Verified violations

Verified violations

- Digital Threat Digest


There’s a thin line between propaganda and disinformation, and it grows thinner with every new election, conflict, or global pandemic. The general shift in disinformation over the past five years has been away from outright fabricated content, away from photoshop, deepfakes, and demonstrably false narrative promotion, towards real people saying real things which become harmful at scale. The Russian invasion of Ukraine has somewhat bucked that trend, as we now see overt disinformation and fabricated content amplified by authentic nodes. And it’s even trickier, because the majority of those nodes are official verified profiles across multiple platforms. Ministry of Foreign Affairs accounts, profiles of ambassadors, official media organisations, and various other verified and state-affiliated entities are openly promoting outright disinformation.

The majority of these profiles—taking Twitter as an example—are verified; the little blue tick that brings legitimacy, authenticity and credence to the words and images they promote. Creating and building a node that has legitimacy is a key component of Information Operation activity, because it typically ensures that any content it promotes leeches that authenticity. It’s why past campaigns have either sought to impersonate official media entities ( still exists and it still uses the official CNN colour scheme) or, like the Ghostwriter campaign, to compromise pre-existing nodes which have prior legitimacy, such as accounts of politicians or journalists.

Most platforms now have some form of publisher transparency information across these nodes, the policy under which George Galloway had his Twitter account labelled as Russia state-affiliated media. Yet on Twitter that mark is missing for the BBC, for France24, for Deutsche Welle. And the designation doesn’t seem to have stopped Russia’s army of Embassies, Ambassadors, and Spokespersons from sharing coordinated disinformation at scale. They’ve captured significant audiences, and are now moving into the second stage of the process, bottling that captive audience in an echo chamber where they can continue to digitally proselytise ad infinitum.

In the case of Russia and Twitter, the redirection is to Telegram, where some 50 channels run by official branded Ministry of Foreign Affairs and diplomatic entities have been created since Russia invaded Ukraine. This not only ensures captive audiences can be held long term, but also provides backup infrastructure to activate in the event of deplatforming, should they continue to violate platform ToS as the invasion continues. Deplatforming might not be the best option, as it will facilitate and speed up the creation of these echo chambers. But the alternative is allowing verified nodes with inherent visual legitimacy to continue promoting disinformation. Very much a zero sum game.

PGI’s Digital Investigations Team brings you the Digital Threat Digest, get SOCMINT and OSINT insights into disinformation, influence operations and online harms, straight to your inbox.

PGI’s Social Media Intelligence Analysts combine modern exploitative technology with deep human analytical expertise that covers the social media platforms themselves and the behaviours and the intents of those who use them. Our experienced analyst team have a deep understanding of how various threat groups use social media and follow a three-pronged approach focused on content, behaviour and infrastructure to assess and substantiate threat landscapes. 

Ready to get started? Speak to one of our experts.

If you have any questions about our services or would like to learn more about our consultants here at PGI, please get in touch with us and speak with one of the team, call us on +44 (0)845 600 4403 or email us at

Get in touch

Want to find out more?