Inside the ‘Journalisten Friekorps’, a pro-Kremlin influence operation

3 October 2022

An ISD investigation unveils the pro-Kremlin influence operation behind a fake video intended to convince audiences that Western weapons meant for Ukraine are ending up on the European black market.

---

 

On 18 September the First Deputy Permanent Representative of Russia to the UN, Dmitry Polanskiy, shared a tweet and a video from @ivan_8848. The video showed what appeared to be part of a Stinger missile, with men’s voices speaking in German telling the person with the camera not to film.

“A student in Bremen, Germany, found an online store selling Stingers and alerted the police. Journalists from Hamburg and other cities have already discovered that the weapons were meant for the Kharkov counteroffensive, yet they ended up on the European black market,” the tweet from @ivan_8848 claimed.

Polanskiy’s own tweet expressed outrage. “We repeatedly warned our Western ex-partners about such threats for their own population. But they are blinded with Russophobia and futile crusade against Russia. This hatred and recklessness will inevitably backfire,” he wrote.

The narrative that weapons provided by western countries destined for Ukraine would end up on the European black market, and therefore threaten European populations, is one that pro-Kremlin sources have been attempting to push for some time. This video appeared to corroborate that narrative.

But the video was a fake – and, it appears likely, so were the “journalists from Hamburg.”

In the course of our investigation into a sprawling Russian information operation targeting Germany based on spoofing legitimate media websites, ISD also uncovered what appears likely to be an attempt by the same or connected actors to pose as German journalists and a German civil society organisation. Takedown data released by Meta linked to the spoofed media network also supports a connection between the spoofed media operation and the accounts posing as German journalists.   Their operation sought to generate hostility against Ukrainian refugees in Germany.

Journalisten Friekorps

On 18 May, as the spoofed media operation was warming up on Facebook, a Telegram channel named ‘Journalisten Friekorps’ was created. The channel spelled ‘Freikorps’ incorrectly for several months in its own channel handle, @friekorps, channel name and logo. In late September the spelling of the channel name was corrected, but to avoid confusion it will continue to be referred to as Friekorps in this article.

The channel claimed to belong to a group of professional and amateur German journalists. Describing its purpose, it claimed that “The official media have moved away from the standards of honest and conscientious journalism. They serve either financial capital or government agencies. Where are the opinions of the real citizens of German cities? She’s going down on social media. We must correct this.” (translated from German).

On May 19th, a related Friekorps Chat channel was created, and made a group named «DUN news. Deutsche unabhängige Nachrichten Chat».

ISD has also identified two domains which appear to belong to the Friekorps operation. The first attempt, which previously featured the Friekorps logo but appears to have been abandoned, used the domain of a former e-commerce website registered in Moscow.

The second website, winter-is-coming[.]de, was registered in mid-July and conceals most of its details behind Cloudflare. As of September it features only the faked Stinger missile video (which will be discussed in more detail below) and a link to the Telegram channel.

The two channels were initially used to share genuine news articles taken from German news sites, which they sometimes paired with anti-Ukrainian memes. The news articles shared tended to be about cost of living increases, energy prices, protests and social tensions. The below example shares text from a Suddeustche Zeitung article about road closures, with a meme implicitly connecting Ukrainians to cost of living increases.

The two channels were also used to share Change.org and Avaaz petitions which sought to whip up hostility against Ukrainian refugees in Germany. These petitions were noted in a report about the removal of the broader spoofed media operation by Meta on 27 September, which found them being shared by the same network of fake accounts.

Notably, the assets associated with the operation on Facebook were at times even fetching Russian text in their URL shares, despite supposedly being shared by Germans to Germans.

This may have been because the Change.org link shortener automatically detected a Russian-language browser. The shortened chng.it link shared in this post lengthened into:

https://www[.]change[.]org/p/zur-bewältigung-der-folgen-der-wirtschaftskrise?recruiter=1267012010&recruited_by_id=00cceb20-dc1b-11ec-857d-374d48ef656b&utm_source=share_petition&utm_campaign=share_petition&utm_term=share_petition&utm_medium=copylink&utm_content=cl_sharecopy_33448010_ru-RU:3

Social Harmony

There is an additional connection between Friekorps and the anti-Ukrainian petitions used by the Russian operation. When the Friekorps channel was first created, its description stated that it was “created with the support of the Association of Journalists and the team from socialharmony[.]de”. It also listed a Telegram handle, @name_de, as the editorial team.

These references were removed from the channel description in September, at the same time as the spelling of ‘Freikorps’ was corrected.

Socialharmony[.]de is a website which claims to represent a grassroots group of concerned Germans called “Eine bessere Zukunft für Deutschland” (A Better Future for Germany) “…who want to prevent the obvious disaster of the current German government policy” in relation to Ukrainian refugees and Russian sanctions.

Further down the page, it states that “for the third time, the Anglo-Saxons have pitted Germany against its natural ally, Russia”, and that “Only a clear expression of consolidated German opinion against a catastrophic future for their country could persuade the government, if not to revise its ruinous policy, at least not to run into the abyss so quickly.”

The site links to the same Change.org petitions promoted by Friekorps and the spoofed media network. It also claims, bizarrely, that the next German federal election may not be held in 2025.

The site says:

“We Germans are a law-abiding people. No matter how much we grumble, no matter how dissatisfied with the current government’s policies, we still avoid loud protests and postpone our dissatisfaction until the next election. But now there is a completely unique situation, for the first time in German post-war history. The next federal election in 2025 may not take place in Germany.

