Weaponized OSINT: The New Kremlin-Sponsored Participatory Propaganda

Image credit: Karyna Lazaruk.

‘Warfakes’ (“Война с фейками”) is the name of a popular Russian Telegram channel at the centre of an entire network of related channels that emerged in the opening days of the current Russian invasion of Ukraine. Along with its English language website Waronfakes. com, these channels present themselves as a network that debunks fake news, in a familiar style of fact-checking websites such as PolitiFact. They produce two dozen posts per day on average, where the techniques of open-source intelligence (OSINT) are often used to expose the supposed untruths in the media coverage of the war. These posts are circulated widely on Telegram as well as other social media networks, especially VKontakte. Warfakes represent a new type of disinformation that we refer to as participatory propaganda where users circulate weaponized OSINT, most notably including the Russian state operatives. Here’s how authors present themselves:

Welcome to the “War on Fakes” project. We are the owners and administrators of several Russian non-political telegram channels. We don’t do politics. But we consider it important to provide unbiased information about what is happening in Ukraine and on the territories of Donbas because we see signs of an information war launched against Russia. Our mission is to make sure that there are only objective publications in the information space. We do not want ordinary people to feel anxious and panicked because of information wars. We are going to look into every fake and give links to the real refutations. Be safe, be at peace, be with us.

Inside the Russian media bubble, debunking sites are just as likely, or even more likely, to ‘bunk’ news that is true as they are to debunk fake news. While this also happens frequently in broadcast television, Telegram is the most popular fake debunking medium, with the Warfakes channel with over 700k subscribers as its prime example. While the organization behind Warfakes is unknown, its content is systematically promoted by the Russian state via the Facebook pages of foreign embassies and other Kremlin-sponsored cultural institutions. A close reading of the channels reveals them to consistently promote a number of pro-Kremlin narratives under the guise of questioning sources and exposing apparent discrepancies in reporting.

Warfakes is the largest Russian Telegram channel in a whole genre of other channels that “debunk” war coverage. Compared to other social media, Telegram generally has a softer touch when it comes to censoring content—though this has begun to change recently. Telegram was developed by Pavel Durov after the Kremlin took over his previous social network VKontakte. Telegram’s servers are located in the Persian Gulf (after the KGB tried to take it over). Telegram has been referred to as a “dark corner” of the internet (Rogers) due to its light-touch approach to moderation. Ultimately, Telegram is a massive platform (with a user base of 400M, which is significantly more than Twitter’s 330 users, for example), which makes it hard to generalize as it supports all kinds of communities.

Image credit: Keulenaar & Kisje

On Telegram, there are multiple channels with similar names, descriptions, and content, which make up a Warfakes network. The channels appeared localized to audiences in specific regions including Ukraine and Belarus and many other smaller Russian-dominated cities and regions (such as Rostov, Belgorod, Cuban, annexed Crimea, Voronezh, Samara, Republic of Kalmykia, Kirov, Khabarovsk region, Zabaykalie, Bashkotorstan, Republic of Sakha). With the main Warfakes channel as its core, we identified similar channels as core clones. When listing these channels we noticed two prominent groups with the same date of creation: 26.02.2022 and 1.03.2022.

Three levels of fakeness

When conceptualizing participatory propaganda, the Warfakes Telegram network has 3 levels of fakeness.

A car driving down a road

The first level is rhetorical, where the site uses the rhetoric of fact-checking to identify ‘fake’ information that is usually not the misinformation. This technique is not unique to Warfakes. In fact, this is a popular format on Russian TV as well and was used in a program called ‘Antifake’ (Starr 2022) as well.1 On Warfakes, the typical rhetorical structure for ‘debunking’ is to flag news as fake and to then counter it with the (fake) truth, accompanied by an explanation and a visual. Since Telegram is a more participatory medium than TV, Warfakes propaganda has a participatory flavor. As such, the second level of fakeness is aesthetic. Much content on Warfakes has a specific “investigative aesthetic” (Weisman and Fuller 2021), where red circles are used to identify an image as a supposed deep fake, for example. On Warfakes, the vernacular term for using investigative aesthetics to debunk images is called “creo”.

As discussed by Eyal Weisman and Matthew Fuller, investigative aesthetics is a collective practice of using open sources to produce actionable intelligence. They describe investigative aesthetics as “scraps of information […] compiled into systems, including narrative structures, that allow for their cross-checking and public presentation”. Warfakes appropriates the authority of investigative aesthetics to manufacture misinformation. One of the most prominent “investigative aesthetics” operations, Bellingcat (currently based in Amsterdam & Berlin), involves a network of 60+ collaborators who have produced important intelligence in the last few years (the Russian involvement in the 2018 Skripal poisoning, for example). Judging from its style and high volume of posts, Warfakes looks like it is being produced by a decentralized network of open-source investigators. However, we simply do not know if this is the case. It could also be produced in a single office, such as Saint Petersburg’s infamous Internet Research Agency. Either way, one thing is clear; the content produced here promotes a pro-Kremin version of the war.

