A “no-fail mission”: the Pentagon’s order to defend the US midterms
“Russia is not my enemy” posts filled European feeds over the past week, calling for friendship with Moscow. They spread in the same week the Pentagon ordered its cyber and intelligence agencies onto midterm election duty, an investigation traced Latvia’s angriest “local” Telegram channels to Russia and Belarus, and Russia’s state news agency RIA Novosti published a column promising Lithuania a “very short” war. Welcome to issue 19 of Narrative Ops.
Hegseth orders Cyber Command and the NSA to protect the midterms
US Defense Secretary Pete Hegseth has ordered the military’s cyber and intelligence agencies to protect the 3 November midterms from foreign interference. The one-page memo, “Countering Foreign Threats to 2026 Elections”, was signed on 22 September and published on Monday, 28 September. It tells Cyber Command, the NSA, the Defense Intelligence Agency and the National Geospatial-Intelligence Agency to counter foreign threats to the vote, and directs Cyber Command to work with the Department of Homeland Security on cyber threats to election infrastructure. Hegseth calls the task “a no-fail mission”.
The order raises a practical question: who will carry it out. For every national vote since 2020, that job has fallen to the Election Security Group, a joint Cyber Command–NSA team set up after Russian operations in 2016. The memo does not specify whether the same model will be used this year.
Part of the answer lies outside the Pentagon. Election security is shared with civilian agencies: two days after Hegseth signed the memo, CISA, the Department of Homeland Security’s cyber agency, released its own election security plan, naming its 10 regional directors as election security advisers and offering election officials a free threat-sharing platform.
Chief Pentagon spokesperson Sean Parnell said the agencies would work “in lockstep with federal, state, and local partners” to protect America’s voting systems. Gen. Joshua Rudd, who leads Cyber Command and the NSA, said on Monday that both agencies “regularly counter actions by malicious foreign cyber actors”, including those trying to interfere with the democratic process.
Thousands of X posts declare Russia “not my enemy” as the US invites Putin to the G20
Since around 22 September, X accounts declaring a dozen different European nationalities have been posting one sentence: “Russia is not my enemy”. The template is always the same – “I’m Danish”, “I’m Finnish”, “I’m Polish” – and the Swedish daily Dagens Nyheter reported thousands of near-identical posts in recent days. The Russian embassy in the Netherlands cheered the wave on, writing it was “so impressed” by the flash mob; its post passed 750,000 views.
The slogan has a history. Ukraine’s Center for Countering Disinformation, a state body under the National Security and Defence Council, reported in August 2025 that stickers with the same message had appeared in Romanian cities, noted similar actions in France and Italy, and attributed the campaign to the Kremlin, saying it presents Russia as a peacemaker. According to Dagens Nyheter, similar messages had circulated in those countries in local languages since 2024. What is new is the format: a street slogan has become a roll call on X, posted in English, German, Spanish, Italian and French, that any account can join with one sentence.
Who runs the current wave is not established. DN visited dozens of participating profiles and found obvious fakes alongside accounts that appear to belong to real people – which does not settle the question, says Björn Palmertz of Sweden’s Psychological Defence Research Institute, because proxy accounts can make one origin look like an organic mix of voices.
The wave coincided with the US announcement, on 23 September, that it had invited Vladimir Putin to December’s G20 summit in Miami, and with warnings from Poland, Lithuania and Denmark, among others, of a possible Russian attack on NATO countries. Hybrid-threats expert Agnieszka Rogozińska, quoted by the Polish news agency PAP, links the campaign’s timing to the invitation: it recasts Russia as a country that could contribute to negotiations rather than an aggressor, and its simple, friendly format is built to spread widely and slip past automated detection.
The “angry Latvians” of Telegram are writing from Russia and Belarus, investigation finds
Latvia banned all Russia-based television channels in 2022, after the invasion of Ukraine. Telegram, a messaging app whose public channels work like a news feed, stayed open, and that is where a new investigation went looking a week before Latvia’s parliamentary election on Saturday, 3 October.
The Insider, a Russian investigative outlet working from exile, mapped the Russian-language Telegram channels about Latvian society and politics. They are written in the voice of ordinary Latvians disappointed with their country, but the people behind the five largest do not live in Latvia: none has lived there in recent years, and some have moved to Russia or Belarus. The largest are linked to Rossiya Segodnya, the state media group that includes RT.
The biggest, with about 30,000 subscribers, belongs to Aleksejs Rosļikovs, a former member of parliament under criminal investigation for inciting ethnic hatred, who left for Belarus in spring 2026 and says he will run again with his Stability! party. The second, Baltnews, is run by the editorial staff of the state media agency Rossiya Segodnya; its editor moved to Moscow after Latvia banned the outlet in 2018. A third, Baltic Antifascists, is led by a man facing criminal cases for gathering intelligence for the FSB, Russia’s security service. The channels repost one another and repeat the same three lines: Russian speakers are persecuted, Nazism is on the rise, and Latvians are poorer because their money goes to Ukraine.
