Digital Forensic Research Lab (DFRLab)

A Russia-linked operation is reportedly using paid ‘activists’ to disseminate false narratives, aiming to influence Moldova’s September 28 election. DFRLab’s Valentin C. and Victoria Olari break down the details in a new report:

⏳ Loading… The DFRLab’s Digital Sherlocks program is preparing for its next chapter 🔎 After a pause, we are excited to share that the program will return in 2026. Since 2019, Digital Sherlocks has formed a global community of open-source investigators, advancing information integrity and strengthening democratic resilience. We are committed to continuing that mission in this challenging time for our community. For future announcements and updates, subscribe to the DFRLab’s #TheSource: bit.ly/47qKvKp

👀 New report: How Storm-1516 targets Moldova’s elections 👀 Today, Alliance4Europe and partners publish a new report, mapping out the actions of the Russian influence operation Storm-1516, run by the EU-sanctioned “Russian Foundation for Battling Injustice” (R-FBI). The group masquerades as an NGO, and was initially set up by Wagner mercenary group founder Yevgeny Prigozhin. The report covers Storm-1516 activities targeting Moldova June 19 - September 25, 2025. Key takeaways: 📰 Storm-1516 shares false stories, often via fabricated and impersonation websites, legitimised by mass-generated AI content. Stories are initially spread by pro-Russian influencers, anonymous “news” accounts, and parody/fan accounts of famous figures such as Ivanka Trump. ⚠️ Storm-1516 relied on a number of fake websites to spread its content, including a page closely resembling the website of Moldova's ruling PAS Party, but which included false, radical policy proposals. 🎯 While the overt political slant of the content varies from left- to right-wing angles, content focuses on undermining Western support for Moldova, attacking PAS and President Maia Sandu, leveraging false allegations of political corruption, political repression, judicial corruption, pedophilia, and identity-based discrimination. Our Recommendations: 🚫 The European Commission should look to expand its list of sanctioned individuals and entities to cover currently unsanctioned actors who contribute content to sanctioned EU channels, and actors who are consistent key amplifiers and possible authors of the Storm-1516 articles, should be reviewed for sanctions.  🌐  Moldovan authorities should look to block access to websites affiliated with Storm-1516 during the election period, in order to stop a clear avenue for manipulation 📱 Social media platforms should track the content connected to Storm-1516 and block its spread, enforce EU sanctions, and ensure that said content does not reach the Moldovan diaspora in Europe, a group that makes up around 21% of Moldova’s citizens. 🤝 The EU and Moldova should continue to work closely together on enacting sanctions, including developing mechanisms for joint sanction enforcement. Full report is in the comments! The report was made possible through the collaboration of Alliance4Europe, Atlantic Council Digital Forensic Research Lab (DFRLab), Debunk.org, International Partnership for Human Rights (IPHR), polisphere, Context.ro, Probe Point Analytics, Alliance for Securing Democracy (German Marshall Fund of the United States), Fojo Media Institute, and DEN Institute as part of the FIMI-ISAC project, ‘FIMI Defenders for Election Integrity’, and coordinated through the Counter Disinformation Network. Saman Nazari Eto Buziashvili Sophie Sacilotto Ania Logvynova Thomas S. Ewan C. Hannah Schimmele Joel Boehme Matteo Pugliese, PhD Larissa Doroshenko Christian Haag Andrea Nicolai Vasile Popa Deniz D. Mihaela Tănase

Most people hear WSIS and think: another technical, bureaucratic, UN thing. But it’s not. WSIS — the World Summit on the Information Society — is one of the few spaces where the world still tries to imagine a people-centred, open, and inclusive digital future. It matters more than it sounds. Right now, that vision is at risk. The UN Office for Digital and Emerging Technologies (ODET) is playing a dirty little game — quietly trying to take over the WSIS process, reshape its architecture, and centralize control. It’s the kind of bureaucratic power grab that sounds dull until you realize its consequences: a digital future designed by institutions, forinstitutions. We need to get this right. Because if WSIS loses its multistakeholder, bottom-up spirit, we don’t just lose a process — we lose one of the last global spaces where the Internet’s future is still open for debate. https://lnkd.in/e7mixyDA #WSIS20 #DigitalGovernance #InternetGovernance #Multistakeholder #UN #DigitalFuture

