Author: Raquel Miguel (building on a report by Nicolás Hénin for EU DisinfoLab)
FIMI is an increasingly widespread concept in the counter-disinformation community, but many questions persist about what it really means. Is FIMI a specific type of disinformation? Or is it a different concept, whether broader or narrower? In this blog post, EU DisinfoLab sheds light on the topic of FIMI to frame it in the counter-disinformation ecosystem within the ATHENA project.
The definition
The European External Action Service (EEAS) coined the term Foreign Information Manipulation and Interference (FIMI) to describe state-sponsored manipulations of information. As the European Democracy Action Plan and the Strategic Compass for Security and Defence moved towards conceptualising FIMI, the EEAS defined the concept in its first report on FIMI in early 2023 as:
“FIMI is a mostly non-illegal pattern of behaviour that threatens or has the potential to negatively impact values, procedures and political processes. Such activity is manipulative in character, conducted in an intentional and coordinated manner. Actors of such activity can be state or non-state actors, including their proxies inside and outside of their own territory.”
Using the ABCDE framework[1] as a reference to better illustrate the concept, the definition of FIMI emphasised:
- Behaviour[2]: Defining FIMI as a “pattern of behaviour” shifts the focus from the operation content to malign actors’ activities or actions. Drawing from cyber-threat intelligence analysis, influence campaigns are dissected into the Tactics, Techniques, and Procedures (TTPs) employed to carry them out. FIMI is “manipulative, intentional, and coordinated”, which means that FIMI operations are coordinated campaigns that use manipulatory tactics aimed at misleading, deceiving, and destabilising their targets, which are often democratic societies but also other countries worldwide. An important disclaimer is that FIMI operations comprise various incidents, but single incidents are not automatically indicators of FIMI. In addition, FIMI’s pattern of behaviour is “mostly non-illegal”, which obviously affects the possibility of countering it through law enforcement.
- Actors: The interference is performed by “state or non-state actors, including their proxies inside and outside of their own territory”. FIMI is initiated by a foreign actor by its very definition, although using proxies from the targeted country complicates things. For example, some politicians in Germany circulated pro-Russian disinformation. In some cases, this propaganda served their agenda, but in other cases there were clear links with Russian actors, as explained in the next sections. Moreover, it is fundamental to remember that identifying FIMI perpetrators is complex and sensitive, and endorsement does not equate to attribution: actors may contribute to amplifying an incident they have not created.
- Degree/effect: Regarding the potential harm of FIMI, according to the definition, it “threatens or potentially impacts values, procedures, and political processes”, pointing to a strategic nature that menaces citizens’ perception of democratic integrity. The EU definition of FIMI aims primarily at political disinformation. However,it also includes any information manipulation that may cause public harm, especially on topics such as health, the environment or security.
- And… what happens with the content? Content is a fundamental element in defining disinformation, which is false information that is disseminated intentionally to cause harm. However, it is not key in defining FIMI. Even the EEAS’ definition does not explicitly mention content. The relevant elements to identify a FIMI campaign are based on the threat actors’ activity and not on the content. And that behaviour may or may not consist of disseminating disinformation.
Then, is FIMI a subset of disinformation, or does it go beyond?
According to EU DisinfoLab’s Disinformation Glossary, disinformation is false information that is disseminated intentionally to cause harm. Therefore, the key factors of disinformation are:
- false content,
- will in the action
- aim to cause harm.
Based on the EEAS’ definition of FIMI, the key elements of FIMI are:
- the involvement of a third country,
- a manipulative pattern of behaviour,
- the existence of coordination and
- a clear intent to harm or negatively impacts values, procedures and political processes.
On the one hand, FIMI overlaps to a considerable extent with disinformation. On the other hand, not all disinformation is FIMI, and FIMI is not only disinformation. That is why we can say that FIMI is a subset of disinformation and a broader concept transcending disinformation simultaneously.
- FIMI is a subset of disinformation when state-sponsored deceptive content has been disseminated to manipulate and exert influence in another country. In other words, when threat actors choose to use false content as a tactic to achieve their goals.
- FIMI is broader than disinformation when a foreign influence campaign seeks to influence and manipulate its targets with tactics other than spreading lies or false content, e.g., by hacking and leaking authentic documents or sensitive data to pollute the information ecosystem.
TTPS, the key to research FIMI
As behaviour is key to investigating FIMI, researchers must focus on a campaign’s so-called tactics, techniques and procedures (TTPs), adopting a similar approach to cyber-threat intelligence analysis. In detail, tactics describe the operational goals that the threat actors try to achieve, techniques are the actions depicting how they try to accomplish them, and procedures are the specific combination of techniques across multiple tactics (or stages of an attack) that indicate intent and may be unique for different threat actors.
In this sense, the DISARM Red Framework provides a set of constantly evolving TTPs to analyse incidents and operations conducted by threat actors. The research community familiar with FIMI is progressively adopting this framework, allowing them to speak the same language when identifying patterns in a campaign. For example, in the Doppelganger operation, there is a pattern of media impersonation, and investigators dealing with the case will use common codes, such as “T0143.003: Impersonated Persona” and “T0097.202: News Outlet Persona”. The underlying idea is that focusing on TTPs will facilitate the identification of threat actors through their modus operandi and, thus, campaign attribution.
Why is FIMI a problem for democracies?
