CheckFirst

How von der Leyen’s no-confidence vote fueled Russian propaganda A confidential study found that a known Russian disinformation network had ramped up its posts by 60 percent while pushing the narrative that the European Commission president was “toxic.&#82…

Russian-sponsored propaganda engines went into overdrive in the weeks leading up to the European Parliament’s no-confidence vote against Ursula von der Leyen, a confidential study seen by POLITICO shows.

While much remains to be explored regarding 16th Center's precise operations, this study paves the way for further research on Russia's security agencies operating in Russia and abroad, including those engaged in intelligence-gathering in Ukraine and European countries. Want to know more about this story? Contact us: info@checkfirst.network

If you have any questions about this report, please write to us at info[a]checkfirst[dot]network. Thanks for reading!

Unit 03110 (1975): The oldest insignia linked to this unit features symbols such as tropical palms and a flag that confirm that it was previously stationed in Lourdes (Cuba), before being relocated close to Sotchi (Russia) in the late 2000s. Among the ten bases we have identified, this one is the only one that equipped its antennas with radomes designed to protect the equipment from weather and hide its orientation and specifications from unwanted eyes. These domes, which may contain a radar or a dish antenna, are even depicted on one of the unit's insignia, which also portrays the facility facing the sea, with mountains in the background.

Unit 61608 (1918): The unit's insignia frequently feature symbolic representations of Moscow, including the Kremlin. The unit hosts more than a dozen parabolic antennas near the T-shaped control building, as well as pole antennas arranged in an antenna array slightly further north. It is situated south of Tsaritsyno Park, concealed within a dense forest in the heart of Moscow.

Each interception centre also has a unique way of depicting itself through its insignia, as can be seen in these two examples from our report.

How the 16th Center depicts itself: The standard format of the shield and sword, symbols inherited from the KGB ; The Russian coat of arms (a double-headed eagle clutching a scepter and an orb surmounted by a cross, representing imperial authority and the Orthodox Church, respectively) ; A red background, a colour traditionally associated with the FSB.

The Center portrays itself in two distinct ways: A terrestrial globe featuring the Russian Cyrillic letter "i". This letter is commonly associated with the Russian word "information" in Soviet and Russian security services, and could be a reference to the information the unit is capable of acquiring ; An antenna positioned next to a key being shattered by a lightning bolt. The antenna is a fairly common symbol of radio transmissions, but is also used to represent signals intelligence (SIGINT). The lightning bolt symbolizes the interception, disruption, and manipulation of enemy communications and radar systems. The key shattered by the lightning bolt is highly likely an explicit reference to cryptanalysis, the branch of cryptography dedicated to breaking codes and cryptographic systems.

Thanks to phaleristics, we were able to gain insight into the unit's current
symbolism.

For over a year, we have collected and analyzed hundreds of photographs of military insignia linked to the 16th Center of the Federal Security Service of the Russian Federation (FSB). We combined phaleristics (i.e. the study of medals, orders, decorations, and related honors issued by states, organizations, and military bodies) and traditional OSINT techniques to get insights into the history of the 16th Center, piece together part of its internal structure, and geolocate several of its interception centers within Russia.

During our research, we identified: 40 distinct insignia corresponding to different departments ("upravleniya") within the 16th Center. 10 departments within the 16th Center with at least 560 employees. 10 SIGINT stations composing a ground-based network highly likely operated by the 16th Center. These "Special Communications Centers" (TsSS) are designated either by a five-digit identifier or a number.

To unveil the infrastructure of the 16th Center, we employed a combination of unusual and traditional OSINT techniques. Our primary sources were hundreds of photographs of Russian insignia available on specialised websites.

Cover of our research "Decoding Secrets With Medals: How Military Insignia Revealed Russia’s Hidden SIGINT Network"

Today, we are proud to publish our latest investigation into the FSB’s 16th Center, publicly accused of operating some of Russia's most sophisticated cyber-espionage groups.
🔗 checkfirst.network/decoding-se...

This week at @cgf-uk.bsky.social at European Media&Information Fund Annual Conference, our founder Emmanuel Vincent presented in a panel on what data researchers need to effectively implement European Code of Conduct on Disinformation&advance transparency obligations under the #DigitalServicesAct.

📢 In a joint civil society effort, we filed a formal DSA complaint against 𝕏 (formerly Twitter) for violating Article 26(3) — which bans targeting ads based on sensitive data like sexuality, politics, religion, health.

📄 Read the joint statement: aiforensics.org/uploads/Join...

The Pravda Network with Valentin Chatelet - The Active Measures Newsletter Podcast This week, Jim Ludes and Mark Jacobson welcome Valentin Chatelet, a research associate at the Atlantic Council's Digital Forensic Research Lab, for an urgent discussion of the Pravda Network--a Russia...

In this week's episode of the Active Measure Newsletter's podcast I was invited to discuss the content of our joint investigation with @dfrlab.bsky.social and @checkfirst.network on the Pravda Network and the consequences of the poisoning of LLMs & the targeting of Wikipedia
omny.fm/shows/active...

1/ Plus que jamais, les actions « hybrides » conduites par la Russie sur le continent européen font la une de l’actualité. Nous avons décidé de construire une cartographie interactive pour mieux représenter et cerner le phénomène ⬇️

🚨 #HEAT shows climate disinfo is systemic – but EU regulation hasn’t caught up.

Platforms still face no legal obligation under the #DSA to address it.

👉 It’s time to treat #ClimateDisinfo as a real threat to democracy.

📘 Read the report 👇
www.disinfo.eu/heat-harmful...

