Jayde Dorland, Counter Threat Strategic Communications Team
Jennifer Loy, Editor in Chief
July 23, 2024
Online Olympic-Related Disinformation[1]
The Paris 2024 Olympics is set to begin with the opening ceremony on July 26, 2024, heightening authorities’ alert for threats to French national security, including terrorism, cyber, and information warfare attempts.[2] A notable threat is that presented by disinformation targeting Paris 2024, France, and the International Olympic Committee (IOC). Information technology company Microsoft’s Threat Analysis Center (MTAC) has assessed the primary distributors of Olympic-themed disinformation are Russian disinformation groups Storm-1679 and Storm-1099, instigating speculation of a possible link to the Kremlin. Narratives espoused by the groups are seeking to discredit the IOC's legitimacy and France’s ability to host an Olympic event, alluding to corruption and fears of terrorism targeting the Games.[3] Storm-1679 and Storm-1099 will almost certainly include topical news stories in their disinformation narratives to boost credibility and audience engagement. Campaigns will almost certainly be increasingly sophisticated, displaying modern editing styles attempting to make disinformation appear as if it comes from authoritative sources. Mainstream and small-scale social media platforms will almost certainly be synonymously used to distribute campaigns, exploiting sites’ use by broad audiences and the unregulated nature of less popular services.
Recent Events
Russia has faced Olympic Games suspensions since 2017 from the World Anti-Doping Agency (WADA) and IOC for the state-sponsored doping of competing athletes. However, athletes were permitted to compete under the Olympic flag as an Olympic Athlete from Russia (OAR).[4] In October 2023, the IOC suspended the Russian Olympic Committee (ROC), restricting its ability to operate as a National Olympic Committee and receive Olympic funding. The IOC based this decision on ROC’s move to include regional sports organizations in Russian-occupied Ukrainian territories as its members. The IOC declared this move a breach of the Olympic Charter, violating Ukraine’s National Olympic Committee’s territorial integrity. The IOC claimed to make a further decision regarding the participation of Russian athletes in Paris 2024.[5] Russia appealed the ROC suspension to the Court of Arbitration, which was denied in February 2024.[6]
The IOC formally decided in December 2023 that Russian and Belarusian athletes cannot compete in Paris 2024 on teams but as Individual Neutral Athletes (AINs). Individuals can compete as an AIN if they display no active support for the Ukrainian-Russian war, are not members of the Russian or Belarusian military or national security services, and satisfy all anti-doping rules by the IOC and International Sports Federations. AINs are permitted to comply with all preexisting Olympic Games rules and regulations. Competing as an AIN means athletes cannot partake in the Games under their national flag, which is prohibited at any official Olympic venue and functions, alongside their representative national anthems and colors. Russian and Belarusian government officials will not receive invitations to attend the Games.[7] Additional decisions have prohibited Russian and Belarusian athletes from partaking in the Olympic Opening Ceremony, with their involvement in the closing ceremony to be decided later.[8] The IOC has labeled Russia’s response to the Olympic ban “extremely aggressive.”[9]
Since June 2023, France has been the subject of various Russian online and physical disinformation campaigns seeking to discredit the country and its interests. As the 2024 Paris Olympics have neared, narratives have shifted to specifically focus on Paris, the Games, and the IOC. MTAC has identified two influence operatives, Storm-1679 and Storm-1099, as the main distributors of Olympic-related information warfare.[10] Previous disinformation campaigns originate from actors affiliated with Russian President Vladimir Putin, Russian intelligence agencies, and the Internet Research Agency, a troll farm governed by deceased Wagner founder Yevgeny Prigozhin. Other campaigns are conducted by individuals working independently from the administration.[11] Storm-1099, also known as the Doppelganger operation, comprises a disinformation network of spoofed international news websites and the Reliable Recent News (RRN) network, known for its on-the-ground and online operations.[12] OSINT analysis has yet to identify the origins of Storm-1679.[13] As Paris 2024 gets closer, disinformation campaigns seeking to diminish the IOC’s and France’s reputation while inciting fears of terrorist targeting of the Olympics have increased. Both Storm-1679 and Storm-1099 are engaging in the act of spoofing legitimate companies and organizations to distribute seemingly official articles and videos. This content is initially shared on Telegram before migrating to other social media news feeds via inter-platform sharing.[14]
