Influence Operations Below the Threshold

This report examines the circulation of the slogan “Russia is not my enemy” as an overarching, multi-platform campaign. Its state-linked layer is coordinated and in part automated: one machine-translated text appeared on fourteen sites of a single network within four minutes, and five Telegram channels published an identical text within the same minute. Its mass layer, by contrast, consists largely of established accounts replicating a template. The analysis therefore distinguishes throughout between coordination that the data document and replication that they do not attribute.

The first part rests on the TikTok corpus of the iGov Observatory. Collection commenced on 24 August 2026. An audit account, configured for a defined demographic profile and geolocated in Europe, was positioned to record the feed that the platform’s recommender system serves to that profile. The exercise was conducted within the SPINE European consortium; its scope was to assess how narratives propagate to diasporic audiences.

Part I inventories the Observatory corpus and examines it along the dimensions used in our earlier analyses (frequency, distribution, cross-platform propagation and comment dynamics), then relates the observed behaviours to the signals through which recommender systems allocate visibility. Part II turns to the multi-platform dataset (X, Facebook, Telegram, web) and retains the network analysis. The Observatory’s repository of the items referred to is appended.

Between 24 August and 28 September 2026 the Observatory archived 3,624 unique posts from 264 accounts over 36 capture days: 3,558 videos and 66 photo posts. Metadata are complete for 2,673 posts, partial for 796 and could not be retrieved for 155. An enrichment layer (transcript, on-screen text, narratives, entities) is available for 2,608 posts. 2,474 posts belong to the 31 daily cases that have been verified and published in the Observatory’s bulletins; the remainder are archived but not yet verified.

At capture, the 3,432 posts with engagement data had accumulated 40.9 million views, 3.79 million likes, 404,335 shares, 245,831 comments and 169,452 saves.

Relevance to the theme was assigned by transparent text patterns in nine languages: tier A, the slogan itself (5 posts); tier B, the same frame without the slogan (32); tier C, contexts in which Russia and Romania, or enemy language aimed at a country, appear together (309). For these 346 posts every public comment thread was retrieved: on 29 September 2026 the platform reported 58,452 comments, of which 48,249 could be read, written by 33,316 accounts.

The feed is recent. Of the 3,537 posts with a known publication date, 62.5% were captured on the day of publication and a further 25.6% on the following day; only 41 were more than thirty days old, the oldest 88.

Supply is persistent rather than episodic. 22 accounts recur on ten or more of the 36 capture days, while 117 appear once. The most prolific account contributes 598 posts, an average of 16.6 per capture day.

Theme-related posts are a steady minority: 346 of 3,624 (9.5%); tiers A and B together number 37.

Posts are concentrated in few accounts: the most active account supplies 16.5% of the archive, the five most active 35.3%, the ten most active 47.9%; 17 accounts contribute fifty posts or more.

Attention is more concentrated still. The median post had 708 views at capture (interquartile range 331–2,840); 59.2% had fewer than 1,000 views and 105 had more than 100,000. The top one per cent of posts account for 34.3% of all views and the top ten per cent for 86.9%; the ten most-viewed accounts hold 42.0%.

Formats are short: the median duration is 45 seconds (interquartile range 20–82), and 67.1% of posts run for a minute or less.

Theme-related posts reach further and draw more comment than the rest of the archive: a median of 1,673 views against 665, and 7.66 comments per 1,000 views against 5.72. Shares are level (9.85 against 9.88) and saves lower (3.11 against 4.31).

Within the posts themselves, traces of other platforms are rare: 64 posts (1.8%) mention or display another platform in the caption, the on-screen text or the transcript, chiefly Facebook (33), WhatsApp (15) and YouTube (10); Telegram appears in 5. No media file is identical, byte for byte, between accounts: of 2,608 files with a computed fingerprint none recurs. A file fingerprint therefore identifies no re-upload in this corpus; footage that has been re-encoded would not be detected by it.

The frame precedes the chain. Of the 37 posts in tiers A and B, 30 were published before 21 September, the day the nationality chain began on X, the earliest on 18 July; 7 were published from that date. The slogan itself (tier A) appears on 2 August, on 9 and 17 September, and then on 21 and 26 September.

On TikTok the frame circulates in a local form, in which the enemy named becomes Ukraine or the European Union, and the comment formulas follow the Romanian news calendar rather than the chain on X. The next section lists the videos concerned; the daily series of comments is given further below.

The 346 threads hold 48,249 retrievable comments: 43,819 top-level and 4,430 replies (9.2%). Activity is concentrated: the ten largest threads hold 41.1% of all comments, while the median thread has 13. Between archiving and 29 September the count reported by the platform rose from 45,748 to 58,452.

Comments arrive early. Measured from each video’s publication, 53.2% were written within 24 hours, 72.6% within three days and 81.3% within a week; 4.8% came after more than thirty days.

They are brief. The median comment has 2 words; 59.0% have three words or fewer and 35.4% consist only of emoji or symbols. 276 texts are used verbatim by three or more authors and account for 2,557 comments (5.3%). Approval is unevenly distributed: 55.5% of comments received no like, and the top one per cent received 43.4% of all likes. Creators themselves liked 10,368 comments (21.5%).

The audience overlaps between accounts. Of 33,316 commenters, 25,624 wrote a single comment; 5,107 (15.3%) commented under two or more accounts and 553 under four or more, the maximum being 13. A commenter active under several accounts is a lead to verify, not a finding of coordination.

The multi-platform dataset holds 8,872 posts published between 1 August and 29 September 2026 and returned by a single English-language query (“Russia is/are not my/our enemy”): X 7,758 (87.4%), Facebook 724, Telegram 264, web 71, VK 41, and a handful from TikTok and YouTube. 5,335 are reposts, 2,605 comments and 760 original posts, from 4,638 accounts.

The sections below follow the phrase through that dataset: the timeline, the nationality chain, amplification by state-affiliated accounts, the targets and the coordination test. The network explorer retains the full relational structure, and each “in the network” link opens the corresponding view.