February 29, 2024
After Prigozhin, Russia clamps down online
This is one chapter of the DFRLab’s report, Undermining Ukraine: How Russia widened its global information war in 2023. Read the rest here.
Throughout 2023, Russia continued its various crackdowns to prevent its citizens from being exposed to content the Kremlin perceived as undermining its war efforts. The most significant development occurred during the June 2023 Wagner mutiny, which appeared to come as a complete surprise to the Kremlin. On June 23, Wagner Group head Yevgeny Prigozhin declared war on the Russian Ministry of Defense in a post to Telegram, where he and the Wagner Group maintained a robust online presence. Prigozhin publicly touted his actions and aims via the messaging app over the course of several days, including a highly critical June 22 post claiming that Russia had failed to articulate its reasons for the war.
The Russian government struggled to limit the spread of Prigozhin’s messages. It tried to restrict information about Prigozhin on Russian social media and search engines during the crisis, eventually shutting access to websites linked to the Wagner Group. Despite Russian internet regulator Roskomnadzor blocking access to the affected internet resources, the websites continued to publish articles critical of the Ministry of Defense following the revolt, targeting Russian officials such as Defense Minister Sergei Shoigu. Soon after the failed revolt, Prigozhin dissolved his Patriot Media Group, with independent Russian media reporting that the Kremlin was looking for a new owner for the media assets.
On Telegram, Russian pro-war channels were somewhat divided in their support to the Russian government and Wagner. A DFRLab analysis of pro-war channels found that a majority of them were consistent in their sentiment, regardless of whether they supported or opposed the revolt or tried to foster unity between both sides. In other instances, Telegram channels wavered over who to back or how to react, leaving them more or less adrift until it was clear that Prigozhin’s mutiny had failed.
Russian state-controlled media reacted to the mutiny in two phases, first attempting to discredit Prigozhin, and then shifting to not mentioning him in their news coverage. Kremlin channels showed footage reportedly displaying Russian special forces raiding Prigozhin’s villa and office, discovering piles of cash, weapons, a helicopter, and falsified passports. State media coverage also brought up his criminal history and implied that he was motivated by greed, a distinct change from generally fawning coverage prior to the mutiny; for example, Kremlin propagandists including Vladimir Solovyov previously praised Prigozhin and participated in Wagner recruitment videos.
Erasing Prigozhin
After a period of media coverage discrediting Prigozhin, the Kremlin attempted to erase him from collective memory. According to an examination of Russian TV transcripts by the nonprofit GDELT Project and the New York Times, “Prigozhin virtually disappeared from the airwaves. On most days between July 13 and Aug. 22, his name was not mentioned at all on any of the four leading state-controlled channels.” The same news report noted that following Prigozhin’s death in a plane crash, Russia’s power elite competed over his assets. The assets included the paramilitary group as well as his media empire, including the election-meddling “troll factory” in Saint Petersburg that played a significant role in Russia’s efforts to undermine democratic institutions globally.
Russia also continued to increase its efforts to censor and surveil domestically. For example, Roskomnadzor launched an internet surveillance system called Oculus that reportedly identifies content online that the Kremlin considers undesirable or unfavorable. According to the Russian outlet RIA Novosti, the system “recognizes images and symbols, given scenes and actions, and analyzes text in photos and videos” and detects “extremist themes, calls for massive illegal events, suicide, pro-drug content, LGBT propaganda,” among other topics. A massive Roskomnadzor data leak by the Belarusian activist group Cyberpartisans in November 2022 suggested that the agency was running a project named “Vepr,” which was tasked with determining the true identity of any internet user who is deemed to be spreading false information or engaging in illegal activity. The leak indicated that the agency was censoring anti-war social media posts and using a bot farm to spread official Russian narratives.
Another set of leaks investigated by Radio Free Europe/Radio Liberty showed that Russia and China had cooperated on censorship and internet control methods.
Roskomnadzor continued to block VPN services in 2023. In May of that year, VPN users received notification of a blockade of the OpenVPN protocol, which some VPN providers use. In July, Putin signed a law mandating that websites offering guidance on how to evade internet blocks in Russia be added to Roskomnadzor’s Unified Register of Prohibited Information, which allows authorities to block websites domestically.
Meanwhile, Russian independent outlet Holod reported that the Kremlin had instructed traditional and online Russian media to stop referring to Volodymyr Zelenskyy as Ukraine’s president. According to Holod, Kremlin officials asked outlets not to mention his official title and to use the phrase “Zelenskyy’s regime” when covering him. In 2022, similar instructions encouraged Russian media to minimize the damage done to the Kerch Bridge and portray the Russian army’s pullback from Kherson in a less negative light.
In the face of mounting casualties and a reluctant populace, the Kremlin also attempted to boost its fighting forces in Ukraine by digitizing conscription and creating an online system to punish individuals who ignore conscription notices sent to their Gosuslugi account, which Russians use to access public services. Authorities now have the right to suspend a person’s driving license and prohibit them from selling private property if they do not show up for service.
