Countering Russian Misinformation, Disinformation, Malinformation and Influence Campaigns in Italy Surrounding the Russian Invasion of Ukraine Max Lesser 1, Hallie J. Stern 1 and Sara J. Terp 1 1 DISARM Foundation Abstract Countering Russian misinformation, disinformation, malinformation (MDM) and influence involves more than content moderation, censoring, and the deplatforming of key individuals on digital platforms. This is especially true in Italy, given the large role that traditional media such as television plays in the Italian media landscape. This paper examines two specific Russian campaigns in Italy surrounding the war in Ukraine to demonstrate how responders can employ the techniques, tactics, and procedures (TTPs) outlined in the DISARM framework to effectively counter Russian MDM and influence with a cross-platform, whole of society approach. Keywords 1 Disinformation, Counter-Disinformation, DISARM, Russia, Italy, Ukraine 1. Misinformation, Disinformation, and Malinformation Extend Beyond Social Media Platforms Much of the discourse surrounding misinformation, disinformation, and malinformation (MDM) focuses on social media, but MDM extends far beyond online platforms. MDM campaigns use every propagation tool necessary to fabricate events through the lens of the storyteller (often a nation state), who uses political leaders, news pundits, or any other aligned, influential entities to push out their agenda to influence a demographic for strategic gain. Influential MDM campaigns combine a number of techniques, tactics, and procedures (TTPS) that vary in scope and style. A series of combined cyber, social, political, and economic schemes can lead to larger military schemes that serve a larger aim, such as undermining democracy. MDM can be amplified with traditional forms of media—such as television, radio, and print—or any platform that has a large audience, reach, or following within specified cohorts or niches across civil society. Considering the range of cross-platform TTPs used in campaigns, effective approaches to countering MDM should move beyond a sole focus on censoring foreign news outlets and deplatforming individuals on social media. Instead, counter-MDM responders should consider taking a “whole of society” approach to security operations in the MDM space in order to shift narratives in public dialogue, both online and offline. To achieve this, there are many tools and strategies that responders can consider, a selection of which will be detailed in this paper. 1 IFDaD 2022 INTERNATIONAL FORUM on DIGITAL and DEMOCRACY, November 17-18, 2022, live and digital event in Rome, Italy EMAIL: max.lesser@disarm.foundation (A. 1) disarm.foundation ©️ 2022 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). CEUR Workshop Proceedings (CEUR-WS.org) 2. MDM and the Italian Media Environment The Global Disinformation Index (GDI) reports that more than a third of recently evaluated Italian online news sites fall into the high- or maximum-risk category of presenting disinformation to the Italian public [1]. GDI states that many of Italy’s media platforms publish sensational or otherwise biased content in order to generate views and clicks, rather than inform, while negatively targeting individuals, and groups, as well as various organizations and nation state leaders [2]. The GDI also suggests that many Italian publishers lack transparency in sources, financial disclosures, and ownership. They report that “even the best-performing sites often fail to publish an adequate code of ethics, disclose the author of an article, or clearly detail the ownership and financial structure of the media outlet” [3]. This lack of transparency and non-adherence to editorial principles and practices creates a media environment in which disinformation can thrive. In a 2020 Global Advisory Survey, Ipsos also found that “in the past five years, the overall trust placed in online news websites and platforms by Italians has decreased by 19 percent, with 69 percent of respondents claiming that ‘fake news’ is prevalent in the news and information provided by online news websites and platforms” [4]. These factors suggest that Italian citizens are aware of the prevalence of MDM in their information ecosystem. The DISARM foundation believes that the prevalence and influence of MDM in Italy can be mitigated through appropriate intervention and application of recommended TTPs. Understanding offensive strategies and employing defensive strategies mapped in the DISARM framework can help counter the spread of MDM in Italy. We use two case studies to illustrate the use of this framework for analysis and to wargame potential responses to targeted MDM campaigns; specifically, the denial of Russian involvement in the Bucha massacre and allegations of US biological laboratories beneath the Azovstal steel mill in Mariupol. 