Introduction

As geopolitical conflicts are increasingly shaped by misleading and deceptive information, Open Source Intelligence (OSINT) has become an indispensable tool in understanding adversarial information operations and being able to compete in the information environment. Noting the value of OSINT, the Office of the Director of National Intelligence (ODNI) recently published a framework for the intelligence community to leverage commercially available information. Competition in the information environment among major powers is not new or unique. Today, Russia and China strategically employ information operations as part of their attempts to undermine US interests. China has actively used information operations to generate favorable strategic outcomes in Africa. Russian and Chinese messaging is also aligned in exploiting how the Israel-Hamas conflict is characterized. In this competition space, the distinction between signal and noise is more heightened than ever. As the volume of data increases, so does the challenge of identifying what matters — the relevant information that can be synthesized into actionable intelligence. This makes OSINT crucial for tracking and analyzing security threats as well as for monitoring the ebb and flow of online narratives that can influence public opinion and shape national security policy.

Derived primarily from online content published by malign actors, narrative intelligence (NARINT) is an increasingly critical tool of OSINT analysis. It refers to the study and analysis of disinformation and propaganda surfaced on social media platforms, news sites, internet forums, blogs, and the dark web. By thoroughly assessing these materials, analysts can gain a clearer understanding of the narrative tactics foreign entities are using to create hostile divisions and erode basic trust in the nation’s institutions. NARINT is particularly critical to detect, analyze, and compete against adversarial information operations that attempt to undermine US national security interests. It can parse through news, blogs, forums, social media, the dark web, digital broadcasts, and other sources to provide insights that are critical for early indications and warnings. Moreover, it can show how narratives shift and affect public sentiments and opinions about conflicts.

Fig. 1: Examples of Russian and Russia-aligned sources amplifying articles about internal division within NATO over its support of Ukraine.

We can illustrate all this by examining how Russia and China have employed sophisticated information operations to manufacture and amplify divisions about how NATO members support Ukraine against the Russian invasion. Figure 1 shows how AI-powered content aggregation and enrichment can detect and surface Russia-aligned sources amplifying and propagating narratives about internal division within NATO. We can see how Russia has strategically employed information operations to exploit and amplify divisions between NATO members. For instance, Russia has amplified narratives of dissent and disagreement among NATO allies over military aid, economic sanctions, and long-term strategy in Ukraine. Russia attempts to weaken the unified front that has been instrumental in countering its advances.

Fig. 2: Theme tracing locates media items that contain similar thematic emphasis, and places them along a timeline with SCAME-rich information about the sources amplifying them.

China has emerged as an opportunistic supporter of Russia’s information operations, amplifying Russian narratives that serve both nations’ interests in diminishing Western influence. Figure 2 shows how Chinese state media, other official platforms, and their affiliates often echo Russian positions on the conflict, presenting a united front that undermines Western policies. The alignment of Chinese support with Russian information operations intensifies the challenge for NATO to maintain a cohesive strategy and public support for Ukraine. It also undermines popular support for NATO’s efforts by creating the impression that the bloc is rife with internecine dissent, and too disorganized to unite effectively around its support of Ukraine. Figure 3 illustrates a theme trace from 11 May to 20 May 2024 that shows how Chinese outlets amplify similar stories to Russian propaganda.

Fig. 3: AI-powered text vectorization allows analysts to search for articles that amplify similar themes, and track the spread and evolution of narratives over time.

Given the volume of content on social media, it’s impossible to be comprehensive, but the evidence speaks for itself. According to one study, nearly 20% of all search results on TikTok lead to some form of disinformation. In one recent survey, 65% of users said they had encountered some form of disinformation on TikTok. Those who push false narratives tend to package them in such a way as to manipulate audience emotion, meaning relatively small volumes of fake news items often gain considerably more traction than legitimate coverage. Online audiences, it seems, prefer galvanizing disinformation and confirmation bias over more objective news, which they often find ‘boring.’

On Telegram, the situation may be even more dire. A 2020 study conducted at Oxford University claimed that “Out of the top dozen news sources examined, 33% of all views go to junk news sources.” Given that Telegram has over 400 million users worldwide, its significance as a source of disinformation isn’t in doubt. It doesn’t help that consumers of junk news tend to be considerably more engaged than mainstream news audiences, meaning they are far more inclined to amplify false narratives than others are to share valid ones. And with much of Telegram’s content originating in Russia and Iran, it seems likely that the amount of disinformation on the platform will only increase over time.

As noted above though, social media is not the only means by which malign actors distribute propaganda and disinformation. They also rely on state-run media outlets, as well as proxy publications that operate independently but contribute to official narratives all the same. A cluster of Russian newspapers has been working to deepen the tension between NATO members over how best to aid Ukraine. These include TASS, Sputnik, and RT (formerly Russia Today). Assisting them in this effort are various other entities, among them South Front News, Global Times, and The People’s Voice.

In addition to social media and news sites, malign actors often employ other means for pushing false narratives. One of these include internet forum sites, such as Reddit, where anonymous manipulators sometimes make false claims in the hopes of garnering engagement from other users.

Beyond online forums, there are also a number of video-sharing sites that manipulators use to spread disinformation. The best-known of these is YouTube, but Odysee and the Canadian-based site Rumble are frequently used as repositories of false propaganda as well. A number of entities have used these and similar sites to push the theme of disunity between the US and the EU over how best to aid and equip Ukraine.