Exploiting online influencers
The Russian war in Ukraine has become a significant factor in cultural and political discourse around the world. Russian messaging has successfully leveraged divisions within Western society driven by skepticism, populist movements, isolationist politics, and demands for greater economic sovereignty. In numerous instances, political parties from the far right and far left that typically are on opposite sides of the ideological spectrum have found common cause with Putin’s demands for a peace agreement on terms favorable to Russia.
Along with populist leaders sympathetic to Russia, like Viktor Orban in Hungary, Marine Le Pen in France, and Sahra Wagenknecht in Germany, Russia successfully exploits so-called “useful idiots” in the West—intellectuals and influencers who downplay Russia’s regional ambitions while blaming the West and NATO expansion for causing the war.
Among the various trends throughout 2023 has been the surge in narratives favorable to Russia on X, formerly known as Twitter, which became a notable vector for Russian propaganda in the West following the purchase of the company by Elon Musk and a group of fellow investors. Numerous factors led to this shift, including massive staff reductions in Twitter’s trust and safety team, removal of state media labels for RT and other Kremlin-controlled channels, and an inversion of its “blue checkmark” verification system that now allows anyone to “verify” themselves and receive a checkmark for a monthly fee.
Blue checkmark policy change boosts Russian propaganda on X
X introduced the new system in April 2023. Dubbed X Premium, the program grants paying customers additional privileges such as higher algorithmic visibility and fewer restrictions on the number of tweets posted per day. X stated that the changes were designed to reduce fake news and untrustworthy accounts; in practice, however, researchers have documented numerous instances of X accounts with blue checkmarks amplifying pro-Kremlin narratives about Ukraine, reaching millions of users on the platform.
In one example uncovered by the DFRLab and BBC Verify, X Premium accounts amplified the Russian TikTok campaign accusing former Ukrainian Defense Minister Oleksii Reznikov of purchasing luxury goods. On July 18, 2023, a blue checkmark X account named @Resist_05 published a video of a French villa alongside claims that Reznikov had purchased it as a wedding present for his daughter for €7 million. The video garnered over 2.3 million views, 31,000 likes, and 18,000 retweets, despite featuring a fact-checking community note challenging the allegation. The villa narrative spread across X in multiple languages, posted on several occasions by other blue-checkmark accounts.
Screenshots of a blue checkmark account republishing false allegations that a former Ukrainian defense minister had allegedly purchased a villa in Cannes, France, for his daughter. The false allegation first surfaced on Russian TikTok accounts. (Source: @BPartisans/archive)
The DFRLab also identified at least two blue checkmark accounts that disseminated unsupported claims alleging that Latvia and Estonia had launched a large-scale drone attack against Russia, when the attack had originated in Ukraine. On the night of August 29, 2023, several Russian regions including Bryansk, Moscow, Ryazan, Kaluga, and Orlov were struck by drones, with Russian media reporting that Russian defense systems had intercepted most of the drones. The attack destroyed four Russian Il-76 transport aircraft at Pskov International Airport and struck a nearby oil depot.
Narratives subsequently emerged in Russian news outlets and on Telegram pointing fingers at Latvia and Estonia. Pro-Russia Telegram channels disseminated screenshots from Yandex Maps, displaying distances from the alleged launch locations in Estonia and Latvia. X Premium accounts @ElephantCivics and @MyLordBebo shared similar messages with another map graphic, claiming that the drones originated from beyond Lake Peipsi, which straddles the border between Estonia and Russia.
Screenshot of X Premium account @MyLordBebo disseminating unsupported claims that Estonia was to blame for August 2023 drone attacks on Russia. The drone attacks originated from Ukraine. (Source: @MyLordBebo/archive)
The BBC collected additional cases of X accounts with blue badges disseminating false and misleading information about Russia’s war in Ukraine. On June 26, 2023, some X Premium accounts claimed that Russian soldiers had discovered so-called “baby factories” in Ukraine where “young children are grown for child sex brothels and organ harvesting.”
In another example, “US Civil Defense News,” an X account with a blue badge, claimed that Ukrainian fighter jets had accidentally launched a missile attack on Kramatorsk, Ukraine, and hit military barracks housing foreign soldiers and mercenaries. The account claimed that the “casualties are still being counted and will be very hard due to NATO attempts to cover their troops in Ukraine!” In a subsequent thread, the same account shared an image purportedly from leaked Pentagon documents that supposedly confirmed the presence of NATO troops in Ukraine. In reality, a Russian rocket struck a pizza restaurant in Kramatorsk, resulting in the deaths of eleven people, including four children. There is no evidence to support the claim that Ukraine launched the missile, nor is there any indication that it struck military barracks housing NATO troops.
Related content
The Atlantic Council’s Digital Forensic Research Lab (DFRLab) has operationalized the study of disinformation by exposing falsehoods and fake news, documenting human rights abuses, and building digital resilience worldwide.
Image: Russia's President Vladimir Putin and Defense Minister Sergei Shoigu watch honor guards passing by after a wreath-laying ceremony marking Defender of the Fatherland Day in Moscow, February 23, 2024. Sputnik/Alexander Kazakov/Pool via REUTERS