In June 2023, Telegram channels began distributing a QR code directing users to another channel featuring a documentary series titled Olympics Has Fallen, reminiscent of the US political action movie Olympus Has Fallen. The documentary, which has since been linked to Storm-1679, used an AI-generated voiceover of Hollywood actor Tom Cruise to discredit the IOC and allege its corruption.[15] Each episode of the documentary featured the official branding of the streaming service Netflix and displayed its opening screen.[16] Shortly after the release of Olympics Has Fallen, several US celebrities were deceived by the encouragement to create and upload videos on the personalized video messaging platform Cameo to push anti-Ukrainian propaganda. Celebrities were asked to film videos addressing a person named Vladimir, which was then edited to allude they were addressing Ukrainian President Volodymyr Zelenskyy and urging him to seek help for his substance abuse.[17] The Cameo videos featured advertisements for Olympics Has Fallen and QR codes for the hosting Telegram channel, falsely claiming the celebrities’ endorsement of the documentary.[18]
In Oct 2023, 250 Stars of David reminiscent of the one depicted in the Israeli flag were graffitied on Parisien and surrounding suburban buildings. Investigations found two pro-Russian Moldovan citizens behind the graffiti with connections to Storm-1099.[19] Russian social media accounts shared images of the graffiti to sow confusion and apprehension among the French Jewish community amid the Israel-Hamas conflict, with many individuals believing the activities to be an anti-Semitic demonstration.[20] Graffiti has been a focal point of another Fall 2023 disinformation campaign. Pro-Russian influence actors shared images of graffiti supposedly being stenciled on Paris buildings. The graffiti alluded to Israeli attendees of Paris 2024 facing violent threats, with some Storm-1679 accounts referencing the 1972 Munich Olympic attack where the Palestine Liberation Organization affiliate, Black September, killed 11 Israeli Olympic team members. Investigations found no evidence of the graffiti existing, suggesting the social media posts were digitally altered.[21]
Storm-1679 continued its disinformation campaigns through the remaining months of 2023, spoofing legitimate organizations and news outlets to incite fears among French citizens and Olympic 2024 tourists. The spoofing attempts used official logos and editing styles of companies to portray misleading content as genuine information. One video clip, claiming to originate from the news outlet Euronews, falsely alleged that Parisian citizens are purchasing property insurance because they expect terrorist acts to increase during Paris 2024. Another media file imitating France 24 claims that 24 percent of purchased tickets for Paris 2024 have been returned for fears of being victims of terrorism. In a more explicit attempt to dissuade tourists from attending Paris 2024, Storm-1679 created a video press release under the guise of the US-based Central Intelligence Agency (CIA).[22] The video outlines the terror threat level for Paris 2024 being high before stating that radical Islamist groups who seek to destabilize the EU, and particularly France during the Olympic Games, present the greatest risk. The media then proceeds to state the CIA has created recommendations for France’s General Directorate for Internal Security (GDSI) and Civil Security Forces, the IOC, and Paris’ Organizing Committee for the 2024 Olympic and Paralympic Games.[23]
Other disinformation campaigns from unverified Russian actors are also targeting Paris 2024. Imitated French news outlets have claimed that vacation booking companies, Airbnb and Booking.com, have canceled 8000 reservations for the Olympic Games because of France’s unstable societal situation and fears of terrorism. Another narrative claims that pregnant women are being induced so that Parisian hospitals will have more free beds at the time of the Olympic Games to accommodate an increase of patients in response to emergencies.[24] Another campaign has exploited the 2023 sightings of bedbugs in Paris and increasing tuberculosis cases. Disinformation narratives have connected the upsurge in cases with the inflow of Ukrainian refugees and soldiers to France, claiming that 85 percent of incoming soldiers tested positive for the disease. Posts supporting the campaign stated, “Bedbugs and tuberculosis. If only I could go to the Olympics in France.”[25]
Assessments
The Counterterrorism Group (CTG) assesses with high confidence that Storm-1679s orchestration of disinformation operations a year before Paris 2024 almost certainly displays a planned campaign to target the Olympic Games. Storm-1679 is very likely following a pre-planned calendar to determine the deployment of large-scale and target-specific information warfare campaigns. Storm-1679 actors almost certainly planned to distribute campaigns expecting to have a large impact at intervals through the year, while fitting in smaller-scale operations in between. Campaigns are very likely to increase in scale and frequency as the opening of Paris 2024 nears, with pre-existing and new narratives almost certainly circulating as the Olympic and Paralympic Games proceed. Storm-1679 and Storm-1099 actors will almost certainly monitor news events surrounding France and Paris 2024 to identify themes usable in campaigns with the greatest societal impact.
