Countering WMD Information Manipulation in Bulgaria and Romania: One of the most troubling aspects of Russia’s aggressive foreign policy is its renewed interest in weapons of mass destruction (WMD), such as chemical, biological, and nuclear weapons. The Kremlin’s strategy utilizes unconventional weapons as both material and psychological threats for global power projection and geopolitical manoeuvring. As a result of Russia's nuclear sabre-rattling, the risk of nuclear weapon use has increased to levels higher than at any time since the depths of the Cold War.

Russia’s WMD-related activities are typically accompanied by the spread of false or misleading information within and beyond its borders. These foreign information manipulation and interference (FIMI) activities aim to evade accountability, sow confusion, issue threats, legitimize the use of force, and undermine international rules on non-proliferation, ultimately paving the way for the normalization of the use of WMD in international relations.

Justification through deception: Shortly after the Russian invasion of Ukraine began in February 2022, Russian leaders attempted to justify their actions by alleging that Ukraine and the United States were collaborating on the development of biological weapons within secret laboratories in Ukraine, without providing any verifiable evidence. This unsubstantiated claim was amplified by Kremlin-controlled and -aligned outlets in Bulgaria and Romania throughout 2022-2023, albeit with significantly different results (see: Georgiev, G. and Novossiolova, T., Disinformation Storm: WMD Hybrid Threats in Romania and Bulgaria).

In Bulgaria, the narrative found significant traction, reflected in the publication of thousands of misleading articles across the nation's most frequented websites over the two years. In contrast, the story flatlined in Romania after March 2022 following an initial flurry of nearly 200 articles. Unlike the case in Romania, virtually every single development on the issue by the Kremlin and its proxies was widely covered by Bulgarian online outlets from 2022-2023.

The dissemination patterns show that over 90% of the Bulgarian-language articles originated from highly-ranked, mainstream domestic websites, significantly impacting the public discourse on the war and emboldening local politicians and other actors aligned with Russia. In contrast, considerably fewer Romanian online outlets amplified the narrative, and the ones that did were fringe websites with a fraction of the reach of their Bulgarian counterparts.

Stark contrast: The analysis underscores a stark contrast between Bulgaria and Romania in the spread and impact of misleading content about biological laboratories, reflecting broader cultural differences in how Russia is perceived publicly. Romania does not share many of the cultural pull factors or cognitive capture that make citizens in majority Slav countries vulnerable to pro-Kremlin information interference, particularly the shared linguistic, ethnic, and historical heritage. Differences in geopolitical public perceptions have been evident in numerous comparative surveys, with Romanians being over eight times less likely (at 3%) to see Russia as a strategic ally after the invasion compared to Bulgarians (at 26%) or Slovaks (25%). These differences appear to be reflected in the level of engagement with pro-Kremlin narratives related to WMD.

For example, the reach of Bulgarian-language articles peaked in March 2022 with nearly 2 million potential readers, accounting for 40% of the country's internet users (with a vast majority encountering the narrative during that month alone). Meanwhile, the reach within Romania was considerably less, with only about 300 thousand readers, or 2% of the internet users, exposed to similar content. As far as local web traffic is concerned, it is estimated that the narrative was roughly 20 times more popular among Bulgarian users compared to Romanian ones.

This disparity extends to social media, where Bulgarian-language Facebook posts on the subject outnumbered and out-interacted Romanian ones by nearly three times. Notably, relevant posts by the Russian Embassy in Sofia garnered more than seven times the interaction rate of those by its counterpart in Bucharest, again illustrating the significant difference in the reach of pro-Kremlin narratives between the two countries.

VK and News Front still active in Europe: A significant share of social media engagement in Bulgaria originated from VK (short for its original name VKontakte)where the Bulgarian editors of the Kremlin-controlled News Front outlet share their work. Despite widespread recognition of their role in pushing the Kremlin’s narratives, the websites of both VK and News Front remain accessible to EU users following the full-scale invasion. 

