This article is part of a series analyzing the various aspects of the suspected Russian intelligence operation. Our top post summarizes these findings.
Franco-German Cooperation, But Not as You Know It
Little of the Russian operation’s content was related to the European Parliament elections in May 2019: in general, the operation primarily promoted Russian foreign-policy narratives.
On May 21, however, users in French, German, and non-native English all posted articles claiming that “liberal forces” in the European Union (EU) had launched a “war against the right.” The articles were translations of one another, or of a common source, and were based on a screenshot of a letter allegedly written by Member of the European Parliament Anna Maria Corazza Bildt.
The letter, in Swedish, called for “resolute and united” cooperation between European liberals and conservatives against the far right and praised the “well-organized work of the German media” against a far-right politician in that country. The three blogs each referred to the letter as a “desperate and oftentimes unlawful informational war […] being made against the forces that try to defend national interests of European countries.” (Wording from the English version.)
The blogs were all posted on the same day; the French and German versions appeared online just 27 minutes apart.
The original language of these articles was unclear. The English text, posted on Medium by a user account that never posted anything else, was riddled with language errors, raising the possibility that it was a translation from some other language, likely Russian. The article’s first sentence opened, “It became known earlier that…,” an unusual formulation in English, but common in Russian as “Ранее стало известно,” recently used in ledes by both TASS and Sputnik’s Russian service.
Other linguistic jewels included:
“Swedish politician Anna Maria Corazza Bildt believes that the current alignment of forces in the EP looks ‘scarily’.”
“Mrs Bildt recommends acting hard-line and holds to conducting information operations against most prominent representatives of the extreme rights.”
“To put it straight, nowadays, desperate and oftentimes unlawful informational war is being made against the forces that try to defend national interests of European countries. The time for information injections is chosen the way to deprive people of the opportunity to revolve it in the mind and to force them act basing solely on emotions.”
All three articles sourced the “letter” to a separate Medium post, dated May 16, and published by a user account called “Tom Welch.” As so often in this operation, the account only posted once and struggled with English. It did not provide a source for its “letter.” The likelihood is that the “letter” was a forgery created by the operation to provide ammunition for far-right forces in Europe ahead of the election.
The story failed to gain significant traction. A scan of the three articles using the online tool BuzzSumo showed that none was shared online.
Attribution by Amplification
The use of burner accounts, specific platforms such as Medium and meinbezirkt.at, multiple language variants, and Russian-flavored English all tie this story to the Russian operation. Two more factors reinforce the attribution.
The German version of the story was posted to an Austrian regional forum called meinbezirk.at by an account known as “Werner Holt from Steinfeld,” registered on April 24. Unusually, this was not the account’s only post.
On the day it was registered, the account published an allegation that the United States and Poland were conducting an “information war” against Germany. One Facebook user shared that article: an “Austrian nationalist” account that Facebook itself identified as part of the Russian operation.
One Twitter account also promoted the “Holt” article: the account @KPrydius posted it 16 times, tagging politicians from Germany’s far-right AfD party. This appears to have been an attempt to flag the story to politicians who might raise a scandal about it; if so, it failed.
The @KPrydius Twitter account linked back to a Facebook asset with the same profile picture and similar name, that Facebook itself confirmed was part of the Russian operation. The Facebook account advertised the Twitter one; on another occasion, the Twitter account amplified a separate anti-immigrant story created by the Russian operation.
It would be stretching credulity to suggest that this amplification by two different assets linked to the operation was a coincidence. The “Werner Holt” account appears to have been run by the operation but used to post two different stories, in defiance of the operators’ normal security measures.
The claim of an “informational war” against the far right in Europe was most likely an attempt at the time of the European Parliament election to provide ammunition for the European far right.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (DFRLab).
Eto Buziashvili is a Research Assistant with the Digital Forensic Research Lab (@DFRLab) based in Tbilisi, Georgia.
Michael Sheldon is a Digital Forensic Research Associate at the DFRLab.
Follow along for more in-depth analysis from our #DigitalSherlocks.
