Page 1 IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF PENNSYLVANIA
UNITED STATES OF AMERICA
)
)
)
)
)
v.
CERTAIN DOMAINS
Case No.: 24-mj-Filed Under Seal
AFFIDAVIT IN SUPPORT OF SEIZURE WARRANT
I,
being duly sworn, hereby declare as follows:
INTRODUCTION
1.
I make this affidavit in support of a warrant for the seizure of 32 internet domains
(the “SUBJECT DOMAINS”) that have been used by the Russian government and Russian
government-sponsored actors to engage in foreign malign influence campaigns colloquially
referred to as “Doppelganger,” in violation of U.S. money laundering and criminal trademark
laws. As set forth below, since at least 2022, under the direction and control of the Russian
Presidential Administration, and in particular Sergei Vladilenovich Kiriyenko (“KIRIYENKO”),
the Russian companies Social Design Agency (“SDA”), Structura National Technology
(“STRUCTURA”), ANO Dialog, have used, among others, the SUBJECT DOMAINS, which
include “cybersquatted” domains 1 impersonating legitimate news entities and unique media brands
created by Doppelganger, to covertly spread Russian government propaganda. As reflected in
SDA’s notes from strategy meetings with KIRIYENKO and other Presidential Administration
officials, SDA project proposals, and other SDA records obtained during the course of the
investigation, some of which are attached as exhibits hereto, these actors designed the content of
Based on my training and experience, I know that cybersquatting is a method of registering a domain
intended to mimic another person or company’s domain. Cybersquatting is used to trick Internet users into
believing they are visiting the legitimate person or company’s website. Page 2 such propaganda to, inter alia, reduce international support for Ukraine, bolster pro-Russian
policies and interests, and influence voters in the U.S. and foreign elections without identifying,
and in fact purposefully obfuscating, the Russian government or its agents as the source of the
content. Among the methods Doppelganger used to drive viewership to the cybersquatted and
unique media domains were the deployment of “influencers” worldwide, paid social media
advertisements (in some cases created using artificial intelligence tools), and the creation of fake
social media profiles posing as U.S. (or other non-Russian) citizens to post comments on social
media platforms with links to the cybersquatted domains, all of which attempted to trick viewers
into believing they were being directed to a legitimate news media outlet’s website.
2.
I am a Special Agent with the Federal Bureau of Investigation (“FBI”). I became a
Special Agent in January 2017 when I was assigned to the Philadelphia Division’s
Counterintelligence Squad. As part of the Counterintelligence Squad, my duties include, among
other things, the investigation of foreign malign influence, espionage, and foreign intelligence
activities against the United States. I have successfully completed the Counterintelligence
Operations Course offered by the FBI Counterintelligence Training Center, where I was exposed
to a variety of counterintelligence techniques, cases, and exercises. I have participated in the
execution of numerous search warrants involving electronic evidence, among other investigative
techniques.
3.
As a federal agent, I am authorized to investigate violations of the laws of the
United States and to execute warrants issued under authority of the United States. I have attended
multiple training courses related to managing counterintelligence and espionage investigations. I
have also been involved in various types of electronic and physical surveillance, the execution of
search warrants, and interviews of crime victims, witnesses, and subjects. Where I assert that an Page 3 event took place on a particular date or at a particular time, I am asserting that it took place on or
about the date or at or near the time asserted. Similarly, where I assert that an event took place a
certain number of times, I am asserting that the event took place approximately the number of
times asserted. Likewise, when I assert that a transaction involved a certain amount of money, I
am asserting that the transaction involved approximately that amount of money.
4.
The facts in this affidavit come from my personal observations, my training and
experience, records seized pursuant to search warrants or obtained through legal process, and
information learned from other agents and witnesses. This affidavit is intended to show merely
that there is sufficient probable cause for the requested warrant and does not set forth all of my
knowledge about this matter.
5.
As set forth below, there is probable cause to believe that the SUBJECT
DOMAINS, 2 see Attachments A-1 through A-9, are property involved in a transaction or attempted
transaction in violation of 18 U.S.C. § 1956(a)(2)(A) (international promotional money
laundering) and 1956(h) (conspiracy to commit same) and/or property used, or intended to be used,
in any manner or part to facilitate violations of § 2320(a)(1) (trafficking in counterfeit goods or
services) (collectively, the “SUBJECT OFFENSES”). In particular, the investigation has revealed
that the SUBJECT DOMAINS have been purchased from U.S. registries or registrars by
individuals abroad who are working under the direction and control of the Russian government,
and in particular KIRIYENKO, including Ilya Gambashidze (“GAMBASHIDZE”), SDA, Nikolai
Tupikin (“TUPIKIN”), and STRUCTURA, which have been sanctioned by the U.S. government
and designated as SDNs, along with ANO Dialog, TABAK, and others, to advance their interests
and the interests of the Russian government, thereby causing U.S. persons to unwittingly provide
References to the individual SUBJECT DOMAINS in this affidavit will be denoted by bolded text. Page 4 goods and services to and for the benefit of one or more of the aforementioned SDNs, in violation
of the International Emergency Economic Powers Act (“IEEPA”). As noted above, the foreign
malign influence effort described herein and carried out by SDA, STRUCTURA, and ANO Dialog
is colloquially referred to as “Doppelganger.”
6.
Because the SUBJECT DOMAINS represent property involved in a scheme to
violate U.S. money laundering laws, they are subject to seizure, and therefore subject to forfeiture
pursuant to 18 U.S.C. §§ 981(a)(1)(A) and 982(a)(1).
7.
In addition, as a secondary basis for seizure and forfeiture, a subset of the SUBJECT
DOMAINS represent property used, or intended to be used, to commit or facilitate the commission
of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in violation of U.S.C. § 2320, and therefore are subject to forfeiture pursuant to 18 U.S.C. § 2323(a)(1)(B) and
(b)(1).
8.
The procedure by which the government will seize the SUBJECT DOMAINS is
described in Attachments A-1 through A-9 hereto and below.
TECHNICAL INFORMATION
9.
Based on my training and experience and information learned from others, I am
aware of the following:
10.
Internet Protocol Address: An Internet Protocol (“IP”) address is a unique numeric
address used by computers on the Internet. An IP Address is a series of four numbers, each in the
range 0-255, separated by periods (e.g., 121.56.97.178). Every computer attached to the Internet
must be assigned an IP address so that Internet traffic sent from and directed to that computer may
be directed properly from its source to its destination. An IP address acts much like a home or
business street address—it enables computers connected to the Internet to properly route traffic to Page 5 each other. The assignment of IP addresses to computers connected to the Internet is controlled by
Internet Service Providers (“ISP”).
11.
Domain Name: A domain name is a string of text that maps to an IP address and
serves as an easy-to-remember way for humans to identify devices on the Internet (e.g.,
“justice.gov”). Domain names are composed of one or more parts, or “labels,” delimited by
periods. When read right-to-left, the labels go from most general to most specific. The right-most
label is the “top-level domain” (“TLD”) (e.g., “.com” or “.gov”). To the left of the TLD is the
“second-level domain” (“SLD”), which is often thought of as the “name” of the domain. The SLD
may be preceded by a “third-level domain,” or “subdomain,” which often provides additional
information about various functions of a server or delimits areas under the same domain. For
example, in “www.justice.gov,” the TLD is “.gov,” the SLD is “justice,” and the subdomain is
“www,” which indicates that the domain points to a web server.
12.
Domain Name System: The Domain Name System (“DNS”) is the way that Internet
domain names are located and translated into IP addresses. DNS functions as a phonebook for the
Internet, allowing users to find websites and other resources by their names while translating them
into the IP addresses that their computers need to locate them.
13.
Domain Name Servers: Domain Name Servers (“DNS servers”) are devices or
programs that convert, or resolve, domain names into IP addresses when queried by web browsers
or other DNS “clients.”
14.
Registrar: A registrar is a company that has been accredited by the Internet
Corporation for Assigned Names and Numbers (“ICANN”) or a national country code top-level
domain (such as .uk or .ca) to register and sell domain names. Registrars act as intermediaries Page 6 between registries and registrants. Registrars typically maintain customer and billing information
about the registrants who used their domain name registration services.
15.
Registry: A domain name registry is an organization that manages top-level
domains, including by setting usage rules and working with registrars to sell domain names to the
public. For example, the registry for the “.com” and “.net” top-level domains is VeriSign, Inc.,
which is headquartered at 12061 Bluemont Way, Reston, Virginia.
16.
Registrant: A registrant is the person or entity that holds the right to use a specific
domain name sold by a registrar. Most registrars provide online interfaces that can be used by
registrants to administer their domain names, including to designate or change the IP address to
which their domain name resolves. For example, a registrant will typically “point” their domain
name to the IP address of the server where the registrant’s website is hosted.
17.
Virtual Private Network: “VPN” means a virtual private network. A VPN extends
a private network across public networks like the Internet. It enables a host computer to send and
receive data across shared or public networks as if they were an integral part of a private network
with all the functionality, security, and management policies of the private network. This is done
by establishing a virtual point-to-point connection through the use of dedicated connections,
encryption, or a combination of the two. The VPN connection across the Internet is technically a
wide area network (“WAN”) link between the sites. From a user perspective, the extended network
resources are accessed in the same way as resources available from a private network-hence the
name “virtual private network.” The communication between two VPN endpoints is encrypted and
usually cannot be intercepted by law enforcement.
18.
Virtual Private Server: “VPS” means a virtual private server. A VPS acts as an
isolated, virtual environment on a physical server operated by a provider. VPS hosting providers Page 7 use virtualization technology to split a single physical machine into multiple private server
environments that share resources. Hosting companies maintain server computers connected to the
Internet. A server is a computer that provides services to other computers. Customers may use
those servers for various functions, depending on the services offered by the hosting company.
Some hosting companies offer simple cloud storage, which allows users to store files, much like
an external hard drive, and share or edit those files with other persons. Other hosting companies
allow users to operate and host websites on the Internet. Other hosting companies enable users to
operate a virtual private server, which allows the customer to run virtualized operating systems
from their computer over the Internet. Each VPS runs on a physical server but has its own selfcontained disk space, bandwidth, processor allocation, memory, and operating system. Multiple
VPS’s can run on one physical server. A hosting company can offer any combination of the above.
In the case of a VPS, each subscriber to a hosting company’s services has full administrative
control over the subscriber’s VPS, which enables the subscriber to choose to install software from
a menu the hosting company offers or store and run the subscriber’s own software.
19.
Who.is: A “Who.is” search provides publicly available information as to which
entity is responsible for a particular IP address or domain name. A Who.is record for a particular
IP address or domain name will list a range of IP addresses that the particular IP address falls
within and the entity responsible for that IP address range and domain name. For example, a Who.is
record for the domain name XYZ.COM might list an IP address range of 12.345.67.0-12.345.67.and list Company ABC as the responsible entity. In this example, Company ABC would be
responsible for the domain name XYZ.COM and IP addresses 12.345.67.0-12.345.67.99. Page 8 INTERNATIONAL MONEY LAUNDERING AND IEEPA
20.
Title 18, United States Code, Section 1956(a)(2)(A) (international promotional
money laundering) prohibits, in relevant part, the transportation, transmission, or transfer of funds
or monetary instruments from or through a place outside of the United States to a place within the
United States, with the intent to promote the carrying on of specified unlawful activity. Pursuant
to 18 U.S.C. § 1956(c)(7)(D), specified unlawful activity includes violations of IEEPA, which is
codified at 50 U.S.C. § 1701 et seq. In addition, any person who “conspires to commit any offense
defined in [Section 1956]” shall also be subject to criminal prosecution. See 18 U.S.C. § 1956(h).
IEEPA
21.
IEEPA authorizes the President of the United States to impose economic sanctions
in response to an unusual and extraordinary threat to the national security, foreign policy, or
economy of the United States. Pursuant to that authority, the President may declare a national
emergency through an Executive Order to deal with that threat.
22.
IEEPA makes it a crime to willfully violate, attempt to violate, conspire to violate,
or cause a violation of any order, license, regulation, or prohibition issued pursuant to IEEPA. U.S.C. § 1705(a), (c).
23.
In 2014, pursuant to his authorities under IEEPA, the President issued Executive
Order 13660, which declared a national emergency with respect to the situation in Ukraine. To
address this national emergency, the President blocked all property and interest in property that
were then or thereafter came within the United States or the possession or control of any United
States person, of individuals determined by the Secretary of the Treasury to meet one or more
enumerated criteria. These criteria include, but are not limited to, individuals determined to be
responsible for or complicit in, or who engage in, actions or policies that threaten the peace, Page 9 security, stability, sovereignty, or territorial integrity of Ukraine; or who materially assist, sponsor,
or provide financial, material, or technological support for, or goods or services to individuals or
entities engaging in such activities. Executive Order 13660 prohibits, among other things,
transferring, paying, exporting, withdrawing, or otherwise dealing in any interest in property in
the United States owned by a person whose property and interests in property are blocked (a
“blocked person”), as well as the making of any contribution or provision of funds, goods, or
services by a United States person, to, or for the benefit of a blocked person, and the receipt of any
contribution or provision of funds, goods, or services by a United States person from any such
blocked person.
24.
The President on multiple occasions has expanded the scope of the national
emergency declared in Executive Order 13660, including through: (1) Executive Order 13661,
issued on March 16, 2014, which addresses the actions and policies of the Russian Federation with
respect to Ukraine, including the deployment of Russian Federation military forces in the Crimea
region of Ukraine; and (2) Executive Order 13662, issued on March 20, 2014, which addresses the
actions and policies of the Government of the Russian Federation, including its purported
annexation of Crimea and its use of force in Ukraine. Executive Orders 13660, 13661, and are collectively referred to as the “Ukraine-Related Executive Orders.” On February 21, 2022, the
President again expanded the scope of the national emergency, finding that the Russian
Federation’s purported recognition of the so-called Donetsk People’s Republic and Luhansk
People’s Republic regions of Ukraine contradicts Russia’s commitments under the Minsk
agreements and threatens the peace, stability, sovereignty, and territorial integrity of Ukraine.
25.
The Ukraine-Related Executive Orders authorized the Secretary of the Treasury to
take such actions, including the promulgation of rules and regulations, and to employ all powers Page 10 granted to the President under IEEPA, as may be necessary to carry out the purposes of those
orders. The Ukraine-Related Executive Orders further authorized the Secretary of the Treasury to
redelegate any of these functions to other offices and agencies of the United States Government.
26.
To implement the Ukraine-Related Executive Orders, the U.S. Department of the
Treasury's Office of Foreign Assets Control (“OFAC”) issued certain Ukraine-Related Sanctions
Regulations. These regulations incorporate by reference the prohibited transactions set forth in the
Ukraine-Related Executive Orders. See 31 C.F.R. § 589.201. The regulations also provide that the
names of persons designated directly by the Ukraine-Related Executive Orders, or by OFAC
pursuant to the Ukraine-Related Executive Orders, whose property and interests are therefore
blocked, are published in the Federal Register and incorporated into the SDNs and Blocked
Persons List (the “SDN List”), which is published on OFAC’s website. Id. at note 2.
27.
Among other things, E.O. 13661 prohibits United States persons from transferring,
paying, exporting, withdrawing, or otherwise dealing in the property or interests in property of a
designated person identified on the SDN List. E.O. 13661 § 1. These prohibitions include the
making of any contribution or provision of funds, goods, or services by, to, or for the benefit of, a
designated person identified on the SDN List. E.O. 13661 § 4. Any transaction that evades or
avoids, or has the purpose of evading or avoiding, or causes a violation of E.O. 13661 is further
prohibited. Id. § 5. “United States person” is defined as a United States citizen, permanent resident
alien, entity organized under the law of the United State or any jurisdiction within the United States
(including foreign branches), or any person in the United States. 31 C.F.R. § 6(c).
28.
