Who is guarding the US midterms from foreign interference?
“Russia is not my enemy” posts filled European feeds this week, calling for friendship with Moscow. They spread while the Pentagon put its cyber units on election duty, Riga counted pro-Kremlin channels posing as disappointed locals, and Moscow’s main news agency floated a “very short” war on Lithuania. Welcome to issue 19 of Narrative Ops.
Five weeks before the vote, the Pentagon gets its order to defend the midterms
In April, Gen. Joshua Rudd, who runs both US Cyber Command and the National Security Agency, told lawmakers he did not know whether the team that has guarded every US election since 2020 had been set up for this year’s midterms. That team, the Election Security Group, was created after Russian operations caught US agencies unprepared in 2016.
Five weeks before the 3 November midterms, the Pentagon now has a written order. Defence secretary Pete Hegseth signed a one-page memo on 22 September, “Countering Foreign Threats to 2026 Elections”, and the department published it on Monday, 28 September. It tells Cyber Command, the NSA, the Defense Intelligence Agency and the National Geospatial-Intelligence Agency to collect intelligence on foreign threats to the vote, to identify and disrupt foreign interference, and to work with the Department of Homeland Security on cyber threats to election infrastructure. Hegseth calls the task “a no-fail mission”.
The memo names no country, no specific operation, no new staff or money and no deadline, and it does not say whether the Election Security Group will be revived.
Since 2022, the administration has dismantled the FBI’s Foreign Influence Task Force, moved most duties of the intelligence community’s Foreign Malign Influence Center to other offices, and reduced election-security support at CISA, the civilian cyber agency, according to CNN and Defense One. CISA published its own election plan two days after the memo. Andrew Schoka, who worked at Cyber Command during the 2020 election, told CNN the group’s work takes months of planning: “If that’s just being started now, you’re really limiting the impact…” Rudd said on Monday that Cyber Command and the NSA regularly counter foreign actors trying to interfere with the democratic process.
Thousands of X posts declare Russia “not my enemy” days after Putin’s G20 invitation
Since around 22 September, X accounts declaring a dozen different European nationalities have been posting one sentence: “Russia is not my enemy”. The template is always the same – “I’m Danish”, “I’m Finnish”, “I’m Polish” – and the Swedish daily Dagens Nyheter counted thousands of near-identical posts in a few days. The Russian embassy in the Netherlands cheered the wave on, writing it was “so impressed” by the flash mob; its post passed 750,000 views.
The slogan has a history. Ukraine’s Center for Countering Disinformation, a state body under the National Security and Defence Council, reported in August 2025 that stickers with the same message were appearing in Romanian, French and Italian cities, and attributed them to a Kremlin campaign presenting Russia as a peacemaker. According to Dagens Nyheter, similar messages had circulated in those countries in local languages since 2024. What is new is the format: a street slogan has become an English-language roll call on X that any account can join with one sentence.
Who runs the current wave is not established. DN visited dozens of participating profiles and found obvious fakes alongside accounts that appear to belong to real people – which proves little, says Björn Palmertz of Sweden’s Psychological Defence Research Institute, because proxy accounts can make one origin look like an organic mix of voices.
The posts spread days after the US invited Vladimir Putin to December’s G20 summit in Miami, and as Poland, Lithuania and Denmark warned that a Russian attack on NATO territory cannot be ruled out. Polish hybrid-threats researcher Agnieszka Rogozińska links the campaign to the invitation: it recasts Russia as a country that could contribute to negotiations rather than an aggressor, and its simple, friendly format is built to spread widely and slip past automated detection.
The “angry Latvians” of Telegram are writing from Russia and Belarus, investigation finds
When Latvia banned Russian television channels after the invasion of Ukraine, their audience did not disappear. Much of it moved to Telegram, a messaging app whose public channels work like a news feed, and that is where a new investigation went looking a week before Latvia’s parliamentary election on Saturday, 3 October.
The Insider, a Russian investigative outlet working from exile, counted 221 Telegram channels about Latvian society and politics and found 65 of them run by pro-Kremlin activists or by staff of Russian state media. Among channels posting in Russian, the share is above 65%. The channels are written in the voice of ordinary Latvians disappointed with their country. The people behind the five largest do not live in Latvia: none has lived there in recent years, and some have moved to Russia or Belarus.
The biggest, with about 30,000 subscribers, belongs to Aleksejs Rosļikovs, a former member of parliament under criminal investigation for inciting ethnic hatred, who left for Belarus in spring 2026 and says he will run again with his Stability! party. The second, Baltnews, is run by the editorial staff of the state media agency Rossiya Segodnya; its editor moved to Moscow after Latvia banned the outlet in 2018. A third, Baltic Antifascists, is led by a man facing criminal cases for gathering intelligence for the FSB, Russia’s security service. The channels repost one another and repeat the same three lines: Russian speakers are persecuted, Nazism is returning, and Latvians are poorer because their money goes to Ukraine. The Insider names the owners and their ties to Russian state media; it does not publish evidence on who sets the channels’ content.
