How the Kremlin circumvented EU sanctions on Russian state media in the first weeks of the illegal invasion of Ukraine

This forum article is about the EU’s sanctions levelled at Russian state media, and the steps the Kremlin took to ensure its war propaganda continued to reach Europe. The article examines Kremlin efforts to coordinate cross-platform influence operations on Telegram, as well as the role of digital diplomacy accounts in partially replacing state media reach. This leads to a discussion on the role of digital diplomacy in war propaganda and some of the consequences for the future of this research field.


Introduction
This article is about a small segment of the information war between the Kremlin and the EU, which reveals a complex battle of attrition taking place within and between social media ecosystems. This battle takes place not at the level of personas and narratives, but rather at the level of the infrastructure that carries (dis-)information. It is, in other words, not so much a question of the propaganda itself and how it is constructed more or less well, but of the techniques and methods by which propaganda gains a foothold in the battle of ideas.
To investigate this, the article explores the restrictions enforced by the European Union (EU) and Very Large Online Platform (VLOP) holders to limit the spread of Kremlin propaganda during the first weeks of the Ukraine war, and the measures taken by Kremlin propagandists to circumvent those restrictions. It describes, therefore, the game of cat-and-mouse which constitutes a front in the information battle, through which the most iconic propagandist images and narratives have been able-or not-to reach their intended audiences. This leads to a discussion on the role of digital diplomacy in war propaganda that will offer food for thought for scholars engaged in the study of diplomats' behaviour on social and digital media.
This forum piece summarises the collective findings from a conglomerate of research organisations who have been advising EU institutions and governments on how VLOP owners have handled Russian propaganda during the war, under the leadership of Felix Kaarte and Ben Scott at RESET. The author is particularly grateful to Julia Smirnova at Institute for Strategic Dialogue (ISD), Rolf Fredheim, Aleksandra Atanasova, Johannes Lindgren, Elsa Isaksson, and Anneli Ahonen in contributing to these research findings.

The scramble to (be seen to) do good
The first days of the invasion saw profound declarations of Western unity seeking to squeeze the Russian war economy through sanctions. Alongside these efforts was a series of updated policies and regulations covering Russian access to media and social media, some of which came from governments, some from the VLOP owners. The shared goal might be said to focus on infrastructures for influence-a concept which may be useful to consider as an inherent, yet nebulous, component of public diplomacy theory. This concept does not refer to the content of digital diplomacy, but rather to the underlying structures that a country invests in, often long-term, in order to facilitate its influence objectives. For example, state news broadcaster RT has over time established an infrastructure capable of delivering statesanctioned content both via traditional media and through targeted methods such as Facebook pages, networks of statebacked news agencies in different languages, and support to proxy groups in different markets. This variety of methods and techniques might together be referred to as an infrastructure for influence. The robustness of such an infrastructure is precisely what is tested when efforts are made to shut it down.