#EMIFund

📊 Operation Overload on Telegram:
• 673 channels analysed
• 7M+ messages
• 2M+ media collisions (39% of 5.5M total)
• 550+ channels share admins
• 70% of Overload-linked emails point to Telegram
• 10 verified channels drive core narratives

Operation Overload: An AI fuelled escalation of the Kremlin-linked propaganda effort - CheckFirst The Russian propaganda operation targeted at media organisations and fact-checkers is still going strong. Operation Overload, which we first documented in June 2024 is now leveraging AI generated content, impersonation techniques and is expanding to more platforms such as TikTok and BlueSky. Telegram and direct emails to newsrooms remain a daily dissemination technique used to attempt to create a sense of urgency amongst their targets. Since we last published an update about the operation last September, some legitimate outlets regularly fall in the trap.

Read the full report and our recommendations here: checkfirst.network/operation-o...

Over 180 individuals and organisations have been impersonated using AI-generated content in an attempt to cause confusion, manipulate debate, and overload fact-checkers. Despite that, platforms’ responses remain worryingly uneven.

Since September 2024, we have recorded over 700 targeted emails and nearly 600 unique pieces of falsified content disseminated across platforms including Telegram, X, BlueSky, and most recently TikTok.

This Russian propaganda campaign, which targets fact-checkers, is now leveraging AI generated content and impersonation techniques, and is expanding to more platforms such as TikTok and BlueSky.

Our cover depicting "Operation Overload", featuring a blurry silhouette alongside screenshots and laptops.

🔴 NEW REPORT
Alongside ‪@reset.tech‬, we publish our third investigation into Operation Overload. ⤵️

We also came up with haveibeentargeted.online
where you can upload your X data and see whether advertisers have targeted you based on your sensitive characteristics 👇

🧵How X enables major brands to target your most sensitive personal data—from health conditions to political beliefs—all in the name of profit.

aiforensics.org/work/sensiti...

Indeed! The official Check First newsletter - CheckFirst Subscribe to our newsletter and get a monthly recap of the latest news from CheckFirst straight in your inbox

Make sure you don't miss our latest updates by subscribing to our monthly newsletter: checkfirst.network/newsletter/

Although we have now been operating for over five years, we are as determined as ever to combat problematic online content and influence operations and advocate for transparency. We cannot wait to pursue our goals and show you what's coming next!

We would like to thank all the NGOs, public institutions and regulators, and journalists that trusted us during all these years:
@faktabaari.bsky.social‬, @reset.tech‬, @dfrlab.bsky.social‬, ‪@aiforensics.org‬, @mozilla.org‬, @ec.europa.eu‬, the OIF, and more!

5 years of Check First: looking back at our journey - CheckFirst Today, it’s Check First’s 5th anniversary! To celebrate this big step, it is time to highlight some of our achievements of the past years.

Today is Check First’s 5th anniversary! To celebrate this milestone, we would like to showcase some of our finest work from the past few years. checkfirst.network/5-years-of-...

GitHub - CheckFirstHQ/RADAR: RADAR is a structured framework that breaks down Digital Service Act requirements into categories, infringements, and observable indicators. It helps stakeholders identify, assess, and address platform compliance risks systematically. RADAR is a structured framework that breaks down Digital Service Act requirements into categories, infringements, and observable indicators. It helps stakeholders identify, assess, and address plat...

Find out more about the RADAR framework:
➡️ checkfirst.network/introducing...
➡️ github.com/CheckFirstH...

The more the framework is used, the larger the dataset will become. This will make it easier to identify patterns, compare assessments and build a comprehensive picture of the digital landscape. So, feel free to use RADAR whenever you work on DSA infringements!

By using these tags systematically in their reports, researchers, civil society organisations, and regulatory bodies can help to create a comprehensive and practical resource for assessing DSA compliance across Europe.

RADAR - Regulatory Assessment for Digital Service Act Risks RADAR is a framework for assessing and mitigating Digital Service Act (DSA) regulatory risks. Developed by CheckFirst, it guides digital service providers through compliance checkpoints and best practices.

Today, we're proud to launch RADAR (Regulatory Assessment for Digital Service Act Risks), an open framework that introduces standardised tags for Digital Service Act (DSA) infringements: radar.checkfirst.network/

Russia’s Propaganda Sites Have Infiltrated AI Chatbots In The Nordics » NORDIS Nordic factcheckers find that AI chatbots use Russian Pravda sites when prompted in Nordic languages. The chatbots recognise the most common narratives but

🔔Russian propaganda have infiltrated AI chatbotss in the Nordics🔔

New NORDIS-investigation suggests that AI chatbots refers to Russian-linked Pravda websites - some of which recycle articles from EU-banned Russian media.

Read the full article here: www.nordishub.eu/nordis-inves...

Logo VIGINUM + Analyse du mode opératoire informationnel russe Storm-1516

VIGINUM publie un rapport sur les activités de Storm-1516, un mode opératoire informationnel russe susceptible d’affecter le débat public francophone et européen.
Ce rapport s'appuie sur l'analyse de 77 opérations informationnelles conduites par Storm-1516 ➡️ www.sgdsn.gouv.fr/publications...

Indeed! The official Check First newsletter - CheckFirst Subscribe to our newsletter and get a monthly recap of the latest news from CheckFirst straight in your inbox

📫 The May edition of our newsletter "Indeed" is out! Explore the Pravda dashboard, our hour-by-hour tracker of Russia's "Portal Kombat" network.

Read the newsletter: r.crossover.social/3glnrijxzlx...
Subscribe: https://checkfirst.network/newsletter/