Last week, I participated in the inaugural session of the Freedom of Speech, Media, and AI Policy and Strategy Working Group in London, organized by the Center for American Progress Action Fund. The working group is tasked with developing ideas to address emerging tech policy challenges. Central to our discussions are the deployment of AI, its potential to transform social, political, and economic systems, and its impact on democracy and civil liberties. Over the next year, the working group will develop policy recommendations on key issues, including how countries can harness the economic benefits of AI without becoming overly reliant on tech corporations based in the U.S. or China. We will also explore how to establish regulatory frameworks that foster innovation while implementing safeguards for AI oversight. The working group benefits from a diverse and international network of expertise, including members such as Megan Shahi, Tim Wu, Roberta Braga, Alexandra Geese, Brando Benifei, Mar Garcia, Hanno Fenech, Raquel Vazquez Llorente, and Mike McMahon, representing organizations like the Center for American Progress, Reset Tech, Centre for Countering Digital Hate, Digital Democracy Institute of the Americas, Public Citizen, European Center for Digital Action, AI Collaborative, Microsoft, and Atlantic Council. This meeting took place just before the 2025 Global Progress Action Summit, a major gathering of progressive leaders from over 20 countries, although primarily from Europe. The summit was co-hosted by the Center for American Progress Action Fund, Labour Together, and the  Institute for Public Policy Research. At the summit, conversations centered on shaping a new progressive policy agenda in response to global political shifts. The main topics of discussion included restoring trust in democracy, reimagining multilateralism, confronting authoritarianism, migration policy, governing for the benefit of working people, and navigating the digital age brought about by AI. High-profile speakers included UK Prime Minister Keir Starmer; President of Spain Pedro Sánchez; Prime Minister of Canada Mark Carney; Prime Minister of Australia Anthony Albanese; Iceland's Prime Minister Kristrún Frostadóttir; Former Prime Minister of New Zealand Jacinda Ardern; Governor of Illinois (U.S.) JB Pritzker; Former Prime Minister of Sweden Magdalena Andersson; UK Deputy Prime Minister David Lammy; and U.S. Democratic Party leader Pete Buttigieg.

💭 🇲🇩 5 DFRLab investigations you should read ahead of Moldova’s 2025 parliamentary elections On September 28, Moldovans head to the polls in a pivotal election. The votes haven’t been cast, but the fight for Moldova’s elections has already started online. At the DFRLab, we’ve tracked how disinformation, covert media, and influence operations are threatening Moldovan democratic institutions: 1. The risks ahead: Coordinated through FIMI-ISAC's FDEI project, the DFRLab, Debunk.org, Alliance4Europe, and EU DisinfoLab evaluate #FIMI threats to Moldova’s 2025 electoral environment in our Country Election Risk Assessment (CERA) report https://lnkd.in/eaiDrxeK 2. Covert media: REST, a newly launched online outlet targeting Moldovan audiences ahead of the country’s parliamentary elections is linked to Rybar, a pro-Russian “military blogger” and propaganda operation https://lnkd.in/ewbD8bB8 3. Paid to post: Inside the “digital army” of influencers flooding Moldova’s feeds with Russian propaganda https://lnkd.in/eJRkTKDD 4. Accusations of Sandu of meddling abroad: A cross-platform campaign tried to discredit Moldova’s president by dragging Romania into the mix https://lnkd.in/ewjXbicR 5. When foreign aid becomes a weapon: Pro-Kremlin actors exploit USAID scrutiny in an effort to destabilize Moldova’s pre-election landscape https://lnkd.in/eDeh9fJV Discover more of our election coverage: https://lnkd.in/eHcN7Kar #MoldovaElection2025

At CYBERWARCON 2024, Emerson Brooking, Dina Sadek, and Max R. from DFRLab presented findings from the Foreign Interference Attribution Tracker, asking a critical question: Are we handling foreign interference claims the right way? Their research compared 2020 and 2024 data, showing how government disclosures shape public attention, how political context influences attributions, and how the frequency of claims may create unintended consequences. Check out their talk here >> https://lnkd.in/eubhHfHG Want to be part of conversations like this? CYBERWARCON returns on November 19, 2025, in Crystal City, VA + virtually! Grab your ticket today >> www.cyberwarcon.com #CYBERWARCON #ForeignInterference #ThreatIntel #NationalSecurity #cybersecurityevents