On March 2, 2021, OFAC announced sanctions designating seven Russian
government officials, including First Deputy Chief of Staff of the Presidential Executive Office
Sergei KIRIYENKO, pursuant to E.O. 13661 for serving as officials of the Russian government. Page 11 In so doing, OFAC noted that KIRIYENKO “is reported to be President Putin’s ‘domestic policy
curator.’”
29.
On April 15, 2021, pursuant to his authorities under IEEPA, the President issued
E.O.14024, which declared a national emergency with respect to:
[H]armful foreign activities of the Government of the Russian Federation—in
particular, efforts to undermine the conduct of free and fair democratic elections
and democratic institutions in the United States and its allies and partners; to engage
in and facilitate malicious cyber-enabled activities against the United States and its
allies and partners; to foster and use transnational corruption to influence foreign
governments; to pursue extraterritorial activities targeting dissidents or journalists;
to undermine security in countries and regions important to United States national
security; and to violate well-established principles of international law, including
respect for the territorial integrity of states—constitute an unusual and
extraordinary threat to the national security, foreign policy, and economy of the
United States.
Similar to the Ukraine-Related Executive Orders, E.O. 14024 blocked the property and interests
in property of persons determined by the Secretary of the Treasury or the Secretary of State to
meet one or more enumerated criteria and prohibited, among other things, the provision of funds,
goods, or services by, to or for the benefit of such a designated person. To implement E.O. 14024,
OFAC issued the “Russian Harmful Foreign Activities Sanctions Regulations,” 31 C.F.R. Part
587. Persons designated pursuant to E.O. 14024 are identified on the SDN List. Id. at note 1.
30.
On February 22, 2022, OFAC announced additional sanctions against
KIRIYENKO pursuant to E.O. 14024. With respect to KIRIYENKO, OFAC again described
KIRIYENKO as “the First Deputy Chief of Staff of the Presidential Office” and reportedly “Putin’s
domestic policy curator.” OFAC noted KIRIYENKO had previously “served as the Prime Minister
of the Russian Federation and as the General Director of Rosatom State Atomic Energy
Corporation” and had been previously designated pursuant to E.O. 13661 in March 2021. Pursuant
to E.O. 14024, OFAC redesignated KIRIYENKO for being or having been a leader, official, senior
executive officer, or member of the board of directors of the Russian government. Page 12 31.
On March 20, 2024, OFAC designated GAMBASHIDZE and TUPIKIN, as well as
SDA and STRUCTURA, pursuant to Executive Order 14024 for “being or having been a leader,
official, senior executive officer, or member of the board of directors of SDA and Structura” and
“for being owned or controlled by, or having acted or purported to act for or on behalf of, directly
or indirectly” for the Russian government. In announcing the sanctions, the Treasury Department
stated, “We are committed to exposing Russia’s extensive campaigns of government-directed
deception, which are intended to mislead voters and undermine trust in democratic institutions in
the United States and around the world.” OFAC explained that GAMBASHIDZE, TUPIKIN,
SDA, and STRUCTURA:
[W]ere involved in a persistent foreign malign influence campaign at the direction
of the Russian Presidential Administration. SDA and Structura have been identified
as key actors of the campaign, responsible for providing GoR with a variety of
services, including the creation of websites designed to impersonate government
organizations and legitimate media outlets in Europe.
Leading into Fall 2022, Tupikin and Gambashidze implemented a campaign that
impersonated news websites, staged videos, and fake social media accounts.
Specifically, Tupikin and Gambashidze, via SDA and Structura, have implemented,
on behalf of GoR, a sprawling network of over 60 websites that impersonated
legitimate news organizations, and which used misleading social media accounts to
amplify the content of the spoofed websites. The fake websites appeared to have
been built to carefully mimic the appearance of legitimate news websites. The fake
websites included embedded images and working links to legitimate sites and even
used the impersonated site’s cookie acceptance page.
32.
SDA and STRUCTURA, both of which were founded by GAMBASHIDZE, are
Russian companies headquartered at adjacent buildings in Moscow. SDA is a public relations
company, specializing in election campaigns, with deep ties to the Russian government. SDA’s
website notes the work it has done for the Russian Duma, the Russian Ministry of Internal Affairs,
as well as multiple other Russian government entities. According to its website, STRUCTURA is
a technology company with experience using bots, offering website design, and coordinating Page 13 information systems among other services. STRUCTURA’s website also highlights the work it has
done for the Russian government and lists the same Russian government clients as SDA.
33.
According to OFAC records, at no time has KIRIYENKO, GAMBASHIDZE,
SDA, TUPIKIN, or STRUCTURA, or any of the individuals or entities described below, including
individuals known to have worked at their direction, obtained a license or other written
authorization to purchase, renew, transfer, use, or export the SUBJECT DOMAINS.
TRAFFICKING IN COUNTERFEIT GOODS
34.
Title 18, United States Code Section 2320(a)(1) (trafficking in counterfeit goods or
services), prohibits intentionally “traffic[king] in goods or services and knowingly us[ing] a
counterfeit mark on or in connection with such goods or services.” “Counterfeit mark” is defined
to mean “a spurious mark—(i) that is used in connection with trafficking in any goods, services,
of any type or nature; (ii) that is identical with, or substantially indistinguishable from, a mark
registered on the principal register in the United States Patent and Trademark Office and in use,
whether or not the defendant knew such mark was so registered; (iii) that is applied to or used in
connection with the goods or services for which the mark is registered with the United States Patent
and Trademark Office . . .; and (iv) the use of which is likely to cause confusion, to cause mistake,
or to deceive[.]” 18 U.S.C. § 2320(f)(1)(A). “Traffic” means “to transport, transfer, or otherwise
dispose of, to another, for purposes of commercial advantage or private financial gain, or to make,
import, export, obtain control of, or possess, with intent to so transport, transfer, or otherwise
dispose of[.]” 18 U.S.C. § 2320(f)(5). “Financial gain” is in turn defined broadly to include “the
On March 20, 2024, Special Agents of the FBI interviewed a member of GAMBASHIDZE’s family who
is a U.S. citizen and alerted the family member to the sanctions. In a follow up interview on April 3, 2024,
the family member confirmed they had spoken with GAMBASHIDZE regarding the sanctions after their
interview with the FBI. The family member confirmed GAMBASHIDZE was aware of the sanctions and
that GAMBASHIDZE claimed “what they say about me is not completely true.” Page 14 receipt, or expected receipt, of anything of value.” 18 U.S.C. § 2320(f)(2). Anyone who commits
an offense under this provision is subject to criminal prosecution. 18 U.S.C. § 2320(b)(1).
35.
According to the United States Patent and Trademark Office (“USPTO”), a
trademark can be any word, phrase, symbol, design, or a combination of these things that identifies
goods or services. The word “trademark” can refer to both trademarks and service marks. A
trademark is used for goods, while a service mark is used for services. Trademark owners can
register their trademarks with the USPTO, which maintains a database of registered and pending
trademarks that is available to the public to search. That database includes the date the trademark
owner applied for trademark registration, the date the trademark registered, and examples of the
trademark.
PROBABLE CAUSE
A. Overview of the Russian-Government-Directed Doppelganger Operation
36.
As set forth below, since at least 2022, under the direction and control of the
Russian Presidential Administration, and in particular KIRIYENKO, Russian companies,
including SDA led by GAMBASHIDZE, STRUCTURA led by TUPIKIN, and ANO Dialog led
by TABAK, have used the SUBJECT DOMAINS to engage in foreign malign influence campaigns
(which, as noted above, are colloquially referred to as “Doppelganger”) designed to reduce
international support for Ukraine, bolster pro-Russian policies, and influence voters in U.S. and
foreign elections by posing as citizens of those countries, impersonating legitimate news outlets,
and peddling Russian government propaganda under the guise of independent media brands.
37.
In general, Doppelganger, which is under the direction and control of the Russian
government, and specifically KIRIYENKO, consists of two related foreign malign influence
efforts. Page 15 38.
The first component of the Doppelganger campaign carried out by STRUCTURA
and SDA, acting under KIRIYENKO’s direction and control, involves the creation of fake
websites that mimic legitimate media outlets. Doppelganger places content on those spoofed
websites that promote specific narratives identified by the Russian government to further the
Russian government’s objectives, such as influencing the U.S. electorate by targeting specific
audiences within the United States and elsewhere. To evade detection, Doppelganger created
sophisticated cybersquatted domains (which include the SUBJECT DOMAINS) that appear to be
the websites of legitimate news outlets such as Fox News, The Washington Post, and Forward,
among others. In general, the cybersquatted domains appear virtually identical to their legitimate
media counterparts, including through the use of the same layout and design, as well as the same
trademarks, logos, and slogans, and through attributing the false articles found on the
cybersquatted domain to real journalists for the legitimate outlet, with the journalists’ names,
photographs, and bylines featured on the domain. In addition, links to other content on the
SUBJECT DOMAINS re-route the reader to the legitimate news outlet. However, the content
published on the cybersquatted domains is not the legitimate journalistic work of the impersonated
media outlet and impersonated journalists; rather, the cybersquatted domains publish fake news
articles that promote Russian interests without identifying, and in fact purposefully obfuscating,
the Russian government or its agents as the source of the content.
39.
and
For example, from within the Eastern District of Pennsylvania, FBI agents located
reviewed
six
articles
published
on
Doppelganger’s
cybersquatted
domain
The FBI used the WayBack Machine to locate articles published on the cybersquatted domains. The
Wayback Machine is a digital archive of the World Wide Web founded by the Internet Archive, an
American nonprofit organization, that allows the user to go “back in time” to see how websites looked in
the past. See EVO Brands, LLC v. Al Khalifa Group LLC, 657 F. Supp. 3d 1312, 1322-23 (C.D. Cal. 2023)
(collecting cases and noting that “[c]ourts have taken judicial notice of internet archives in the past, Page 16 washingtonpost[.]pm. Washingtonpost[.]pm is a nearly identical duplication of the legitimate
Washington Post website. All links on washingtonpost[.]pm such as the website navigation menu,
the Washington Post icon, and the byline, re-route the reader to the legitimate washingtonpost.com
website. Washingtonpost[.]pm also features trademarks registered to The Washington Post. The
articles published on the washingtonpost[.]pm are published under the name of a legitimate
Washington Post journalist and feature his/her photograph. Based on my training, experience, and
this investigation, I believe this duplication is likely to mislead or confuse U.S. persons and other
readers into believing that the Russian propaganda presented in the article is from a legitimate
U.S.-based news organization. A search for the articles located on washingtonpost[.]pm or
substantially similar content on washingtonpost.com yielded negative results, as did a review of
the legitimate Washington Post journalist’s published articles on washingtonpost.com.
40.
The articles located on washingtonpost[.]pm present a pro-Russia and anti-
Ukrainian viewpoint, and many of the articles focused on U.S. policy or politics. None of the
articles include attribution to SDA, STRUCTURA or the Russian government. For example, one
article is titled “White House Miscalculated: Conflict with Ukraine Strengthens Russia” and
purports to be authored by a Washington Post reporter. The article states, in part:
It is time for our leaders to recognize that continued support for Ukraine is a
mistake. It was a waste of lives and money, and to claim otherwise only means
further destruction. For the sake of everyone involved in the conflict, the Biden
administration should just make a peace agreement and move on.
See Exhibit 1 for illustrative examples of the cybersquatted domains.
41.
To distribute their propaganda without attribution to the Russian government,
Doppelganger created social media profiles posing as U.S. (or other non-Russian) citizens. These
including Archive.org’s ‘Wayback Machine,’ finding that Archive.org possesses sufficient indicia of
accuracy that it can be used to readily determine the various historical versions of a website”). Page 17 profiles then posted comments on social media platforms with links to the cybersquatted domains
to trick viewers into believing they were visiting a legitimate news outlet.
42.
The cybersquatted domains used by Doppelganger generally are not indexed by
search engines. A visit to the standalone domain, such as www.washingtonpost[.]pm, reveals a
blank page or an error page. Rather, as its primary method of distribution, Doppelganger created
fraudulent social media personas impersonating U.S. citizens to post article-specific extended
hyperlinks to the cybersquatted domains on those social media platforms. 5 To further disseminate
their propaganda beyond social media posts, Doppelganger also purchased and placed
advertisements on social media platforms to drive traffic to their articles. Based on my training
and experience, I believe Doppelganger distributes its propaganda in this manner in order to
obscure from Americans and other targeted readers the fact that they are not visiting a legitimate
news outlet.
43.
The second component of the Doppelganger campaign, carried out by ANO Dialog
and TABAK, acting under KIRIYENKO’s direction and control, focused on creating original
brands (which include the SUBJECT DOMAINS) to disseminate Russian propaganda. These
brands purport to be independent journalists or independent news media organizations but actually
published content under the direction and control of the Russian government. As discussed below,
the same articles would appear on both the cybersquatted domains and the ANO Dialog media
brands, which indicates to me that ANO Dialog and SDA/STRUCTURA acted in close
coordination under the direction and control of the Russian government and KIRIYENKO.
For example, while a visit to www.foxnews.cx would reveal a blank or error page, a visit to
www.foxnews.cx/world/US-Decided-to-Trade-Ukraine-for-Security.html would reveal the active
cybersquatted website with an article and the re-routing links to the legitimate Fox News. Page 18 44.
As detailed below, individuals associated with Doppelganger—who are believed to
be based in Russia or elsewhere outside the United States—have transferred funds from outside
the United States to lease most of the SUBJECT DOMAINS from United States-based domain
registrars or registries at the direction and control of, and for the benefit of, sanctioned persons,
including KIRIYENKO, GAMBASHIDZE, SDA, TUPIKIN, and STRUCTURA. These criminal
actors did not obtain an OFAC license before leasing the SUBJECT DOMAINS. Because they
have transferred funds from or through a place outside the United States to a place within the
United States, with the intent to promote a specified unlawful activity (here, an IEEPA violation),
there is probable cause to believe they have violated U.S. money laundering laws. In addition, the
conspirators took steps to make each of the SUBJECT DOMAINS available on the Internet,
including in the Eastern District of Pennsylvania. As set forth below, the conspirators specifically
targeted the Commonwealth of Pennsylvania’s citizens, including those located in the Eastern
District of Pennsylvania, in order to influence the electorate in this, and other districts.
45.
In addition, and as detailed further below, there is probable cause to believe that a
subset of the SUBJECT DOMAINS is being used or is intended to be used to commit or facilitate
trafficking in counterfeit goods or services. These SUBJECT DOMAINS feature registered
marks—The Washington Post logo, for example—that are identical to, or substantially
indistinguishable from, marks registered on the Principal Register maintained by the USPTO and
that are in use by the mark holder. The SUBJECT DOMAINS use these marks in connection with
goods or services that are the same as those for which they are registered on the Principal Register
and the SUBJECT DOMAINS’ use of the marks is likely to cause confusion, mistake, or to deceive
the public. As set forth below, the infringing SUBJECT DOMAINS were accessed from the Page 19 Eastern District of Pennsylvania and thus the infringing goods passed through Eastern District of
Pennsylvania.
B. Public Reporting on Doppelganger
46.
In July 2023, the European Union (“EU”) sanctioned seven Russian individuals and
five Russian entities for their role in Doppelganger. Among the entities and individuals sanctioned
by the EU were SDA, STRUCTURA, GAMBASHIDZE, and ANO Dialog. In so doing, the EU
explained:
Russian actors have conducted a digital information manipulation campaign named
‘RRN’ (Recent Reliable News) aiming at manipulating information and
disseminating propaganda in support of Russia’s war of aggression against Ukraine.
That campaign, in which government bodies or bodies affiliated to the Russian
State have participated, relies on fake web pages usurping the identity of national
media outlets and government websites as well as fake accounts on social media. STRUCTURA and SDA were identified as “the key actor[s] of the campaign, responsible for the
creation of fake websites impersonating government organizations and legitimate media in Europe
(primarily Germany, France, Italy, Ukraine and the United Kingdom) and for boosting the proRussian ‘RRN’ campaign on social media.” 47.