The State Security Service, the VDD, published its own reading on 28 September. It has recorded isolated attempts to spread false claims about the election and specific parties, and it is assessing them. It has found no significant or systematic effort by Russia to push the result towards any party, and no attempt to buy votes. It still expects that Russia may step up campaigns against parties that back Ukraine, and it asked residents to report fake videos made with AI.
RIA Novosti floats a “very short” war on Lithuania, then pulls the column
RIA Novosti is Russia’s main state news agency, part of the government-owned media group that also runs Sputnik. On Friday, 25 September, it published a column headlined “Russia Is In for Another SVO. It Will Be Very Short”. SVO is the government’s name for its war on Ukraine; the column promised a second one, in Lithuania.
The timing was not random. Three days earlier Lithuania’s parliament had voted to advance a proposal lifting the constitutional ban on stationing nuclear weapons and foreign bases in the country. The column’s author, Alexander Nosovich, who edits RuBaltic.ru, a Kaliningrad-based site about the Baltic states, wrote that Europe wanted nuclear weapons on Russia’s borders and had found a state willing to host them, and he called Lithuania “a small but proud kamikaze in Russia’s near abroad”, Meduza reports from an archived copy. The piece raised the prospect of a nuclear strike.
Within hours the column was gone. RIA replaced it with a note saying a freelance author’s piece did not match the agency’s views, its editorial policy or Russian state policy. By then it had spread on social media in Lithuania, and the independent outlets Agentstvo and Meduza had reported it. A Lithuanian military spokesperson answered that Russia routinely tries to intimidate its neighbours with hostile rhetoric, Ynetnews reports.
Two facts help place the episode. Agentstvo pointed to earlier investigations by the Dossier Center and Lithuanian public broadcaster LRT that put Nosovich in a “Baltic network” set up by a Russian intelligence officer, Yevgeny Umerenkov. And RIA has published and withdrawn before: on 26 February 2022 a pre-written report on the capture of Kyiv went live automatically and was taken down. Whether Friday’s column was a genuine error or a way to send a threat while keeping the state’s distance from it is a question none of the sources can settle.
EU sanctions former RT France executive later hired by Bolloré’s CNews
Xenia Fedorova ran RT France until the EU banned the channel in 2022, then resurfaced as a commentator on Vincent Bolloré’s CNews and Europe 1. On 24 September the EU sanctioned her: in its reasoning, the Council writes that after RT’s suspension she continued spreading the same pro-Russian narratives about the war through French outlets. The listing freezes her assets and bars her from entering or transiting the EU.
Russian operators used Claude to script radio propaganda in Central Africa, Anthropic says
Anthropic, the US company behind the Claude AI assistant, reported that a Russian-speaking operator in Bangui, the capital of the Central African Republic, used the model to write daily content for Radio Lengo Songo, a station researchers link to Russian financing, and to keep files on opposition politicians. Claude refused a request to paint them as armed militants; the account was closed. The first reactions from Bangui came on 27 September, through DW.
Fifteen dossiers on foreign manipulation have reached Italy’s parliament since June 2025
Italy’s intelligence agencies have sent the parliamentary committee Copasir a monthly “FIMI” report since June 2025, fifteen so far, on foreign attempts to distort public debate: fake news on Telegram, cloned pages of established newspapers, and hacker groups tied to states, mostly Russia and China, Il Messaggero reports. Foreign minister Antonio Tajani says he is convinced attempts to sway Italy’s next vote can happen.
Russia’s Matryoshka operation adds Mother Jones to its list of faked newsrooms
Matryoshka dresses false stories in the logos of real newsrooms, and before the midterms it has copied CNN, the BBC and the New York Times. Last week researchers found it using Mother Jones, a non-profit investigative magazine founded in 1976. A video with its branding claimed the Democratic National Committee paid CNN’s chief $259 million to promote gender transition among children; it reached 155,000 views in a day before X removed it.
Last week we reported Andy Burnham’s UN announcement of a National Centre for Information Defence to detect and disrupt foreign information attacks on Britain.
Update: the Kremlin replied within a day. Spokesman Dmitry Peskov said the prime minister had said nothing new and was creating “an atmosphere of total Russophobia”, Reuters reports. At home, the Commons foreign affairs committee, which had recommended such a centre in March, welcomed it; one member, Richard Foord, asked that it be public-facing, set in law and answerable to Parliament. Reform UK leader Nigel Farage attacked the plan.
Get Narrative Ops in your inbox
Powered by Repsense narrative intelligence