One such entity, the Hindustan Times, an Indian-based news outlet, often amplifies pro-Kremlin narratives. In mid-April it published a video reporting on a disagreement between Secretary of State Antony Blinken and French Foreign Minister Stephane Sejourne. In approximately one month’s time, the story has garnered 35,000 views and 185 comments. Similarly, the India-based Firstpost, also a Russia-friendly publication, posted an item in mid-2023 depicting a bitter divide between the EU and NATO over the same question. One year later, it has garnered 872,000 views, 14,000 positive reactions, and 5,973 comments.

Russia leverages a broad network of media outlets — often spearheaded by state-controlled media entities — to disseminate targeted misinformation and disinformation aimed at political groups within NATO countries. These efforts are designed to stoke anti-war sentiment by emphasizing the human and financial costs of the conflict. By magnifying isolated incidents of friction among NATO allies, such as disputes over the levels of military aid or the enforcement of sanctions, Russia attempts to foster a narrative of disunity and inefficiency. The Kremlin’s aims appear to be to weaken international resolve and try to diminish domestic support for Ukraine within these countries, thereby obstructing the collective defensive measures critical to Ukraine’s resistance against the Russian invasion.

Fig. 4: Narrative mapping can show geographic locations of amplifiers, and the targets of the narrative items they’re amplifying. This narrative shows Russian and Russian-aligned influencers amplifying articles about internal division within NATO over its support of Ukraine.

Russia has recently amplified a narrative claiming that Volodymyr Zelensky is no longer the legitimate president of Ukraine. Using georeferencing and enriching metadata, we entered a simple description of the claim — “Zelensky no longer legitimate president of Ukraine” — and the system’s vector analysis techniques initially surfaced over 450 narrative items. Figure 5 illustrates how these AI models can rapidly surface and visualize who is amplifying this false narrative  and how they are aligned over time. Adjusting the narratives’ similarity threshold to 84.7% (a relatively tight setting), we zeroed in on 89 items containing thematically similar content. Predictably, the amplifiers were predominantly Russian and Russia-aligned publications, but no small percentage of them are from Australia and Canada, and are not publishers at all but rather sources active on social media who are more akin to “influencers,” an indication that Russia understands the importance of having western social media users co-amplify the narratives pushed out by the Kremlin and its state media mouthpieces.

Fig. 5: A vector-based theme trace on the Russian-generated narrative that Volodomyr Zelensky is not the legitimate president of Ukraine reveals dozens of items published by Russian state media outlets, and amplified by a number of social media influencers, including a number from Australia and Canada.

As strategic competition continues to intensify, the necessity of detecting and understanding adversarial narratives has never been more critical. Information warfare does not pause or discriminate. Russia and China are both adept at crafting and rapidly propagating narratives that promote their national interests and undermine those of their rivals, but based on the past few years’ analysis of their respective efforts, there are, generally speaking, some noticeable differences between Russian disinformation campaigns versus their Chinese counterparts.

From what we see, Russian disinformation campaigns are sometimes coordinated by the Kremlin and pushed downward through state media outlets. Sometimes these campaigns are amplified by media-savvy oligarchs networks, members of which range from organizations behaving much like small- to medium-sized media outlets, to individuals operating inside Russia, throughout Europe, and often in the US and Canada. The Kremlin appears to leverage loosely coordinated networks

The Kremlin and the oligarch media appear to work together. Sometimes oligarch media put their own spin on the official Kremlin line, simultaneously amplifying it while getting their own message out in the process. Russian information operations show a generally higher level of familiarity with US culture, regional differences, and political factions, leading to more effective content that typically resonates better with their target audiences.

Like Russia, the Chinese government also pushes its disinformation campaigns downward through its state media outlets and affiliates, but absent the kind of oligarch media network in Russia, its content appears more centrally controlled by the upper echelons of the CCP media apparatus. However, China has begun to leverage regional and local outlets to amplify its messages. For the time being, China does not seem to have the familiarity with, or depth of understanding of, US culture as their Russian counterparts, which further hampers their campaigns’ effectiveness.

That said, the effectiveness of these campaigns in shaping international perception and influencing policy decisions should not be underestimated. Developing robust mechanisms to identify and counter these narratives is crucial for maintaining strategic advantage and ensuring national security.

The integration of AI into these endeavors significantly enhances intelligence capabilities. AI-based technologies can analyze vast amounts of data, detecting patterns and shifts in narratives at scale and at speeds that far surpass the capacity of human analysts, and with a degree of accuracy that continues to improve extremely rapidly. By employing AI-driven tools, intelligence professionals can quickly identify emerging adversarial narratives, assess their potential impact, and alert decision-makers in real-time. This approach allows for timely and informed responses, enabling the discovery of aligned narratives and actors and the crafting of effective aligned narratives that support US interests.

Narrative intelligence that combines comprehensive publicly-available information with AI has become critical to effective competition in the information environment. Given how malign actors exploit the openness of the information environment, it is imperative that the US leverage OSINT and AI to compete in the cognitive domain. Narrative intelligence plays a critical role in enabling first-move advantage in the information environment.

Note: Joe Stradinger is founder and CEO of EdgeTheory, a private corporation that works closely with public sector organizations to help detect and respond to foreign malign influence.

Image: NATO