The Information Space Is a Front. Time to Treat It Like One.

The Commission president has called manipulation of the information space warfare, and Europe's counter-disinformation tools were built for something much smaller. 

The information space is territory. Not defending it does not make it neutral – it makes it someone else's. NATO accepted that logic for cyberspace at its 2016 summit in Warsaw and for space in 2019, recognising both as operational domains to be defended like land, sea and air. The information space, where Europeans form the opinions their democracies run on, has never been put on that list, and Russia has worked it for more than a decade as if it were the front.

On 16 September that logic was spoken from the highest podium in Europe. In her State of the Union address, Ursula von der Leyen turned to the threats against European democracy and described election campaigns poisoned by foreign propaganda and conspiracy theories. "This is cognitive warfare," she told the European Parliament, calling for a collective capacity to anticipate, detect and respond.

The term she chose comes from military planning. Since a 2020 study for NATO's Allied Command Transformation, planners have debated whether the human mind should count as a sixth operational domain, one where the target is how people think rather than what they think. The president of the European Commission, meanwhile, has now used the term herself, in a speech that also proposed a counter-hybrid playbook, an emergency response protocol and a European Security Council. Manipulation of the information space is no longer a media policy question in Brussels – it has become a security question.

Ten years of renaming the problem

Europe's answers to that manipulation have changed name several times, and each name shaped what got built. In 2015 the EU set up the East StratCom Task Force on the assumption that false Russian stories could be corrected one at a time, so the answer was fact-checking. By 2018 the problem was called disinformation, and the answer became a voluntary code of conduct for platforms. In 2023 the EU's diplomatic service renamed it FIMI, foreign information manipulation and interference, and its analysts moved from judging whether posts were true to documenting how the actors behind them behave.

The tools built under those names share one assumption, that the problem arrives in separate cases which can be closed. A fact-check closes a claim, a takedown closes an operation, an attribution report closes an investigation. A war does not close, and the Russian programme behind it has an annual budget, career staff and no end date.

What the other side runs

That budget can be counted. Russia's 2026 federal budget gives 146.3 billion roubles, roughly 1.5 billion euros, to state television, news agencies and online projects, according to Finance Ministry figures reported by The Moscow Times, and the figure has grown 28 per cent since before the full-scale invasion. Ukraine's foreign intelligence service estimates a further 1.85 billion dollars set aside this year for influence operations abroad. Europe's dedicated answers, the European Democracy Shield and the new European Centre for Democratic Resilience, are funded in tens of millions and their mandate is to share information between member states, not to direct any response.

The result of that imbalance shows up in the EU's own monitoring. In 2025 the EEAS, the EU's diplomatic service, documented 540 coordinated manipulation campaigns aimed at Europe and its partners, and each of those campaigns is a separate operation rather than a single post: together they ran through some 10,500 channels and websites and produced tens of thousands of pieces of content across 19 platforms. More than 100 countries were targeted.

The share of campaigns using AI reached 27 per cent, three times the level of a year earlier. Two thirds of the campaigns could not be attributed to any actor, and full attribution may never be realistic at this scale. The workable standard is one step lower: proving that accounts, pages and sites are acting in coordination. Platforms remove networks on that evidence, and governments can warn their publics on it, without waiting for a name that may never come.

The other problem is speed. A campaign starts on Telegram in the morning, and by evening the same story is running as TikTok videos, in Facebook comments and on small local news sites, in several languages. A fact-check takes days. Last September TikTok removed a Russian-linked network in Moldova, and within 24 hours a replacement network was already running.

A crisis that was visible before it happened

This summer showed what an unwatched information space costs. In her speech, von der Leyen named the Ceuta border crisis among the summer's tests, warned about scenarios where mass movements of people are engineered, and promised that Europe will learn to detect and anticipate online. At Ceuta, there was something to detect. Repsense analysed 25,335 posts and comments from nine platforms and found calls to head for the border spreading through fourteen public Facebook groups weeks before the mass crossings of 30 July.

