Kremlin’s dirty infowar: sow division abroad, spread lies at home
While Russia disseminates fake news across the Western cyberworld, it has also been working hard to dominate the pro-Kremlin discourse back at home. Over the past decade, its secret intelligence service has set up hundreds of propaganda websites, disguised as innocuous local news outlets, targeting a diverse range of communities across the Federation, a study has found.
OpenFacto, a non-profit open-source intelligence body based in Paris, conducted a three-month investigation that found InfoRos – ostensibly a Russian news agency but in fact linked to its military intelligence service the GRU – had registered more than 1,300 bogus “news portals” since 2012.
“OpenFacto discovered and mapped more than one thousand Russian-speaking websites linked to the GRU, to reconstruct their strategy and objectives, in a landscape already saturated with media loyal to the Kremlin,” said the study.
“Attached to cities, towns, districts, or even villages, InfoRos has created a network of amplifiers that surreptitiously broadcast the Russian government’s preferred narrative.”
Though these websites at first glance appear to be nonpolitical in nature, closer examination revealed a more sinister purpose.
“The websites are primarily empty shells that regularly copy and paste innocuous content [but] publish InfoRos content at regular intervals, which has a pro-government or anti-Western tone. The sites appear to relay an editorial line, which appearances suggest would be defined by the GRU, whose mandate is theoretically limited to outside the Russian Federation.”
OpenFacto asserts that the Ru.net – a term for the Russian-speaking segment of the world wide web – has been under-researched, although Kremlin-backed disinformation campaigns abroad such as Secondary Infektion and the St Petersburg-based Internet Research Agency have been exposed.
Referencing “the palpable presence of the Russia-versus-the-West rivalry in the content produced by the Russian security services,” OpenFacto added: “In contrast to sites aimed at international audiences, Russian InfoRos portals do not promote division but, rather, act as a bulwark against Western information.”
Shadows past and present: InfoRos and the GRU
Founded in 2003, InfoRos appears on the surface to be a news agency registered in Moscow. However, analysts in Estonia and the US believe that it is controlled by Unit 54777, which answers to the GRU. Directly descended from its Communist-era predecessor, the GRU survived the break-up of the Soviet Union and “specializes in psychological operations,” according to OpenFacto.
Despite such murky origins and previous links to foreign disinformation campaigns, InfoRos maintains a veneer of transparency within the Russian Federation, with some of its domestic sites officially registered with internet regulatory body Roskomnadzor.
But appearances can be deceptive. Only 276 sites are registered with Roskomnadzor; these were originally discovered by another investigative body EU Disinfo Lab, using PublicWWW.com, a source code search engine. But after conducting a reverse DNS lookup – which entails using IP addresses to find domain names and not the reverse as is more commonly practiced – OpenFacto found a far higher number of sites indexed to InfoRos.
“InfoRos websites all contained a distinctive snippet of source code, which OpenFacto endeavored to locate,” said the study. “We collected a total of 1,341 unique URLs for further analysis, although we do not know whether other websites remain undiscovered. The InfoRos-controlled news sites within Russia often mentioned a city, town, or region associated with the terms ‘pressa,’ ‘info,’ ‘news,’ ‘golos’ (voice) ‘vestnik,’ (newsletter) or ‘novosti’ (news). With a few exceptions [...] most sites are registered in .ru.”
In further evidence that the websites were centrally controlled by InfoRos, all were found to have “identical construction: same HTML architecture, same icons, same categories, sections, and types of external links.”
Even more sinisterly, the footer sections of the websites’ pages “list all ‘foreign agents’ and organizations considered ‘terrorists’ by the Russian Ministry of Justice, including the anti-corruption activist Aleksei Navalny.” These footer texts were written in a much smaller 8pt font rather than the larger characters normally used on web pages – possibly to make them less conspicuous but still possible to read.
“At first glance, the narratives of the news portals linked to localities seem innocuous: most of the articles published are about local life events, be it sports competitions, national holidays, or official messages from the authorities,” said OpenFacto.
“However, on a regular basis, the sites share articles with a much more political tone. Thus, there is much content criticizing the expansion of NATO, the government in Kyiv, or the unfounded nature of ‘Western’ accusations and sanctions against Russia. Even more often, Russian history and security services are glorified.”