The third level of fakeness at work in the case of Warfakes is the narrative. Through a process of qualitative data analysis by trained coders, the top 8% of the most engaged with content (141 of a total of 1731 posts) of the Warfakes core channel were selected (from the 24th of February to the 20th of March 2022). A close reading revealed nine narratives:

Denial of war crimes: against civilians and civilian infrastructure: 27, 66% of the analysed content
Blaming and accusing Ukrainians fakes/discrediting: 22,7%
Denial of failures and misery of the russian army: 18%

Blaming and accusing of making up sanctions against Russia: 13,48% Denying mobilization of russian people: 5,67%
Denying victories of the Ukrainian army: 4,96%
Discrediting President Vladymyr Zelenskij: 3,55%

Blaming and accusing Ukrainians of Nazism: 2,84% Biolaboratories in Ukraine: 0,71%

We found that the most popular “debunked” narratives were about the Russian army’s worst atrocity to that date*: 1.) the missile attacks on a maternity house and children’s hospital in Mariupol 2.) the attack on a drama theatre in Mariupol and 3.) the killing of journalist Brent Renaud.

Three months after the first analysis we performed the same close reading of a wider scope of 10% of the most engaged content and found nine new narratives:

  • Deterioration of life in the world because of Ukraine
  • Discrediting the Armed Forces of Ukraine
  • NATO assistance is ineffective and leads to a bigger war
  • Russians are interested in the topic of “special operations” and / or support it Denial of support for Ukraine by other countries or initiatives
  • Life under occupation is good and peaceful
  • European countries cannot be trusted
  • Russia is friendly to refugees and residents of the occupied territories Recognition of “LDNR” as a legal territory

During the first three months of the Russian full-scale invasion denying war crimes and blaming Ukrainians for creating fakes were the narratives that were used most frequently. The debunking of the worst atrocities, such as the Bucha massacre, was also the most popular.

Warfakes as State-Sponsored Propaganda

In the course of analysing who reposted Warfakes content, we found that from the 24th of February until the 28th of March in 2022, the director of the Information and Press Department of the MFA RF, Maria Zakharova’s, reposted Warfakes content from her own verified Telegram channel. The first post promoted waronfakes.com and the second was a repost of their ‘debunking’ of the Russian army’s bombing of the Mariupol maternity ward. Later we observed that the telegram channel of the Ministry of Defence of Russia made 264 mentions of the Warfakes (as of 30.07.2022). Using the Meta research tool Crowdtangle, we investigated all mentions of the Warfakes TG channel on Facebook. We found that the main promoters of Warfakes content were Russian embassies and Russian houses of culture, both of which are under the jurisdiction of the Russian Ministry of Foreign Affairs. Each of these Facebook pages had 9800 subscribers (from 49471 to 594) on average, and each post had an engagement rate from 1482 to 5.

Screenshot from tgstats.ru with the most frequent interaction (incoming and outgoing) between channels.

Warfakes as participatory propaganda

Warfakes is a new form of propaganda that is participatory, as opposed to ‘traditional’ propaganda, which is usually top-down. By definition, participatory propaganda is co-produced by users to some extent. While we do not know who makes the content on Telegram, a crucial affordance of the medium is sharing. As such, part of what makes this propaganda so successful is how it spreads, including users sharing the content who may not agree with it.

Warfakes should be considered in the broader context of the Russian disinformation strategy. This can be traced back to Putin’s reaction to the UN-backed war in Libya and Maidan protests. In order to avoid his own uprising, state-sponsored influence operations have developed these new forms of participatory propaganda.

Their strategy is to create epistemological confusion that causes people to question the idea of objective truth. This benefits reactionary nationalistic narratives. Since Maidan, Russia’s military has developed a new “Gerasimov doctrine” in which future wars would take place mostly in the information space. Therefore, it seems reasonable to speculate that Warfakes may in fact be a Russian military operation.

Telegram’s ownership tried to resist state control in the past, but the platform is being used by the Kremlin. We believe they should take responsibility and remove the channels.

This article was based on the findings of the project executed during the Digital Methods Winter School in 2022 in Amsterdam. Participants: Karyna Lazaruk and Marc Tuters (project leaders), Borka Balogh, Marta Ceccarelli, Emillie de Keulenaar, Kiara Khorram, Devin Mitter, Son Nguyen, Stijn Peeters, Emilie Schwantzer, Cemal Tahir, Alexander Teggin, Yana Mashkova, and Anton Mishchuk.


In July, INC has published a new 44th edition of Theory on Demand, called Dispatches from Ukraine: Tactical Media Reflections and Responses, which includes the following piece. Order a physical copy or download the whole publication free of charge here.