Countering Russian misinformation, disinformation, malinformation (MDM) and influence involves more than content moderation, censoring, and the deplatforming of key individuals on digital platforms. This is especially true in Italy, given the large role that traditional media such as television plays in the Italian media landscape. This paper examines two specific Russian campaigns in Italy surrounding the war in Ukraine to demonstrate how responders can employ the techniques, tactics, and procedures (TTPs) outlined in the DISARM framework to effectively counter Russian MDM and influence with a cross-platform, whole of society approach.
Much of the discourse surrounding misinformation, disinformation, and malinformation (MDM) focuses on social media, but MDM extends far beyond online platforms. MDM campaigns use every propagation tool necessary to fabricate events through the lens of the storyteller (often a nation state), who uses political leaders, news pundits, or any other aligned, influential entities to push out their agenda to influence a demographic for strategic gain.
Influential MDM campaigns combine a number of techniques, tactics, and procedures (TTPS) that vary in scope and style. A series of combined cyber, social, political, and economic schemes can lead to larger military schemes that serve a larger aim, such as undermining democracy. MDM can be amplified with traditional forms of media—such as television, radio, and print—or any platform that has a large audience, reach, or following within specified cohorts or niches across civil society.
Considering the range of cross-platform TTPs used in campaigns, effective approaches to countering MDM should move beyond a sole focus on censoring foreign news outlets and deplatforming individuals on social media. Instead, counter-MDM responders should consider taking a “whole of society” approach to security operations in the MDM space in order to shift narratives in public dialogue, both online and offline. To achieve this, there are many tools and strategies that responders can consider, a selection of which will be detailed in this paper.
The Global Disinformation Index (GDI) reports that more than a third of recently evaluated Italian
online news sites fall into the high- or maximum-risk category of presenting disinformation to the
Italian public [
The GDI also suggests that many Italian publishers lack transparency in sources, financial
disclosures, and ownership. They report that “even the best-performing sites often fail to publish an
adequate code of ethics, disclose the author of an article, or clearly detail the ownership and financial
structure of the media outlet” [
In a 2020 Global Advisory Survey, Ipsos also found that “in the past five years, the overall trust
placed in online news websites and platforms by Italians has decreased by 19 percent, with 69 percent
of respondents claiming that ‘fake news’ is prevalent in the news and information provided by online
news websites and platforms” [
The DISARM foundation believes that the prevalence and influence of MDM in Italy can be
mitigated through appropriate intervention and application of recommended TTPs. Understanding
offensive strategies and employing defensive strategies mapped in the DISARM framework can help
counter the spread of MDM in Italy. We use two case studies to illustrate the use of this framework for
analysis and to wargame potential responses to targeted MDM campaigns; specifically, the denial of
Russian involvement in the Bucha massacre and allegations of US biological laboratories beneath the
Azovstal steel mill in Mariupol.
3. Russian Influence in the Italian Information Ecosystem
Winston Churchill famously referred to Italy as the “soft underbelly” of Europe while communicating
his strategic vision during WWII [
Indeed, the prevalence of Russian influence in the Italian information ecosystem has been well
documented. COPASIR (the Parliamentary Committee for the Security of the Republic), the Italian
parliamentary committee that oversees Italian intelligence, opened a probe in May 2022 to investigate
the use of Italian media outlets to propagate Russian MDM [
The alarming degree of Russian influence in Italy’s information ecosystem is exemplified by the
appearance of Russian Minister of Foreign Affairs, Sergey Lavrov, on the Italian television show
Zona Bianca [
First, he dismissed the notion that Ukrainian President Vlodomyr Zelensky’s Jewish heritage
undermines the Russian claim that Ukraine is run by Nazis. Stating that Zelensky’s Jewish heritage
“amounts to nothing,” Lavrov asserted that “Hitler, too was of Jewish origin” and that “all the worst
antisemites are Jewish” [
Another event that highlights the severity of Russian influence in Italian media occurred during a
prime time television show that was aired from Moscow’s Red Square on La7, an Italian television
channel [
As the above incidents demonstrate, Russian MDM and influence in Italy extend far beyond online
platforms and social media; these are also spread through traditional media, and, significantly,
national television. Foregrounding the extent of Russian presence in Italian television, Decode39, an
Italian geopolitical and analytic news outlet, has listed Russian state officials and influencers who
have appeared on Italian television, drawing on research from Matteo Pugliese, an Italian Institute for
International Political Studies Fellow [
It appears that Russian influence has had a measurable effect on Italian public opinion. The full extent
is unknown, but a study by the European Council of Foreign Relations found that only 56% of Italians
blame Russia for war in Ukraine, the lowest in the European Union [
Considering that Russian MDM and influence in the Italian information ecosystem involve traditional
media such as television in addition to online platforms and social media, an effective response should
take a cross-platform approach to MDM in Italy’s media landscape. A sole focus deplatforming social
media users will likely fail to address the issue with traditional media such as television and radio.
