By Matt Apuzzo and Adam Satariano, New York Times
Less than two weeks before pivotal elections for the European Parliament, a constellation of websites and social media accounts linked to Russia or far-right groups is spreading disinformation, encouraging discord and amplifying distrust in the centrist parties that have governed for decades.
European Union investigators, academics and advocacy groups say the new disinformation efforts share many of the same digital fingerprints or tactics used in previous Russian attacks, including the Kremlin’s interference in the 2016 U.S. presidential campaign.
Fringe political commentary sites in Italy, for instance, bear the same electronic signatures as pro-Kremlin websites, while a pair of German political groups share servers used by the Russian hackers who attacked the Democratic National Committee.
The activity offers fresh evidence that despite indictments, expulsions and recriminations, Russia remains undeterred in its campaign to widen political divisions and weaken Western institutions. Despite online policing efforts by American technology companies, it remains far easier to spread false information than to stop it.
Russia remains a driving force, but researchers also discovered numerous copycats, particularly on the far right. Those groups often echo Kremlin talking points, making it difficult to discern the lines between Russian propaganda, far-right disinformation and genuine political debate.
Investigators are confident, however, that networks of Facebook profiles, Twitter accounts, WhatsApp groups and websites are spreading false and divisive stories about the European Union, NATO, immigrants and more. Conspiracy theories are peddled freely, including that last month’s Notre-Dame fire was the work of Islamic terrorists, a spy agency, or an elite cabal that secretly runs the world.
Often, these messages come directly from Russian news media and are repeated and amplified elsewhere. Others are more carefully cloaked: Facebook shuttered a pair of pages in Italy last week that were concealing far-right political messaging in what appeared to be lifestyle or sports sites unrelated to politics.
“The goal here is bigger than any one election,” said Daniel Jones, a former F.B.I. analyst and Senate investigator whose nonprofit group, Advance Democracy, recently flagged a number of suspicious websites and social media accounts to law enforcement authorities. “It is to constantly divide, increase distrust and undermine our faith in institutions and democracy itself. They’re working to destroy everything that was built post-World War II.”
The European Parliament elections, which will be held between May 23 and May 26, are regarded as a test of rising populism in the European Union. Populist leaders, many of them sympathetic to Russia, have loosely joined together in hopes of expanding their influence in the Parliament and, in turn, redirecting or subverting policymaking in Brussels.
Intelligence officials have not publicly accused the Kremlin of backing specific candidates in Europe in the way that American authorities say that President Vladimir V. Putin sought to promote Donald J. Trump in 2016. But Mr. Putin has long sought to divide the European Union, and has supported populist movements that seek to undermine the bloc from within.
It is nearly impossible to quantify the scale and resonance of the misinformation. Researchers say millions of people see the material.
Investigators have found hundreds of Facebook and Twitter accounts, more than a thousand examples of WhatsApp messages sharing suspicious materials, and a hodgepodge of dodgy websites that launder varying degrees of misinformation — whether conspiracy theories or polarized slants on the news.
A longstanding debate has been whether this material changes behavior or votes, especially as tech companies have worked to stamp it out. But security researchers suggest that swinging elections is a stretch goal for this kind of campaign, if that. The primary point is to muddle the conversation, make people question what is true, and erode trust.
Russia dismisses accusations of meddling.
“The election has yet to come, and we are already suspected of doing something wrong?” the Russian prime minister, Dmitri A. Medvedev, said in March. “Suspecting someone of an event that has not yet happened is a bunch of paranoid nonsense.”
Distinguishing Russian interference from clickbait or sincere political outrage is difficult, even for intelligence services. The digital trail often winds up in one of the internet’s anonymized dead ends. But pro-Russian fingerprints exist.
In 2016, an Italian website called I’m With Putin appeared, promoting pro-Russian news and criticism of the West. That now-defunct site shared a Google tracking account with the official campaign website of Matteo Salvini, the far-right deputy prime minister and Italy’s most powerful politician.
At the time, Mr. Salvini’s campaign acknowledged that a web developer sympathetic to the party had built both websites, but said it had no affiliation with the pro-Putin page.
That same Google tracking number is also associated with the StopEuro website, which today promotes stories from Russian news media and Kremlin-connected websites that criticize the European Union.
“The Kremlin has empowered and amplified other venal and anti-democratic actors to grow their influence in Europe, creating a snowball effect for its anti-Western agenda,” a European Union task force said in one of its recent summaries of Russian disinformation.