3. Russian Influence in the Italian Information Ecosystem Winston Churchill famously referred to Italy as the “soft underbelly” of Europe while communicating his strategic vision during WWII [5]. Today, this term has been appropriated to convey Italy’s susceptibility to Russian influence [6]. Indeed, the prevalence of Russian influence in the Italian information ecosystem has been well documented. COPASIR (the Parliamentary Committee for the Security of the Republic), the Italian parliamentary committee that oversees Italian intelligence, opened a probe in May 2022 to investigate the use of Italian media outlets to propagate Russian MDM [7]. Adolfo Urso, COPASIR’s President, confirmed that 13,831 documented instances of MDM have entered Italy’s information ecosystem since 2014 [8]. More instances are likely undocumented. The alarming degree of Russian influence in Italy’s information ecosystem is exemplified by the appearance of Russian Minister of Foreign Affairs, Sergey Lavrov, on the Italian television show Zona Bianca [9]. Here, Lavrov advanced claims that elicited widespread controversy. First, he dismissed the notion that Ukrainian President Vlodomyr Zelensky’s Jewish heritage undermines the Russian claim that Ukraine is run by Nazis. Stating that Zelensky’s Jewish heritage “amounts to nothing,” Lavrov asserted that “Hitler, too was of Jewish origin” and that “all the worst antisemites are Jewish” [10]. Lavrov also denied Russian responsibility for the Bucha massacre in this interview, claiming that the Ukranians staged the massacre [11]. Lavrov appeared to be received warmly by the presenter of the program, who refrained from pushing back on Lavrov’s assertions, closing the interview by wishing Lavrov “good luck with your work” [12]. Another event that highlights the severity of Russian influence in Italian media occurred during a prime time television show that was aired from Moscow’s Red Square on La7, an Italian television channel [13]. This event featured Maria Zakharova, Director of the Information and Press Department of the Russian Ministry of Foreign Affairs, and Vladimir Solovyov, a popular Russian radio and television presenter [14]. Both have been known to make false claims that appear to advance the Kremlin’s interest, such that Russia did not start the war in Ukraine and that the Pentagon is developing biological weapons [15-16]. As the above incidents demonstrate, Russian MDM and influence in Italy extend far beyond online platforms and social media; these are also spread through traditional media, and, significantly, national television. Foregrounding the extent of Russian presence in Italian television, Decode39, an Italian geopolitical and analytic news outlet, has listed Russian state officials and influencers who have appeared on Italian television, drawing on research from Matteo Pugliese, an Italian Institute for International Political Studies Fellow [17-18]. This research documents 12 Russians advancing Kremlin talking points—including government officials, idealogues, and media personalities—who were hosted on Rete4 and 8 who were hosted on La7, both of which are private networks, and 1 who was hosted on state broadcaster RAI [19]. 4. The Effects of Russian Influence on Italian Public Opinion It appears that Russian influence has had a measurable effect on Italian public opinion. The full extent is unknown, but a study by the European Council of Foreign Relations found that only 56% of Italians blame Russia for war in Ukraine, the lowest in the European Union [20]. This same study found that Italy is nearly evenly split over “which country constitutes the biggest obstacle to peace between Russia and Ukraine,” with 39% saying that Russia is the biggest obstacle and 35% saying Ukraine [21]. Similarly, a “Flash Eurobarometer Survey” performed by the European Commission found that only 39% of Italians think Russian authorities are responsible for invasion of Ukraine [22]. 