Within two days of the start of the invasion on February 24, 2022, EU Commissioner Breton called on VLOP owners to do more about pro-Kremlin disinformation, later tweeting images from a video conference with Silicon Valley CEOs. 1 The following day, EU President Ursula von der Leyen announced that the EU was "developing tools to ban" the Kremlin's "toxic and harmful disinformation in Europe." 2 On 1 March, the EU announced unprecedented sanctions on Russian state media including RT and Sputnik, temporarily removing them from TV, streaming platforms, apps, and the Internet. 3 Meanwhile, the Kremlin enacted its own policy changes toward VLOPs. Already ongoing was a new law (the "landing law") created to force VLOPs to set up legal entities in Russia, in order to make them vulnerable both to the Russian legal system and Kremlin pressure to censor unfavourable material. 4 In the first days of the war, Meta rejected demands to stop fact-checking and labelling of Russian state media sources, and in retaliation the Kremlin restricted access to Facebook and Instagram within Russia. 5 The Kremlin also demanded that all media organisations remove words such as "assault," "invasion," or "declaration of war" from their coverage of Ukraine under threat of large fines or being blocked. 6 Soon after, legislation was proposed to punish 'fake news' about the war with 15 years in prison, and access to some (but not all) Western VLOPs within Russia was throttled if not fully restricted (Image 1). 7 Image 1 Availability of selected web domains in Russia on 15th of March 2022. Source Globalcheck.net In these initial moments of the invasion, Meta (owner of Facebook and Instagram), 8 Twitter, 9 and Alphabet (owner of Google/YouTube) 10 made public statements of policy changes targeting the Kremlin, which then quickly aligned with the new EU sanctions to ban Russian state media content. In general, VLOP policy changes focused upon: • Geo-blocking and account suspension of Russian state media • Account and content labelling of official Russian sources • Increased moderation of war-related content • Demotion of official Russian content and some other warrelated content • Demonetisation of pro-Kremlin channels • Advertising bans by Russian channels • Limited creation of new accounts in Russia The sum of these changes may be considered a scramble to make a difference and to be seen as doing the right thing. In many respects, the result was unenforceable and un-measurable chaos: policies piled upon policies, culminating with EU-wide sanctions against Russian state media. In most cases, VLOP owners made statements of policy changes without providing evidence or clarification for what was being done in practice. For example, as of June 2022, no VLOP has published a list of the Russian state media accounts geo-blocked within the EU. The result was a fog of (information) war on the VLOPs, in which no single actor, including the EU Commission, could claim to have oversight of which measures were actively enforced, and what the overall effects of those changes were. The infrastructures for influence were disrupted without any clear picture of impact. It is in this context that the first weeks of the information war took place, which this essay attempts to offer some insights.

Did the EU's Russian state media sanctions have an effect?
The first and most obvious question to ask is whether the VLOP enforced the EU's ban. Our research group created a list of 303 known Russian state media accounts on seven major VLOPs and tracked whether each VLOP geo-blocked or removed these accounts for EU audiences during the first two weeks of the sanctions' announcement. 11 The list is incomplete and reflects the best-known accounts collected by a group of researchers familiar with Russian state media. We found that performance varied greatly, with 123 accounts remaining accessible. The aggregated reach of the remaining accounts totalled almost 50 million subscribers or followers (see Image 2).
A month later, our researchers took a deeper look at how the ban had affected a more extensive list of 83 Russian state media-affiliated Facebook pages to see what impact these changes had in practice. The results seem to suggest that Russian state media Facebook pages were no longer as significant a news source in Europe. Pages targeting the EU showed a significant increase in engagements during the first week of the war, rising from around 1.6 million a week to a peak of almost 3 million, before dropping to less than 50% of pre-war engagements. This decline steadily continued, with the pages levelling out at under one-third of pre-war levels (Image 3). However, the number of posts made on these pages decreased by nearly two-thirds during the same period. This indicates that the page owners anticipated blocking and directed their resources elsewhere, or perhaps that they encountered technical problems such as staff or content shortages. 12 Either way, the sanctions clearly contributed to a drop in the relevance of Russian state media to EU audiences on Facebook.
In practical terms, it is impossible to determine whether these changes are the results of the sanctions, changes in Facebook algorithms, changes in RT/Sputnik behaviour, changes in consumer behaviour, or some combination of these and more. What is, however, clear is that disruption Image 2 Implementation of the EU ban on Russian state media on seven VLOPs, first 2 weeks 8 https:// twitt er. com/ nglei cher/ status/ 14969 09654 07231 5915; https:// about. fb. com/ news/ 2022/ 02/ metas-ongoi ng-effor ts-regar ding-russi asinvas ion-of-ukrai ne/. 9 https:// blog. twitt er. com/ en_ us/ topics/ compa ny/ 2022/ our-ongoi ngappro ach-to-the-war-in-ukrai ne. 10 https:// editi on. cnn. com/ 2022/ 02/ 26/ tech/ meta-youtu be-faceb ookrt-demon etize/ index. html. 11 Note that while both Telegram and VKonkakte are Russian-owned and primarily Russian-speaking VLOPs, both were compelled to follow the same procedure as Western VLOPs and apply EU sanctions upon content accessed within the EU. 12 There have been reports of RT staff quitting on principle or being laid off due to the war. to the infrastructure for influence, in this case the ability of Russian state media to maintain active Facebook pages, is significant. These results offer an intriguing early glimpse into the possible effects of the sanctions, while begging the question of what steps the Kremlin took to reconfigure its propaganda delivery to Europe in anticipation of the sanctions disrupting its usual methods.

