[screen 1]
A divisive story appears simultaneously across dozens of seemingly unrelated accounts. Within hours, it trends on multiple platforms. Traditional media picks it up. By the time fact-checkers debunk it, millions have seen it.
This isn’t organic virality - it’s coordinated manipulation using proven tactics. Understanding these techniques is essential for detection and defense.
[screen 2]
The FIMI Playbook
While specific operations vary, common tactical patterns emerge:
Seeding: Introducing narratives through multiple channels
Amplification: Using networks to boost visibility
Legitimization: Getting narratives picked up by authentic accounts and media
Persistence: Sustaining narratives despite debunking
Adaptation: Evolving tactics as platforms respond
These stages often overlap and repeat in sophisticated operations.
[screen 3]
Fake Accounts and Personas
Inauthentic accounts are fundamental to FIMI operations:
Bot accounts: Automated or semi-automated accounts for volume
Troll accounts: Human-operated fake personas
Sock puppets: One operator controlling multiple personas
Hijacked accounts: Compromised legitimate accounts
Aged accounts: Built over time to seem authentic before activation
Sophisticated operations use convincing personas with histories, consistent personalities, and realistic activity patterns.
[screen 4]
Building Believable Personas
Creating credible fake accounts requires effort:
- Profile photos: Stolen or AI-generated faces
- Biographical details: Consistent, locally relevant information
- Activity history: Months of normal-seeming posts before operation
- Network building: Connecting with real users
- Content diversity: Not just propaganda - also normal social media activity
- Local knowledge: Cultural references, language nuances
Well-constructed personas are difficult to distinguish from authentic accounts.
[screen 5]
Coordinated Inauthentic Behavior (CIB)
Platforms increasingly detect not individual fake accounts but coordinated networks:
Simultaneous posting: Multiple accounts sharing identical or near-identical content at the same time
Coordinated engagement: Networks liking, sharing, and commenting in patterns
Amplification chains: Content passing through networks in organized sequence
Coordinated targeting: Multiple accounts attacking or defending same targets
CIB detection focuses on patterns rather than content, making it harder to evade.
[screen 6]
Content Strategies
FIMI operations employ diverse content approaches:
Inflammatory: Designed to provoke emotional response
Divisive: Exploiting existing societal fault lines
Partially true: Mixing facts with false conclusions
Authentic but manipulated: Real content recontextualized
Absurd: Flooding space with contradictory claims to create confusion
Whataboutism: Deflecting criticism by pointing to others’ problems
Effective operations use sophisticated content, not obvious propaganda.
[screen 7]
Narrative Laundering
Making foreign propaganda appear organic and credible:
-
Seed content on marginal websites or social media
-
Amplify through inauthentic networks
-
Get picked up by conspiracy sites and fringe media
-
Further amplification makes it appear popular
-
Traditional media reports on trending content
-
Politicians and public figures reference it
-
Original foreign source cites Western coverage as validation
This cycle transforms obvious propaganda into seemingly legitimate news.
[screen 8]
Targeting and Timing
Sophisticated operations carefully target and time content:
Audience segmentation: Different messages for different demographics
Geographic targeting: Local languages, cultural references, regional issues
Psychographic targeting: Personality-based messaging
Strategic timing: During elections, crises, or relevant news cycles
Rapid response: Exploiting breaking news before fact-checking can respond
Sustained campaigns: Long-term narrative building, not just reactive
Targeting precision dramatically increases effectiveness per resource invested.
[screen 9]
Exploiting Platform Features
FIMI operators understand and exploit platform mechanics:
Algorithmic amplification: Creating engagement that algorithms reward
Hashtag hijacking: Co-opting trending topics
Reply-guy tactics: Inserting narratives into high-visibility conversations
Community manipulation: Taking over or creating groups/communities
Recommendation exploitation: Getting content into “recommended” feeds
Cross-platform coordination: Using multiple platforms simultaneously
Platform-specific tactics evolve as platforms change features and policies.
[screen 10]
The “Firehose of Falsehood”
A particularly Russian tactic involves overwhelming volume and speed:
Principle 1: High volume: Numerous channels, many messages
Principle 2: Rapid, continuous: Constant stream, not discrete campaigns
Principle 3: No commitment to consistency: Contradictory messages acceptable
Principle 4: No commitment to objective reality: Lying without consequence
Goal isn’t persuasion but confusion - making truth indistinguishable from falsehood. When everything is false, nothing is true.
[screen 11]
Integration with Cyber Operations
FIMI often combines with cyber tactics:
Hack-and-leak: Stealing and selectively releasing information
DDoS attacks: Taking down competing narratives
Website defacement: Psychological impact
Doxing: Revealing personal information to intimidate
Malware distribution: Through manipulated links
Information and cyber operations reinforce each other, creating compound effects.
[screen 12]
Offline-Online Integration
Sophisticated operations don’t stay online:
- Organizing real-world protests
- Creating physical propaganda (posters, billboards)
- Events and conferences
- Funding political organizations
- Cultivating relationships with political figures
- Traditional media placement
Online amplification makes offline activities appear more significant; offline activities lend authenticity to online content.
[screen 13]
Astroturfing
Creating fake grassroots movements:
- Manufacturing appearance of organic public support
- Fake petition signatures
- Coordinated letter-writing campaigns
- Fake protest organizing
- Impersonating activists and organizations
“Astroturf” (fake grass) movements aim to influence policymakers and media by simulating public opinion.
[screen 14]
Exploiting Mainstream Media
FIMI operations often aim to get mainstream media coverage:
- Creating events newsworthy enough to report
- Flooding social media to create “people are talking about…” stories
- Providing seemingly credible sources for journalists
- Creating controversy that demands coverage
- Gaming trending algorithms
Once in mainstream media, foreign propaganda gains legitimacy and reach far beyond inauthentic networks.
[screen 15]
Persistence and Adaptation
FIMI operations show remarkable persistence:
Returning narratives: Same false claims reappear months or years later
Tactical evolution: Adapting to platform countermeasures
Network regeneration: Creating new accounts as old ones are removed
Multi-platform redundancy: When one platform acts, move to others
Learning: Studying what works and doesn’t work, improving operations
This persistence means defense requires sustained effort, not one-time fixes.
[screen 16]
Why These Tactics Work
FIMI techniques exploit fundamental features of information ecosystems:
- Cognitive biases: Confirmation bias, emotional reasoning
- Platform economics: Engagement-optimizing algorithms
- Information overload: Difficulty processing volume
- Speed asymmetry: Lies spread faster than corrections
- Polarization: Existing divisions easy to exploit
- Decreasing trust: Institutional skepticism creates information vacuum
Understanding why tactics work helps design countermeasures that address root vulnerabilities.