The initial targeting of the IOC with the Olympics Has Fallen campaign very likely highlights Storm-1679s intention to discredit the core of the Olympics, branding them corrupt to implicate affiliates and partners and weaken their legitimacy. The impersonation and deception of popular celebrities and official streaming services to allege their endorsement of Olympics Has Fallen very likely increases citizens’ inclination to watch the documentary and its believability, exploiting citizens’ trust in familiar faces and online sites. Combining the narrative of the documentary with anti-Ukrainian rhetoric likely suggests the targeting of a specific demographic. Storm-1679 likely intended for Olympics Has Fallen to gain traction among viewers with predisposed negative views on Ukraine, leveraging their sentiments to spread toward the IOC and Paris.
Storm-1679 and Storm-1099 narratives forecasting terrorist attacks during Paris 2024 almost certainly seek to lessen the number of attendees at the Olympic Games, very likely attempting to weaken profitability and the IOC and Organizing Committee for the Olympic Games’ ability to hold future events. Storm group actors very likely perceive that the lower the likelihood of future games, the lower the probability of Russian athlete exclusion and public denouncement against Russian actions, including doping and dissatisfaction with the Kremlin’s invasion of Ukraine. The spoofing of the CIA almost certainly reinforces citizens' and attendees’ fears of terrorism targeting the Olympics, increasing the perceived credibility of the threat. Campaigns almost certainly aim to present France as an incompetent nation to host the Olympics and provide proficient security, magnifying incidents related to national security in its rhetoric to generate mass fear among expected attendees. Storm-1679, Storm-1099, and other Russian disinformation actors will almost certainly push narratives to influence ticket holders to sell their tickets, not turn up for sporting events, or avoid traveling to Paris.
Future Implications
Storm-1679 and Storm-1099 very likely intend on campaigns originating on Telegram to spread onto mainstream social media platforms, including X, Facebook, and TikTok, almost certainly to ensure narratives target the greatest number of individuals. Campaigns will also very likely exploit smaller social media platforms, such as Gab and Discord, almost certainly to leverage less regimented content moderation policies and undermine their technological ability to detect disinformation and impersonated accounts. The groups very likely expect that a higher prevalence of false and misleading posts on these platforms will increase the total number of users consuming the narrative and the likelihood of them believing the message. However, the scale of news coverage of Paris 2024 on television and social media will very likely provide social media users a greater opportunity to fact-check stories they see online, reducing their susceptibility to disinformation.
Social media companies are almost certainly on alert for disinformation campaigns targeting the Olympics, increasing their monitoring of trending posts and hashtags to mitigate the spread of misleading information as the Games commence. Content moderation teams will very likely increase the frequency of human content moderation surveillance, combining the method with automated tools to strengthen efficiency. Teams will almost certainly incorporate AI with their moderation tools, likely updating pre-existing models and training them on new disinformation campaign tactics, including impersonated official organizational logos. Teams will very likely seek to teach their AI programs in multiple languages to circumvent disinformation’s use of non-English in campaigns seeking to influence larger audiences and non-English speaking Olympic visitors. Increasing the scope of automated and AI tools will very likely harden platforms’ defense against disinformation, minimizing the number of posts circulating news feeds and influencing social media users. Social media companies will almost certainly aim to decrease the amount of misinformation and disinformation frequenting their sites to ensure user trust and mitigate reputational damage. Failure to protect users from harmful narratives has a roughly even chance of influencing account holders to stop using the service, delete their accounts, or migrate to other platforms perceived to implement better protections against disinformation. Social media companies with weakened disinformation policies, such as X and Gab, are very unlikely to revise their regulations in preparation for Paris 2024. These sites will almost certainly depend on users to regulate their content by blocking accounts they do not want to view. X will very likely rely on its Community Notes feature to provide fact-checks and contextual knowledge to misleading posts.