Recent international events – from the Russian invasion of Ukraine to China’s pressure on Taiwan – have highlighted the increasing use of FIMI as part of a hybrid warfare strategy in the digital realm. To exemplify this, researchers have uncovered campaigns such as Doppelganger, Portal Kombat, CopyCop, and PAPERWALL. Therefore, FIMI campaigns are frequently used by Russia and China, as well as by other actors and countries, seeking to manipulate or undermine confidence in democratic institutions and systems.
Nonetheless, the problem lies not only in the threat but also in how to react to it. FIMI campaigns are difficult to address because, as their definition indicates, they employ “mostly non-illegal” actions, which limit the legal means to tackle and address them. In many instances, platforms prohibit covert or coordinated influence operations, which provides an avenue for mitigation. In addition, unlawful behaviour such as impersonation has sometimes triggered legal actions by the impersonated media and EU sanctions against the perpetrators. The most recent example is the US Department of Justice’s decision to seize 32 domains related to a Russian influence operation and impose sanctions on several individuals and organisations. As a result, EU DisinfoLab has made efforts to map responses against FIMI – applied to the Doppelganger operation – and study their effectiveness.
Another challenge is how the public perceives these campaigns and reacts to them. As mentioned, not all FIMI is disinformation, and factual information may be included in a campaign. For instance, measures to stop the leaks of confidential documents to protect national security could be interpreted as censorship. This shows that failure to communicate the FIMI threat correctly to citizens can lead to problems for democratic societies, feeding into the threat actors’ goal to degrade democratic institutions and sow societal divisions.
One more layer of complexity regards the intersection between domestic (DIMI) and foreign manipulation and interference. Domestic actors may be directly involved and act as proxies (acknowledged in the definition of FIMI), or they might simply sympathise with the campaign – but again, endorsement does not equal attribution!
Hence, it can be difficult to establish whether:
- A foreign state has initiated a FIMI campaign and directly or indirectly recruited a domestic actor to achieve its goals.
- The domestic actor was the initiator of a DIMI campaign that was later exploited or instrumentalised for FIMI purposes.
The German case illustrates this dilemma. Actors close to the far-right party AfD, the far-left party BSW, or pro-Russian media often circulate pro-Russian disinformation and propaganda. In some cases, domestic actors promoted disinformative content or propaganda that served their agenda (i.e., DIMI). For example, the German politician Sarah Wageknecht argued that sanctions against Russia did not harm Russians but only Germans, in a stance that served her interest in splitting from her party Die Linke and founding a new one (BSW). In other cases, direct links with Russian actors were established (i.e., FIMI). For instance, one episode of the Doppelganger influence operation (a widely researched FIMI campaign with Russian origins) in Germany evidenced domestic political exploitation by impersonating and harming Green Party politician Annalena Baerbock, while supporting AfD and BSW. These instances highlight the overlap between FIMI and DIMI and the complexity of defining when we are dealing with one of them.
What can we do?
The effort to employ common terminology and harmonise concepts and procedures is driven by the aspiration to improve the defender community’s capability to conduct research, exchange information, and respond to foreign influence operations. In line with this objective, the EEAS has adopted a whole-of-society approach to mitigating the phenomenon, as further detailed in its second report focused on a response framework to FIMI incidents, published in early 2024.
To support this initiative, the EEAS also facilitated the creation of the FIMI-ISAC (Information Sharing and Analysis Center) to foster knowledge-sharing. Following Joseph Borrel’s announcement of the initiative on 7 February 2023, an expert group was formed to advise on the ISAC’s formation, officially launched at the end of that year. Today, it comprises like-minded organisations dedicated to safeguarding democratic societies, institutions, and critical information infrastructures of democracy from external manipulation and harm, as outlined on their website.
In addition to the FIMI-ISAC, EU-funded projects such as ATHENA and its sister projects in the “Tackling FIMI in Europe” cluster are currently addressing this challenge.
Additional recommendations
Fighting FIMI should be viewed as a long-term effort and tackled accordingly. A comprehensive set of responses is needed to:
- Build and sustain the capacity to research and expose FIMI campaigns;
- Gather evidence and prosecute threat actors;
- Raise awareness and strengthen societal resilience;
- Enhance cooperation among different stakeholders, including the public and private sectors, civil society, academia and media;
- Develop a toolbox with legal instruments (i.e., the Digital Services Act (DSA) will play a crucial role), and design appropriate, proportionate responses based on evidence and real-world cases.
It is also crucial to avoid exaggerating the threat, as doing so could play into the hands of threat actors, giving them more perceived success than they deserve. Therefore, accurately assessing the impact of FIMI campaigns is essential.
Equally important is building trust in democratic systems. An effective first step is communicating the problem to citizens, helping them understand the threat FIMI poses to their societies and the necessity of responding. Addressing deep-rooted vulnerabilities and internal issues that malign foreign actors can exploit to distort facts and divide people is also vital.
With a multidisciplinary consortium, the ATHENA project is working on these and other recommendations and fostering research and information exchange among its partners. It is also transmitting knowledge to different stakeholders, including policymakers, so that they can develop the necessary tools based on the empirical results. By disseminating blogs such as this one, ATHENA is increasing our understanding of FIMI’s threat to our societies and what we can do about it.
[1] This framework considers the (foreign) Actor(s) involved, the manipulative, intentional, and coordinated Behaviour that TTPs unleash, the Content created and distributed – including disinformation-, the Degree of harm and severity of the case, as well as its Effect in terms of impact.
[2] Starting with B since the behavioural variable is the central element of the definition.