How the Kremlin reconfigured its propaganda to bypass EU sanctions
In the first 2 weeks of the sanctions, the Kremlin took several ad hoc measures aimed at circumventing the ban. The measures demonstrate the operational inventiveness of a social media-savvy adversary. Some early technical solutions can only be described as ad hoc. Mirror and copycat accounts were created across VLOPs. For example, mirror accounts of main RT and Sputnik channels mostly used numbers and underscores to differentiate their account names from the banned channels. Some of those channels were caught and removed, but new iterations continually appeared.
The restricted websites switched to domains such as.site and.team, while as much traffic as possible was redirected to unrestricted Russian platforms such as VKontakte, Odysee, and Yandex, where the accounts could continue their business as usual, albeit to smaller audiences. SNA, the German version of Sputnik, tried to circumvent sanctions by renaming itself to "Nachrichten aus Osteuropa" on Telegram; it did not fool the platform operators. The android version of the RT app was made available for direct download, thereby evading the Google Play Store ban, while social media accounts promoted links to high quality livestreams of RT delivered through web proxy services, using the infrastructure of mirrored accounts mentioned above to share the latest links.
While these ad hoc measures engaged the VLOP in a low-brow game of cat and mouse, some more significant systemic changes in the Kremlin's propaganda methods took hold by mid-March. The two most significant adaptations go hand-in-hand: a shift in focus to Telegram as the main VLOP of choice, and a shift to conducting much 13 coordination of influence operations overtly rather than covertly. Indeed, Ukrainian propaganda sources have also made Telegram a social media base of sorts, suggesting that a key front in the information war took place on a VLOP less familiar to many Western social media users.
Likely enabled by Telegram's more permissive content rules, a recurring theme of Kremlin propaganda since March has been the use of open Telegram channels to coordinate cross-platform influence operations. Cross-platform influence operations refer to efforts coordinated in one place, such as a chat room or messaging service that sets out a plan for users to move en masse to another VLOP in order to, for example, target hostile comments to a specific account or post. This is sometimes referred to as brigading or flooding. In some cases, coordination involves production of campaign assets, such as scripts, audio-visual content, lists of accounts or posts to target, and sometimes payment. Examples of early pro-Kremlin overt cross-platform influence operations on Telegram include: • Coordinated infiltration of channels intended to share emergency information locally in Ukraine to seed misleading or harmful disinformation • Channels aggregating troop movements and other opensource intelligence (OSINT) related to the war Telegram provided, in other words, an alternative infrastructure for influence that channelled the mass movement of trolls and other engaged social media users either to other VLOPs, other parts of the Internet, or to real-world actions.
Most interesting for the purposes of understanding digital diplomacy during the war was a renewed focus on official social media accounts as well as those of state media journalists and staff. The accounts of individuals associated with RT such as Editor-in-Chief Margarita Simonyan, as well as the network of MFA and Russian Embassy accounts, were unaffected by the ban. Put simply, a broader infrastructure of digital diplomacy channels supplemented by the accounts of prominent state-affiliated individuals remained a key source of Kremlin propaganda within the EU even if RT and Sputnik were not there to amplify that content.
