The Narrative Wars: Tracking Public Web Influence Operations Across the Globe

Geopolitical tensions don’t only play out on battlefields or in diplomatic cables. Increasingly, they play out on social media feeds, in comment sections, and across thousands of low-traffic websites and channels that collectively shape what the public believes. The information domain has become a theater of conflict, and the organizations working to defend it – fact-checkers, investigative journalists, researchers, and civil society groups – need tools that they often don’t have the budget for.The two cases below from our Project 4β partnerships are different in many aspects. One happens in Central Europe, where the European Union borders a decades-old Belarusian regime. The other is about the tense relationship in Far East Asia. One faces the challenge of identifying a coordinated influence operation before it reaches critical mass. Another involves picking up on weak signals in a foreign media ecosystem that suggest a shift in narrative strategy. But they have one thing in common. The tracking of influence operations requires systematic, large-scale monitoring of the public web. Monitoring as an early warning Since 2020, Belarus’s state propaganda apparatus has expanded into something closer to an industrial operation. The main state news agency alone churns out up to 300 items a day. That content gets picked up and amplified by pro-government Telegram channels, while a separate ecosystem of YouTube propagandists adds hours of politically aligned videos on top of it. Meanwhile, the independent journalists and researchers trying to counter this – most of them working from exile with limited funding – have had no realistic way to keep up. FactCheck.LT responded by developing Foresight Analysis, an AI-based monitoring system that has processed over 200,000 documents covering the Belarusian media environment through 2025 and into 2026. The system tracks how narratives evolve across state media, democratic outlets, Telegram, and YouTube simultaneously – detecting when a new framing strategy begins propagating through official channels, often weeks before it reaches wide circulation. One of the metrics used by FactCheck.LT is "toxicity level," which measures how aggressive a discourse is by tracking the level of hostile rhetoric, how far that aggression spreads into unrelated topics, and how often the language dehumanizes opponents. An analysis of nearly 6,200 publications from Q4 2025 found that the toxicity level of pro-government discourse was nine times higher than that of independent Belarusian media, with the dominant rhetorical markers being terms designed to criminalize political opposition, like "extremist," and "terrorist The FactCheck.LT team is ensuring that every conclusion is verified by human experts and that automation enhances their judgment rather than standing in for it. What the monitoring system does is surface patterns that would otherwise stay hidden. Those aiming to form new narratives don’t announce their game in advance. These narratives show up as faint signals across many channels at once, easy to lose in the noise until they've already spread far enough to feel like common sense. And by then, the damage to public trust is already done. The significance of small operations Not every influence operation reaches tens of millions, of course. Some of the most consequential work in this area involves identifying activity that is, by current metrics, fairly minor in itself, but foreshadows bigger – and more serious – activities looming on the horizon. Doublethink Lab’s recent investigation into foreign information manipulation in South Korea found inauthentic Facebook accounts engaging with Korean-language content from Chinese state media. The accounts posed as Korean women, pulling profile photos from South Korean and Chinese websites, and used them to post Korean-language comments pushing pro-China narratives and skepticism toward the U.S. and South Korea’s conservative bloc. None of this was high-volume activity – a few likes here, an occasional comment there, on posts that most people never even saw. What the investigation found was a pattern consistent with early-stage influence infrastructure: accounts built to blend in, positioned to amplify messaging below the threshold of ordinary visibility. Detecting them required sustained monitoring of politically sensitive social media spaces, cross-referencing profile photos through reverse image searches, and mapping behavioral patterns against established FIMI frameworks. In the report’s own framing, these were canaries in the coal mine – early warning signs whose significance lies not in their current impact but in what their existence suggests about capability and intent. A three-sided coalition for the public good? These cases share more than just a threat type. In each instance, organizations working in the public interest – without government intelligence resources, without platform-side access – were able to expose coordinated manipulation by systematically collecting and analyzing publicly available web data at scale. Democratic defense used to mean something fairly concrete – borders, institutions, laws. What it requires now is harder to see and harder to build. The public web is technically open to everyone, but there’s a significant difference between being able to access it and being able to monitor it systematically. Doing the latter, across multiple platforms and geographies and at the speed at which these threats move, takes serious technical infrastructure. Building that has historically been out of reach for the civil society organizations that need it most. The asymmetry matters. State-linked actors operating influence campaigns have resources, automation, and the advantage of working across fragmented platforms where no single moderator has a complete view. The researchers and journalists trying to track them have expertise, credibility, and public trust – but often lack the technical means to work at the speed and scale the problem demands. The cases above point toward one practical model for closing that gap: making enterprise-grade data collection infrastructure available to civil society organizations working on information integrity. Here, we needed a three-sided coalition of those who understand what needs to be done and those on whom it falls to enable the professionals. First, there are institutions, agencies, and organizations like FactCheck.Lt and Doublethink Lab - there’s no shortage of will there. Then, there are companies building and developing technology that these organizations need - we’re seeing that the will and understanding of the importance of this work are growing here. The question remains whether there’s enough political will in the European Union and other democratic institutions to learn about this technology and regulate to enable its positive use.