, new ones were established and continued to spread RT’s disinformation. Approximately 50 websites of RT Germany, identified by the Firehose project,  have been active at some point since the sanctions.

In Serbia, Russia Today opened its Belgrade newsroom and started the Serbian language website in November 2022, with TV channel launch plans by 2024.

Read more detailed descriptions of the situation in individual countries in the reports by the participating investigative centres. We can see that each country has its peculiarities and level of vulnerability.

In the following parts, we will look in more detail at individual websites and their content disseminators in the social networking environment and examples of cross-border cooperation.

This story originally appeared on Vsquare, as a result of an international collaborative project undertaken with the involvement of Atlatszo. A Hungarian version is available here. Project led by Josef Šlerka, Investigace.cz. Journalists participating in the project: Josef Šlerka, Investigace.cz, Czech Republic; Anastasiia Morozova, Julia Dauksza, Anna Gielewska, FRONTSTORY.PL, Poland; Karin Kőváry Sólymos, ICJK, Slovakia; Boglárka Rédl, Márton Sarkadi Nagy, Átlátszó, Hungary; Kaili Malts, Delfi Estonia; Inese Liepiņa, Re:Baltica, Latvia; Sarunas Cerniauskas, Siena.lt, Viktoras Dauksas, DebunkEU.org, Lithuania; Palina Milling, Petra Blum, Westdeutscher Rundfunk (WDR), Germany;  Katarina Bulatović, Oštro, Slovenia; Anja Vladisavljević, Oštro, Croatia; Iulia Stănoiu, Context.ro, Romania; Atanas Tchobanov, BIRD.BG, Bulgaria; Marija Vučić, KRIK, Serbia. We thank the security researcher Vladimir Smitka from lynt.cz for his technical and OSINT insights. Thanks also to Karel Minarik, author of the network visualisation, and Jakub Kubs from Debunk.org for support with data analysis.