Non-governmental organizations (NGOs) and news outlets focused on countering disinformation will almost certainly conduct their own monitoring and investigations into Russian disinformation campaigns against the Olympic Games, orchestrating counter-campaigns seeking to minimize the impact of harmful narratives. Organizations involved in counter campaigns will very likely conduct their activities online and offline to maximize targets and the ability to overpower negative rhetoric. Online campaigns will almost certainly primarily target social media, with organizations conducting fact-checks of claims, offering media literacy guidance, and contributing to Xs Community Notes on misleading posts. Some counter-campaign actors will likely create videos to increase user engagement, providing visual aids to better inform viewers and specifically target narratives within Russian campaigns. Offline counter-campaigns will almost certainly populate television and radio, with a roughly even chance of some campaigners handing out flyers around Paris to provide factual information regarding the security status in Paris.
Disinformation campaigns will very likely exploit topical global news, such as the Israel-Hamas conflict and the US 2024 presidential election, incorporating themes with anti-Olympics narratives to reinforce speculation of campaign origins, intentions, and targets. The variance of topics used in campaigns will almost certainly widen the audience consuming narratives, increasing the likelihood of misleading rhetoric influencing individuals’ opinions and mindsets. Ongoing campaigns will almost certainly continue to impersonate trusted information sources, such as French news outlets, very likely to leverage perceived proximity to the Olympics and community connections to provide information before international organizations. Storm-1679 or Storm-1099, presenting themselves as local French news networks and the first to cover breaking stories, will very likely prolong the longevity of disinformation campaigns, restricting audiences' ability to fact-check events as they are reported. The Storm groups will very likely attempt to continue impersonating official organizations, including those related to security or government departments, almost certainly to instill further fear in Olympic attendees and Parisien citizens.
Are you a threat, security, investigative, intelligence, or operational professional? Do you need to stay ahead of the latest threats to your agency, organization, company, or individuals? Then try the Counter Threat Center for free today!
The CTC provides critical intelligence and knowledge of the wide range of global threats. With our help, you can detect, deter, and defeat any threat before it can harm those you have been charged to protect.
Sign up for a free trial today and see how the CTC can help you keep your people and assets safe.
The CTC provides access to a wide range of global threats, including terrorism, cybercrime, and political instability.
The CTC's intelligence is gathered from a variety of sources, including open-source intelligence, human intelligence, and technical intelligence.
The CTC's analysts are experts in their field and have a deep understanding of the threats facing businesses and organizations today.
The CTC's products are tailored to the specific needs of each customer.
The CTC offers a variety of subscription options to fit any budget.
