Russian Op 6: EU Elections

Forgeries and fake accounts targeted European politics

Russian Op 6: EU Elections

Share this story

Forgeries and fake accounts targeted European politics

(Source: @KaranKanishk/DFRLab)

This article is part of a series analyzing the various aspects of the suspected Russian intelligence operation. Our top post summarizes these findings.

Franco-German Cooperation, But Not as You Know It

Little of the Russian operation’s content was related to the European Parliament elections in May 2019: in general, the operation primarily promoted Russian foreign-policy narratives.

On May 21, however, users in French, German, and non-native English all posted articles claiming that “liberal forces” in the European Union (EU) had launched a “war against the right.” The articles were translations of one another, or of a common source, and were based on a screenshot of a letter allegedly written by Member of the European Parliament Anna Maria Corazza Bildt.

The French-language post by “Marc Perrot” on May 21 showing the letter attributed to Corazza Bildt. (Source:

The letter, in Swedish, called for “resolute and united” cooperation between European liberals and conservatives against the far right and praised the “well-organized work of the German media” against a far-right politician in that country. The three blogs each referred to the letter as a “desperate and oftentimes unlawful informational war […] being made against the forces that try to defend national interests of European countries.” (Wording from the English version.)

The blogs were all posted on the same day; the French and German versions appeared online just 27 minutes apart.

Timing is everything… Screenshots of the French (top) and German (bottom) versions of the article. The red boxes show the date and time of each post: May 21, 2019, at 10:43 and 11:10, respectively. (Source:, top;, bottom)

The original language of these articles was unclear. The English text, posted on Medium by a user account that never posted anything else, was riddled with language errors, raising the possibility that it was a translation from some other language, likely Russian. The article’s first sentence opened, “It became known earlier that…,” an unusual formulation in English, but common in Russian as “Ранее стало известно,” recently used in ledes by both TASS and Sputnik’s Russian service.

Here’s one we did earlier… The use of “Ранее стало известно” (“It became known earlier that”) by Sputnik (top) and TASS (bottom). (Source: Sputnik/archive, top; TASS/archive, bottom)

Other linguistic jewels included:

“Swedish politician Anna Maria Corazza Bildt believes that the current alignment of forces in the EP looks ‘scarily’.”

“Mrs Bildt recommends acting hard-line and holds to conducting information operations against most prominent representatives of the extreme rights.”

“To put it straight, nowadays, desperate and oftentimes unlawful informational war is being made against the forces that try to defend national interests of European countries. The time for information injections is chosen the way to deprive people of the opportunity to revolve it in the mind and to force them act basing solely on emotions.”

All three articles sourced the “letter” to a separate Medium post, dated May 16, and published by a user account called “Tom Welch.” As so often in this operation, the account only posted once and struggled with English. It did not provide a source for its “letter.” The likelihood is that the “letter” was a forgery created by the operation to provide ammunition for far-right forces in Europe ahead of the election.

The story failed to gain significant traction. A scan of the three articles using the online tool BuzzSumo showed that none was shared online.

BuzzSumo scan of the three articles, showing the lack of engagement. (Source: @EtoBuziashvili/DFRLab)

Attribution by Amplification

The use of burner accounts, specific platforms such as Medium and, multiple language variants, and Russian-flavored English all tie this story to the Russian operation. Two more factors reinforce the attribution.

The German version of the story was posted to an Austrian regional forum called by an account known as “Werner Holt from Steinfeld,” registered on April 24. Unusually, this was not the account’s only post.

On the day it was registered, the account published an allegation that the United States and Poland were conducting an “information war” against Germany. One Facebook user shared that article: an “Austrian nationalist” account that Facebook itself identified as part of the Russian operation.

Left, the article posted on Right, the share by the Russian-run Facebook account. (Source:, left; Facebook, right)

One Twitter account also promoted the “Holt” article: the account @KPrydius posted it 16 times, tagging politicians from Germany’s far-right AfD party. This appears to have been an attempt to flag the story to politicians who might raise a scandal about it; if so, it failed.

Some of the 16 shares by @KPrydius of the article, tagging AfD politicians. Translated from German: “Good day! People on the net are actively discussing an American-Polish information campaign against Germany. Have you already heard of that? Could you comment? Article on the subject:” (Source: @KPrydius/archive)

The @KPrydius Twitter account linked back to a Facebook asset with the same profile picture and similar name, that Facebook itself confirmed was part of the Russian operation. The Facebook account advertised the Twitter one; on another occasion, the Twitter account amplified a separate anti-immigrant story created by the Russian operation.

“Psst, follow me on Twitter.” The German is grammatically incorrect. (Source: Facebook)

It would be stretching credulity to suggest that this amplification by two different assets linked to the operation was a coincidence. The “Werner Holt” account appears to have been run by the operation but used to post two different stories, in defiance of the operators’ normal security measures.

The claim of an “informational war” against the far right in Europe was most likely an attempt at the time of the European Parliament election to provide ammunition for the European far right.

Follow along for more in-depth analysis from our #DigitalSherlocks.