Further, censorship of media outlets that have operations across online and traditional media will
likely fail to significantly stem the tide of Russian MDM and influence: indeed, the EU banned
Sputnik and Russia Today (RT) in March 2022, yet Russian MDM and influence continue to spread
throughout the Italian information ecosystem [
To demonstrate the techniques, tactics, and procedures (TTPs) that responders can use to
counter Russian MDM and influence, we have analyzed two incidents (below), one surrounding the
Bucha massacre and the other surrounding the alleged US biological laboratories underneath the
Azovstal steel mill in Mariupol, Ukraine. For both incidents, we used the DISARM framework to map
out a selection of the TTPs used by the incident creators in their MDM and influence campaigns, and
the tools that can be used by responders to counter these incidents. These responder TTPs provide a
broader spectrum of possible response than deplatforming, content moderation, and censorship, which
can enable responders to respond more fully and effectively to Russian MDM and influence that spans
multiple forms of media.
6. Incident 1: Disinformation Denying the Bucha Massacre
A major talking point of Lavrov on Zona Bianca was the accusation that the Ukranians staged the
Bucha Massacre. These claims have been advanced by the official channels of the Russian Ministry of
Defense and the Twitter page of the Russian Ministry of Foreign Affairs [
The Institute of Strategic Dialogue conducted a study that identified the top 10 Facebook posts concerning Bucha in 20 countries [25]. The study found that “8 of the 10 most shared posts” that mentioned Bucha in the Italian information ecosystem were pro-Kremlin, the highest out of all the 20 countries it surveyed [26]. The study also found that these 8 posts “had either originated from the official Facebook page of Italian war reporter Toni Capuozzo or mentioned a controversial interpretation of the events by Capuozzo”: Capuzzo claimed that the fact that photos of the massacre appeared in the media after the Russian troops withdrew suggests that the Ukranians rather than Russians might be responsible for certain deaths [27]. Capuozzo also alleged inconsistencies between photographs and people’s account of the massacre, noting that blood was not in the streets and that the mayor of Bucha did not mention the bodies in a video that was released after the Russian troops withdrew [28].
Below, we provide an overview of the TTPs displayed by the incident creators in this campaign, as well as TTPs that can be used by responders to counter this campaign. These “red” and “blue” TTPs are drawn from the open source DISARM framework [29].
The DISARM incident creator TTPs outlined below align with aspects of this specific incident. A claim was made by Lavrov on Italian television (T0002, T0111, T0111.001) and the Russian Ministry of Defense and Ministry of Foreign Affairs (T0110), one which dismissed the credibility of the Bucha massacre (T0075, T0075.001, T0004, T0068, T0023). This claim was then picked up by an influential Italian war reporter (T0039, T0100, T0100.001, T0100.003) and echoed across social media platforms (T0104).
DISARM also outlines a wide range of TTPs that responders can use to counter this MDM and influence. These TTPs that extend far beyond censoring and deplatforming individuals. Several of these TTPs seek to strengthen the media environment more broadly, such as coalition building with stakeholders and third party inducements (C00161). Others target the narrative directly, such as developing a compelling counter narrative, one that is truth based (C00030). Others target specific individuals, such as training newsrooms and journalists to counter influence moves (C00188) and naming and shaming influencers who spread disinformation (C00048).