On July 19, 2023, the Viginum Agency (“VIGINUM”), a French government
agency tasked with vigilance and protection against foreign digital interference, which operates
under the authority of the Secretariat-General for National Defense and Security, highlighted
Doppelganger’s creation and operation of cybersquatted domains:
Since February 2023, VIGINUM has noticed an increasing number of impersonations of
major French and foreign media outlets, in order to publish pro-Russian articles linked to
the war in Ukraine. . .
The appearance of typosquatted websites is in every way similar to that of the media outlets
they are impersonating, the only difference being the visited URL. The domain names of
Regulations, Official Journal of the European Union, L 190, Vol. 66 (28 July 2023) available at
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2023:190I:FULL.
Id. Page 20 typosquatted media outlets use the same source code as that of legitimate media outlets:
most of the links on the legitimate website are downloaded on the typosquatted website,
which lends it credibility in the eyes of unsuspecting users.
48.
VIGINUM also highlighted Doppelganger’s use of Facebook pages and
advertisements to disseminate disinformation. According to VIGINUM, “Since February 2023,
more than 160 Facebook pages have been identified by VIGINUM, posting more than sponsored content containing links to articles and websites linked to the campaign.” As described
below, the investigation has revealed that Doppelganger purchased numerous social media
advertisements targeting U.S. politicians and relied on artificial intelligence to generate the
content.
C. The Russian Presidential Administration, through KIRIYENKO, Exercises Direction
and Control Over Doppelganger
49.
GAMBASHIDZE took extensive notes documenting meetings between
KIRIYENKO, SDA, STRUCTURA, TUPIKIN, ANO Dialog, members of the Russian
government like Sofia Zakharova (“Zakharova”), and others involved in Doppelganger.
GAMBASHIDZE’s notes include contact lists, staff lists, task or to-do lists, and potential ideas for
malign foreign influence campaigns. Between April 2022 and April 2023, GAMBASHIDZE took
notes related to at least 20 Russian Presidential Administration meetings.
50.
For example, one note was titled “Meeting with SVK at the AP” 8 and dated April
16, 2022. I assess that AP is an abbreviation for Administratsiya Prezidenta, which translates from
Russian to English as the Presidential Administration. Based on the context and content of the
meeting notes, other records obtained during this investigation, and the supervisory role that SVK
Virtually all records discussed herein were in the Russian language. Throughout this affidavit, italicized
quoted language indicates a verbatim translation, whereas plaintext quoted language indicates a summary
translation. Exhibits 2B through 13B to this affidavit have been translated verbatim. All translations were
completed by FBI linguists. Page 21 appears to play in the Doppelganger campaign, I assess that SVK is a reference to Sergei
Vladilenovich KIRIYENKO. As noted above, KIRIYENKO has been sanctioned and described
by OFAC as “the First Deputy Chief of Staff of the Presidential Office” and reportedly “Putin’s
domestic policy curator.” KIRIYENKO is frequently referred to in Russian and Western media as
“Putin’s right-hand man.” In addition, the notes refer to Russian President Vladimir Putin and
reveal that SVK, who is also referred to as Sergey in the notes, is overseeing and directing the
malign foreign influence efforts described herein.
51.
That note from April 16, 2022 details a meeting led by SVK at which “SVK was
taking detailed notes” to discuss bolstering support for Russia’s invasion of Ukraine. The meeting
participants discussed topics for propaganda, and SVK provided his opinion, with
GAMBASHIDZE recording SVK’s response to the ideas as “well received”, “need to work”, or
“the right thing to do.” SVK told the group they must use two mechanisms “to be effective: 1.
Creating of a nuclear psychosis. The USA have been prepping Europe for a big war with the
Russian Federation. War for peace. 2. Exaggeration.” While GAMBASHIDZE’s note contains
passing references to other meeting participants, the most substantive details recorded were when
SVK provided his opinion or instructions. This note also makes reference to “Tabak.” I assess that
the “Tabak” referenced in GAMBASHIDZE’s notes is Vladimir TABAK, the head of ANO Dialog.
52.
On July 13, 2022, GAMBASHIDZE wrote a note titled “Minutes of the Meeting at
the AP on July 13, 2022.” The note listed meeting participants as “Stas, Sofia, Ilya, and Sergey.” I
assess that the Sofia referenced is likely Sofia Zakharova, a Russian Presidential Administration
spokesperson. Zakharova is a Kremlin official who has also focused on information technology
and communications infrastructure. Zakharova has regularly taken part in conferences and events Page 22 dedicated to artificial intelligence. 9 Based on my training, experience, and information gathered
through this investigation, I assess that the Ilya referenced is Ilya GAMBASHIDZE and that the
Sergey referenced is KIRIYENKO. GAMBASHIDZE’s note identifies KIRIYENKO, as “SVK”,
telling the meeting participants, “it’s an impossible task,” which I assess to be a reference to the
difficulties in effectuating the Doppelganger campaign. GAMBASHIDZE notes that the
participants had “initially talked him into five countries. Now he says no.” Based on the context of
the note and this investigation, I assess that “him” and “he” refers to KIRIYENKO.
GAMBASHIDZE records that the group agreed “the Germans are more dependent than the
French” and decided to focus its efforts on the Germans. In particular, the group agreed that “first
and foremost, we need to discredit the USA, Great Britain and NATO, and secondly, we need to
convey the truth about the war in Ukraine” and the need to convince Germans to oppose the
“inefficient politics of sanctions.”
53.
According to the note, the participants used the remainder of the meeting to discuss
anti-Ukrainian, pro-Russian narratives to distribute, with a focus on Germany. GAMBASHIDZE
noted “They were assigned Russian Reliable News – changed it into Recent, it’s going to work.(was
sent by Tabak).”
54.
GAMBASHIDZE referenced SVK in six other notes in addition to the two
described above. According to a note titled “Meeting Minutes AP_25.07.22 – 11.00” SVK and
others again discussed targeting Germany. SVK suggested “in order to normalize relations, it is
necessary to show who caused them to deteriorate,” and directed the meeting participants to
influence German-Russian relations. The notes indicate that Sofia, whom I assess to be Zakharova,
See https://www.voanews.com/a/investigation-who-is-ilya-gambashidze-the-man-the-us-governmentaccuses-of-running-a-kremlin-di
Page 23 instructed the creation of “websites to tell the Germans the truth!” Another participant suggested
using “real facts to complement fake facts.” One suggestion included trying to “make a fake on an
American soldier that raped a German woman. That would be great!” Another note, titled “AP
Meeting Minutes, Monday, January 16” referenced another party as being “fully in charge of filling
the content on the Ukraine Tribunal portal.” That note also indicated a topic “for business-elites”
as “Bypassing sanctions: they don’t need to be lifted, they need to be bypassed.”
55.
Although five of the notes did not list SVK as a participant, the meeting notes
indicate that the meetings discussed presentations, reports, and metrics related to Doppelganger
for SVK’s review and awareness as well as his reactions to, and approval of, various products. For
example, in a note titled “Minutes of the Meeting at the AP, August 1, 2022”, GAMBASHIDZE
mentioned that articles would be submitted to SVK’s office and that “so far three were well
received.” Other notes mentioned creating reports or presentations for SVK, to include media
monitoring. Another note, “Minutes_-_ECC_AP_05.04.23”, included a discussion of resources,
wherein a participant reported “SVK is not against including our influencers abroad.” 10 That note
referenced a French businessman whom the participants believed could do an “interview” for
“RRN.” A note titled “Meeting Minutes -_AP_01.18.23” refers to SVK as “listening to no more
than ten newsworthy events” and notes that “we need to create our OWN concept based on Ukraine
monitoring and Tabak’s concept.” GAMBASHIDZE noted, “They are expecting fake news from
us every day.”
56.
At least 13 of the meeting notes listed “SAZ” as a meeting participant, which I assess
to be a reference to Zakharova due to her initials and the use of Sofia in the body of some notes.
Another meeting note indicated that “we need influencers! A lot of them and everywhere. We are ready
to wine and dine them.” Page 24 Based on my training, experience, this investigation, and the context and content of the notes, I
assess that Zakharova reported to KIRIYENKO and conveyed information regarding these
meetings to and from KIRIYENKO for his approval and further direction.
57.
One note of a January 13, 2023, meeting attended by GAMBASHIDZE, Zakharova
and others mentioned they had “reported to the President about the project.” I assess that “the
President” refers to Russian President Vladimir Putin. The note stated that the participants should
not constrain themselves to specific countries; rather, “false stories spread could be initiated
everywhere, in different countries, even launched through media.” The note referenced specific
campaigns, including the use of influencers, a “media cluster” with “40-50 websites per country,”
which I assess refers to creating unique media brands led by ANO Dialog, and making “political
animated movies.” After mentioning “our fakes will be restored”, “the IAG team” was specifically
assigned to work on “analytical products and videos.” I assess that IAG is a reference to
GAMBASHIDZE.
58.
In addition to foreign influence campaigns, Doppelganger also appears to have
conducted influence campaigns domestically within Russia, underscoring its close ties to the
Russian government. For example, one note indicates that the “project could be used for P’s
election campaign” which I assess to be a reference to Russian President Putin. Likewise, a
different meeting note from a meeting SAZ attended indicated the group discussed “Putin team-example of work for the upcoming campaign” and explained that “Our battlefield is here. That’s
why men are not in Donbas.”
59.
Another note, titled “Meeting Minutes_-_AP_Factory_01.27.23” includes the
instruction that “When providing a narrative it’s important to remember that this is ‘from a German Page 25 to a German’, ‘from a Frenchman to a Frenchman’!” I assess this to be a reference to the
Doppelganger’s strategy of posing as citizens of other countries in order to influence their publics.
D. Internal SDA Documents, Correspondence, and Notes Take Credit for the Doppelganger
Campaign and Discuss SDA’s Overarching Foreign Malign Influence Strategy
60.
An SDA internal document titled “Countermeasures by foreign agencies and
organizations” which recounted that the “‘collective West’ countries are seriously concerned by
the effectiveness of the project” and that, along with “major online platforms, factcheckers and
investigators” they have “been involved in the effort of countering our narratives since September
2022.” The document went on to list and summarize 15 publications from various news sources
and organizations, such as Meta, Premier Ministre, The Washington Post, Wired, and Le Monde,
which discussed Doppelganger. I believe this document reflects SDA’s acknowledgment of its role
in Doppelganger. See Exhibit 2. 61.
In a similar vein, another SDA document highlighted social media companies’
attempts to combat SDA, STRUCTURA, and ANO Dialog’s propaganda by identifying the
cybersquatted domains, as well as RRN, as suspicious and blocking them. The document set out a
plan to combat the social media companies’ disruption efforts by posting comments through social
media accounts to complements their use of bots and further publicize their narratives. The plan
was to post “60,000 comments per month for France and Germany combined.” See Exhibit 3.
62.
SDA also possessed at least 27 invoices for the equivalent of thousands of U.S.
dollars’ worth of translation services. These invoices requested payments for the translation of
Attached as Exhibits to this affidavit are the original Russian-language SDA documents lawfully obtained
during this investigation (see Exhibits 2B through 13B) as well as English-language translations (see
Exhibits 2A through 13A). All of the SDA documents were obtained prior to June 1, 2024. Consistent with
Department of Justice policy, redactions have been applied to certain identifiers contained within the
documents. The terms substituted in place of those identifiers in the English language translations relate to
the status of those persons or entities at the time the documents were obtained. Page 26 files, identified by the file name. The file names on the invoices appear to correspond to the
headlines of articles published on the cybersquatted domains, including certain SUBJECT
DOMAINS. For example, one SDA invoice dated December 18, 2023, contained six file names,
which matched articles found either on washingtonpost[.]pm or fox-news[.]in. One of the partial
headlines listed on the SDA invoice was “Middle East Coalition of US Allies Crumbles.” I have
located and reviewed a corresponding article published on washingtonpost[.]pm that is titled
“Middle East Coalition of US Allies crumbles like a House of Cards.” Accordingly, I believe these
invoices reflect SDA’s payment for Doppelganger-related services. See Exhibit 1 at 6.
63.
Multiple SDA documents detail SDA’s strategy for implementing its foreign malign
influence campaigns. Among these documents is what appears to be an initial concept plan for the
Doppelganger campaign, which specifically referenced GAMBASHIDZE, and noted “if we can,
we need a separate department for fakes - a factory!” 12 The document indicated the campaign
would target England, Germany, and Italy and would have “Two news sites: English-language and
German-speaking.” 64.
A hallmark of the Doppelganger campaign was to impersonate U.S. and other non-
Russian citizens through the creation of fake social media profiles. Then, that social media profile,
posing as an American or other non-Russian citizen, would post comments or other content
promoting a pro-Russian narrative and include a hyperlink to the cybersquatted domain
impersonating a legitimate news outlet like The Washington Post or Fox News. Using this manner
of distribution, KIRIYENKO, GAMBASHIDZE, TUPIKIN, SDA, and STRUCTURA are able to
mislead, for example, American citizens into believing they are seeing the viewpoints of a fellow
This translation was completed using machine translation software.
This translation was completed using machine translation software. As discussed below, I assess that
these two “news” websites are likely references to RRN and Journalisten Freikorps. Page 27 American citizen, rather than the Russian government’s view. SDA documents provide detailed
instructions on how these fake American social media profiles should distribute Doppelganger
content through social media platforms. For example, SDA documents provide instructions and
exemplar social media posts designed to influence the U.S. election. One such document first sets
out what appears to be an article, written in English, likely to be published on one of the
cybersquatted domains with the headline “U.S. Loses Its Position as a World Leader by Making
Too Many Mistakes” under the heading of “International Politics.” The document envisions the
creation of social media profiles posing as American citizens “living in a small town,” which would
post comments linking to the article in order to influence the views of actual American voters. That
document also provided suggested English-language comments for use in distributing the article
on social media. See, e.g., Exhibit 4, Exhibit 5.
65.
Another 26-page SDA manual set forth a plan for a campaign targeting the
Ukrainian public. The manual showed SDA dividing its influence campaigns into four sections:
“monitoring, analytics, content production, and content delivery.” See Exhibit 6. This manual
described SDA’s efforts to create “articles (long reads)” which were “original texts ranging from
2,000 to 5,000 characters with spaces, devoted to topics relevant to the Ukrainian audience, which
fit into the main subject areas of the project. Each text is professionally edited and accompanied
by 10 comments and 3 teasers for disseminating the text on social networks.” I assess that SDA’s
reference to these articles, or “long reads”, refer to the original content produced by Doppelganger
and intended to be posted on domains SDA controls, including the SUBJECT DOMAINS, and
which may also be distributed through ANO Dialog’s unique media brands. Further, I assess that
the reference to “10 comments and 3 teasers” refers to SDA’s practice of spreading Doppelganger Page 28 content by posting links to the cybersquatted domains through proposed social media comments,
as discussed in the preceding paragraphs.
66.
SDA documents further reveal that SDA extensively monitors and collects
information about a large number of media organizations and social media influencers. One
document revealed a list of more than 2,800 people on various social media platforms like Twitter,
Facebook and Telegram, spanning 81 countries, that SDA identified as influencers, including
television and radio hosts, politicians, bloggers, journalists, businessmen, professors, think-tank
analysts, veterans, professors, and comedians. When referring to politicians, the list often
mentioned which U.S. state and/or political party they represent and the position they hold in
Congress. The U.S.-based influencers accounted for approximately 21% of the accounts being
monitored by SDA. On another list of over 1,900 “anti-influencers” 14 from 52 countries, the U.S.based accounts comprised 26% of the total accounts being monitored by SDA. I assess that “antiinfluencer” indicates that the account posts content that SDA views as contrary to Russian
objectives. Based on my review of other records obtained during this investigation, I know that
SDA adds information captured through its monitoring efforts to dashboards. These dashboards
analyze trends in public opinion and thereby measure the effectiveness of the malign foreign
influence campaign based on its impact on public opinion. SDA’s content varies from project to
project; however, it can include videos, memes, cartoons, social media posts, and/or articles. SDA’s
content delivery also varies each campaign, but often relies heavily on social media posts driving
targeted audiences to domains SDA controls, like the SUBJECT DOMAINS.
