The Baltic Word uses unverifiable online personas to publish op-eds hostile toward NATO’s presence in the Baltic region

By Nika Aleksejeva

Kremlin-owned media outlets like Baltnews and Sputnik, along with Kremlin-affiliated outlets Riafan.ru, Ekonomika Segodnya, and Fondsk.ru, recently started to amplify fringe disinformation outlet The Baltic Word, which has previously been linked to the cyber-enabled influence operation known as Operation Ghostwriter.

The Baltic Word publishes articles by anonymous online personas with Latvian and Lithuanian sounding names. These articles are usually hostile toward NATO and critical of the Baltic state governments. The articles are then usually amplified on other self-publishing platforms like OpEdNews and The Duran. Kremlin media — both owned and affiliated — have recently started citing The Baltic Word’s articles as if they were legitimate Western media. The DFRLab previously analyzed the English-language disinformation outlet in 2019 and 2020.

This appears to be a change in the Kremlin’s strategy toward targeting the Baltic states with hostile information. In 2019, The Baltic Word targeted an English-speaking audience and had little pick-up among Russian-language outlets. Since 2020, though, Kremlin media outlets have adapted its stories for their Russian-speaking audiences, granting some legitimacy to an entity that would otherwise be considered fringe.

Cybersecurity firm FireEye published a report on July 29, 2020 in which it explained how The Baltic Word was involved in Operation Ghostwriter. According to FireEye, Ghostwriter entailed:

“…website compromises or spoofed email accounts to disseminate fabricated content, including falsified news articles, quotes, correspondence and other documents designed to appear as coming from military officials and political figures in the target countries. This falsified content has been referenced as source material in articles and op-eds authored by at least 14 inauthentic personas posing as locals, journalists, and analysts within those countries. These articles and op-eds, primarily written in English, have been consistently published to a core set of third-party websites that appear to accept user-submitted content, most notably OpEdNews.com, BalticWord.com, and the pro-Russian site TheDuran.com, among others, as well as to suspected Ghostwriter-affiliated blogs.” [emphasis added]

Promoting anti-NATO sentiment

The DFRLab identified 25 stories on Kremlin-owned and pro-Kremlin media outlets that mentioned the keywords “The Baltic Word” in the titles or bodies of the articles. The mentions were usually references to articles published in The Baltic Word. Seven of the 25 articles used by Kremlin media focused on how Lithuania or other Baltic states are spending unnecessarily on defense.

For example, in a story based on the European Commission’s Country Report Lithuania 2020, the author, “Adomas Abromaitis,” wrote “Lithuania made slow progress on implementing social and economic reforms to ensure that growth benefits all of society.” At the end of the article, he added: “Given this background, the Lithuanian government continues to increase defense funding annually. Huge amounts are spent on improving military infrastructure.” Baltnews Lithuania and Fondsk.ru translated and adapted the article, citing The Baltic Word and Abromaitis. The DFRLab previously covered Abromaitis, an unverified online persona whose name has appeared on articles on multiple fringe websites.

The second most prevalent theme amplified by Kremlin media, which was found in five stories, was that NATO membership is dangerous for the Baltic states; in fact, The Baltic Word published an April 2021 article with the on-the-nose title, “Why NATO is dangerous for the Baltic states.” Riafan.ru and Baltnews Lithuania, among others, amplified the story on May 6, 2021, both incorporating verbatim language, “The United States is committed to rebuilding and mobilizing NATO. This requires an external enemy,” in their stories’ introductions.

The third most popular theme, encompassing four stories, was that NATO is not united. For instance, The Baltic Word questioned the loyalty of the United States to the organization by asking, “How will the Baltic States survive without US help?” They also suggested, that Poland would use the opportunity to “merge” with Lithuania, stating “ Polish authorities are interested in a state of affairs in which weaker European states depend on stronger countries, such as Poland.”

Amplification by the same outlets

In most of the cases, The Baltic Word was amplified by Baltnews Lithuania and, in one case, Baltnews Latvia, media outlets known to be owned by the Kremlin. Four out of the 13 cited Baltic Word articles in 2021 were cited by RIA Fan, while Ekonomika Segodnya and Fondsk.ru cited three apiece. These outlets are believed to be run from the Internet Research Agency, the St. Peterburg troll farm associated with Putin ally Yevgeny Prigozhin. Kremlin-owned Sputnik in Estonia, Lithuania, and Belarus, as well as mainstream pro-Kremlin outlet Rambler, were also among serial amplifiers of The Baltic Word’s articles.

Notably, in many of the cases, Baltnews Lithuania was the first outlet to cite a Baltic Word story, often followed by other Kremlin-owned or pro-Kremlin outlets within 48 hours. This pattern appeared in eight out of 13 stories in 2021 that the DFRLab identified and analyzed.

Creating unique content

Baltnews Lithuania and other pro-Kremlin outlets that cited the same Baltic Word story did not always copy each other verbatim. In half of the analyzed cases articles were unique though published on the same day. For instance, seven pro-Kremlin and Kremlin-owned outlets adapted The Baltic Word’s story about the Baltic states being among the top countries that spend over 2 percent of their GDP for military purposes. Only Rambler and Slovo I Delo had verbatim titles. All the other outlets had unique titles and unique article text.

Despite referencing the same Baltic Word story, the stories on the fringe Russian-language outlets all featured unique composition and unique authors, so this is not a case of identically written stories being spread across multiple websites to gain more prevalence.

That said, there was also no information about the authors’ identities on any of the websites, and the DFRLab could not draw any further conclusions about the authors’ real identities based on open-source information, indicating the possible use of pseudonyms.

Added legitimacy

The Kremlin outlets also used legitimizing attributions to cite The Baltic Word. For instance, Riafan.ru used the phrase“Baltic analysts” to cite a story about military spending in the Baltic states. I Reactor used the “Baltic media outlet” to describe The Baltic Word. Fondsk.ru, in turn, used “the media outlet from the European Union” as a mean to describe The Baltic Word.

This strategy of repackaging unsupported or exaggerated stories from outlets that push disinformation in a different language shows a more sophisticated approach to amplification and legitimization of The Baltic Word, as it had previously lacked any presence within the Russian-language media landscape. By using a “news” item based on an English-language media outlet that Russian speakers may be unfamiliar with — but which nonetheless has ties to the Russian government — Kremlin-owned and Kremlin-aligned media outlets are giving The Baltic Word an added veneer of legitimacy in the eyes of their Russian-language audience.

Nika Aleksejeva is a Research Associate, Baltics, with the Digital Forensic Research Lab.

Cite this case study:

Nika Aleksejeva, “Kremlin media legitimize Operation Ghostwriter outlet smearing NATO in the Baltic states,” Digital Forensic Research Lab (DFRLab), August 9, 2021, https://medium.com/dfrlab/kremlin-media-legitimize-operation-ghostwriter-outlet-smearing-nato-in-the-baltic-states-2d175d8a4d8.

Follow along for more in-depth analysis from our #DigitalSherlocks.