Click here to learn more: https://www.counterthreatcenter.com/subscriptions
[1] Laptop, generated by a third party database
[2] Australian security consultant who has worked on 11 Olympic Games says Paris comes at a 'challenging time,' Australian Broadcasting Corporation, July 2024, https://www.abc.net.au/news/2024-07-22/paris-olympics-security-terrorism-threats-right-wing-extremism/104105782
[3] “Russian influence efforts converge on 2024 Paris Olympic Games,” Microsoft Threat Analysis Center, 2024, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/MTAC_Report_Russian_Influence_and_Paris_2024.pdf
[4] Russians and Belarusians can compete in the 2024 Olympics — as neutral athletes, NPR, December 2023, https://www.npr.org/2023/12/09/1218406353/russian-belarus-athletes-ioc-2024-olympic-games
[5] IOC Executive Board suspends Russian Olympic Committee with immediate effect, International Olympic Committee, October 2023, https://olympics.com/ioc/news/ioc-executive-board-suspends-russian-olympic-committee-with-immediate-effect
[6] Russia's appeal against suspension by International Olympic Committee dismissed, BBC, February 2024, https://www.bbc.co.uk/sport/olympics/68378456
[7] Strict eligibility conditions in place as IOC EB approves Individual Neutral Athletes (AINs) for the Olympic Games Paris 2024, International Olympic Committee, December 2023, https://olympics.com/ioc/news/strict-eligibility-conditions-in-place-as-ioc-eb-approves-individual-neutral-athletes-ains-for-the-olympic-games-paris-2024
[8] Paris 2024 Olympics: Russia & Belarus athletes will not be part of opening ceremony, BBC, March 2024, https://www.bbc.co.uk/sport/athletics/68606455
[9] Olympic Games 2024: IOC criticises 'extremely aggressive' Russian claims, BBC, March 2024, https://www.bbc.co.uk/sport/olympics/68621940
[10] “Russian influence efforts converge on 2024 Paris Olympic Games,” Microsoft Threat Analysis Center, 2024, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/MTAC_Report_Russian_Influence_and_Paris_2024.pdf
[11] Fake News Reports and Videos Seek to Undermine the Paris Olympics, New York Times, June 2024, https://www.nytimes.com/2024/06/03/us/politics/russia-disinformation-olympics-paris.html
[12] “Russian threat actors dig in, prepare to seize on war fatigue,” Microsoft, 2023, https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjIuqj1xueGAxVJUkEAHffeADwQFnoECBUQAQ&url=https%3A%2F%2Fwww.microsoft.com%2Fcontent%2Fdam%2Fmicrosoft%2Ffinal%2Fen-us%2Fmicrosoft-brand%2Fdocuments%2FSemi-annual-Russia-Report-12-07-2023.pdf&usg=AOvVaw1DJTKkno6Ued4Nmia65Sbs&opi=89978449
[13] Fake News Reports and Videos Seek to Undermine the Paris Olympics, New York Times, June 2024, https://www.nytimes.com/2024/06/03/us/politics/russia-disinformation-olympics-paris.html
[14] “Russian influence efforts converge on 2024 Paris Olympic Games,” Microsoft Threat Analysis Center, 2024, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/MTAC_Report_Russian_Influence_and_Paris_2024.pdf
[15] Ibid
[16] Russian influence campaign targets Paris Olympics using fake Tom Cruise documentary, France 24, June 2024, https://www.france24.com/en/tv-shows/truth-or-fake/20240604-russian-influence-campaign-targets-paris-olympics-using-fake-tom-cruise-documentary
[17] RUSSIAN ACTORS MANIPULATE CELEBRITIES FOR ANTI-UKRAINE PROPAGANDA AND CARTEL CLASH CLAIMS 14 LIVES, by Sophia Ritscher, Dan Flanagan, Jayde Dorland
[18] “Russian influence efforts converge on 2024 Paris Olympic Games,” Microsoft Threat Analysis Center, 2024, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/MTAC_Report_Russian_Influence_and_Paris_2024.pdf
[19] Star of David graffiti in Paris - the Russian connection, BBC, November 2023, https://www.bbc.co.uk/news/world-europe-67360768
[20] FRANCE-RUSSIA TENSIONS RISE AMID ANTI-SEMITIC ACCUSATIONS AND RUSSIA ANNOUNCES NATIONWIDE VPN BAN, by Dan Flanagan, Jayde Dorland, Barbara Batycka
[21] “Russian influence efforts converge on 2024 Paris Olympic Games,” Microsoft Threat Analysis Center, 2024, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/MTAC_Report_Russian_Influence_and_Paris_2024.pdf
[22] Ibid
[23] CTG Threat Hunter 36 via X
[24] No, French pilots did not 'accidentally' paint a Russian flag during Olympic flyover, France 24, May 2024, https://www.france24.com/en/tv-shows/truth-or-fake/20240509-no-french-pilots-did-not-accidentally-paint-russian-flag-during-marseille-olympic-parade-flyover
[25] Russian propaganda usurps RFI report and French armed forces website, France 24, March 2024, https://www.france24.com/en/tv-shows/truth-or-fake/20240328-russian-propaganda-usurps-rfi-and-french-ministry-of-arms-website