Weaponized OSINT

Warfakes (Война с фейками) is the name of a popular Russian Telegram channel at the centre of an entire network of related channels that emerged in the opening days of the Russian invasion of Ukraine. Along with its English language website, these channels present themselves as a network that debunks fake news, in a familiar style of fact-checking websites such as PolitiFact.

They produce two dozen posts per day on average, where the techniques of open-source intelligence (OSINT) are often used to expose the supposed untruths in media coverage of the war. These posts are circulated widely on Telegram as well as other social media networks, especially VKontakte. Warfakes represent a new type of disinformation that we refer to as participatory propaganda where users circulate weaponized OSINT, most notably including the Russian state operatives. Here’s how authors present themselves:

Welcome to the War on Fakes project. We are the owners and administrators of several Russian non-political telegram channels. We don’t do politics. But we consider it important to provide unbiased information about what is happening in Ukraine and on the territories of Donbas, because we see signs of an information war launched against Russia. Our mission is to make sure that there are only objective publications in the information space. We do not want ordinary people to feel anxious and panicked because of information wars. We are going to look into every fake and give links to the real refutations. Be safe, be at peace, be with us.

Inside the Russian media bubble, debunking sites are just as likely, or even more likely, to ‘bunk’ news that is true as they are to debunk fake news. While this also happens frequently in broadcast television, Telegram is the most popular fake debunking medium, with the Warfakes channel with over 700k subscribers as its prime example. While the organization behind Warfakes is unknown, its content is systematically promoted by the Russian state via the Facebook pages of foreign embassies and other Kremlin-sponsored cultural institutions. A close reading of the channels reveals them to consistently promote a number of pro-Kremlin narratives under the guise of questioning sources and exposing apparent discrepancies in reporting.

Warfakes is the largest Russian Telegram channel in a whole genre of other channels that ‘debunk’ war coverage. Compared to other social media, Telegram generally has a softer touch when it comes to censoring content – although this has begun to change recently. Telegram was developed by Pavel Durov after the Kremlin took over his previous social network VKontakte. Telegram’s servers are located in the Persian Gulf (after the KGB tried to take it over). Telegram has been referred to as a ‘dark corner’ of the internet (Rogers) due to its light touch approach to moderation. Ultimately, Telegram is a massive platform (with a user base of 400M), which makes it hard to generalize, as it supports all kinds of communities.

On Telegram there are multiple channels with similar names, descriptions and content, which make up a Warfakes network. The channels appear localized to audiences in specific regions including Ukraine and Belarus and many other smaller Russian-dominated cities and regions (such as Rostov, Belgorod, Cuban, annexed Crimea, Voronizh, Samara, Republic of Kalmykia, Kirov, Khabarovsk region, Zabaykalie, Bashkotorstan and Republic of Sakha). With the main Warfakes channel as its core, we identified similar channels as core clones. When listing these channels we noticed two prominent groups with the same date of creation: 26 February 2022 and 1 March 2022.

Three levels of fakeness

A fake police car in Russia. Image via Wikimedia Commons

When conceptualizing participatory propaganda, the Warfakes Telegram network has three levels of fakeness.

The first level is rhetorical, where the site uses the rhetoric of fact-checking to identify ‘fake’ information that is usually not misinformation. This technique is not unique to Warfakes. In fact, this is a popular format on Russian TV as well and was used in a program called Antifake as well.1 On Warfakes, the typical rhetorical structure for ‘debunking’ is to flag news as fake and to then counter it with the (fake) truth, accompanied by an explanation and a visual. Since Telegram is a more participatory medium than TV, Warfakes propaganda has a participatory flavour.

As such, the second level of fakeness is aesthetic. Much content on Warfakes has a specific ‘investigative aesthetic’, where red circles are used to identify an image as a supposed deep fake, for example. On Warfakes, the vernacular term for using investigative aesthetics to debunk images is called ‘creo’.2

Eyal Weisman and Matthew Fuller discuss investigative aesthetics as a collective practice of using open sources to produce actionable intelligence. They describe investigative aesthetics as ‘scraps of information … compiled into systems, including narrative structures, that allow for their cross-checking and public presentation’. Warfakes appropriates the authority of investigative aesthetics to manufacture misinformation. One of the most prominent ‘investigative aesthetics’ operations, Bellingcat, involves a network of 60+ collaborators who have produced important intelligence in the last few years (the Russian involvement in 2018 Skripal poisoning, for example). Judging from its style and high volume of posts, Warfakes looks like it is being produced by a decentralized network of open-source investigators. However, we simply do not know if this is the case. It could also be produced in a single office, such as Saint Petersburg’s infamous Internet Research Agency. Either way, one thing is clear: the content produced here promotes a pro-Kremin version of the war.