This translation was completed using machine translation software. Page 29 67.
One SDA document outlined a project titled “International Conflict Incitement”
which targeted Germany and France. As described by SDA, the
objective of the ‘International Conflict Incitement’ project is to escalate internal
tensions in the countries allied with the United States in order to promote the
interests of the Russian Federation on the international arena. To influence reallife conflicts and artificially create conflict situations, it is proposed to use a wide
range of information tools to influence public opinion.
SDA intended for its project to result in the “[e]scalation of the conflict situation through the use
of available tools (traffic redirection, work with comments, work with influencers, analytical
articles, augmented reality, media mirror outlets, fakes, etc.) in order to destabilize the societal
situation.” I believe “media mirror outlets” is the term SDA used to refer to Doppelganger’s use
of cybersquatted domains to impersonate legitimate news outlets. The project intended to
artificially generate conflicts through, among other things, “spreading additional false narratives”;
“fake videos, documents, and telephone conversation recordings”; “comments on social media”;
and “fake and real quotes from influencers”. The project identified the “media mirrors outlets”;
“foreign and Russian influencers” and “bots and work with comments;” as “delivery channels” for
the project. See Exhibit 7.
68.
In another document, SDA summarized its campaign against Germany, identifying
three major themes: (1) “HOHLI – pigs”; 15 (2) “The difference between Ukraine and Germany”;
and (3) “The U.S. is behind everything.” 16 It also included 43 ideas for propaganda, which were
all associated with one or more of the three themes listed above. The document placed each idea
into a table, complete with the target audience and media type. For example, one idea for “The
U.S. is behind everything,” theme was a “screenshot of the publication with a photo of the US
After consulting with Ukrainian and Russian speaking FBI employees, I have learned that this term is a
derogatory word for Ukrainians.
This translation was completed using machine translation software. Page 30 Embassy in Germany. Headline: Scholz became employee of the month at the US Embassy.” This
screenshot and headline were meant to impress upon viewers that the U.S. directs German policy.
SDA’s Foreign Malign Influence Plans for the 2024 U.S. Election
1. The Good Old U.S.A. Project
69.
SDA records show that, starting in the fall of 2023, SDA began developing a
campaign targeting the 2024 U.S. federal elections which it called “The Good Old U.S.A.
Project.” 17 See Exhibit 8. According to the planning document, the project’s goal was to influence
U.S. public opinion to align with the viewpoint “that the US should target their effort towards
addressing its domestic issues instead of wasting money in Ukraine and other ‘problem’ regions.”
The document laid out objectives and specific demographics for targeting U.S. audiences
(including specific messaging to voters in six swing states) through social media groups, social
media advertising, and influencers. The document specifically refers to the content to be
distributed by SDA as “bogus stories disguised as newsworthy events.” These “bogus” stories
would be complimented by “Mass distribution of text comments and memes in Facebook and X
(Twitter) discussion threads.” This “commentary campaign” would spread “false reworked project
narratives supported by facts” and engage in “targeted social engineering based on information
trends and users’ emotional attitude towards them.”
70.
The Good Old U.S.A Project specifically highlighted the use of “[t]argeted
advertising” on social media that would enable SDA to track Americans reactions “to the
distributed material in real time, and directing the psychological response group to contribute to
In the original Russian-language document, the words “The Good Old U.S.A.” were written in English.
This document followed a design template frequently used by SDA, featuring a red and black color scheme;
a common Cyrillic font; bolded, numerical section headers; and logo in the bottom left of each page. Based
on my review of documents obtained during this investigation, I know this template is frequently used by
SDA employees. Page 31 comments thereof. With the help of a network of bots, the psychological response moderates top
discussions and adjust further launches depending on which group was affected the most.”
71.
The use of targeted advertising by Doppelganger is corroborated by records
obtained from Meta pursuant to a warrant, which identified Meta pages and advertisements linked
to the Doppelganger campaign. Notably, those records revealed Doppelganger’s apparent use of
artificial intelligence tools to generate content, including images and videos, for use in negative
advertisements about U.S. politicians. Several of these Meta accounts were registered with account
names that approximate legitimate news media organizations, such as CNN California,
Sacramento Inside, California News, and California BBC (screenshots from the Meta pages
created by Doppelganger are contained below). The CNN California Facebook Page’s profile
picture displayed a blue version of the legitimate CNN logo with California written underneath in
the same shade of blue. The Page was listed on Facebook as a News and Media website and had a
banner in blue with the CNN logo also in blue that read BREAKING HOT NEWS /// HOT NEWS
/// and LIVEHD /// TODAY. Meta records also revealed that Doppelganger used credit cards issued
by U.S. financial institutions to purchase Facebook advertisements. Page 32 2. The “Guerrilla Media Campaign in the United States”
72.
SDA documents include a proposal for another campaign focused on influencing
the United States, titled “The Guerrilla Media Campaign in the United States.” See Exhibit 9. The Guerilla Media Campaign focused on exploiting the perceived polarization of U.S. society by
focusing on eight “Campaign Topics.” As reflected in the proposal, SDA anticipated using social
media profiles on Facebook, X (formerly known as Twitter), YouTube, and Truth Social but noted
that with “Facebook, Twitter and YouTube, we need to create multiple ‘perishable’ accounts,
primarily for the work with comments.” The Guerilla Media Campaign would disseminate its
propaganda through posts, “comments on social networks and local group chats”, memes, and
“video content, including news stories in the Fox News style.” SDA’s plan stated “In order for this
work to be effective, you need to use a minimum of fake news and a maximum of realistic
information. At the same time, you should continuously repeat that this is what is really happening,
but the official media will never tell you about it or show it to you.” I believe the reference to the
“work in the comments” is a reference to Doppelganger’s creation of inauthentic social media
profiles to post comments on social media that included links to the cybersquatted domains,
including the SUBJECT DOMAINS. Further, it appears that SDA required a large number of
“perishable” accounts to disseminate this content because of enforcement efforts by U.S. social
media companies to identify and deactivate accounts associated with Doppelganger. Finally, as
noted above, GAMBASHIDZE’s notes from meetings with the Presidential Administration reveal
a suggestion to use “real facts to complement fake facts.”
This document follows the same template frequently used by SDA, like in The Good Old U.S.A. Project. Page 33 3. “U.S. Social Media Influencers Network” Project
73.
SDA records revealed another influence campaign aimed at avoiding detection and
mitigation by U.S. social media companies by creating and developing “a network of 200 accounts
in Twitter, four in each of the 50 states: two active and two ‘dormant’ ones. Active accounts in each
state will be maintained on behalf of a fictitious individual, who actively supports” a political party
and “represents ‘a community of local activists.’” SDA actively sought to “eliminate the possibility
of detection of the ‘Russian footprint’ in the proposed project, a multi-level protection of the
infrastructure will be built. It will contain VPN services, physical servers located in the United
States, etc.” The project’s goal was to steadily increase the number of subscribers, eventually
reaching one million in one year. See Exhibit 10.
4. Targeting the U.S. by Influencing Other Countries.
74.
SDA records also revealed its planning of campaigns targeting foreign countries,
including Mexico and Israel, with the intent that those efforts would influence associated ethnic or
religious groups residing in the United States. The goal of these campaigns was twofold: (1) to
influence each countries’ populace; and (2) to influence the U.S. 2024 Presidential Election. A
Presidential Administration meeting note from January 13, 2023, revealed that one of the
objectives of the campaign, which had been assigned to GAMBASHIDZE, was to “draft a media
plan for work through expat community media outlets (Armenia--France; Turkey--Germany,
Israel--USA)” and to “compile a list of scenarios for stirring inter-ethnic, religious, racial, and
political conflicts in ‘focus countries’.”
75.
For example, one SDA document with the sub-heading “PROJECT OF
EFFECTIVE PROXY PARTICIPATION IN THE NOVEMBER 2024 CAMPAIGN” presented a
theme of “México no perdona” which translates in English to “Mexico does not forgive.” See Page 34 Exhibit 11. The campaign intended to encourage “anti-American sentiment” as well as to
exacerbate confrontation between the United States and Mexico. Although the campaign would
target Mexico, the campaign’s goal also intended to influence the U.S. Presidential Election. The
proposal concluded with: “Today, the time has come to show to the United States that it is under a
threat. And we can do it.”
76.
As another example, an SDA document described a project titled The
Comprehensive Information Outreach Project in Israel (and also Jewish Community Outreach in
the US)”. See Exhibit 12. Similar to the document relating to Mexico, one of the stated goals of
this campaign was to influence the 2024 U.S. Presidential Election. Notably, the proposal
suggested creating “a full-fledged three language” information project that would “target Jewish
communities across the globe, first and foremost in Israel and the US.” I believe that this reference
to a full-fledged online information project is likely a reference to the unique Doppelganger media
brands discussed below.
77.
Consistent with other Doppelganger campaigns explicitly targeting the United
States, this Israel-related campaign would involve the creation of a media brand, targeted
advertising to spread content, the publication of articles in legitimate media, and an operation
involving the widespread posting of social media comments impersonating Israelis. A separate
SDA document provided an example of how to pose as an Israeli and disseminate fake articles and
comments presenting an unattributed Russian narrative through comments on social media. See
Exhibit 13.
THE CYBERSQUATTED SUBJECT DOMAINS
78.
The FBI’s investigation revealed that Doppelganger leased numerous cybersquatted
domains from U.S. companies Namecheap, NameSilo, and GoDaddy using four online personas, Page 35 which I refer to as Kethorn, Kamcopec, Kaspartill, and Anguillet. Each of these personas used
email accounts that incorporated the persona’s name in the email address. I believe that the identity
information provided to lease the domains is false given inconsistencies in names, mailing
addresses, and naming conventions of the associated email addresses. These four online personas
had significant overlap in the legitimate news sources their cybersquatted domains impersonated.
All four personas leased domains impersonating Der Spiegel,19 three personas leased domains
impersonating Bild 20 and T-Online, 21 and two personas leased domains impersonating Reuters, Delfi, 23 and Süddeutsche Zeitung. 79.
The personas used a similar pattern of cryptocurrency 25 payments and Proton Mail
email addresses. 26 In general, Doppelganger actors took steps to obfuscate the origin of the
Der Spiegel is a German news magazine and website based in Hamburg using the domain spiegel.de.
Bild is a German newspaper and website based in Berlin using the domain bild.de.
T-Online is a German news website based in Berlin using the domain t-online.de.
Reuters is a joint British/Canadian news agency that is one of the largest news companies in the world.
It uses the domain reuters.com.
Delfi is a news website in Estonia, Latvia, and Lithuania using the following domains delfi.ee, delfi.lv,
delfi.lt, pl.delfi.lt, and en.delfi.lt.
The Süddeutsche Zeitung, published in Munich, Bavaria, is one of the largest daily newspapers in
Germany and uses the domain sueddeutsche.de.
Based on my training and experience and consultation with FBI subject matter experts, I know that many
criminal actors used virtual currencies or cryptocurrency, like Bitcoin, in order to obfuscate their activity.
In general, transactions involving cryptocurrencies are posted to a public ledger, like the Bitcoin Blockchain
(which can be reviewed through any number of open-source blockchain explorer websites or proprietary
software programs that provide user-friendly interfaces to view data from the Bitcoin Blockchain).
Although transactions are visible on the public ledger, each transaction is only listed by a complex series
of numbers that do not identify the individuals involved in the transaction. This feature makes virtual
currencies pseudo-anonymous; however, it is sometimes possible to determine the identity of an individual
involved in a transaction through several different tools that are available to law enforcement. Bitcoin are
sent to and received from Bitcoin “addresses.” A Bitcoin address is somewhat analogous to a bank account
number and is represented as a 26-to-35-character-long case-sensitive string of letters and numbers.
Proton Mail is an end-to-end encrypted email service based in Switzerland. Page 36 cryptocurrency by using services like ChangeNOW and cryptocurrency mixing algorithms to
obfuscate the originating cryptocurrency wallet used in their transactions.
80.
Based on the commercially available cryptocurrency analysis tools 27 and analysis
by an FBI cryptocurrency subject matter expert, these personas’ cryptocurrency transactions with
NameSilo and Namecheap show that the transactions originated with a cluster of cryptocurrency
wallets. In this case, the FBI determined that the aforementioned cluster of wallets was funded by
an account at a virtual currency exchange (“VCE-1”). 81.
Records received from VCE-1 pursuant to legal process revealed that the funding
account belonged to an individual referred to herein as “Konstantin”. 29 Those records showed that
Konstantin provided Russian identification documents to VCE-1 and only accessed his account at
While the identity of the address owner is generally anonymous, law enforcement may be able to ascertain
information about the identity of the owner of a particular address by analyzing the Blockchain. The
analysis can also reveal additional addresses controlled by the same individual or entity. For example, a
user or business may create many addresses to receive payments from different customers. When the user
wants to transact the cryptocurrency that it has received, it may group those addresses together to send a
single transaction. Law enforcement uses sophisticated, commercial services offered by several different
Blockchain-analysis companies to investigate transactions. These companies analyze the Blockchain and
attempt to identify the individuals or groups involved in the transactions. Specifically, these companies
create large databases that group transactions into “clusters” through analysis of data underlying
transactions. Through numerous unrelated investigations, law enforcement has found the information
provided by these companies to be reliable. The third-party Blockchain-analysis software utilized in this
case is software used by banks and law enforcement organizations worldwide. This third-party Blockchain
analysis software has supported many investigations and been the basis for numerous search and seizure
warrants, and as such, has been found to be reliable. Computer scientists have independently shown that
they can use “clustering” methods to take advantage of clues in how cryptocurrency is typically aggregated
or split up to identify addresses and their respective account owners. See generally United States v.
Sterlingov, 2024 WL 860983 (D.D.C. Feb. 29, 2024) (analyzing reliability of commercial Blockchainanalysis software).
A virtual-currency exchange is a virtual-currency trading platform. Virtual currency exchanges typically
allow trading between the U.S. dollar, other foreign currencies, Bitcoin, and other digital currencies. Many
virtual-currency exchanges also act like virtual banks and store their customers’ Bitcoin. Virtual currency
exchanges doing business in whole or in substantial part in the United States are regulated under the Bank
Secrecy Act, codified at 31 U.S.C. § 5311 et seq., and must comply with federal regulations designed to
combat money laundering, including the collection of identifying information about their customers.
Konstantin’s full name is known to law enforcement but omitted here due to the ongoing nature of law
enforcement investigations. Page 37 VCE-1 through IP addresses that resolve to Russia. On March 7, 2024, Konstantin was interviewed
by U.S. law enforcement regarding his VCE-1 accounts and suspected criminal activity.
Konstantin stated he was a “point to point” exchanger on VCE-1. In describing his business,
Konstantin stated the funds that went through his accounts came from point to point requests and
he had no direct communication with the people he moved the funds for, nor did he know the
origin of the funds. Based on these facts and the analysis described above, I believe there is
probable cause to believe the funds used to lease the SUBJECT DOMAINS by the four personas
as described below, originated from outside the United States.
82.
An analysis of the registrar account login records for the personas revealed that the
vast majority of the login timestamps roughly correspond to Moscow business hours. The IP
addresses used to access the registrars all resolved to either VPS services, or IP addresses that the
cybersecurity company Spur 30 previously associated with criminal cyber actors who compromise
IP addresses and sell access to them, to allow buyers to gain further anonymity online. Even the
VPS services used by the personas were accessed through other VPS services and paid for using
cryptocurrency.
83.
For example, the Kamcopec persona used a particular IP address from a VPS
service to lease one of the domains discussed herein. Records received pursuant to legal process
revealed that a VPS service leased that IP to an account, which used another operational email
address 31 and a second VPS service to access the first VPS. That second VPS account accessed a
GitHub repository which contained a script for layering VPSs. Based on the use of that repository,
Spur is a U.S. cybersecurity industry leader specializing in detecting anonymous infrastructure cyber
criminals use to obfuscate their locations and identities.
