Module: FIMI Case Studies

[screen 1]

Abstract concepts become concrete through specific examples. This module examines well-documented FIMI operations to illustrate tactics, impacts, and lessons learned.

These aren’t hypothetical threats - they’re documented operations that targeted democratic societies, with real consequences.

[screen 2]

Case Study 1: 2016 US Election

Perhaps the most studied FIMI operation, Russian interference in the 2016 US presidential election demonstrated sophisticated multi-platform coordination.

Actors: Internet Research Agency (IRA), GRU military intelligence

Tactics:

Fake social media personas (both left and right-wing)
Targeted ads to swing state voters
Organization of real-world events
Hack-and-leak operations (DNC emails)
Amplification of divisive content

Impact: Millions of engagements, mainstream media coverage of leaked materials, potential influence on close election

Lessons: Multi-platform coordination, long-term planning (IRA accounts built over years), exploiting existing polarization

[screen 3]

Case Study 2: Brexit Referendum

The 2016 UK referendum on EU membership involved multiple foreign influence operations.

Documented activities:

Russian accounts amplifying both Leave and Remain to increase division
Targeting Scottish independence narratives
Amplifying anti-immigrant sentiment
Creating appearance of organic grassroots movements

Unique factors:

Short campaign period limited detection
Less robust platform monitoring than in US
Intersecting with domestic disinformation

Lessons: FIMI doesn’t necessarily support one side - sowing division can be the objective itself

[screen 4]

Russian FIMI operations regarding Ukraine demonstrate sustained, multi-year campaigns.

2014-2022: Pre-invasion

“Ukraine is failed state” narratives
Amplifying corruption allegations
“Nazi” and “fascist” labeling of Ukrainian government
Questioning Ukrainian national identity
MH17 disinformation (multiple contradictory explanations)

2022-present: During invasion

False flag narratives (claiming Ukraine attacked itself)
Denial of war crimes despite evidence
Justification narratives
Anti-NATO messaging to European audiences
Targeting Western support and resolve

Lessons: Long-term narrative preparation before kinetic operations, integration of information warfare with military action

[screen 5]

Case Study 4: COVID-19 Infodemic

The pandemic became a massive FIMI opportunity for multiple actors.

Russian operations:

Amplifying anti-vaccine content
Promoting conspiracy theories
Discrediting Western vaccines while promoting Sputnik V
Amplifying pandemic denialism

Chinese operations:

Defending regime’s pandemic response
Spreading theories about US origins of virus
Amplifying criticism of Western pandemic management

Iranian operations:

Anti-Western pandemic narratives
Bioweapon conspiracy theories

Lessons: Crises create information chaos that FIMI operations exploit; public health becomes information battleground

[screen 6]

Case Study 5: French Presidential Elections (2017)

Russian-linked operations targeting Emmanuel Macron’s campaign demonstrated sophisticated tactics.

Operation:

Macron campaign hack and leak days before election
False narratives about Macron’s personal life
Amplification through US alt-right networks before spreading to France
Timed for maximum impact with minimum response time

Response:

French media maintained blackout period despite leaks
Campaign had prepared by providing false documents among real ones
Swift attribution and exposure

Lessons: Pre-bunking and preparation can limit impact; election integrity requires defending information space

[screen 7]

Case Study 6: German Elections (2017)

Multiple operations targeted German federal elections, though with more limited success than in other countries.

Attempts:

Lisa case (false story about refugee sexual assault)
Anti-refugee disinformation
Support for AfD (far-right party)
Hack-and-leak attempts

Why limited success:

Strong German media literacy
Robust fact-checking
Language barrier (Russian operators less fluent in German)
Platform and government coordination
Public awareness after 2016 US/UK experiences

Lessons: Preparedness and resilience reduce FIMI effectiveness; not all operations succeed

[screen 8]

Case Study 7: Catalonia Independence Referendum (2017)

Russian accounts amplified tensions around Catalonia’s independence referendum in Spain.

Activities:

Amplifying both separatist and unionist content to increase conflict
Creating appearance of international support for independence
Amplifying violent imagery from police response
Parallel to strategy in Ukraine (supporting separatism in adversary states)

Lessons: Regional separatist movements within EU are FIMI targets; the goal is often destabilization rather than specific outcome

[screen 9]

Case Study 8: “Operation Secondary Infektion”

A long-running Russian operation discovered in 2019 demonstrated sophisticated forgery and amplification.

Tactics:

Creating fake documents appearing to be from US, UK, and other sources
Publishing on blogs and forums
Attempting to get mainstream media to report

Notable forgeries:

Fake Integrity Initiative documents
False NATO documents
Fabricated intelligence reports

Why interesting: Operation ran for years with limited success - most forgeries were ignored or quickly debunked

Lessons: Quantity doesn’t ensure quality; sophisticated operations can still fail when targeting aware audiences

[screen 10]

Case Study 9: COVID Lab Leak Narrative

The laboratory origin theory for COVID-19 demonstrates the complexity of FIMI around uncertain issues.

Timeline:

Early 2020: Natural origin consensus among scientists
Chinese dismissal of any origin investigation
Russian and Chinese amplification of bioweapon theories
2021: Lab leak hypothesis gains some scientific credibility
Ongoing: Mix of legitimate scientific debate and FIMI operations

Challenges:

Distinguishing legitimate questions from disinformation
Foreign actors amplifying genuine scientific uncertainty
Politicization of scientific questions

Lessons: FIMI is most effective when exploiting genuine uncertainty; line between foreign manipulation and legitimate debate can blur

[screen 11]

Case Study 10: Operation Doppelgänger

An ongoing (as of 2024-2026) operation creating fake versions of legitimate media websites.

Method:

Creating fake websites mimicking legitimate news outlets
Publishing false articles on these sites
Sharing via social media to create confusion
Some articles mix real reporting with inserted false claims

Targets: German, French, and other European media outlets

Detection: Researchers and platforms identified network through coordination patterns

Lessons: Attribution and exposure reduce but don’t eliminate operations; actors continue operating even after exposure

[screen 12]

Common Patterns Across Cases

Several themes emerge from documented operations:

Multi-platform coordination: Successful operations rarely stay on one platform
Long-term investment: Most sophisticated operations involve years of preparation
Exploitation of real tensions: FIMI amplifies existing divisions rather than creating new ones
Adaptation: Actors learn from failures and platform countermeasures
Persistence: Exposure doesn’t end operations; actors regenerate and continue
Increasing sophistication: Tactics evolve toward more believable, harder-to-detect methods

[screen 13]

The Attribution Challenge

Many cases demonstrate attribution difficulties:

Actors use proxies and cutouts
Technical evidence (IP addresses, etc.) can be spoofed
Determining state direction vs independent actors is difficult
Political implications of attribution require high confidence

Later module covers attribution in detail, but these cases show why it’s challenging.

[screen 14]

Impact Assessment Challenges

Determining actual impact of FIMI operations is difficult:

Correlation doesn’t prove causation (would Brexit/Trump have happened without FIMI?)
Measuring attitude change is complex
Separating foreign from domestic manipulation
Accounting for organic spread after initial seeding

These cases affected public discourse, but quantifying electoral or policy impact remains contentious.

[screen 15]

Lessons for Defense

These cases inform defense strategies:

Prevention:

Awareness and media literacy reduce vulnerability
Platform policies and enforcement matter
International coordination enables swift response

Detection:

Pattern recognition across platforms
Linguistic and behavioral analysis
Researcher and civil society monitoring