Russian Disinformation Followed Drone Incursion of Poland

Pro-Kremlin disinformation groups responded quickly after Russian drones violated Polish airspace in early September.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Multiple information operations teams “rapidly promoted related narratives in the period immediately following the drone incursion,” advancing “multiple, often intersecting influence objectives aligned with historic pro-Russia IO threat activity,” reported threat researchers at Google Cloud on Tuesday.

The overlapping information operations included “concerted efforts to amplify messaging denying Russia’s culpability for the incursion,” by reframing the event as a pretext manufactured by Poland and NATO allies to advance its own political aims, the threat researchers said.

The messaging also continued long-running Russian efforts to try and sour Poles’ faith in their own government, as well as undercut their government’s ongoing support for Ukraine, they said.

Such efforts frequently mirrored the official line from the Kremlin: that if there was any incursion, it was accidental. “No objects on Polish territory were planned to be targeted,” said the Kremlin in the wake of the airspace violation.

“The pro-Russian disinformation efforts that regularly target Poland didn’t miss the opportunity to undermine Poland’s response to the drone incursions,” said John Hultquist, chief analyst at Google Threat Intelligence Group. “Physical attacks and disinformation work in tandem to erode society’s faith in institutions.”

At least 19 Russian drones violated Poland’s airspace from Sept. 9 to Sept. 10, leading NATO to activate its air defenses and rapidly respond, said NATO Secretary General Mark Rutte on Sept. 10. The incursion, he said, was “not an isolated incident,” and that in its wake, “allies expressed solidarity with Poland and denounced Russia’s reckless behavior.”

Ukraine’s military intelligence agency told Reuters the incursion was designed to test NATO’s resolve. “Such hybrid operations likely aim to increase pressure on Ukraine’s Western partners, potentially leading to: reduced support for Ukraine, especially military aid,” the agency said.

Russia has repeatedly violated the airspace of NATO members. Estonia reported that a Russian helicopter violated its airspace on Sept. 7, while Romania on Sept. 13 reported that a drone entered into its territory for over 45 minutes.

Polish Prime Minister Donald Tusk on Sept. 15 reported another suspicious incident involving a drone, this time flying over government buildings, which he said the military neutralized. Police detained two Belarusian citizens as part of their investigation.

Unexpected drone activity continued in late September, with a series of still-unexplained sightings of unmanned aerial vehicles over airports and military bases in Denmark and Norway, leading to a temporary shutdown of Copenhagen Airport just days before the city hosted a European Council meeting.

Western officials have called on Putin to cease such provocations. “Whether intentional or not, Russian incursions into NATO airspace are deeply concerning, and reckless,” said Neil Holland, Britain’s ambassador to the Organization for Security and Cooperation in Europe. “Denials and attempts to diminish the seriousness of this incident are unacceptable.”

The European Parliament condemned the airspace violations in September in a resolution that framed them as part of a pattern of “systematic military and hybrid warfare and provocations against the EU.”

Danish Prime Minister Mette Frederiksen warned that Russia has initiated “a hybrid war against Europe,” telling her Nordic countrymen that “we are going to see more of it.”

Information Operations Teams

Pro-Moscow information operations teams followed a long-established Russian playbook. Kremlin propaganda operations have intensified following Russian President Vladimir Putin’s invasion of Ukraine in February 2022, Google threat researchers said.

“These IO campaigns used a real-world event as a springboard to inject manipulative narratives into the public discourse,” said Austin Larsen, principal threat analyst for Google’s threat intelligence group, in a LinkedIn post.

Google researchers tracked at least three specific information operations teams at work following the Russian drone incursions into Poland:

• Portal Kombat: Multiple reports tie this actor, aka the Pravda Network, to the production of a series of overlapping domains in different languages that advance a pro-Russian narrative, especially around the Ukraine War. In this case, the threat actor claimed Russian drones lacked the range to have reached Polish airspace, and that the Baltic states and Poland were inappropriately using the supposed incident to derail Russia-Ukraine peace negotiations.
• Doppelganger: Researchers said this well-known actor published a German-language article to its domain claiming Russia alerted Poland in advance to the drone flights, asserting the drones were non-threatening, and that NATO recast the incident to advance an anti-Moscow agenda. For a Polish audience, it wrote emphasized the costs of NATO membership.
• NDP: The online publication “Niezależny Dziennik Polityczny,” which claims to be an “independent political journal,” regularly employs dubious sources and “has been characterized by multiple sources as a prolific purveyor of primarily anti-NATO disinformation and has recently been a significant amplifier within the Polish information space of pro-Russia disinformation surrounding Russia’s ongoing invasion of Ukraine.”

Russia’s information warfare or “active measures” campaigns involve what experts often describe as “4D” campaigns – for dismiss, distort, distract and dismay. They also regularly seek to target, amplify and exploit existing divisions in society (see: Russia Blamed for COVID-19 Disinformation Campaigns).

Such tactics are designed to complicate “society’s ability to establish a fact-based understanding of potential threats in real-time, by diluting the information environment with noise,” as well as to offer a Russian-authored view of reality that seeks to bolster Moscow’s strategic objectives, the Google researchers said.