Based on my training and experience, I know cybercriminals often create “operational” email addresses
using fake identifying information to conduct illegal activity as a way to obfuscate their identity. Page 38 I believe the Kamcopec persona was using at least three layers of VPS services to obfuscate their
true identity and location. Based on my training and experience, this layering on top of layering of
VPSs and operational email addresses, like Russian nesting dolls, are indicative of a high level of
technical sophistication evidencing an intentional, willful desire to conceal identities and
whereabouts that is commonly associated with state-sanctioned action. As noted above, internal
SDA documents revealed that SDA actively sought to reduce the chance of “detecting the ‘Russian
footprint’ in the proposed project,” by using “a multi-level security infrastructure” including VPN
services and physical servers located in the U.S.
84.
Based on the aforementioned similarities, I assess that these personas were all used
in coordination and furtherance of the Doppelganger campaign either by individuals working for
the sanctioned entities SDA and STRUCTURA, as well as ANO Dialog, and/or their coconspirators, at the direction of KIRIYENKO, a sanctioned person, and the Russian government.
Furthermore, as described herein, there is probable cause to believe that the funds used to lease the
SUBJECT DOMAINS originated outside the United States.
A. The Kamcopec Persona
85.
Information received from GoDaddy, a U.S. company, pursuant to legal process
indicated that the Kamcopec persona leased the following 30 cybersquatted domains used in the
Doppelganger campaign: washingtonpost[.]ltd, lemonde[.]ltd, 32 leparisien[.]ltd, 33 spiegel[.]pro,
bild[.]llc, bild[.]ws, welt[.]ltd, 34 welt[.]ws, welt[.]media, spiegel[.]work, nd-aktuell[.]net, 35 nd-
Le Monde is a French daily afternoon newspaper that uses the domain lemonde.fr.
Le Parisien is a French daily newspaper that uses leparisien.fr.
Die Welt (“The World”) is a German national daily newspaper that uses the domain welt.de.
Neues Deutschland is a German daily newspaper that uses the domain nd-aktuell.de. Page 39 aktuell[.]pro, nd-aktuell[.]co, bild[.]work, obozrevatel[.]ltd, 36 rbk[.]media, 37 milliyet[.]com.co, albayan[.]me, 39 gulfnews[.]ltd, 40 pravda-ua[.]com, 41 faz[.]ltd, 42 faz[.]agency, faz[.]life,
spiegel[.]agency, sueddeutsche[.]ltd, sueddeutsche[.]me, sueddeutsche[.]cc, sueddeutsche[.]co,
tagesspiegel[.]ltd, 43 and tagesspiegel[.]co. The Kamcopec persona also leased three noncybersquatted domains: fraiesvolk[.]com, fraiepozition[.]store, and fraiepozition[.]site. 86.
The Kamcopec GoDaddy account was registered using the name Iakov Shultz, a
GMX email account, and a Polish address and phone number. Records received pursuant to legal
process show these domains were generally leased for one year, and the majority are inactive. The
inactive domains were either taken down by the registries or registrars, or not renewed. Of the
aforementioned domains, nine SUBJECT DOMAINS identified in the preceding paragraph remain
active; however, one of those domains appears to have been taken over by one of the
cybersquatting victim companies, Süddeutsche Zeitung. The Kamcopec GoDaddy account used at
least five VPS services, all of which are non-U.S. companies, one of which Spur linked to
Obozrevatel is a Ukrainian news outlet that uses the domains OBOZ.ua and Obozrevatel.com.
RBK is a Russian media group that runs a newspaper, TV station, and the website, rbc.ru.
Milliyet is a Turkish newspaper based in Istanbul that uses the domain milliyet.com.tr.
Al-Bayan is an Arabic language newspaper in the United Arab Emirates (UAE) which is owned by
Government of Dubai that uses the domain albayan.ae.
Gulf News is a daily English language newspaper published from Dubai, UAE, currently distributed
throughout the UAE and also in other Persian Gulf Countries that uses GulfNew.com.
Ukrainska Pravda is a Ukrainian online newspaper using the domain pravda.com.ua.
Frankfurter Allgemeine Zeitung is a German newspaper that uses the domain. faz.net.
Der Tagesspiegel is a German daily newspaper, though it has a regional correspondent office in
Washington, D.C. and uses the domain tagesspiegel.de.
Based on my training and experience and information gathered through this investigation, I believe that
the fraiesvolk domain was intended to mimic a German daily newspaper published in the 1950s that was
highly critical of the Allied Powers. Page 40 cybercriminal activity, and an Argentinian internet service provider to lease the eleven SUBJECT
DOMAINS.
87.
Each of the SUBJECT DOMAINS leased from GoDaddy by the Kamcopec persona
were paid for using credit cards issued by U.S. financial institutions. Each of the SUBJECT
DOMAINS was leased from GoDaddy between the hours of 4:22 A.M. and 6:08 P.M., Moscow
time. Specifically, the Kamcopec persona paid for the following SUBJECT DOMAINS using a
credit card issued by a U.S. financial institution: sueddeutsche[.]co, tagesspiegel[.]co, faz[.]life,
bild[.]work, and rbk[.]media. The Kamcopec persona paid for the following SUBJECT
DOMAINS using a credit card issued by a different U.S. financial institution: faz[.]ltd,
lemonde[.]ltd, leparisien[.]ltd, spiegel[.]agency, and Pravda-ua[.]com.
88.
Records received pursuant to legal process revealed that the credit cards used to
lease the aforementioned SUBJECT DOMAINS from GoDaddy were issued by U.S. banks to a
U.S. company that has significant ties to, and employees based in, Russia. Consistent with other
identified Doppelganger actors, the Kamcopec persona generally used IP addresses that resolved
to VPS companies for their transactions. Based on my training and experience I know criminal
cyber actors frequently use VPS companies to obfuscate their location, however analyzing their
time stamps can reveal relevant information as to the cyber actor’s potential location. For example,
here, the VPS IP logins revealed that the actor behind the Kamcopec persona is most likely located
in Russia. I assess that the Kamcopec persona either transferred money from Russia to the U.S.based company, which acquired credit cards from U.S. institutions in order to obfuscate the source
of the funds or paid off the credit cards used to lease the domains with funds from Russia. Page 41 89.
Of the nine remaining domains initially leased from GoDaddy, five domains have
been transferred by the Kamcopec persona to other registrars. 45 Specifically, on March 14, 2024,
spiegel[.]agency was transferred to NewFold Digital, which is a U.S. registrar, but the registry
remained Identity Digital Limited. On May 1, 2024, pravda-ua[.]com was transferred to Long
Drive Domains, also a U.S. registrar, however the registry remained Verisign Global Registry
Services.
90.
For the remaining three domains, while the registrar was transferred to a foreign
registrar, the registry for all three remained U.S. companies. Accordingly, there is probable cause
to believe that when the domains were transferred, thus renewing the lease on the domain, a portion
of those funds are used by the overseas registrar to pay the U.S.-based registries. On February 21,
2024, bild[.]work was transferred to GMO Internet, which is a Japanese registrar doing business
as Onamae.com, but the registry remained GoDaddy Registry Services, LLC. On December 28,
2022, lemonde[.]ltd was transferred to Nameshield SAS, a French registrar, but the registry
remained Identity Digital Limited. On February 2, 2022, leparisien[.]ltd was also transferred to
Nameshield SAS, but the registry remained Identity Digital Limited.
91.
Records received pursuant to legal process revealed that the Kamcopec persona
also leased the cybersquatted domains foxnews[.]cx, bild[.]bz, and lefigaro[.]me 46 from
Namecheap. However, in registering with Namecheap, the person using the Kamcopec GMX
email account used a different name, address, and phone number than what was provided to
GoDaddy. Additionally, the Namecheap account was accessed by a secondary Proton Mail account
and used cryptocurrency to lease its domains, none of which are still active. I believe that the
Domain transfer is a process of changing domain name registrars which is a common and simple process.
When a domain is transferred it automatically renews the domain.
Le Figaro is a French daily morning newspaper founded in 1826 using the domain lefigaro.fr. Page 42 Kamcopec persona’s provision of different names, addresses, and phone numbers to GoDaddy and
Namecheap is indicative of an effort to obfuscate the true identity and location of the person(s)
behind the Kamcopec persona, whom I assess to be located in Russia.
B. The Kethorn Persona
92.
Information received pursuant to legal process from NameSilo and Namecheap
identified accounts created using a Proton Mail email address used by the Kethorn persona.
Between June 26, 2022, and October 2, 2022, the Kethorn persona leased six domains from
NameSilo and 24 from Namecheap. The domains include cybersquatted domains affiliated with
the Doppelganger campaign that impersonated legitimate news sources and organizations
including Reuters, Der Spiegel, T-Online, Bild, Delfi, la Repubblica, 47 and ManaBalss. 93.
Specifically, the Kethorn persona leased the following domains: 70-putin-
freunde[.]de, freikorps[.]press, 49 friekorps[.]press, jfreicorp[.]press, jfriecorp[.]press, sieben-
La Repubblica is an Italian newspaper and website using the following domains repubblica.it,
quotidiano.repubblica.it, and video.repubblica.it.
ManaBalss.lv is a civic organization based in Latvia that launched in June 2011 to provide a possibility
for the citizens of Latvia to promote their initiatives and gain support for these initiatives for further
submission to the national parliament of Latvia.
Another one of the purportedly independent media brands that has been identified as having been
established by the Doppelganger campaign is Journalisten Freikorps. This brand appears to be a reference
to the German Freikorps which was a paramilitary unit that existed in Germany for decades. During World
War II, many former Freikorps members rose to power in the Nazi party. I know that the Russian
government has made claims about the presence of purported Nazis or Neo-Nazis in Ukraine as a
justification for Russia’s invasion of Ukraine. I accessed both freikorps[.]press and jfriecorp[.]press using
the Wayback Machine and ascertained that both webpages ostensibly posted news stories in German
consistent with other Doppelganger content using the same Freikorps logo and banner. Through the
investigation, the FBI identified an associated email address that incorporated “J.Freikorps” that was
created on August 24, 2022, two days after a Telegram channel associated with Journalisten Freikorps
started posted on Telegram inviting journalists to share their pieces. Records received pursuant to legal
process revealed the subscriber’s name for the “J.Freikorps” email address was Journalisten Freikorps and
that an SDA employee’s email address was connected to that account by cookies. Based on my training and
experience, I know that when two or more accounts are linked by cookies, this means that the accounts
were accessed using the same device(s) and are likely accessed by the same user(s). Thus, there is probable
cause to believe that SDA is directing and controlling the Journalisten Freikorps campaign. Page 43 fragen-putin[.]de, tonline[.]life, tonline[.]today, t-onlinr[.]life, t-onlinr[.]live, t-onlinr[.]today,
delfi[.]today,
spiegel[.]fun,
spiegel[.]quest,
spiegel[.]today,
spiegel[.]today,
winter-is-
comming[.]de, landwirtinnen[.]de, help-to-migrant[.]de, reuters[.]cfd, reuters[.]cyou, bild[.]vip,
bild[.]asia, delfi[.]today, delfi[.]top, Repubblica[.]icu, repubblica[.]world, socialharmony[.]de,
manabalss[.]li, and musubalss[.]org.
94.
Of the aforementioned domains, only delfi[.]top appears to still be active and under
SDA control. The Kethorn persona provided Namecheap with a German address and German
phone number to lease domains and used German IP addresses resolving to a German VPS service
to lease all the aforementioned domains. On July 12, 2022, the Kethorn persona sent
cryptocurrency to Namecheap to lease delfi[.]top. While the delfi[.]top domain was initially leased
from Namecheap, on February 15, 2024, the Kethorn persona transferred delfi.top to Tucows, a
Canadian registrar. As noted above, this transaction, along with the initial lease of all the
aforementioned domains leased by this persona, originated from a cluster of wallets that were
funded by Konstantin P.
C. The Kaspartill Persona
95.
Information received pursuant to legal process from NameSilo and Namecheap
identified accounts created using a Proton Mail email address, hereafter referred to as the Kaspartill
persona, which leased three domains from NameSilo and 14 from Namecheap. Specifically, the
Kaspartill persona leased the following domains: spiegel[.]ink, sueddeutsche[.]online, tonline[.]life,
bild[.]pics,
dailymail[.]cam,
dailymail[.]cfd,
delfi[.]life,
repubblica[.]life,
The Daily Mail is a British daily tabloid newspaper published in London that also uses the domain
dailymail.co.uk. Page 44 spiegeli[.]life, spiegeli[.]live, spiegeli[.]today, reuters[.]sbs, dailymail[.]top, blld[.]live, itcb[.]life,
dekommnt[.]live, and ukcommunity[.]vip.
96.
Of the aforementioned domains, only dailymail[.]top appears to still be active and
under SDA control; however, on or about October 18, 2023 the Kaspartill persona transferred
registrars for the domain from Namecheap to Alibaba Cloud Computing. The Kaspartill persona
provided Namecheap with a German address, German phone number, and used a German IP
address resolving to a German VPS service to lease all the aforementioned domains. On June 9,
2022, the Kaspartill persona sent cryptocurrency to Namecheap to lease dailymail[.]top. The
transaction took place at approximately 7:30 AM Moscow time and was effectuated using BTCPay.
As noted above, this transaction, along with the initial lease of all the aforementioned domains by
this persona, originated from a cluster of wallets that were funded by Konstantin.
D. The Anguillet Persona
97.
Information received pursuant to legal process from Namecheap identified an
account registered using a Proton Mail account, hereafter referred to as the Anguillet persona, as
having leased the following nine domains, all of which are no longer active: Spiegelr[.]live,
spiegelr[.]today,
t-onlinl[.]life,
t-onlinl[.]live,
t-onlinl[.]today,
sueddeutsche[.]life,
sueddeutsche[.]site, sueddeutsche[.]today, and spiegelr[.]life. Anguillet also used cryptocurrency
to lease its domains and provided a German address, German phone number, and German IP
addresses resolving to a German VPS service to lease the aforementioned domains.
THE U.S. TRADEMARK INFRINGING SUBJECT DOMAINS
98.
Four of the SUBJECT DOMAINS infringe on the trademarks of U.S. media outlets.
Specifically, washingtonpost[.]pm, washingtonpost[.]ltd, fox-news[.]in, fox-news[.]top, and
forward[.]pw, are domains operated by Doppelganger that are likely to confuse, mislead, or Page 45 deceive viewers into believing they are visiting the legitimate Washington Post, Forward, and Fox
News websites. 51 See Exhibit 1. These SUBJECT DOMAINS not only feature infringing content
but also are themselves infringing through their use of registered trademarks as part of the domain
name.
99.
The Washington Post is an American daily national newspaper published in
Washington, D.C. According to its website, The Washington Post’s mission statement includes
seven principles, including “to tell the truth as nearly as the truth may be ascertained.” The
legitimate domain for The Washington Post is washingtonpost.com. The following marks have
been registered on the Principal Register maintained by the USPTO by WP Company LLC on
behalf of The Washington Post:
The wordmark: The stylized wordmark:
The Washington Post
The wordmark:
Democracy Dies in Darkness
100.
I
have
reviewed
content
published
on
washingtonpost[.]pm
and
washingtonpost[.]ltd. Those domains feature articles purportedly written by a Washington Post
reporter and feature their pictures and bylines. A review of the legitimate Washington Post website
reveals no such articles written by that journalist. The washingtonpost[.]pm and
washingtonpost[.]ltd domains use the registered marks of The Washington Post.
The registry for fox-news[.]in is National Internet Exchange of India and the registrar is Tucows, Inc.
The registry for fox-news[.]top is .TOP Registry and the registrar is Tucows, Inc. The registry for
forward[.]pw is Micronesia Investment and Development Corporation and the registrar is Sarek Oy. The
registry for washingtonpost[.]pm is Association Francaise Pour Le Nommage Internet en Cooperation and
the registrar is Sarek Oy.
