Russia is directing its anger towards the Olympics and this year's hosts, Paris, after its athletes were banned from competing under their flag at the Summer Olympics.
According to a report released Sunday by Microsoft, Russian propagandists produced an hour-long documentary, ran fake news reports and even impersonated French and American intelligence agencies to issue false warnings urging people to avoid the Olympics.
The report details a disinformation campaign carried out by a group it calls “Storm1679,” which appears to have accelerated since March, with social media being flooded with short videos warning of possible terror attacks and stirring fears about safety.
While the operation is targeted at the Olympics, it is spreading disinformation using a range of techniques that could also be used in European and US elections.
U.S. and French officials are tracking the operation, and one U.S. official said Russian disinformation, spread by the Kremlin through social media, continues to threaten the security of the U.S. and its allies.
The group also encourages fact-checkers to verify its claims, and tries to use the attention each time a false story is debunked to spread it to new audiences.
French authorities have been focusing for months on possible Russian attempts to disrupt the Olympics: Hackers linked to Russian intelligence disrupted the opening ceremony of the 2018 Winter Olympics in South Korea, and French authorities are bracing for more cyberattacks this year.
France raised its terrorism alert level after Islamic State attacks in Moscow in March and a threat to a high-profile soccer match in Paris, and has also stepped up security for the Olympics. Neither French nor US authorities have warned people to stay away from the Olympics, but a Russian disinformation campaign aims to scare people into doing so.
Microsoft researchers and U.S. government officials have identified several groups with ties to the Kremlin that are spreading disinformation targeting Europe and the United States.
Some are led by associates of Russian President Vladimir V. Putin. Some are affiliated with Russian intelligence services. Some hide behind fake nonprofits. Some are veterans of the Internet Research Agency, the St. Petersburg troll farm that spread 2016 election propaganda and was run by Yevgeny Prigozhin, the founder of a mercenary group that led an uprising against the Kremlin and who died in a plane crash last year.
According to Microsoft, Storm-1679 appears to be separate from those operations, and while the group's disinformation is consistent with Kremlin propaganda, few details are known about it.
Bellingcat, a research group that uses public data to conduct open-source research, has been targeted by the disinformation videos and has been watching the campaign unfold. Bellingcat founder Elliot Higgins said the group has not yet confirmed whether Storm 1679 is backed by the Russian government or is independent.
“Perhaps Prigozhin 2.0 is working for the Kremlin, or perhaps it's just some imaginative pro-Russian bloggers doing it for fun – it's impossible to know at this point,” Higgins said.
The effort began in earnest last summer with the release of a fake documentary about the International Olympic Committee that stole the Netflix logo and used an AI voice spoofing Tom Cruise. The committee successfully removed the video, a parody of the 2013 film “Olympus,” from YouTube. But the attacks continue, as do relentless efforts to discredit the committee's leadership, the committee said in March, citing a campaign that used fake recordings of phone calls purportedly made by African Union officials on behalf of Russia.
Known as Storm 1679, the group now appears to be producing shorter videos, which are easier to produce. The group once focused on denigrating Ukrainian refugees in Western countries, but has shifted its focus to the Olympics since French President Emmanuel Macron began publicly considering sending French troops to Ukraine.
Microsoft estimates that Storm1679 produces between three and eight fake videos each week in English and French, many of which impersonate the BBC, Al Jazeera and other broadcasters. The group appears to be quick to react to news events, such as protests in the French Pacific territory of New Caledonia. One group has focused on possible terror attacks in Paris.
Most of the videos claiming to be from the CIA or French intelligence are relatively straightforward: They are nothing like anything the CIA has actually produced, but their use of CIA logos and black text on a white background might make them appear legitimate to uninformed online readers.
“They're trying to incite expectations of violence. They're trying to make people afraid to go to the Olympics,” Clint Watts, director of Microsoft's Digital Threat Analysis Center, said of the group behind the fake posts.
A CIA spokesman said a video circulated online in February purporting to be a CIA warning of terrorist attacks during the Olympics was fabricated.
In February, Visinum, a French government agency that fights online disinformation, identified the fake CIA video as part of a campaign it dubbed “Matryoshka,” a reference to the popular Russian matryoshka doll.
The campaign also produced fake videos about French domestic intelligence and the French government. A person familiar with the French investigation, speaking on condition of anonymity to evaluate intelligence, said Visinum and the French Foreign Ministry were quick to identify Russian disinformation from the group trying to disrupt the Olympics.
French authorities and Microsoft have said they believe part of the group's strategy is to attract the attention of fact-checking organizations.
“Typically, when Storm1679 posts content on Telegram, it sits there for a day or two and then disappears,” Watts said. “Content doesn't normally move from one platform to another, but when their false content is fact-checked by accounts with large followings, it gets a lot more views and is exposed to a new and different audience.”
Higgins said that if luring fact-checkers was part of the group's strategy, it didn't seem to have been effective. He said Bellingcat was aware that reporting misinformation could draw attention to propaganda, and that the group takes that into account when fact-checking videos.
“Their message doesn't seem to be amplified,” Higgins said. “It doesn't seem to be shared at all, even among regular connoisseurs of Russian disinformation.”