During the war, pages of Russian diplomatic representations in the EU significantly increased both their followers and the level of engagement of their audience (see Image 4). An analysis of 44 accounts of Russian diplomatic representations in the EU countries shows that the level of engagements increased by 240% compared to the pre-war level. Of course, much of this engagement is negative, and many Europeans are using those pages to vent their frustration at the Kremlin's actions. Yet, overall followers of these pages in the EU increased by 21.4% since the beginning of the year. While the total number of followers for pages of Russian diplomatic representations in the EU (448k) still stays well below the followers of pages of Russian state media focused on the EU (29.8 million), pages of embassies and consulates have a higher interaction rate per follower (3% of followers interacted with posts on average in the observed period compared to 0.02% of followers for Russian state media). In the week of 15-21 May, pages of diplomatic representations in the EU received 148 thousand interactions, compared to 334 thousand interactions on state media pages. Put simply, digital diplomacy is keeping the channels for discussion open between the Russian state and EU publics during a time of geoblocking, bans, and censorship.

Conclusion
Russia lost the early stages of the information war, at least in Europe. The state media sanctions disrupted the usual infrastructures for influence, which seems to have forced a reliance on open Telegram channels to run influence operations targeting Western VLOPs. However, official government social media accounts are not covered by the EU state media ban, despite those accounts often making use of high-quality media production capabilities dedicated entirely to the promotion of official state-sanctioned content. So while these disruptions seem comprehensive, digital diplomacy channels have assumed the role of a backup state media broadcasting system. We may question how effective this really isanecdotally, many engagements with these accounts in many Image 4 Total number of followers for pages of Russian diplomatic representations in the EU, 1 January-24 May 2022. Source ISD/CrowdTangle markets are highly critical of Russia, just as Europeans have been outside of Russian embassies in their capitals-but still this network keeps communication channels open between the Kremlin and EU audiences during a challenging time.
This may point to some value-added for digital diplomacy accounts when friendly relations between states break down: as a space where public diplomacy can persist, given time. Infrastructures for influence include an element of robustness and redundancy; they should be able to cope with disruption. However, this does raise difficult questions about digital diplomacy's potential as a back-up or proxy for state media, and hence whether information shared by diplomats and diplomatic institutions can always be an exception to national sanctions or VLOP content moderation. Furthermore, it begs questions of the robustness of Western influence infrastructures targeting Russia, which have been pressured by reciprocal sanctions. How effectively have they performed in light of geo-blocking, throttling, and bans, and what types of workarounds has the West provided for its friends in Russia who seek alternatives to fascist Z propaganda?
Perhaps the most concerning aspect of the trends highlighted above is the lack of capability, both within the EU and the VLOPs, to provide fast and accurate insights into the effects of policy changes to researchers, journalists, and the public. At the moment, it remains unclear which actions have contributed to desired results, and which were unnecessary, contradictory, or harmful. It is this ambiguity (or "fog of information war") that enables an adversary like Russia with considerable resources and digital know-how to continue to thrive despite overwhelming efforts to disrupt its propaganda activities. Disinformation is not unstoppable, but it will seep through enforcement gaps. More systematic approaches to dealing with infrastructures for influence require stronger concepts, research methods, legislative oversight, and access to data. At present, all areas are lacking. In particular, so long as VLOP owners restrict researcher access to information about their platforms, the development of robust concepts and research methods will likely remain several steps removed from the cutting edge.
Public and digital diplomacy scholars can identify entire research agendas within these questions of exploits and vulnerabilities. While public diplomacy research by definition covers the creation of infrastructures for delivering friendly relations and promotional content, less well understood are the actors and practices behind contemporary illicit and illegitimate infrastructures for influence. The disruptive nature of illegitimate influence is so much more than simply "disinformation" and should be viewed as an existential threat to the norms and credibility of public and digital diplomacy in its current liberal forms. Research agendas might, therefore, also include disruptive practices toward legitimate public diplomacy, as well as the effects of disruption upon illegitimate infrastructures for influence. For amid the geopolitical uncertainty of 2022 one thing is clear: there is no simple way to return to a pre-invasion security order, and hence no simple return to the public and digital diplomacy of recent years.
Funding Open access funding provided by Lund University. Funding was provided by Marcus och Amalia Wallenbergs minnesfond.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http:// creat iveco mmons. org/ licen ses/ by/4. 0/.