Registration number 1665832.
Registration number 1665831.
Registration number 6590892. Page 46 101. Fox News is an American national media outlet based in New York City. According
to its website, “FOX News Media offers its audiences in-depth news reporting, along with opinion
and analysis encompassing the principles of free people, free markets and diversity of thought, as
an alternative to the left-of-center offerings of the news marketplace.” The legitimate domain for
Fox News is foxnews.com. The following marks have been registered on the Principal Register
maintained by the USPTO by Fox Media LLC on behalf of Fox News:
The wordmark:*° Fox News
The Stylized wordmark:°° VF Ox NEWS
sf
nesstiatwetaai” a RU ATAU
FOX
The Stylized wordmark:*® NEWS
102. I have reviewed content published on fox-news[.]in and fox-news[.]top. Those
domains feature articles purportedly written by a Fox News reporter and feature their pictures and
bylines. A review of the legitimate Fox News website reveals no such articles written by that
journalist. Both fox-news[.]in and fox-news|.]top use the registered marks of Fox News.
°° Registration number 2708769.
°° Registration number 6548048.
>? Registration number 88980501.
*® Registration number 518099. Page 47 103. Forward is an American news media organization. According to its website,
Forward delivers “incisive coverage of the issues, ideas and institutions that matter to American
Jews.” The legitimate domain for Forward is forward.com. The following mark has been registered
on the Principal Register maintained by the USPTO by The Forward Fund, Inc., on behalf of
Forward:
The Stylized wordmark:°?
104. Ihave reviewed content published on forward[.]pw and have been unable to find
the same or similar articles on forward.com. The forward[.]pw domain uses the registered mark
of The Forward Fund, Inc.
105. Records received from Cloudflare Inc. pursuant to legal process, revealed that two
Proton Mail email accounts purchased Cloudflare services for washingtonpost|.]pm, fox-
news|.]in, and fox-new|.]top. The Cloudflare accounts associated with these two Proton Mail
email accounts were each accessed from the same Netherlands IP address which resolves to a
British VPS server leased by Doppelganger with an address ending in 11.27 (the “11.27 Server”).
On January 2, 2024, a search warrant was authorized for the 11.27 Server. The 11.27 Server had
been identified as having been created by the same user who created two other VPS servers from
the same provider that were used by the Kamcopec persona to register foxnews|.]cx from
Namecheap, Spiegel. |ltd, fax[.|ltd, and welt[.]ltd from GoDaddy, and to access a Cloudflare
account associated with Sueddeutsche{.|Itd.
°° Registration number 5243694. Page 48 106.
The true IP address 60 for forward[.]pw resolves to a Hostinger VPS IP address.
Records received from Hostinger pursuant to legal process, reveal that the Hostinger VPS was
leased by adampalmer1973[@]proton.me on May 18, 2023 using cryptocurrency. The account
accessed the Hostinger VPS using all three of the Doppelganger Servers leased from the British
provider, including the 11.27 Server. 61 Based on my training and experience, I know that when a
person leases a VPS server, like the 11.27 Server, only that person or individuals they grant access
to, can use that VPS server. Accordingly, I assess that any account or domain accessed from the
11.27 VPS server is a member of the Doppelganger conspiracy.
107.
As described further above, the SUBJECT DOMAINS were used by Doppelganger
as part of a foreign malign influence campaign carried out at the behest of the Russian government.
SDA and STRUCTURA are Russian companies that list various Russian government entities as
clients and that perform work for the Russian government.
The Unique Media Brand SUBJECT DOMAINS
108.
As noted above, in addition to impersonating legitimate news outlets,
Doppelganger, led by ANO Dialog and TABAK, under the direction and control of KIRIYENKO,
a sanctioned person, also created original media brands (which are included among the SUBJECT
DOMAINS). These brands purport to be independent journalists or news media organizations but
are actually under the direction and control of the Russian government. The investigation has
A true IP address for a domain is the server where the actual information that comprises the website or
webpage resides. Accordingly, a True IP address for a domain is leased or purchased by the individual in
control of the domain.
As noted above, records received pursuant to legal process revealed that Doppelganger leased three
servers from the Provider who provided the 11.27 Server in three-month intervals before switching to a
new server from the same Provider. Page 49 revealed that as ANO Dialog created the domains for its purportedly unique media brands, it also
registered email addresses that correspond to those domains.
A. RRN, War on Fakes, and the RoyGeneral Persona
109.
As discussed above, GAMBASHIDZE’s notes from Presidential Administration
meetings with KIRIYENKO document the use of Reliable Recent News (“RRN”) by TABAK and
ANO Dialog to further the malign influence campaign, noting “They were assigned Russian
Reliable News – changed it into Recent, it’s going to work.(was sent by Tabak).” RRN was hosted
at rrn[.]world and published in numerous languages. As the Meta coordinated inauthentic behavior
reports 62 note, RRN “maintain[ed] accounts on Twitter and Telegram, which were amplified by
the operation’s Facebook Pages. The Facebook Pages of the Russian diplomatic missions in
Malaysia, Sweden, Hungary, Slovakia and Bangladesh shared links to the site.” According to Meta,
Doppelganger articles would often appear on RRN after they were posted on the cybersquatted
domains: “For example, the same article about Bucha was published on the same day in English
on the spoofed Guardian site, in Italian on the spoofed ANSA site, and in German on the spoofed
Spiegel site. It also appeared in English, French, German, Italian, Spanish and Chinese on
rrn[.]world.” 110.
Information received from NameSilo, a U.S. company, pursuant to legal process
revealed that the domain rrn[.]world was registered on June 6, 2022, by an identified individual,
Starting on September 27, 2022, Meta released a series of reports regarding Doppelganger. These
reports are available to the public on Meta’s website.
During the Russian occupation of Bucha, Ukraine, numerous reports of Russian war crimes were alleged.
After the Russian military retreated from the town, independent journalists confirmed significant atrocities
largely against the civilian population. See https://www.hrw.org/news/2022/04/21/ukraine-russian-forcestrail-death-bucha. “The Russian Defense Ministry denied allegations that its forces killed civilians in Bucha,
stating in a Telegram post on April 3, [2022] that ‘not a single local resident has suffered from any violent
action’ while Bucha was “under the control of the Russian armed forces,’ and claiming instead that the
evidence of crimes was a ‘hoax, a staged production and provocation” by authorities in Kyiv.” On July 7, Page 50 using a Moscow address, with email address reliablerecentnews[@]gmail.com. The individual
applied for and received visas from the State Department to enter the United States from Russia in
2008, 2012, 2015, and 2019. Information received from Google pursuant to legal process revealed
that reliablerecentnews[@]gmail.com was created on July 14, 2023, with the name Reliable Recent
News, a recovery email of rrussianews[@]gmail.com and recovery telephone number that matched
the number provided by the individual on her State Department applications.
111.
I determined that rrn[.]world continued to post Doppelganger content until
approximately July 10, 2024, when it appears ANO Dialog lost control of the domain. At some
point shortly thereafter, unknown actors took over the domain and renamed it Rotten Reliable
News and used the domain to publish information regarding Doppelganger’s methods and
activities, much of which I know to be accurate.
112.
Records received pursuant to legal process from Namecheap, revealed that on July
26, 2023, a week after the VIGINUM report was published identifying rrn[.]world as part of
Doppelganger, RoyGeneral[@]proton.me was used to register an account with Namecheap and
lease rrn[.]media and vip-news[.]org. In registering that Namecheap account, the RoyGeneral
persona provided a Beaverton, Oregon address and what appeared to be an incomplete U.S. phone
number. Law Enforcement and open-source records checks indicate the name and home address
provided are not correlated. Additionally, as further discussed below, the RoyGeneral persona also
created an account with NameSilo to lease three more Doppelganger domains and provided a New
York City address and Canadian phone number.
2022, RRN published an article titled “Video: False Staging in Bucha Revealed!” which falsely alleged the
atrocities were staged by Ukraine. Page 51 113.
On July 26, 2023, the RoyGeneral persona accessed Namecheap with an Estonian
VPS IP address ending in 77.25 (the “77.25 Server”) and deposited $55.00 with BitPay. 64 That
same day, the RoyGeneral persona used $42.90 of the $55 deposited to lease rrn[.]media. Like
the 11.27 Server, given the frequent use of the 77.25 Server by Doppelganger actors, I assess that
the 77.25 Server was leased by Doppelganger and only accessible to persons involved in
Doppelganger.
114.
As discussed further below, the RoyGeneral, Goodbye, Levinaigrenet,
Holylandherald, and Artichocio personas used the 77.25 Server to access their Namecheap
accounts between February 27, 2023 and July 12, 2024. On at least four occasions, more than one
Doppelganger persona accessed their Namecheap accounts at approximately the same times using
this same IP address. This was not the only shared IP address. Between May 11, 2024 and July 1,
2024, the RoyGeneral, Levinaigrenet, Holylandherald, and Artichocio personas each accessed
their Namecheap accounts on at least two occasions from the same Dutch IP address resolving to
the same Russian VPS ending in 76.173 (the “76.173 Server”). Based on my training and
experience, I know that unlike VPNs, which tend to be used once and discarded, when cybercriminals lease a VPS they will frequently make use of that particular server for a period of time
until the lease ends. For example, records received pursuant to legal process revealed that
Doppelganger leased servers from the Provider who provided the 11.27 Server in three-month
intervals before switching to a new server from the same Provider.
As noted below, the persona responsible for leasing levinaigre[.]net, warfareinsider[.]us, and
meisterurian[.]io also accessed Namecheap from the 77.25 Server. Likewise, the individual responsible
for leasing holylandherald[.]com, grenzezank[.]com, and lexomnium[.]com also accessed Namecheap
from the 77.25 Server. Page 52 115.
On July 1, 2024, the RoyGeneral persona accessed Namecheap via three IP
addresses, including a British IP address resolving to a Russian VPS that Spur has linked to a
cybercriminal network, a Moscow IP address that Spur has linked to a cybercriminal network, and
from the 76.173 Server. That same day, the RoyGeneral persona deposited $300.00 with BitPay
and used $42.90 to renew the lease for rrn[.]media and $7.66 to lease vip-news[.]org. I reviewed
materials posted on rrn[.]media and discovered that it uses the same logo and branding as the
original rrn[.]world and continues to post content consistent with the malign influence campaign
previously posted on rrn[.]world.
116.
In addition, records received from OpenAI, a U.S.-based artificial intelligence
research organization, revealed the purchase of multiple artificial intelligence program accounts,
like ChatGPT, to generate and edit articles and comments specifically for rrn[.]media and other
Doppelganger-linked domains. There were five email accounts used to register for OpenAI
services linked to Doppelganger. Records received pursuant to legal process revealed one of those
email accounts was connected by cookies to reliablerecentnews[@]gmail.com. Based on my
training and experience, I know that when two or more accounts are linked by cookies, this means
that the accounts were accessed using the same device(s) and are likely accessed by the same
user(s). One of the other email accounts used to register for OpenAI was connected by cookies to
37 other email accounts. Almost all of these connected email accounts used naming conventions
that corresponded to domains used by Doppelganger as part of their unique media branding
operation, including some of the SUBJECT DOMAINS, as discussed further below.
117.
One of the SUBJECT DOMAINS, waronfakes[.]com, was discussed in length in
the VIGINUM report:
The first articles published on RRN website were identical copies of articles
previously published on the fake Russian fact-checking website War on Fakes, Page 53 launched a few hours after Russia invaded Ukraine. Quickly identified for its role
in legitimizing the Russian ‘special military operation’ and discrediting the
Ukrainian State, War on Fakes has also been amplified by at least 65 official
Facebook pages and official Twitter accounts of the Russian diplomatic network.
Moreover, War on Fakes the administrator’s login page has been set up to redirect
traffic to rrussianews.com, thereby establishing a technical link between the two
websites. The domain name waronfakes[.]com was registered on 1 March and was updated a year later by Timofey VASILIEV a Russian citizen known for
having worked for ANO Dialog. Dialog is an organization created in 2019 under
the supervision of the Russian Presidential Administration and the Department of
Information Technologies of Moscow city. In charge of a portion of the public
relations and communication strategy of Moscow, ANO Dialog has been accused
of conducting online propaganda activities on behalf of the Russian State. 118.
As noted in the VIGINUM report, the administrator’s login page for
waronfakes[.]com redirected traffic to rrussianews.com. The corresponding email address for
rrussianews.com, rrussiannews[@]gmail.com was the recovery email for the above-described
Russian citizen’s reliablerecentnews[@]gmail.com account, which in turn was used to register the
rrn[.]world domain. In addition, SDA records revealed that GAMBASHIDZE had the resume of
an individual assessed to be working for Doppelganger, who described their experience from
October 2022 to present as a writer for the Telegram channel war on fakes, with duties including
writing posts for the channel war on fakes and war on fakes analytics, and working on translations
and open-source research. Waronfakes[.]com is leased from an overseas registrar which leases
the domain from the U.S. registry, VeriSign Global Registry Services (“VeriSign”). Accordingly,
there is probable cause to believe that when ANO Dialog renews the lease on the domain, a portion
of those funds are used by the overseas registrar to pay VeriSign in the United States for the benefit
of sanctioned persons.
Available
at
https://www.sgdsn.gouv.fr/files/files/20230719_NP_VIGINUM_RAPPORTCAMPAGNE-RRN_EN1.pdf Page 54 B. Other Doppelganger Media Brands
119.
Based on records received pursuant to legal process, open-source research, the
content of articles published on the domains, and information obtained throughout this
investigation, I assess that each of the SUBJECT DOMAINS listed below is part of Doppelganger.
1. The Demon Accounts
120.
As noted above in paragraph 116, five email accounts were identified as using
OpenAI services in furtherance of Doppelganger. Records received from Google pursuant to legal
process revealed that one of those accounts (the “Demon Account”) was subscribed in the name
of “White Seo.” When it was registered, the Demon Account selected Russian as its language,
listed a Russian recovery email ending in .ru with the same naming convention, namely “Demon”
followed by a string of numbers, and provided a Russian phone number. The Demon Account was
linked by cookies to 37 other email accounts with naming conventions that correspond to domains
connected to Doppelganger’s unique media branding operation, including some of the SUBJECT
DOMAINS, such as:
Email Account Linked by Cookies to the Corresponding SUBJECT DOMAIN
Demon Account
holylandheraldcom[@]gmail.com
holylandherald[.]com
mypride.press[@]gmail.com
mypride[.]press
liesofwallstreet.com[@]gmail.com
liesofwallstreet[.]io
50statesoflie.com[@]gmail.com
50statesoflie[.]media
ukrlm.info[@]gmail.com
ukrlm[.]info
meisteruiancom[@]gmail.com
meisterurian[.]io
Acrosstheline.press[@]gmail.com
acrosstheline[.]press
Electionwatch.live[@]gmail.com
electionwatch[.]io Page 55 Honeymoney.infonow[@]gmail.com
honeymoney.press
Uschina.press.now[@]gmail.com
uschina[.]online
Spicyconspiracy.info[@]gmail.com
spicyconspiracy[.]io
Levinaigre.net[@]gmail.com
levinaigre[.]net
2.
The Goodbye Persona Leased the Acrosstheline[.]press, ukrlm[.]info, and
mypride[.]press Domains Linked to the Demon Account
121.
Two
Proton
Mail
email
accounts,
Aurevourmail[@]proton.me
and
Buenasnochesmail[@]proton.me, (collectively, the “Goodbye persona”), leased domains from
Namecheap for use in the Doppelganger campaign, including acrosstheline[.]press, ukrlm[.]info, 67 and mypride[.]press. 68 Given that these Proton Mail addresses included
derivations of a phrase roughly translated into two languages: Au Revoir and Buenas Noches, I
assess that the Namecheap accounts were created using operational email addresses by ANO
Dialog employees or agents acting on their behalf and will refer to them collectively as the
Goodbye persona.
122.