Furthermore, most of the nonpolitical “cover content” was not original, having simply been copied from social media accounts on VKontakte – a Russian version of Facebook – and websites belonging to local celebrities and institutions.
On the other hand, the “politicized articles systematically flow from the official InfoRos site” to constitute what OpenFacto described as “a national megaphone for InfoRos [...] defined by the GRU editorial line.”
It added: “The agency’s strategy would appear to aim at developing trust among the targeted audiences and at guiding this public to conclusions that serve government interests. Circumstantial confirmation of this impression comes from reports that indicate this tactic of trust cultivation closely resembles the strategy of the Internet Research Agency in the run-up to the 2016 US presidential elections.”
Empire of deception
“InfoRos’ targets span the entire Russian territory,” the study found. “We can also notice websites in Crimea, which Russia annexed in the spring of 2014, as well as in Abkhazia. This region seceded from Georgia with Moscow’s support in 2008.”
It added that the GRU and InfoRos had apparently focused their shell websites on three strategic areas: the greater Moscow region, the borders with Belarus and Ukraine, and the stretch of land from the North Caucasus to the Black Sea.
While the concentration of sites roughly corresponded to population density throughout Russia, “the appearance of correlation might be incidental, and reflect [instead] an effort to control information in strategic zones like the Moscow region, the border that runs along war-torn Donbas [territory comprising the breakaway ‘pro-Russian’ republics in south-eastern Ukraine], and the Muslim republics of the Caucasus, which still endure both separatist and extremist movements.”
OpenFacto argues that the sharper focus on western and border regions of the Russian Federation could be an effort to counter “the influences and media of the European Union and NATO countries.”
While the “strategy of large-scale registration” of shell websites by InfoRos dates from 2012, this was followed by an apparent lull between 2013 and 2019. But since then, InfoRos appears to have drastically stepped up production, creating three-quarters of the shell sites discovered by OpenFacto.
It also described this latter period of domain registration as “much more focused, with the agency often crisscrossing regions one by one.”
“For example, thirteen sites related to entities located in Kaliningrad [a Russian coastal enclave sandwiched between Lithuania and Poland] were registered on April 20, 2020, alone,” said OpenFacto. “On September 11 of the same year, ten sites of entities in the Moscow region surfaced, followed by twenty more the next day.”
Just over thirty of the bogus sites uncovered by OpenFacto were also found to have aimed disinformation campaigns at specific communities, profiled according to age, gender, ethnicity, or religion.
Once again, Crimea was a central focus, with ethnic Jews, Greeks, Czechs, and Estonians living on the peninsula specifically targeted – despite such minorities comprising less than one percent of the population. Crimean Tatars – often accused by the Kremlin of supporting the Kyiv government – had one shell site devoted entirely to them.
“The presence of these sites suggests that InfoRos seeks to maintain control over the image and information conveyed [to] these communities in the region,” said OpenFacto, which it said proved the Russian government believed that the “hearts and minds of minorities in Crimea have yet to be conquered.”
Numerous errors in the spelling of place names in website domain names also suggested the rapid pace of creation had been facilitated by automation – and further undermined any claims that the sites were simply news portals set up by and for local Russians. “Native residents likely know their city’s name, which makes the notion that these are local news sites all the more difficult to believe,” said OpenFacto.
A propaganda network long prepared for war
Furthermore, OpenFacto suggested that the lull in registration of InfoRos-controlled domestic websites between 2013 and 2019 was due to the agency’s resources being redirected to combat the Euromaidan uprisings in Ukraine and subsequently to justify the annexation of Crimea. The protests occurred in response to the Azarov government’s decision to quash a parliamentary vote favoring closer ties to the EU.
“At the beginning of 2019, the agency [...] resumed unfinished work aimed at shaping the Russian information space in its image – with potentially greater means and less erratic procedures,” said OpenFacto.
This propaganda network that the Kremlin appears to have been painstakingly constructing during the past decade will serve it well during wartime, allowing it to rapidly deploy disinformation to counter peace protests on Russian soil.
“A network of local news sites throughout the country would allow the GRU to rapidly disseminate content in crisis,” said OpenFacto. “InfoRos could denigrate demonstrations or accuse opponents of corruption, on a local or national scale.”
More from Cybernews:
Subscribe to our newsletter