Our families shouldn’t have to freeze next winter and starve in spring just because a madman from Washington and a tyrant from London decided to once again “punish” Russia. The insane spending on someone else’s war should be stopped if the situation in the country deteriorates.

Your signature on the petition serves the solidarity of the people 

The best way to express our opposition to the Scholz government’s suicidal policies is to demonstrate the dissatisfaction of most Germans without loud rallies, street parties and other actions that can further destabilize an already difficult situation. The number of signatures on the petition should allow us to demonstrate our public opposition to the dangerous and senseless policy of confrontation with Russia and insane spending on someone else’s war at a time when the situation in the country is deteriorating. The more signatures, the more obvious it will be for the German government and personally for Chancellor Scholz to listen to our opinion, to change the already existing laws and to change the general political vector.” [Translated from German]

Dropdowns for the petitions on the site refer to “our Telegram channel”, @News_Freies_Deustchland. This is one of the Telegram channels noted by Meta for its involvement in the spoofed media network.

While most of the details for socialharmony[.]de are hidden by Cloudflare, taken together there appears to be significant circumstantial evidence for suspecting that the site is part of or connected to the broader Russian influence network targeting Germany.

Fake videos and recruiting for real Germans

Beginning in late August, the Friekorps channel appeared to be moving beyond simply selective sharing of real news.

On 22 August, the channel posted an invitation for journalists, particularly young journalists, to work with Journalisten Friekorps and have their pieces shared out through Journalisten Friekorps’ channels. Friekorps claimed that the mainstream media had “moved away from the standards of honest and conscientious journalism. They serve either financial capital or government agencies,” and called for the “opinions of real German citizens.”

Attempting to recruit real writers, often freelancers or student journalists, is an increasingly common tactic for state-linked information operations, including those emanating from Russia. In some cases, the writers have no idea that they have been working for a Russian covert propaganda or influence campaign.

Interestingly, the Friekorps post also describes a “Bonus – a bot which allows for sharing the news written by our journalists on social networks and being rewarded for it.”

Two weeks later on September 7th, Friekorps posted the faked Stinger video which would later be shared by Russian UN diplomat Dmitry Polanski. As far as both ISD and fact-checking organisation Lead Stories have discovered, the Friekorps channel is the earliest place where this video was posted.

The post accompanying the video claimed that it had been sent by an eyewitness who had been in the port of Bremen on 20 July, and had seen customs officers arresting presumed Ukrainian military personnel after finding “tubular devices” about to be smuggled to Turkey aboard a ship sailing under a Ukrainian flag.

The video was a clumsy fake, overlaying footage with a soundtrack from a different video. Bremen Police confirmed on September 18th that no such arrests had occurred.

The trajectory of a fake Stinger missile video

Initially, the Ukrainian Stinger disinformation campaign appears to have gotten off to a slow start. Friekorps’ direct audience on Telegram was and remains relatively small, with just 6,200 subscribers as of 28 September.

In the days following, Friekorps posted other claims including that they had found Ukrainians selling Western weapons on the dark web, and that Ukrainians were recruiting through Telegram for people to place online orders for weapons as part of an elaborate competition between two arms traffickers.

They also claimed to have been contacted by a German student in Dresden, who had seen his neighbour accessing the supposed dark web weapons site and was seeking a journalist to accompany him to a meeting with the police (Journalisten Friekorps offered no explanation as to why one of their own supposed German journalists were not able to accompany him). It is unclear if anyone took ‘Max’ up on this offer.

On 15 September, Friekorps posted a link to an article in an online publication called Weltexpress, claiming that Weltexpress had covered their “story” about Stinger missiles being sold by Ukrainians on the black market via Germany.

Weltexpress is a pay-for-coverage publication. Via its parent company Münzenberg Medien/PR Now, clients can pay to have stories written about topics and events of their choosing. This service is offered to clients in multiple languages, for example an advert in 2020 promising Russian-speaking clients that PR Now could “turn shit into candy.”

Weltexpress has a long history of writing articles which are extremely favourable to Russia, and the Stinger video is not the first case in which Weltexpress has published faked content promoting disinformation about the Ukrainian conflict. Recently, Weltexpress also played a role in the distribution of a faked RAND report which claimed that the US was plotting to weaken Germany. RAND has stated that the report is a fake.

The Weltexpress article appears to have been what helped the Stinger disinformation video go viral. From the 15th onwards, claims that Ukrainians were selling Stinger missiles in or through Germany have spread across social media (both with and without mention of where the narrative had originated), receiving thousands of shares and interactions despite being debunked by multiple factcheckers.

Polanskiy is not the only official to have shared the fake narrative. AfD politician Olga Petersen also shared the Weltexpress article on Facebook on 22 September.

In summary, the Journalisten Friekorps/Social Harmony operation appears to have a number of noteworthy connections to the spoofed media Russian influence campaign recently removed by Meta. A plausible hypothesis is that it is run by either the same actors or by a connected group.

It is unclear how successful or active the Social Harmony element of the campaign has been; it appears to have been intended primarily to funnel users towards the petitions, a number of which have now been removed by Change.org.

Journalisten Friekorps, however, has succeeded in injecting a faked video promoting harmful disinformation about the Ukrainian conflict into the broader discourse on social media. It has also evidently succeeded in reaching at least one German politician and through her, her social media followers and presumably her voters.

More broadly this operation is an indicator of the ways in which Russian disinformation actors are now gearing up to attack the will and resolve of the German people, through attempting to generate aggression, hostility and suspicion against Ukrainian refugees and to undermine German support for sanctions against Russia.