Records received from Namecheap pursuant to legal process revealed that the
Goodbye persona leased acrosstheline[.]press, ukrlm[.]info, and mypride[.]press using the
77.25 Server and paid for them using a U.S.-based payment provider, called BitPay, which allows
Across the Line presents itself as a website focused on migration and forced displacement issues, often
presenting only an adverse perspective as it relates to the U.S. Its website footer notes, “Join us in tackling
the problems of refugees across the globe and at the US border. Let’s cross the line to support those who
didn’t ask to leave their homes and face uncertainty.”
UKRLM is an English language website that describes itself as “Bringing you the latest updates, analysis,
and insights from war-torn Ukraine. Stay informed on the ongoing Russia-Ukraine conflict with us.”
My Pride Press is an English language website that focuses on the LGBTQ community, with topics
including trans youth, athletes, health, woke wars, LGBT. Page 56 users to make payments via Bitcoin. Records received pursuant to legal process from Namecheap
and BitPay revealed the following:
a. On February 27, 2023, the Goodbye persona, using the 77.25 Server, sent 0.BTC, equivalent to $60.46, from a Bitcoin address ending in -MiP6T to
Namecheap. The same day, Namecheap credited the Goodbye persona account with
$60.00 and the account used $53.12 to lease acrosstheline[.]press, ukrlm[.]info,
and mypride[.]press which included a $38.64 monthly subscription for EasyWP, a
Namecheap product for managing websites.
b. On March 21, 2023, the Goodbye persona, using the 77.25 Server, sent 0.BTC, equivalent to $40.84, from a Bitcoin address ending in -JPrHF to Namecheap.
The same day, Namecheap credited the Goodbye persona account with $40.00,
which prevented the previously mentioned subscription from overdrawing the
account.
c. On April 20, 2023, the Goodbye persona, using the 77.25 Server, sent 0.BTC, equivalent to $110.62, from a Bitcoin address ending in -mhtcF to
Namecheap. The same day, Namecheap credited the Goodbye persona account with
$110.00, which prevented the previously mentioned subscription from overdrawing
the account.
d. On July 23, 2023, the Goodbye persona, using a German IP address that Spur has
linked to a cybercriminal network, sent 0.006791 BTC, equivalent to $202.51, from
a Bitcoin address ending in -Z2my to Namecheap. The same day, Namecheap
credited the Goodbye persona account with $200.00, which prevented the
previously mentioned subscription from overdrawing the account. Page 57 e. On December 15, 2023, the Goodbye persona, using a German IP address that Spur
has linked to a cybercriminal network, sent 0.002147 BTC, equivalent to $89.99,
from a Bitcoin address ending in – qpwW to Namecheap. The same day,
Namecheap credited the Goodbye persona account with $70.00, which prevented
the previously mentioned subscription from overdrawing the account.
f. On July 23, 2023, the Goodbye persona, using a German IP address that Spur has
linked to a cybercriminal network, sent 0.004861 BTC, equivalent to $206.86, from
a Bitcoin address ending in -Z2my to Namecheap. The same day, Namecheap
credited the Goodbye persona account with $205.00 and the account used $89.to renew their lease of acrosstheline[.]press, ukrlm[.]info, and mypride[.]press.
123.
Based on these BitPay transactions, the IP addresses, and my training and
experience, there is probable cause to believe the funds used to lease these three SUBJECT
DOMAINS originated from outside the United States.
3.
The Levinaigrenet Persona Leased the Levinaigre[.]net,
Meisterurian[.]io Domains Linked to the Demon Account and Warfareinsider[.]us.
124.
and
Records received from Namecheap pursuant to legal process revealed that a user
with the email address levinaigrenet[@]proton.me leased levinaigre[.]net, 69 meisterurian[.]io, and warfareinsider[.]us. 71 The Levinaigrenet persona provided Namecheap with a name of Jay
Rom and a Broken Bow, Nebraska mailing address. All payments were made using funds
transferred from BitPay. Law enforcement records checks reveal no association between a Jay
Levinaigre is a French language website that focuses on French scandals.
Meisterurian is a German language website that purports to publish German news stories.
Warfareinsider is an English language website that describes itself as reporting on “Latest military news.
Stay sharp to look at it from the different perspective.” Page 58 Rom and the physical mailing address in Nebraska provided to Namecheap. In addition, despite
indicating a U.S. mailing address, on June 16, 2023, the Levinaigrenet persona accessed
Namecheap via the 77.25 Server and, using BitPay, deposited $72.00. On June 19, 2023, the
Levinaigrenet persona used the 77.25 Server to access Namecheap and used $25.04 to lease
levinaigre[.]net and purchase a monthly subscription of EasyWP. Then, on July 5, 2023, the
Levinaigrenet persona accessed Namecheap via a French IP address that Spur linked to a
cybercriminal network and, using BitPay, deposited $120.00. The same day the Levinaigrenet
persona used $70.22 to lease warfareinsider[.]us and meisterurian[.]io and purchase monthly
subscriptions of EasyWP for both. On June 4, 2024, the Levinaigrenet persona accessed
Namecheap via the 76.173 Server. and, using BitPay, deposited $200.00. The same day the account
used $10.48 to renew the lease for warfareinsider[.]us and meisterurian[.]io.
125.
As discussed below, on both June 16 and 19, 2023, another Doppelganger linked
Namecheap account also used the 77.25 Server to access their Namecheap account. Accordingly,
although the Levinaigrenet persona provided Namecheap with a U.S. address, I assess that the
individual accessing and paying for the account is actually located overseas.
4.
The Holylandherald Persona Leased the Holylandherald[.]com Domain
Linked to the Demon Account and Grenzezank[.]com, and Lexomnium[.]com
126.
Records received from Namecheap pursuant to legal process revealed that a user
with the email address holylandheraldcom[@]proton.me leased holylandherald[.]com, grenzezank[.]com, 73 and lexomnium[.]com. 74 The Holylandherald persona provided Namecheap
Holyland Herald poses as an Israeli based English language news website focused on Israel-US relations,
the war in Gaza, and other Middle East issues, however it also posted articles related to Ukraine, such as
an article titled “Ukraine Interferes in Russian Presidential Elections.”
Grenzezank is a German language website that focuses on international news, including U.S. politics.
Lex omnium, which translates to The Law of All in Latin, is a French language website that appears to
focus on French news with a legal perspective. Page 59 with a first name of holyland, a last name of herald, and a mailing address in Kansas City, Missouri
that indicated the country of residence to be Germany. All payments for the domains were made
using funds transferred from BitPay.
127.
Specifically, on June 16, 2023, the Holylandherald persona accessed Namecheap
via the 77.25 Server and, using BitPay, deposited $65.00. On June 19, 2023, the Holylandherald
persona accessed their Namecheap account using the 77.25 Server and used $22.64 to lease
holylandherald[.]com and purchase a monthly subscription of EasyWP. As referenced above,
records received from Namecheap revealed that the account used to lease Levinaigre[.]net,
meisterurian[.]io, and warfareinsider[.]us accessed Namecheap from the same server at
approximately the same time. On April 16, 2024, the Holylandherald persona accessed Namecheap
via a U.S. IP address that Spur has linked to a cybercriminal network and, using BitPay, deposited
$104.00. On May 20, 2024, Namecheap charged the account $16.06 to renew the lease for
holylandherald[.]com.
128.
On July 5, 2023, the Holylandherald account accessed Namecheap via a German
IP address that Spur has linked to a cybercriminal network and, using BitPay, deposited $120.00.
The same day the account used $45.28 to lease grenzezank[.]com and lexomnium[.]com and
purchase monthly subscriptions of EasyWP for both. On May 31, 2024, the account accessed
Namecheap via the 76.173 Server. and, using BitPay, deposited $100.00. The same day the account
used $32.12 to renew the lease for grenzezank[.]com and lexomnium[.]com. Page 60 5.
The RoyGeneral Persona Leased the 50statesoflie[.]media,
uschina[.]online, and HoneyMoney[.]press Linked to the Demon Account
129.
As referenced above, the Doppelganger campaign created email addresses with a
naming convention that correspond to 50statesoflie[.]media, 75 honeymoney[.]press, 76and
uschina[.]online. 77 The registrar for all three of those domains was NameSilo and the domains
were leased, from QHoster, a Uruguayan domain reseller, 78 using RoyGeneral[@]proton.me.
Records received pursuant to legal process from NameSilo, revealed that the RoyGeneral persona
created a QHoster account, using a New York, New York address and a Canadian phone number
and leased the 50statesoflie[.]media, uschina[.]online, and honeymoney[.]press. Law
enforcement and open-source records checks indicate the name and home address provided are not
correlated. As referenced above in paragraph 112, the RoyGeneral persona also leased rrn[.]media
and vip-news[.]org but provided an Oregon address and an incomplete U.S. telephone number. At
least one article published on honeymoney[.]press focused on the current U.S. Presidential
administration’s stance on Ukraine. Although the RoyGeneral persona provided NameSilo with a
U.S. address, based on the RoyGeneral’s use of VPSs with Namecheap, links to other
Doppelganger actors, and leasing of rrn[.]media and waronfakes[.]com, I assess that the
individual accessing and paying for the RoyGeneral account is actually located overseas.
130.
Mandiant, an American cybersecurity firm and a subsidiary of Google, tracks the
“Doppelganger Information Operations Campaign” and publishes a monthly report with updates
50 States of Lie describes itself as “Exposing the scandals that shape American politics and culture. We
bring you the latest on corruption, cover-ups, and controversies in the land of the free.”
Honey Money Press is an English language website that focuses on U.S. consumer trends.
US China Online on issues related to China’s national interest, including U.S.-China relations, Taiwan,
and U.S. trade and foreign policies.
A reseller is a third-party company that offers domain name registration services through a registrar, in
this case NameSilo, a U.S. company. Page 61 to the state of the campaign in a document Mandiant calls a “Narrative Tracker.” In their April
2024 report, Mandiant noted in addition to the continued use of cybersquatted websites, the
Doppelganger campaign had begun using the following domains to target American audiences:
Election Watch (electionwatch[.]live), Spicy Conspiracy (spicyconspiracy[.]info), 50 States of Lie
(50statesoflie[.]com), and Dragonfly Times (uschina[.]press). Of note, records received from
Hostinger pursuant to legal process, showed that the Goodbye persona leased Electionwatch[.]live,
50statesoflie[.]com, and uschina[.]press on February 23, 2023, using cryptocurrency transferred
using CoinGate, a Lithuanian cryptocurrency payment processor.
131.
As noted above, the Demon Account created email addresses that correspond
directly to spicyconspiracy[.]io 79 and electionwatch[.]io. 80 At present, electionwatch[.]live,
spicyconspiracy[.]info, 50statesoflie[.]com, and uschina[.]press are no longer active. However, I
have reviewed the active domains 50statesoflie[.]media, uschina[.]online, spicyconspiracy[.]io,
and electionwatch[.]io and have confirmed that they use the same branding and formatting as
electionwatch[.]live, spicyconspiracy[.]info, 50statesoflie[.]com, and uschina[.]press, which leads
me to conclude that the same person(s) are behind these domains.
6.
The Artichocio persona leased truthgate[.]us, shadowwatch[.]us, 81 and
artichoc[.]io,
132.
Records received from Namecheap revealed that an individual using the email
address artichocio[@]proton.me leased truthgate[.]us, shadowwatch[.]us, and artichoc[.]io, and
Spicy Conspiracy describes itself as “Uncovering the truth behind the veil. Your source for in depth
coverage of conspiracies, secret agendas, and hidden realities.”
Election Watch focuses on U.S. elections, including the 2024 U.S. presidential election, political
candidates, purported corruption, and polling results.
Truth Gate and Shadow Watch are English language websites that focused on disseminating corruption
and conspiracy disinformation targeting the U.S.
Artichoc io is a French language website with a tagline that translates to “Art that Shocks.” It purports to Page 62 provided the name Jason Kant with a French mailing address and a U.S. phone number. The
domains were purchased using Bitcoin transferred through BitPay.
133.
June 29, 2023, the Artichocio persona used the 77.25 Server to access Namecheap
and deposit $120.00 using BitPay. As discussed above, given the frequent use of the 77.25 Server
by Doppelganger actors, I assess that the 77.25 Server was leased by Doppelganger and only
accessible to persons involved in Doppelganger. The same day, the Artichocio persona used $52.to lease artichoc[.]io and purchase a monthly subscription of EasyWP. On April 16, 2024, the
artichocio account accessed Namecheap via a German IP address that Spur has linked to a
cybercriminal network and, using BitPay, deposited $92.00. On May 30, 2024, Namecheap
charged the artichocio account $48.98 to renew the lease for artichoc[.]io.
134.
On July 5, 2023, the artichocio account accessed Namecheap via a U.S. IP address
resolving to a British VPS service and, using BitPay, deposited $120.00. The same day, the
artichocio account used $34.72 to lease truthgate[.]us and shadowwatch[.]us and purchase
monthly subscriptions of EasyWP for both. On June 18, 2024, the artichocio account accessed
Namecheap from the 76.173 Server and, using BitPay, deposited $220.00. The same day, the
account used $20.96 to renew the lease for truthgate[.]us and shadowwatch[.]us.
7.
135.
The Ukraine Domains
As noted above, one of GAMBASHIDZE’s notes from a meeting with the
Presidential Administration referenced a participant as “fully in charge of filling the content on the
Ukraine Tribunal portal.” Two Doppelganger-linked domains, tribunalukraine[.]info, 83 and
focus on pop culture, art, and entertainment.
Tribunal Ukraine is a German language website a focus on revealing the alleged truth about what is
happening in Ukraine. Page 63 ukraine-inc[.]info, 84 were leased from Newfold Digital, a U.S. registrar. Records received from
Newfold Digital revealed that ukraine-inc[.]info was registered on November 3, 2023. Those
records also revealed that the email address trelelcalra1975[@]yahoo.com, was used to lease
ukraine-inc[.]info. The trelelcalra1975[@]yahoo.com was only logged into five times, four times
from German VPSs and once from a Russian IP address. The trelelcalra1975[@]yahoo.com user
registered their Newfold Digital account in the name of Dennis Eggers with a German mailing
address and German phone number. Subscriber records received from Yahoo Inc. revealed that the
trelelcalra1975[@]yahoo.com account was registered using a Cyrillic first name and the last name
Reddy and a Brazilian phone number, which does not match the information provided to Newfold
Digital.
136.
registered
Records received from Newfold Digital revealed that tribunalukraine[.]info was
on
June
10,
2022.
glennwallace9672[@]outlook.com
Those
was
records
used
to
revealed
lease
that
the
email
address
tribunalukraine[.]info.
The
glennwallace9672[@]outlook.com user registered their Newfold Digital account in the name of
Glen Wallace with a Vienna mailing address and an Austrian phone number. Records received
from Microsoft revealed that glennwallace9672[@]outlook.com was registered by Glenn Wallace
from Austria. Notably, that Outlook account was only logged into twice, September 28, 2022, and
October 5, 2022. According to records received from Newfold Digital, the Newfold Digital
account for tribunalukraine[.]info was accessed from the 11.27 Server.
Ukraine Inc is an English language website that features animated anti-Ukrainian videos. The videos
contain anti-Semitic tropes that depict Ukrainian President Zelensky as an alcoholic and imply that the
deaths of Ukrainians benefit him financially. Page 64 THE SUBJECT DOMAINS
137.
As described above, the SUBJECT DOMAINS were used by individuals abroad
who are working under the direction and control of the Russian government, and in particular
KIRIYENKO, GAMBASHIDZE, SDA, TUPIKIN, and STRUCTURA, all of whom have been
sanctioned by the U.S. Government, along with ANO Dialog, TABAK, and others, to advance their
interests and the interests of the Russian government and to facilitate the violation of, or in
violation of, the SUBJECT OFFENSES.
138.
As set forth above and in Attachments A-1 through A-9, a search of publicly
available Who.is domain name registration records revealed the dates that the SUBJECT
DOMAINS were registered, with which registrar, the headquarters of that registrar, the registrant
of each of the SUBJECT DOMAINS, and the top-level domain for each of the SUBJECT
DOMAINS.