Owned by the state-controlled Gazprombank (a subsidiary of the energy giant Gazprom), VK is one of the most visited social media in Russia and the world, with some 80 million monthly active users at the end of 2022. The platform is used by the Kremlin to both monitor the online activities of its citizens and as an informational weapon aimed at Russian speakers globally. VK’s CEO, the Kremlin-connected Vladimir Kiriyenko, was sanctioned by the U.S., EU, and UK in 2022 in relation to Russia’s  invasion of Ukraine.

For its part, News Front was established amidst the annexation of Crimea when Russian forces bearing no insignia stormed the building of the Crimean Center for Investigative Journalism (a reputable investigative outlet at the time) before incorporating it into the Kremlin’s growing propaganda machine. The outlet publishes in nine Central and East European languages (including Bulgarian but not Romanian). It has been sanctioned repeatedly by the U.S. Department of the Treasury due to its reported connections with and the support it receives from Russian intelligence services. The presence of significant traffic from VK and News Front reflects the relatively higher cross-country connectivity between Bulgarians and Russians on the platform (and presumably beyond it).

Next steps: The media monitoring reveals significant discrepancy between the neighboring countries and important nuances in the challenges they face. While pro-Kremlin, WMD-related disinformation constitutes a security threat for both Bulgaria and Romania, its magnitude is much more pronounced in Bulgaria. However, this is far from implying that Romania’s information space and politics are safe from hybrid threats or authoritarian influence. Sympathies for anti-systemic actors have always been present and appear to be on the rise in 2024 together with political and social polarization, as the country prepares to hold local, presidential, parliamentary, and European elections.

Tackling WMD-related disinformation should focus on the following priorities:

• Institutional Reforms and Media Transparency. Strengthening institutional frameworks to enhance media freedom and transparency is vital. A top priority for both countries is to address critical institutional issues related to media freedom and pluralism, especially the lack of transparency regarding media ownership, the distribution of state funds, and the broadcasting of content paid for by political parties. Ensuring the editorial independence of public broadcasters and addressing SLAPPs (strategic lawsuits against public participation) are also crucial steps.
• Enhanced Regulatory Frameworks. Media regulators must be empowered with the necessary resources and authority to track and penalize content from sanctioned entities. This includes ensuring their independence from political interference and adopting advanced technology solutions that can automate some oversight functions. Similar to other EU members (e.g. the Netherlands), Bulgaria and Romania must explore the option of extending their legal and institutional frameworks for legacy media regulation to cover popular local video content on large online platforms (such as Facebook, YouTube., TikTok, etc.). To this end, both countries should make use of the new tools and mechanisms provided by the Digital Markets Act (DMA) and particularly the Digital Services Act (DSA). Bulgaria still needs a comprehensive legal basis for applying media-related sanctions.
•  Digital Forensics. Establishing a dedicated digital forensics infrastructure to detect and investigate information operations and the actors that amplify them in near real-time is essential. Media monitoring and audience analysis tools that measure the volume and reach of recurrent narratives should be complemented with open-source tools and task forces specializing in investigation through OSINT collection. A more sophisticated system would also comprise tools that analyze the digital makeup of online news sources in bulk and automatically detect signs of exploitation and abuse, such as inauthentic contact or ownership information, domain repurposing, and lack of a privacy policy or general terms of use, as well as other well-documented signs of malicious intent. A further step would be monitoring the integrity of algorithms and the monetization of content through advertisements, ensuring they comply with national and international obligations. Introducing technology solutions, data analysis, and a flexible, case-based workflow for media regulators, as well as Digital Services Coordinators (DSC), is practically a necessity at this point.
• Public Exposure and Counter-Messaging. Bulgaria and Romania must seek to publicly expose and pre-bunk Russian plans and underlying intents, including by declassifying intelligence when deemed necessary. A counter-messaging strategic plan containing various options should be included as an integral part of a wider integrated national approach for countering hybrid threats.