In less than three weeks, Moldova heads into its parliamentary elections facing very aggressive and sophisticated foreign interference. In a new report I co-authored with my colleague Victoria Olari – in cooperation with Alliance4Europe, Debunk.org, & EU DisinfoLab – we break down the threat landscape: a mix of illicit money, manipulation, & manufactured dissent. 📅 Key developments 2023–2025 • 2023: crude intimidation - coup plots, street agitation, infiltration of protests. • 2024: hybridization - spoofed emails, fake media outlets, Russian-linked transfers for vote-buying & mobilisation. • 2025: escalation - anonymous bribes & threats by phone/text, financial apps promising thousands, cryptocurrency streams, and AI-driven deepfakes targeting Moldova’s institutions. 🕵️ Foreign actor tactics • Russian ops like Storm-1516 & Matryoshka continue to target Moldova’s info space. • Apps such as Taito and platforms like HaiTV funnel payments, harvest IDs, and recruit for protests. • Sanctions circumvention: Moldova24 & mirror domains kept Kremlin narratives alive. • Increasing sophistication of cyber-enabled ops. • Offline, Russian agents have funnelled up to €200M (~1% of Moldova’s GDP) into vote buying and protester training. 💸 Vote buying & illicit financing • Sanctioned Russian banks & cryptocurrency exchanges fuel shadow financing. • Digital apps coordinate micro-payments, track protest attendance. • Result: voter agency distorted, foreign leverage entrenched, trust in elections eroded. 🚩 Paid protest mobilisation • Oligarch Ilan Shor offered protesters up to $3,000/month (4x the average Moldovan wage). • “Tent protests” sustained by salaries, transport & lodging - designed to project a fake crisis & exhaust state institutions. • These spectacles masquerade as grassroots dissent but are financed destabilisation ops. ✅ Steps taken, but gaps remain • Moldova has adopted a National Strategy on Countering Disinfo (2024–28), modernised its electoral code, revoked pro-Kremlin media licenses, & stress-tested its cyber defences with EU partners. CSOs play a vital role. • Yet, enforcement is patchy, inter-agency coordination lags, and big platforms react far too slowly (as Captain Renault would say “I’m shocked, shocked to find that gambling is going on in here!”) *coughs in platform-direction* 📌 Policy recs (2 highlights) • Ensure the CCSCD & the 2024–2028 strategy are backed by real resources, cross-agency planning, & safeguards for independence - otherwise political pressure and fear of reprisals risk paralysing them. • Build dynamic cooperation with platforms & ISPs to counter mirrored domains, proxy ownership, and rebranded outlets - static takedowns alone won’t cut it. The question is whether institutions, allies, & platforms can move fast enough to keep pace. Standing with Moldova now means standing up for European democracy. Grateful to Layla Mashkoor for her outstanding leadership in editing! [Link in the comments]

[My latest] Lately, Brussels has been exploring ways to intervene in the interconnection market, with DG CNECT signaling interest in traffic optimisation and possible regulatory oversight—especially involving CAP networks and CDNs. BEREC is even being discussed as a “neutral” arbiter for disputes. On paper, regulation, network resilience, and Single Market competitiveness are unassailable goals. In practice, the details matter—and the risks are real. 📊 What the data tells us: **BEREC reports show Europe’s interconnection market is largely competitive, with declining transit/CDN prices and growing traffic handled efficiently. **CDNs and peering arrangements already allow networks to self-adapt, improve performance, and foster innovation at the edge. ⚠️ Risks of over-intervention: **Regulatory capture: Big telcos could dominate rule-setting, disadvantaging smaller players. **“Sender-pays” models: Forcing CAPs/CDNs to pay for traffic could distort incentives, discourage investment, and raise costs. **Innovation chill: Edge computing, streaming, IoT, and emerging tech rely on flexible, decentralized content delivery—overregulation threatens it. **User experience impact: Standardized, regulator-mandated traffic paths may increase latency, reduce redundancy, and hinder experimentation. Europe risks creating a safer but staler internet—one dominated by incumbents rather than innovators—if Brussels substitutes micromanagement for flexible, evidence-based policy. ✅ Recommended approach: **Focus on last-mile infrastructure investment (fiber, 5G). **Maintain net neutrality and open internet principles. **Intervene only where clear, evidence-based market failures exist. **Support CDNs, edge computing, and cloud deployment closer to users. Europe’s digital future should favor innovation, flexibility, and fair competition—not regulatory control that locks in incumbents. #DigitalPolicy #InternetGovernance #NetNeutrality #Cloud #CDNs #Innovation #EUtech https://lnkd.in/eUWqhrZT

My latest for the Atlantic Council: As the US retreats from internet governance, Europe must step up As the U.S. steps back from global internet governance—distracted by domestic politics and captured by corporate interests—authoritarian powers are stepping up. 📡 China and Russia are hard at work embedding state control and digital sovereignty into the internet's DNA. Meanwhile, Europe has the regulations—but not the strategy. GDPR, the DSA, and the AI Act are world-leading tools. But without a coherent foreign policy agenda, they risk becoming regional exceptions—not global standards. 🛑 Internal regulation ≠ global influence. In UN negotiations, ITU standard-setting, and cybersecurity talks, the EU is often fragmented, reactive, or absent. China sends coordinated, well-resourced delegations. Europe sends silence—or 27 competing voices. This isn’t just a diplomatic failure. It’s a strategic vulnerability. 📣 If the EU wants to defend an open, rights-based internet, it must start treating the internet as a pillar of foreign policy, not a technical afterthought. Here’s what leadership would look like: ✅ Appoint a Senior Envoy for Digital Affairs ✅ Give the EEAS a clear digital mandate ✅ Forge alliances with the Global South on trust and rights ✅ Invest in open, inclusive digital infrastructure ✅ Show up early, united, and loud in multilateral negotiations The open internet is not guaranteed. It’s a geopolitical asset—and it’s up for grabs. 🇪🇺 Europe has the laws. Now it needs the will. https://lnkd.in/eeD4aGaE #DigitalDiplomacy #InternetGovernance #Europe #DigitalSovereignty #CyberPolicy #EU #TechGeopolitics #OpenInternet #GlobalSouth #ITU #UN #DigitalRights