Russia’s Affront on the News: How NewsFront’s Circumvention of Social Media Bans Demonstrates the Need for Vigilance

There has been a sizable public- and private-sector effort to rid the United States’ social media ecosystem of Kremlin disinformation since Russia interfered in the 2016 presidential election. But what happens to one of those Russian outlets when social media companies suspend its accounts, journalists and NGOs report its possible connections to Russian intelligence, and the U.S. State Department highlights its role in the Russian influence machine? Answer: It adapts, overcomes, and improvises in pursuit of social media audiences worldwide.

This is the story of NewsFront, a self-proclaimed “objective” news website reporting on conflict, military operations, and geopolitics that is in actuality a Kremlin-linked covert influence platform, born out of the takeover of a Crimean journalism center during the Russian invasion in 2014.

NewsFront publishes content in 10 languages on 10 NewsFront subdomains, and its narratives are straight out of the Kremlin’s “Active Measures” playbook—stories run the gamut from blatant fake news to true events subtly twisted into anti-West themes and conspiracies. Even though social media companies have taken action against NewsFront—both Twitter and Facebook suspended NewsFront accounts and banned link-sharing from the website in 2020—the outlet has innovated to avoid detection and continue spreading its content online to unwitting readers. Through a network of “mirror sites,” websites that are identical to the original NewsFront website but use innocuous domain names, NewsFront has continued to push content on Facebook and Twitter, skirting link-sharing bans and targeting audiences around the world.

NewsFront Subdomains and Mirror Sites

Last August, the State Department’s Global Engagement Center noted that the Kremlin “invests massively in its propaganda channels.” NewsFront’s recent adaptations prove this to be true and also illustrate the importance placed on propaganda and disinformation in the Kremlin’s eyes. If Kremlin information operations can be thought of as using a “firehose of falsehood” model, then NewsFront is one of the Kremlin’s major pipes. And someone—possibly the FSB—is putting a lot of time and effort into making sure that pipe’s tap doesn’t get turned off on major U.S. social media platforms.

In many ways, NewsFront’s evolution—from a seized Crimean journalism center to one of the Kremlin’s most prolific and far-reaching propaganda weapons—highlights familiar patterns observed across many of the tools of Kremlin malign influence. For one, its purpose expanded. NewsFront was originally employed during the Crimean invasion to win the concurrent battle in the information space that targeted Ukrainians, Russians, and the West with disinformation to justify Putin’s land-grab. Then, with their skills honed and infrastructure fully established, NewsFront went global, seeking a wider audience and bigger ambitions by targeting elections in European countries. Now, its target audiences stretch around the world as they broadcast in 10 languages, attempting to influence readers as far away as the United States and West Africa on issues ranging from commentary on local politics to criticisms of NATO and the EU.

How Did NewsFront Adapt?

In mid-2020, social media companies acted against NewsFront, removing NewsFront-affiliated accounts and, perhaps more crucially, blocking any NewsFront content from being shared on the platforms through a link-sharing ban. For a while this seemed to work;NewsFront articles’ spread on both social platforms appeared limited. For NewsFront these suspensions meant losing access to the world’s two biggest social media sites—key conduits to their global target audience. But it was a short-lived victory for Silicon Valley.

NewsFront knew it needed to maintain the ability to meet its target audiences where they already congregate—Facebook groups with large, global followings—and, to a lesser extent, Twitter, where information propagates quickest around the world. Access to these platforms are a must for disinformation outlets like NewsFront.

To keep content flowing into these spaces, NewsFront employed what can be thought of as “mirror sites”:exact replicas of NewsFront’s original domains, but using new, innocuous domain names. Whenever an article is published on NewsFront’s original site, an identical version also appears on the corresponding mirror site for each language. Every part of the article—the title, content, photos, publication time, even most of the URL—is a perfect copy.

But, crucially, the mirror site URLs are not picked up by Facebook or Twitter’s link-sharing bans, meaning that the outlets and the resulting content these platforms had previously ruled as violating platform policies continues to spread.

NewsFront didn’t just stop there; it targeted users on these social media platforms through a coordinated, systematic effort. NewsFront deployed a tight network of online personas whose sole activity on social media consists of sharing NewsFront mirror site articles. These users are the engine behind NewsFront’s current operation. While some appear to be real people openly affiliated with NewsFront, many others appear to be sock puppet accounts hiding behind fake names and avatars. One user was even suspended back in April when Facebook discovered that NewsFront used the same tactic of inauthentic accounts to spread its content on the platform; this user appears to have simply created a new account under a nickname, changed his profile picture, and now continues spreading NewsFront content via the mirror sites. Some of the same users are also active on Twitter and VK, a Russian social media platform, sharing mirror site content across platforms simultaneously.

Analyzing where the mirror site content is published online revealed that NewsFront is running a large-scale, sophisticated operation. The online personas that appear to be associated with NewsFront are sharing content regularly into at least 235 Facebook groups with the potential to reach more than 3.4 million people in seven languages (Bulgarian, French, Georgian, German, Russian, Slovak, and Spanish). The biggest target audiences appear to be French- and

Spanish-speakers, possibly concentrated in West Africa and Southern and Central America, based on discernable Facebook location data, which is less than perfect. The sheer volume of NewsFront’s French-language Facebook activity can perhaps be explained by NewsFront’s personnel links to Unite Continentale, a pro-Russia fighter group primarily made up of French, Serbian, and Brazilian nationals active in the 2014 war in Donbas.

What We Learned

What we’re currently seeing with NewsFront’s mirror sites—this tactic of employing inauthentic websites and social media personas to amplify content and manipulate social media—is nothing new. We’ve seen it before in the infamous Russian botnets active during the 2016 U.S. election, and as recently as April 2020 in NewsFront’s fake account network targeting the nation of Georgia. But since then, the stakes have been raised. With increased moderation efforts from social media companies, NewsFront was forced to innovate.

NewsFront’s newest content-sharing innovation of using mirror sites reveals a few interesting insights, like its target audiences and personnel networks, and one critical insight: Social media companies and counter-propaganda initiatives must remain vigilant. NewsFront has no shame—despite reporting from major U.S. news outlets and the U.S. government shining light on its dubious origins and malign techniques, it continues to pump out content. And NewsFront is resilient. Obstacles like account shutdowns and link-sharing bans haven’t deterred those behind the site, and NewsFront is able to manipulate social media to worm its way into the global information environment and inject the Kremlin’s propaganda and disinformation. Ironically, resilience is often held forth by counter-propaganda analysts and many organizations across the world as a vital aspect of our defense against Russia’s malign influence. NewsFront’s proven resilience means that we—researchers, governments, journalists, and social media companies—must be more than resilient. We must also remain vigilant.

The views expressed in GMF publications and commentary are the views of the author alone.