5. Countering Russian MDM and Influence in Italian Information Ecosystem: Moving Beyond Deplatforming, Content Moderation, and Censorship Considering that Russian MDM and influence in the Italian information ecosystem involve traditional media such as television in addition to online platforms and social media, an effective response should take a cross-platform approach to MDM in Italy’s media landscape. A sole focus deplatforming social media users will likely fail to address the issue with traditional media such as television and radio. Further, censorship of media outlets that have operations across online and traditional media will likely fail to significantly stem the tide of Russian MDM and influence: indeed, the EU banned Sputnik and Russia Today (RT) in March 2022, yet Russian MDM and influence continue to spread throughout the Italian information ecosystem [23]. To demonstrate the techniques, tactics, and procedures (TTPs) that responders can use to counter Russian MDM and influence, we have analyzed two incidents (below), one surrounding the Bucha massacre and the other surrounding the alleged US biological laboratories underneath the Azovstal steel mill in Mariupol, Ukraine. For both incidents, we used the DISARM framework to map out a selection of the TTPs used by the incident creators in their MDM and influence campaigns, and the tools that can be used by responders to counter these incidents. These responder TTPs provide a broader spectrum of possible response than deplatforming, content moderation, and censorship, which can enable responders to respond more fully and effectively to Russian MDM and influence that spans multiple forms of media. 6. Incident 1: Disinformation Denying the Bucha Massacre A major talking point of Lavrov on Zona Bianca was the accusation that the Ukranians staged the Bucha Massacre. These claims have been advanced by the official channels of the Russian Ministry of Defense and the Twitter page of the Russian Ministry of Foreign Affairs [24]. The Institute of Strategic Dialogue conducted a study that identified the top 10 Facebook posts concerning Bucha in 20 countries [25]. The study found that “8 of the 10 most shared posts” that mentioned Bucha in the Italian information ecosystem were pro-Kremlin, the highest out of all the 20 countries it surveyed [26]. The study also found that these 8 posts “had either originated from the official Facebook page of Italian war reporter Toni Capuozzo or mentioned a controversial interpretation of the events by Capuozzo”: Capuzzo claimed that the fact that photos of the massacre appeared in the media after the Russian troops withdrew suggests that the Ukranians rather than Russians might be responsible for certain deaths [27]. Capuozzo also alleged inconsistencies between photographs and people’s account of the massacre, noting that blood was not in the streets and that the mayor of Bucha did not mention the bodies in a video that was released after the Russian troops withdrew [28]. Below, we provide an overview of the TTPs displayed by the incident creators in this campaign, as well as TTPs that can be used by responders to counter this campaign. These “red” and “blue” TTPs are drawn from the open source DISARM framework [29]. The DISARM incident creator TTPs outlined below align with aspects of this specific incident. A claim was made by Lavrov on Italian television (T0002, T0111, T0111.001) and the Russian Ministry of Defense and Ministry of Foreign Affairs (T0110), one which dismissed the credibility of the Bucha massacre (T0075, T0075.001, T0004, T0068, T0023). This claim was then picked up by an influential Italian war reporter (T0039, T0100, T0100.001, T0100.003) and echoed across social media platforms (T0104). DISARM also outlines a wide range of TTPs that responders can use to counter this MDM and influence. These TTPs that extend far beyond censoring and deplatforming individuals. Several of these TTPs seek to strengthen the media environment more broadly, such as coalition building with stakeholders and third party inducements (C00161). Others target the narrative directly, such as developing a compelling counter narrative, one that is truth based (C00030). Others target specific individuals, such as training newsrooms and journalists to counter influence moves (C00188) and naming and shaming influencers who spread disinformation (C00048). A robust response to the Bucha massacre would ideally employ a variety of these methods. The following provide examples of responder TTPs in the context of this specific incident: forming an Italian MDM-focused Information Sharing and Analysis Center (C00161); advancing the narrative that the Bucha massacre plays into a long history of Russian atrocities by using hard evidence (C00030); creating incentives (financial, social) for broadcasters on national television to undergo courses that train them to identify and counter instances of MDM (C00188); and creating a campaign that publically identifies