The posts themselves looked harmless. They were blessings, jokes and scenes of people setting out, posted into real communities where Moroccans abroad trade advice on visas and work. The coordination was visible only in the mechanics.

A fact-checker had almost nothing to correct in any of this, and the campaign still put crowds at a European border. What happened after the crisis matters even more. From 30 July, the EU's diplomatic service reported Russian information channels pushing the Ceuta story across platforms, and stressed it had seen no such activity before that date: the crisis was not made in Moscow, but Moscow moved in the moment it existed. Analysts at 411, a counter-disinformation group, traced accounts linked to the Russian military spreading far-right framings of the crossings, an invasion underway, authorities complicit, in seven languages, reaching over half a million people within days. Hard-right politicians across Europe seized on the images, and a border event in North Africa spent August doing political work inside European democracies.

The 18-hour gap

Calling this warfare has one practical advantage: a war has an enemy with structure, and structure can be studied for weak points. A 194-page study produced by the NATO StratCom Centre of Excellence, which commissioned Repsense to carry out the research, analysed 3.13 million Russian media and social posts over fifteen months and mapped how the Kremlin's propaganda system behaves when reality surprises it. The answer is that it follows a schedule. First comes visible confusion, with state media hedging and pro-Kremlin channels contradicting one another. Then an approved line comes down, and only then does the whole ecosystem push it in unison.

Agreeing that line takes on average 18 hours. For most of a day after every strike, scandal or accident, the story has no owner. Nerijus Maliukevičius of Vilnius University Institute of International Relations and Political Science, commenting on the study, put it that "the system's weakest point is the transition from chaos to control," and until that transition happens, he notes, information interventions and fact-based explanations of the event are still possible. A government that is already watching can use those hours to establish what happened and reach its public first.

What Europe Needs to Change in Its Information Defence

Holding terrain is a different job from correcting mistakes on it, and the difference comes down to four changes, all of them within the power of governments rather than platforms.

The first is a standing watch: monitoring that runs every day, in every language an adversary uses, the way air policing watches the sky. The Baltic states and Ukraine began building this kind of capacity after 2014, through volunteer monitoring groups, military strategic communications units and, in Riga, a NATO centre dedicated to the field.

The second is a change in what gets analysed, from the single post to the structure around it: which accounts move together, which outlets republish within minutes of each other, which storylines sit quietly between crises waiting to be picked up. That structure needs to be described in a shared language across member states, so that a network mapped in Prague is recognised when it appears in Vilnius or Madrid. The frameworks for this exist, including the EU's own FIMI taxonomy, and their use remains voluntary and uneven.

The third is response while a campaign is still running, because a price imposed late changes nothing. The EU sanctioned the operators of the Doppelganger network in July 2023, and researchers later documented the operation publishing on regardless. Attribution, sanctions and pressure on platforms work as deterrents only when they arrive inside the campaign's own timeline.

The fourth is persistence after the response. A takedown removes accounts, and the people, funding and playbook behind them stay, so the question after every enforcement action is not whether the network was removed but how quickly it is back. The Moldovan case in September, with a replacement network running a day after the removal, is the normal pattern rather than the exception.

None of this means governments deciding what people may believe. That worry is real: researchers at the ETH Zurich Center for Security Studies have warned that treating minds as a battlefield risks turning civilian problems into military ones. The answer is to draw the line clearly. The defence goes after foreign and coordinated fake activity, it works under civilian oversight, and what citizens think and argue about stays their own business.

The capacity von der Leyen asked for already exists in pieces across Europe, in the Baltic monitoring units, in Ukraine's institutions, in the EU's own analyst teams. What is missing in most capitals is the decision to fund it as a permanent function rather than as a project around each election, and that decision sits in the national budgets now being written for next year.

Repsense maps how narratives originate, travel and coordinate across platforms. The company works with governments, institutions and organisations across Europe on continuous narrative monitoring and analysis.