The third level of fakeness at work in the case of Warfakes is the narrative. Through a process of qualitative data analysis by trained coders, the top 8% of the most engaged with content (141 of a total of 1,731 posts) of the Warfakes core channel were selected (from the 24 February to the 20 March 2022). A close reading revealed nine narratives (in order of highest frequency):

Denial of war crimes: against civilians and civilian infrastructure

Blaming and accusing Ukrainians fakes/discrediting

Denial of failures and misery of the Russian army

Blaming and accusing of making up sanctions against Russia

Denying mobilization of Russian people

Denying victories of the Ukrainian army

Discrediting President Vladymyr Zelenskij

Blaming and accusing Ukrainians of Nazism

Biolaboratories in Ukraine

We found that the most popular ‘debunked’ narratives were about the Russian army’s worst atrocities in that period: 1.) the missile attacks on a maternity house and children’s hospital in Mariupol; 2.) the attack on a drama theatre in Mariupol; and 3.) the killing of journalist Brent Renaud.

Three months after the first analysis we performed the same close reading of a wider scope of 10% of the most engaged content and found nine new narratives:

Deterioration of life in the world because of Ukraine

Discrediting the Armed Forces of Ukraine

NATO assistance is ineffective and leads to a bigger war

Russians are interested in the topic of ‘special operations’ and/or support it

Denial of support for Ukraine by other countries or initiatives

Life under occupation is good and peaceful

European countries cannot be trusted

Russia is friendly to refugees and residents of the occupied territories

Recognition of ‘LDNR’ as a legal territory

During the first three months of Russia’s full-scale invasion, denying war crimes and blaming Ukrainians for creating fakes were the narratives that were used most frequently. The debunking of the worst atrocities, such as the Bucha massacre, were also the most popular.

State-sponsored propaganda

In the course of analysing who reposted Warfakes content, we found that from the 24 February until the 28 March, the director of the Information and Press Department of the MFA RF, Maria Zakharova, reposted Warfakes content from her own verified Telegram channel. The first post promoted waronfakes.com and the second was a repost of their ‘debunking’ of the Russian army’s bombing of the Mariupol maternity ward. Later we observed that the Telegram channel of the Ministry of Defence of Russia made 264 mentions of Warfakes (as of 30 July 2022). Using the Meta research tool Crowdtangle, we investigated all mentions of the Warfakes Telegram channel on Facebook. We found that the main promoters of Warfakes content were Russian embassies and Russian houses of culture, both of which are under the jurisdiction of the Russian Ministry of Foreign Affairs. Each of these Facebook pages had 9,800 subscribers on average, and each post had an engagement rate from 1,482 to 5.

Monitoring the Warfakes channel on Facebook on the 22 March 2022 revealed that Russian households spread posts to the following cities (in order of highest transference first): Sofia, Belgrade, Chisinau, Ankara, Beirut, Prague, Cairo, Athens, Zagreb, Romania, Skopje, Bishkek, Amman, New Delhi, Yerevan, Bratislava, Tunisia, Alexandria, Chennai, Podgorica, Vein, Brest and Dar es Salaam.

On the same date, Russian embassies spread the Warfakes channel on Facebook to Bulgaria, Sweden, Macedonia, România, Slovenia, Laos, Denmark and Israel (highest transference first).

Participatory propaganda

Warfakes is a new form of propaganda that is participatory, as opposed to ‘traditional’ propaganda, which usually operates top-down. By definition, participatory propaganda is co-produced by users to some extent. While we do not know who makes the content on Telegram, a crucial affordance of the medium is sharing. As such, part of what makes this propaganda so successful is how it spreads, including users sharing the content who may not agree with it.

Warfakes should be considered in the broader context of the Russian disinformation strategy. This can be traced back to Putin’s reaction to the UN-backed war in Libya and Maidan protests. In order to avoid his own uprising, state-sponsored influence operations have developed these new forms of participatory propaganda.

Their strategy is to create epistemological confusion that causes people to question the idea of objective truth. This benefits reactionary nationalistic narratives. Since Maidan, Russia’s military has developed a new ‘Gerasimov doctrine’ in which future wars would take place mostly in the information space. Therefore, it seems reasonable to speculate that Warfakes may in fact be a Russian military operation. Telegram’s ownership tried to resist state control in the past, but the platform is being used by the Kremlin. We believe they should take responsibility and remove the channels.

This article was based on the findings of a project executed during the Digital Methods Winter School, Amsterdam, 2022, and was first published in Dispatches from Ukraine: Tactical media reflections and responses by the Institute of Network Cultures (INC).

Project participants include: Karyna Lazaruk and Marc Tuters (project leaders), Borka Balogh, Marta Ceccarelli, Emillie de Keulenaar, Kiara Khorram, Devin Mitter, Son Nguyen, Stijn Peeters, Emilie Schwantzer, Cemal Tahir, Alexander Teggin, Yana Mashkova and Anton Mishchuk.