Capuozzo as the culprit of disinformation and strongly denounces his actions (C00048) . Table 1 Disinformation Denying the Bucha Massacre Through the Lense of the DISARM Framework Incident Creator TTPs Responder TTPs TAO2: Plan Objectives TA01: Plan Strategy T0002: Facilitate C00190: Open Engagement with Civil Society State Propaganda C00174: Create a Healthier News Environment T0075: Dismiss C00161: Coalition Building with Stakeholders T0075.001: Discredit and third-party inducements Credible Sources TA02: Plan Objectives TA14: Develop Narratives C00030: Develop a compelling counter narrative T0068: Respond to (truth based) Breaking News Event C00031: Dilute the core narrative - create or Active Crisis multiple permutations, target/amplify T0004: Develop TA05: Micro Target Competing Narratives C00065: Reduce political targeting TA06: Develop Content C00178: Fill information voids with T0023: Distort facts non-disinformation content TA08: Conduct Pump Priming C00130: Mentorship: elders, youth, credit. Learn T0039: Bait legitimate vicariously. influencers TA06: Develop Content TA16: Establish Legitimacy C00014: Real-time updates to fact-checking T0100: Co-opt trusted database sources C00094: Force full disclosure on corporate T0100.001: Co-Opt sponsor of research Trusted Individuals TA07: Select Channels and Affordances T0100.003 Co-opt C00099: Strengthen verification methods Influencers TA08: Conduct Pump Priming TA07: Select Channels and C00154: Ask media not to report false Affordances information T0104: Social C00188: Newsroom/Journalist training to Networks counter influence moves T0110: Formal C00113: Debunk and defuse a fake expert / Diplomatic Channels credentials T0111: Traditional TA09: Deliver Content Media C00200: Respected figure (influencer) disavows T0111.001: TV misinfo C00125: Prebunking TA11: Persist in the Information Environment C00138: Spam domestic actors with lawsuits (ie. defamation) TA15: Establish Social Assets C00062: Free open library sources worldwide C00203: Stop offering press credentials to propaganda outlets" C00036: Infiltrate the in-group to discredit leaders (divide) C00048: Name and Shame Influencers 7. Incident 2: Disinformation Alleging US Biological Laboratories Underneath Azovstal Steelworks A graphic depicting alleged US biological laboratories beneath Azovstal steelworks, which served as Ukraine’s last stand in Mariupol, was distributed by multiple Italian national television programmes, including “Porta a Porta,” RAI 1’s flagship programme, as well as Rete4 and La7 [30]. This photo appears to have been originally disseminated by Serhei Markov, political scientist and advisor to Vladimir Putin [31]. This photo is not a real depiction of the Mariupol steel mill, but a rendering of a bunker from “GURPS” (Generic Universal Roleplaying System), a role playing game developed in the 1970s and 80s [32]. This particular reference is related to a zombie fan fiction called the “Morrow Project,” which takes place after a “devastating nuclear war” set in 1989 [33]. The latest edition of this game was released in December of 2013 [34]. Figure 1: Image of alleged US Biolab beneath Mariupol Steel Mill, which is actually a graphic from an apocalyptic board game. Source: “Kremlin on Air. Putin’s propaganda soars in Italy,” Source: Decode39. The allegation of US biological laboratories draws upon a recurring conspiracy theory that goes back at least as far as the 1980s, namely, that the US created AIDs in a laboratory [35]. The AIDs conspiracy is part of a Russian operation known as “Operation Infektion,” which appears to have aimed to sow distrust among citizens of the US and its allies by discrediting the intentions of the US government [36-37]. Here, the methods used by the incident creators span a range of TTPs that are outlined in the DISARM framework. The fact that the image was originally circulated by a Putin aide demonstrates that the incident creators originally facilitated state propaganda (T002); in particular, propaganda that distorts the true nature of the event (T0076) in a capacity that can distract from the perception that the last stand at the Mariupol steel plant is a heroic occurrence (T0077). This campaign leverages existing conspiracy narratives and suspicions surrounding the US using biological laboratories to create bioweapons (T0081.004, T0003). In doing so, Russian actors amplified an existing conspiracy theory narrative (T0022.002) while simultaneously developing an original iteration of this narrative (T0022.002) that responded specifically to a breaking news event and active crisis at