The State Security Service, the VDD, published its own reading on 28 September. It has recorded isolated attempts to spread false claims about the election and specific parties, and it is assessing them. It has found no significant or systematic effort by Russia to push the result towards any party, and no attempt to buy votes. It still expects that Russia may step up campaigns against parties that back Ukraine, and it asked residents to report fake videos made with AI.
RIA Novosti floats a “very short” war on Lithuania, then pulls the column
RIA Novosti is one of Russia’s main state news agencies, part of the government-owned media group that also runs Sputnik. On Friday, 25 September, it published a column headlined “Russia Is In for Another SVO. It Will Be Very Short”. SVO is the government’s name for its war on Ukraine; the column promised a second one, in Lithuania.
The timing was not random. Three days earlier Lithuania’s parliament had voted to advance a proposal lifting the constitutional ban on stationing nuclear weapons and foreign bases in the country. The column’s author, Alexander Nosovich, who edits RuBaltic.ru, a Kaliningrad-based site about the Baltic states, wrote that Europe wanted nuclear weapons on Russia’s borders and had found a state willing to host them, and he called Lithuania “a small but proud kamikaze in Russia’s near abroad”, Meduza reports from an archived copy. The piece raised the prospect of a nuclear strike.
Within hours the column was gone. RIA replaced it with a note saying a freelance author’s piece did not match the agency’s views, its editorial policy or Russian state policy. By then it had spread on social media in Lithuania, and the independent outlets Agentstvo and Meduza had reported it. A Lithuanian military spokesperson answered that Russia routinely tries to intimidate its neighbours with hostile rhetoric, Ynetnews reports.
Two facts help place the episode. Meduza notes that the Dossier Center, in an investigation later published by Lithuanian public broadcaster LRT, linked Nosovich to an influence network run by staff of Russia’s presidential administration and foreign intelligence service. And RIA has published and withdrawn before: on 26 February 2022 it ran a column, written in advance, declaring that “Ukraine has returned to Russia”, and quickly deleted it. Whether Friday’s column was a genuine error or a way to send a threat while keeping the state’s distance from it is a question none of the sources can settle.
EU sanctions former RT France executive later hired by Bolloré’s CNews
Xenia Fedorova ran RT France, which the EU banned in 2022, and later resurfaced as a commentator on Vincent Bolloré’s CNews and Europe 1. On 24 September the EU sanctioned her: in its reasoning, the Council writes that after RT’s suspension she continued spreading the same pro-Russian narratives about the war through French outlets. The listing freezes her assets and bars her from entering or transiting the EU.
A Russian-speaking operator used Claude to script radio propaganda in Central Africa, Anthropic says
In its 10 September threat report, Anthropic, the US company behind the Claude AI assistant, says a Russian-speaking operator in Bangui, the capital of the Central African Republic, used the model to write daily content for Radio Lengo Songo, a station the All Eyes on Wagner project says Wagner set up and financed in 2017, and to track opposition politicians. Claude refused a request to label real people as militants in a way that could trigger security action against them. Anthropic closed the account.
Black voter groups publish a field guide to “cynicism bombing” before the midterms
Onyx Impact, a registered nonpartisan nonprofit, is publishing a 41-page “propaganda playbook” this week to help voters and social media creators recognise election disinformation aimed at Black Americans, The New York Times reports. It names tactics such as “context extraction”, where real footage is stripped of its original meaning, and “cynicism bombing”, which casts voting as pointless. The NAACP and other groups have published similar guides.
Russia’s Matryoshka operation adds Mother Jones to its list of faked newsrooms
Matryoshka dresses false stories in the logos of real newsrooms, and before the midterms it has copied CNN, The New York Times, The Washington Post and others, according to the tracking group @antibot4navalny. Last week the group alerted Mother Jones, a non-profit investigative magazine founded in 1976, to a fake video with its branding that put words in the mouth of its editor-in-chief. The video claimed the Democratic National Committee paid CNN’s chief $259 million to promote gender transition among children. X counted 155,000 views within a day, a figure researchers say is likely inflated, and removed the post after a complaint from Mother Jones.
Last week we reported Andy Burnham’s UN announcement of a National Centre for Information Defence to detect and disrupt foreign information attacks on Britain.
Update: the Kremlin replied within a day. Spokesman Dmitry Peskov said that maintaining “an atmosphere of total Russophobia” is what Britain does, Reuters reports. At home, the Commons foreign affairs committee, which had recommended such a centre in March, welcomed it; one member, Richard Foord, said it should be public-facing, placed on a statutory footing and accountable to Parliament. Reform UK leader Nigel Farage attacked the plan.
Get Narrative Ops in your inbox
Powered by Repsense narrative intelligence