In Germany, the far-right Alternative for Germany party, or AfD, gets strong support from both official Russian government media and unofficial pro-Russian channels. But Mr. Jones, the former F.B.I. analyst, said the Kremlin also appeared to amplify messages from AfD’s staunchest opponents, left-wing anti-fascists. That would underscore what analysts say is Russia’s true interest — sowing political discord in democracies, regardless of ideology.
One example: Websites promoting what appear to be two local German anti-fascist groups, Antifa West Berlin and Antifa Nord Ost, share a server used by Russian government hackers who attacked the Democratic National Committee during the 2016 election. The registration information for one of the German sites includes an anonymized email address that was also used to set up a pair of Russian spearphishing sites.
This month, these two websites prodded thousands of Twitter followers to attend an anti-AfD rally in Berlin. The murky combination of anonymous online content and in-the-street action is reminiscent of 2016, when Russian groups pushed people in the United States to attend rallies claiming to support both Black Lives Matter and the police.
Mr. Jones said he was concerned the same thing was happening in Germany.
Some security experts, however, cautioned against drawing conclusions in this case. Experts regard that server with deep suspicion, but Russian hackers are not the only ones who use it.
A definitive attribution would require the kind of tools that the American government used to reveal the 2016 interference. Twitter said the accounts do not currently violate its policies. Neither of the anti-fascist groups responded to questions about their sites.
Yet even as Russia remains a concern, officials say political groups across the Continent — particularly supporters of the far right — are adopting many of the Kremlin’s tactics, further blurring who is behind the messages.
The left-leaning democracy group Avaaz said it identified more than 100 Facebook pages coordinating the release of articles, memes and videos to support far-right and populist causes in Italy, including Mr. Salvini’s League party and the Five Star Movement, its coalition partner in government. In the past three months, these networks had 18 million followers and 23 million interactions from users, according to Avaaz.
Many of the pages appear to focus on music, sports or travel, but intersperse a stream of articles from far-right news sites. One page, “I Valori Della Vita,” presented itself to its 1.5 million followers as a generic lifestyle page, but shared material from the far-right news site Leggilo.org in a coordinated manner.
Another page, “Lega Salvini Premier Santa Teresa,” portrayed itself as a farmers’ association before turning into a local group backing the League.
This practice violates Facebook’s policies but is a common tactic to artificially amplify content. Facebook removed both pages last week after Avaaz shared its findings with the company.
Christoph Schott, an Avaaz campaign director, said that for every example spotted by investigators, many more went undetected. They spotted other coordinated campaigns in France, Poland and Spain. Facebook, he said, has “so much money and so many people and we’re just a group of concerned citizens and investigators who were able to find it.”
Technology companies have toughened policies to eliminate fake accounts, but researchers say their platforms will always be fertile ground for influence campaigns. Algorithms reward content that keeps users engaged, which means posts that stir anger spread and get clicks.
Since 2016, Facebook has hired thousands of people to work on security and elections, including at a new hub in Dublin to coordinate oversight of Europe’s elections. It has removed roughly 2.8 billion fake accounts and banned networks spreading misinformation, including some targeting Europe.
Days before Spanish elections last month, Facebook blocked several far-right accounts that had reached almost 1.7 million users and were spreading misinformation, including a manipulated picture of a candidate giving a Hitler salute.
“We are fundamentally dealing with a security challenge,” said Nathaniel Gleicher, head of Facebook’s cybersecurity policy. “There are a set of actors that want to manipulate public debate.”
The European Union presents a unique test: how to police billions of posts each day across 28 countries and in 24 official languages. Facebook has more users in Europe than in the United States.
Further complicating its efforts is the dissemination of articles that are exaggerated, slanted or inflammatory but not obviously fake. Deleting this material raises difficult questions about the boundaries of free speech.
Last October, Facebook, Twitter and Google agreed to a voluntary code of conduct for their platforms in the European Union to limit the spread of misinformation. Critics say tougher laws and penalties are needed.
“We shouldn’t leave it to the platforms that created the problems to come up with the solutions,” said Marietje Schaake, a Dutch member of the European Parliament.
Researchers say disinformation tactics are changing alongside people’s digital habits, including the use of messaging platforms like WhatsApp. In Spain, Avaaz identified a campaign to spread false claims that Prime Minister Pedro Sánchez had agreed to Catalan independence. In Germany, Avaaz found dozens of racist and anti-immigration messages.
“The importance of Europe is it’s a test bed,” said Ben Nimmo, a senior fellow at the Atlantic Council’s Digital Forensic Research Lab who studies misinformation in Europe. “It’s really an indicator of the number of different ways people may be trying to meddle.”