the time (T0068), which is the Ukrainians last stand in Mariupol. The incident creators also reused existing content (T0084), that is, the image from the GURPS game, and deceptively labeled it (T0084.003) in order to appropriate it as evidence for their narrative (T0084.04). This artifact, which was originally circulated by a Putin aide, eventually found its way onto Italian national television, which is a form of traditional media (T0114.002, T0117). Responders can employ a range of methods to counter this campaign. For example, they can engage the payload directly and debunk it, propagating evidence that the image originates in a fantastical game (C00119). They can also repurpose the image with new text (C00118), for example, creating a meme that labels it with its original source. Responders can also engage a respected influencer to disavow this campaign (C00200), an individual who has broad influence in Italian society. See Table 2 on the following page for an overview of incident creator TTPs observed in this campaign and a range of recommended responder TTPs. 8. A Cross-Platform, Whole of Society Approach to Countering Russian MDM and Influence in Italy This paper demonstrates a) how cross-platform vectors of attack can be used by incident creators in MDM campaigns and b) how the DISARM framework can serve as a bridge between analysis and response by mapping connections between incident creator and responder TTPs. Future research can document and measure the effectiveness of the response measures detailed above against various campaigns. In both incidents, content quickly moves across platforms, with false claims advanced by Russian state officials spreading throughout both social media and traditional media. An effective response should accordingly move beyond platforms, focusing on a range of both long-term and short-term initiatives targeting individual people, individual communities, individual campaigns, as well as the broader media environment. Despite the scope and severity of Russian MDM and influence, the techniques outlined in the DISARM framework can empower incident responders to take concrete steps toward countering Russian MDM and influence. Amid the largest armed conflict in Europe since WWII, Italy can build resilience to Russian MDM and influence by methodically mapping incident creator TTPs and undertaking TTPs in response across a range of platforms. Table 2 Disinformation Alleging US Biological Laboratories Underneath Azovstal Steelworks Through the Lense of the DISARM Framework Incident Creator TTPs Responder TTPs TAO2: Plan Objectives TA01: Plan Strategy T0002: Facilitate State C00190: Open Engagement with Civil Society Propaganda C00174: Create a Healthier News Environment T0076: Distort C00161: Coalition Building with Stakeholders and third-party T0077: Distract inducements TA13: Target Audience Analysis T0081.004: Identify Existing TA02: Plan Objectives Conspiracy C00030: Develop a compelling counter narrative (truth based) Narratives/Suspicions C00031: Dilute the core narrative - create multiple TA14: Develop Narratives permutations, target/amplify T0003: Leverage Existing TA05: Micro Target Narratives C00065: Reduce political targeting T0022.001: Amplify Existing C00178: Fill information voids with non-disinformation Conspiracy Theory Narratives content T0022.002: Develop Original C00130: Mentorship: elders, youth, credit. Learn vicariously. Conspiracy Theory Narratives T0068: Respond to Breaking TA06: Develop Content News Event or Active Crisis C00014: Real-time updates to fact-checking database TAO6: Develop Content C00094: Force full disclosure on corporate sponsor of T0084: Reuse Existing Content research T0084.003: Deceptively Labeled TA07: Select Channels and Affordances or Translated C00099: Strengthen verification methods T0084.004: Appropriate Content TA08: Conduct Pump Priming TA07: Select Channels and Affordances C00154: Ask media not to report false information T0111: Traditional Media C00188: Newsroom/Journalist training to counter influence T0111.001: TV TA09: Deliver Content moves T0114.002: Traditional Media C00113: Debunk and defuse a fake expert / credentials T0117: Attract Traditional Media TA09: Deliver Content C00200: Respected figure (influencer) disavows misinfo C00125: Prebunking TA11: Persist in the Information Environment C00138: Spam domestic actors with lawsuits (ie. defamation) TA15: Establish Social Assets C00062: Free open library sources worldwide C00203: Stop offering press credentials to propaganda outlets" C00036: Infiltrate the in-group to discredit leaders (divide) C00048: Name and Shame Influencers 9. Acknowledgements A special thanks to Decode39 for exposing the MDM campaigns that serve as a basis for our analysis. 