A robust response to the Bucha massacre would ideally employ a variety of these methods. The following provide examples of responder TTPs in the context of this specific incident: forming an Italian MDM-focused Information Sharing and Analysis Center (C00161); advancing the narrative that the Bucha massacre plays into a long history of Russian atrocities by using hard evidence (C00030); creating incentives (financial, social) for broadcasters on national television to undergo courses that train them to identify and counter instances of MDM (C00188); and creating a campaign that publically identifies Capuozzo as the culprit of disinformation and strongly denounces his actions (C00048) . 7. Incident 2: Disinformation Alleging US Biological Laboratories
A graphic depicting alleged US biological laboratories beneath Azovstal steelworks, which served as Ukraine’s last stand in Mariupol, was distributed by multiple Italian national television programmes, including “Porta a Porta,” RAI 1’s flagship programme, as well as Rete4 and La7 [30]. This photo appears to have been originally disseminated by Serhei Markov, political scientist and advisor to Vladimir Putin [31].
This photo is not a real depiction of the Mariupol steel mill, but a rendering of a bunker from “GURPS” (Generic Universal Roleplaying System), a role playing game developed in the 1970s and 80s [32]. This particular reference is related to a zombie fan fiction called the “Morrow Project,” which takes place after a “devastating nuclear war” set in 1989 [33]. The latest edition of this game was released in December of 2013 [34].
The allegation of US biological laboratories draws upon a recurring conspiracy theory that goes back at least as far as the 1980s, namely, that the US created AIDs in a laboratory [35]. The AIDs conspiracy is part of a Russian operation known as “Operation Infektion,” which appears to have aimed to sow distrust among citizens of the US and its allies by discrediting the intentions of the US government [36-37].
Here, the methods used by the incident creators span a range of TTPs that are outlined in the DISARM framework. The fact that the image was originally circulated by a Putin aide demonstrates that the incident creators originally facilitated state propaganda (T002); in particular, propaganda that distorts the true nature of the event (T0076) in a capacity that can distract from the perception that the last stand at the Mariupol steel plant is a heroic occurrence (T0077).
This campaign leverages existing conspiracy narratives and suspicions surrounding the US using biological laboratories to create bioweapons (T0081.004, T0003). In doing so, Russian actors amplified an existing conspiracy theory narrative (T0022.002) while simultaneously developing an original iteration of this narrative (T0022.002) that responded specifically to a breaking news event and active crisis at the time (T0068), which is the Ukrainians last stand in Mariupol.
The incident creators also reused existing content (T0084), that is, the image from the GURPS game, and deceptively labeled it (T0084.003) in order to appropriate it as evidence for their narrative (T0084.04). This artifact, which was originally circulated by a Putin aide, eventually found its way onto Italian national television, which is a form of traditional media (T0114.002, T0117).
Responders can employ a range of methods to counter this campaign. For example, they can engage the payload directly and debunk it, propagating evidence that the image originates in a fantastical game (C00119). They can also repurpose the image with new text (C00118), for example, creating a meme that labels it with its original source. Responders can also engage a respected influencer to disavow this campaign (C00200), an individual who has broad influence in Italian society. See Table 2 on the following page for an overview of incident creator TTPs observed in this campaign and a range of recommended responder TTPs. 8.A Cross-Platform, Whole of Society Approach to Countering Russian
This paper demonstrates a) how cross-platform vectors of attack can be used by incident creators in MDM campaigns and b) how the DISARM framework can serve as a bridge between analysis and response by mapping connections between incident creator and responder TTPs. Future research can document and measure the effectiveness of the response measures detailed above against various campaigns.
In both incidents, content quickly moves across platforms, with false claims advanced by Russian state officials spreading throughout both social media and traditional media. An effective response should accordingly move beyond platforms, focusing on a range of both long-term and short-term initiatives targeting individual people, individual communities, individual campaigns, as well as the broader media environment.
Despite the scope and severity of Russian MDM and influence, the techniques outlined in the DISARM framework can empower incident responders to take concrete steps toward countering Russian MDM and influence. Amid the largest armed conflict in Europe since WWII, Italy can build resilience to Russian MDM and influence by methodically mapping incident creator TTPs and undertaking TTPs in response across a range of platforms.
A special thanks to Decode39 for exposing the MDM campaigns that serve as a basis for our analysis. 10. References [26] [27] [28] [29] [30] [31] [32] [33] [34] [35]