10. References [1] M. Petrocchi, A. Spognardi., Disinformation Risk Assessment: The Online News Market in Italy, 2022. URL: www.disinformationindex.org. [2] Ibid. [3] Ibid. [4] Ipsos & the Trust Project, The Future of Trust in Media: Graphic Reference Report, 2020. URL: https://www.ipsos.com/sites/default/files/ct/publication/documents/2020-10/the-future-of-trust -in-media-graphic-reference-report.pdf.. [5] The Churchill Project 2016, Were “Soft Underbelly” and “Fortress Europe” Churchill Phrases? URL: https://winstonchurchill.hillsdale.edu/soft-underbelly-fortress-europe/. [6] R. Sanderson, Draghi Toughens Italy’s ‘Soft Underbelly’ Reputation, Washington Post, 2022.URL:https://www.washingtonpost.com/business/draghi-toughens-italys-soft-underbelly- reputation/2022/03/07/5aa4fe1e-9de4-11ec-9438-255709b6cddc_story.html. [7] The Local It, Italy launches investigation into Russian disinformation claims, 2022. URL: https://www.thelocal.it/20220513/italy-launches-investigation-into-russian-disinformation-cla ims/. [8] Decode39, Watch out, NATO: Russia is winning the disinfo war in Italy, 2022. URL: https://decode39.com/3318/russia-disinfo-italy/. [9] O. Lanzavecchia, Kremlin on air, part II: Lavrov’s freewheeling propaganda on Italian TV, 2022. URL: https://decode39.com/3272/lavrov-italian-tv/. [10] Ibid. [11]Ibid. [12] Ibid. [13] Decode39, Live from Moscow: Italian TV’s Lowest point (yet), 2022. URL: https://decode39.com/3545/live-moscow-italian-tv/. [14] Ibid. [15] DW Fact Check, Fact check: Russia falsely blames Ukraine for starting war, 2022. URL: https://learngerman.dw.com/en/fact-check-russia-falsely-blames-ukraine-for-starting-war/a-60 999948. [16] US Department of State, Faces of Kremlin Propaganda: Vladimir Solovyov, 2022. URL: https://www.state.gov/disarming-disinformation/faces-of-kremlin-propaganda/vladimir-solov yov/. [17] Decode39, Mapping the Kremlin’s propagandists on Italian TV, 2022. URL: https://decode39.com/3603/kremlin-propagandists-italian-tv/. [18] M. Pugliese. URL: https://twitter.com/MatteoPugliese/status/1536392735338397703. [19] Decode39. Mapping the Kremlin’s propagandists on Italian TV, 2022. URL: https://decode39.com/3603/kremlin-propagandists-italian-tv/. [20] I. Krastev, M. Leonard, Peace versus Justice: The coming European split over the war in Ukraine, 2022. URL: https://ecfr.eu/publication/peace-versus-justice-the-coming-european-split-over-the-war-in-uk raine/. [21] Ibid. [22] European Commission, Eurobarometer: Europeans approve EU’s response to the war in Ukraine, 2022. URL: https://ec.europa.eu/commission/presscorner/api/files/document/print/en/ip_22_2784/IP_22_2 784_EN.pdf. . [23] Council of the EU, EUimposes sanctions on state-owned outlets RT/Russia Today and Sputnnik’s broadcasting in the EU, 2022. URL: https://www.consilium.europa.eu/en/press/press-releases/2022/03/02/eu-imposes-sanctions-on -state-owned-outlets-rt-russia-today-and-sputnik-s-broadcasting-in-the-eu/. [24] New Atlanticist, Atlantic Council. Russian War Report: Kremlin claims Bucha massacre was staged by Ukraine, 2022. URL: https://www.atlanticcouncil.org/blogs/new-atlanticist/russian-war-report-kremlin-claims-buch a-massacre-was-staged-by-ukraine/. [25] Digital Dispatches, Institute for Strategic Dialogue, On Facebook, Content Denying Russian Atrocities in Bucha is More Popular than the Truth, 2022. URL: https://www.isdglobal.org/digital_dispatches/on-facebook-content-denying-russian-atrocities-i n-bucha-is-more-popular-than-the-truth/. [26] Ibid. [27] Ibid. [28] Ibid. [29] DISARM Framework. URL: https://disarmframework.herokuapp.com/. [30] Decode39, Kremlin on air. Putin’s propaganda soars in Italy, 2022. URL: https://decode39.com/3246/kremlin-on-air-putins-propaganda-soars-in-italy/. [31] Ibid. [32] GURPS Bunker. URL: https://www.pinterest.com/pin/715227984550823989/. [33] More about GURPS. URL: https://www.sjgames.com/gurps/details.html. [34] GURPS Morrow Project. URL: https://arrgh.weebly.com/gurps-morrow-project.html. [35] A. Ellick, and A. Westbrook, Disinformation Operation Infektion, 2018. URL: https://www.nytimes.com/2018/11/12/opinion/russia-meddling-disinformation-fake-news-elec tions.html. [36] A. Jeppsson, How East Germany Fabricated the Myth of HIV Being Man-Made, 2017. URL: https://journals.sagepub.com/doi/full/10.1177/2325957417724203. [37] P. Ratner, 38 years ago, a KGB defector chillingly predicted modern America, 2018. URL: https://bigthink.com/the-present/yuri-bezmenov/.