STATUTORY BASIS FOR SEIZURE AND FORFEITURE
139.
Title 18, United States Code, Section 981(a)(1)(A) provides, in relevant part, that
any property involved in a transaction or attempted transaction in violation of 18 U.S.C.
§ 1956(a)(2)(A) (international promotional money laundering) and 1956(h) (conspiracy to commit
the same) is subject to civil forfeiture.
140.
Title 18, United States Code, Section 2323(a)(1)(B), provides, in relevant part, that
any property used, or intended to be used, in any manner or part to commit or facilitate the
commission of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in
violation of 18 U.S.C. § 2320, is subject to civil forfeiture to the United States government. Page 65 141.
Title 18, United States Code, Section 981(b)(2) authorizes seizure of property
subject to civil forfeiture based upon a warrant supported by probable cause and “obtained in the
same manner as provided for a search warrant under the Federal Rules of Criminal Forfeiture.”
142.
Title 18, United States Code, Section 981(b)(3) permits the issuance of a seizure
warrant by a judicial officer in any district in which a forfeiture action against the property may be
filed and such warrant may be executed in any district in which the property is found, and provides
that the warrant may be executed in any district in which the property is found or transmitted to
the central authority of a foreign state for service in accordance with any treaty or other
international agreement.
143.
Title 18, United States Code, Section 982(a)(1) provides, in relevant part, that when
imposing sentence on a person convicted of an offense in violation of 18 U.S.C. § 1956(a)(2)(A)
(international promotional money laundering) and 1956(h) (conspiracy to commit the same), a
court shall order that person’s property that was involved in the offense be forfeited to the United
States.
144.
Title 18, United States Code, Section 2323(b)(1), provides, in relevant part, that the
court, in imposing sentence on a person convicted of Trafficking in Counterfeit Goods or Services
(e.g., trademark infringement), in violation of 18 U.S.C. § 2320, an offense under section 506 of
title 17, or section 2318, 2319, 2319A, 2319B, or 2320, or chapter 90, of this title, shall order, in
addition to any other sentence imposed, that the person forfeit to the United States Government
any property subject to forfeiture under 18 U.S.C. § 2323(a) for that offense.
145.
Title 18, United States Code, Section 982(b)(1) incorporates by reference the
procedures for seizure and forfeiture in 21 U.S.C. § 853. Title 21, United States Code, Section
853(f) provides in relevant part that a seizure warrant for property subject to forfeiture may be Page 66 sought “in the same manner in which a search warrant may be issued. A court shall issue a criminal
seizure warrant if it determines that the property to be seized would, in the event of a conviction,
be subject to forfeiture and that a restraining order would be inadequate to assure the availability
of the property for forfeiture.”
146.
Neither a restraining order nor an injunction is sufficient to guarantee the
availability of the SUBJECT DOMAINS for forfeiture. By seizing the SUBJECT DOMAINS and
redirecting them to another website(s), the Government will prevent third parties from acquiring
the name and using it to commit additional crimes. Furthermore, seizure of the SUBJECT
DOMAINS will prevent third parties from continuing to access the SUBJECT DOMAINS in their
present form.
147.
Title 18, United States Code, Section 2323(a)(1)(B), provides, in relevant part, that
any property used, or intended to be used, in any manner or part, to commit or facilitate the
commission of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in
violation of 18 U.S.C. § 2320, is subject to civil forfeiture. Title 18, United States Code, Section
2323(b)(1), provides, in relevant part, that the court, in imposing sentence on a person convicted
of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in violation of U.S.C. § 2320, shall order, in addition to any other sentence imposed, that the person forfeit to the
United States Government any property subject to forfeiture under 18 U.S.C. § 2323(a).
148.
Title 18, United States Code, Section 981(h) provides that venue for civil forfeitures
brought under this section lies in the district either where the defendant owning the property is
located or in the judicial district where the criminal prosecution is brought. Page 67 149.
Title 18, United States Code, Section 981(b)(3) provides that a seizure warrant may
be issued in any district in which a forfeiture action against the property may be filed under U.S.C. § 1355(b).
150.
Title 28, United States Code, Section 1355(b)(1)(A), provides that a forfeiture
action or proceeding may be brought in a district court for the district in which any of the acts or
omissions giving rise to the forfeiture occurred.
151.
Title 21, United States Code, Section 853(l) provides that the district courts of the
United States having jurisdiction to enter orders, including seizure warrants, without regard to the
location of property which may be subject to criminal forfeiture under § 853.
152.
As set forth above, there is probable cause to believe that the SUBJECT DOMAINS
are subject to civil and criminal forfeiture because they are property involved in in the commission
of violations of 18 U.S.C. § 1956(a)(2)(A) (international promotional money laundering) and
1956(h) (conspiracy to commit same). Specifically, the SUBJECT DOMAINS are property
involved in transactions or attempted transactions that violate 18 U.S.C. § 1956(a)(2)(A)
(international promotional money laundering) and 1956(h) (conspiracy to commit same), done
with the intent to promote the carrying on of specified unlawful activity, specifically violations of
IEEPA. Further, as set forth above, there is probable cause to believe that a subset of the SUBJECT
DOMAINS are subject to civil and criminal forfeiture because they are property that facilitated
the commission of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in
violation of 18 U.S.C. § 2320.
153.
Venue for civil and criminal forfeiture is proper in this district pursuant to 18 U.S.C.
§ 981(b)(3) and (h), 28 U.S.C. § 1355(b)(1)(A), and 21 U.S.C. § 853(l), as set forth above, as the
government has venue to charge the above described international promotional money laundering, Page 68 conspiracy to commit the money laundering, and trafficking in counterfeit goods or services
offenses in the Eastern District of Pennsylvania. In addition, as part of the money laundering
conspiracy to promote violations of IEEPA, the conspirators took steps to make the SUBJECT
DOMAINS available on the internet, including in the Eastern District of Pennsylvania and the
defendants used a subset of the SUBJECT DOMAINS to commit or facilitate the commission of
Trafficking in Counterfeit Goods or Services, including in the Eastern District of Pennsylvania.
SEIZURE PROCEDURE
154.
As detailed in Attachments A-1 through A-9, upon execution of the seizure warrant,
the registry or registrar for the top-level domain or for each SUBJECT DOMAIN (collectively, the
“PROVIDERS”), shall be directed to restrain and lock the SUBJECT DOMAINS pending transfer
of all right, title, and interest in the SUBJECT DOMAINS to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS cannot be made
absent court order or, if forfeited to the United States, without prior consultation with the Federal
Bureau of Investigation or DOJ.
155.
In addition, upon seizure of the SUBJECT DOMAINS by the Federal Bureau of
Investigation, the PROVIDERS will be directed to associate the SUBJECT DOMAINS to a new
authoritative name server(s) to be designated by a law enforcement agent. The Government will
display a notice on the website to which the SUBJECT DOMAINS will resolve indicating that the
site has been seized pursuant to a warrant issued by this court.
REQUEST FOR SEALING
156.
I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation that is neither public nor known to all of the Page 69 targets of the investigation. Accordingly, there is good cause to seal these documents because their
premature disclosure may seriously jeopardize that investigation.
CONCLUSION
157. For the foregoing reasons, I submit that there is probable cause to believe that the
SUBJECT DOMAINS are used in and/or intended to be used in facilitating and/or committing the
SUBJECT OFFENSES. Accordingly, the SUBJECT DOMAIN NAMES are subject to seizure
pursuant to 18 U.S.C. §§ 981(b), 982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f), and subject
to forfeiture to the United States pursuant to 18 U.S.C. §§ 981(a)(1)(A) and 982(a), and 18 U.S.C.
§ 2323(a)(1)(B), (b)(1), and I respectfully request that the Court issue a seizure warrant for
SUBJECT DOMAIN NAMES.
158. Because the warrant will be served on the PROVIDERS that control the SUBJECT
DOMAINS, and the PROVIDERS, thereafter, at a time convenient to them, will transfer control
of the SUBJECT DOMAINS to the government, there exists reasonable cause to permit the
execution of the requested warrant at any time in the day or night.
Respectfully submitted,
Special Agent, Federal Bureau of Investigation
Affidavit submitted by email and attested to me as true and accurate by telephone consistent
with Fed. R. Crim. P. 4.1 and 41(d)(3) this 30th day of August, 2024 at 9:34pm.
Digitally signed
by
Date: 2024.08.22:19:07 -04'00'
United States Magistrate Judge Page 70 ATTACHMENT A-With respect to tribunalukraine.info, rrn.media, ukrlm.info, faz.ltd, spiegel.agency,
lemonde.ltd, leparisien.ltd, rbk.media, 50statesoflie.media, meisterurian.io, artichoc.io
(“SUBJECT DOMAINS”), Identity Digital, located at 10500 NE 8th Street, Ste. 750 Bellevue,
WA 98004, who is the domain registry for the SUBJECT DOMAINS, shall take the following
actions to effectuate the seizure of SUBJECT DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the
direction of the FBI, by associating the SUBJECT DOMAINS to the following
authoritative name-server(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Identity Digital Limited.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 71 The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 72 ATTACHMENT A-With
respect
to
vip-news.org,
acrosstheline.press,
mypride.press,
truthgate.us,
warfareinsider.us, shadowwatch.us (“SUBJECT DOMAINS”), NameCheap, located at East Washington Street Suite 300 Phoenix, AZ 85034, who is the domain registrar for the
SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of SUBJECT
DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Namecheap.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 73 The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 74 ATTACHMENT A-With respect to pravda-ua.com, waronfakes.com, holylandherald.com, levinaigre.net,
grenzezank.com, lexomnium.com (“SUBJECT DOMAINS”), VeriSign Global Registry
Services, located at 12061 Bluemont Way, Reston, VA 20190, who is the domain registry for the
SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of SUBJECT
DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to VeriSign Global Registry
Services.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 75 The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 76 ATTACHMENT A-With respect to uschina.online, honeymoney.press (“SUBJECT DOMAINS”), NameSilo,
located at 1300 E Missouri Ave Ste A-110 Phoenix, AZ 85014-2362 who is the domain registrar
for the SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of
SUBJECT DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to NameSilo.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 77 The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 78 ATTACHMENT A-With respect to sueddeutsche.co, tagesspiegel.co (“SUBJECT DOMAINS”), GoDaddy.com
LLC., located at 100 S. Mill Ave Suite 1600 Tempe, AZ 85281 USA, who is the domain registrar
for the SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of
SUBJECT DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to GoDaddy.com LLC.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 79 The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 80 ATTACHMENT A-With respect to bild.work (“SUBJECT DOMAIN”), GoDaddy Registry Services, LLC, located at
100 S. Mill Ave Suite 1600 Tempe, AZ 85281 USA, who is the domain registry for the SUBJECT
DOMAIN, shall take the following actions to effectuate the seizure of SUBJECT DOMAIN:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAIN to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to GoDaddy Registry Services,
LLC.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAIN pending transfer
of all right, title, and interest in SUBJECT DOMAIN to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAIN cannot be
made absent court order or, if forfeited to the United States, without prior consultation with
FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 81 The Government will display a notice on the website to which the SUBJECT DOMAIN
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 82 ATTACHMENT A-With respect to fox-news.top, fox-news.in (“SUBJECT DOMAINS”), Tucows Inc., 10400 NE
4th Street, 5th Floor, Suite 121, Bellevue, Washington 98004 who is the domain registrar for the
SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of SUBJECT
DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Tucows Inc.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 83 The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 84 ATTACHMENT A-With respect to forward.pw (“SUBJECT DOMAIN”), Micronesia Investment and Development
Corporation, located at P.O. Box 1256 Koror 96940, Palau who is the domain registry for the
SUBJECT DOMAIN, shall take the following actions to effectuate the seizure of SUBJECT
DOMAIN:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAIN to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Micronesia Investment and
Development Corporation.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAIN pending transfer
of all right, title, and interest in SUBJECT DOMAIN to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAIN cannot be
made absent court order or, if forfeited to the United States, without prior consultation with
FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 85 The Government will display a notice on the website to which the SUBJECT DOMAIN
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 86 ATTACHMENT A-With respect to washingtonpost.pm (“SUBJECT DOMAIN”), Sarek Oy, located at Urho
Kekkosen katu 4E 00100, HELSINKI, Uusimaa Finland, who is the domain registry for the
SUBJECT DOMAIN, shall take the following actions to effectuate the seizure of SUBJECT
DOMAIN:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAIN to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Sarek Oy.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAIN pending transfer
of all right, title, and interest in SUBJECT DOMAIN to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAIN cannot be
made absent court order or, if forfeited to the United States, without prior consultation with
FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order. Page 87 The Government will display a notice on the website to which the SUBJECT DOMAIN
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.” Page 88 EXHIBIT 1Page 89 Washingtonpost[.]ltdPage 90 The Washington Post
Workd Warm Uwere Africn Ameicns Asin Europe Middle East = Foreign Correspondents
ECONOMY
The U.S. Sacrifices Control over Artificial
Intelligence for Ideology
A new White House executive order bans direct investment in high-tech Chinese com
nes. But who's going to be
worse off for it?
MOST READ WORLD
1. “=. _
s.- L
As Russians inch forward near
Bakhmut, Ukrainians dig
fallback defenses
_—
6a ise L0min CA om ancie
The U.S, and China, whose relations are already far fre
ideal, are eme
Ez
new round of fighting. The White House picked a pretty good time to strike
another blow against an advancing rival. This came at a time when the world's
second-largest economy was in a very vulnerable position: it was very difficult
tor China to get out of the prolonged covid lockdowns, and it may never reach
the cherished goal of 5% of GDP by the end
It would seem to be the right move — to reduce the opportunities of a direct
competitor on the global chessboard, where political sketches of planetary scale
are played out. But will the move lead to further problems for the L.S,?
China is already predictably furious. Chinese experts are calling the updated
U.S. technology export controls targeting all semiconductor factories in China
the most ‘deadly’ ban since the U_S. began imposing related sanctions on
tech companies in 2019.Page 91 The Washington Post
Workd Wari irene Airco Americns 3 Asin Europe Middle Ext Foreign Cormespondents
READ THIS ARTICLE: EXCLUSIVE!
Revelations of the head of Ukraine
on of Volo
Our editorial Board has receive ymyr Zelensky, in which he speaks
about the arrangements with the
MOST READ WORLD
As Russians inch forward near
Bakhmut, Ukrainkuns dic
fallback defenses
oe
Forced to speak, give orders and sign documents.
Note! The authenticity of the video material has not been confirmed. Our fight
editors have deciphered the dialogue and bring to your attention a
sensational recording of the revelations of the head of Ukraine. 2 Germany pledge t
Surname, Name, Patronymic?
Zelensky Vladimir Alexandrovich
Date of birth?
Nationality?
Ukraine
Position?Page 92 Washingtonpost[.]pmPage 93 The Washington Post
World Warlin Ukraine Africa Americas Asia Europe MiddleEast Foreign Correspondents
INTERNATIONAL POLITICS
Middle East Coalition of U.S. Allies
Crumbles like a House of Cards
The main players in the Middle East are moving into Russia's orbit of influence. The crisis of American diplomacy is
shattering the familiar world
MOST READ WORLD *
\s Russians inch forward near
Bakhmut, Ukrainians dig
fallback defenses
—_
| As Russians inch forward near
Bakhmut. Ukrainians dig
fallback defenses
2 Russia has lost nearly half
its main battle tanks, report
estimates
3 Russian mercenary chief
says he is also behind global
information war
ee!
=f
j Lukashenko blames Ukraine a
for war, wams Belarus will &
join fight if attacked
=| Rermaninladtads miltonPage 95 a Ta Ca CU tied
World WarinUkraine Africa Americas Asia Europe MiddleEast Foreign Correspondents
INTERNATIONAL POLITICS
No More Money: Kremlin Will Solve
Ukraine's Problems
The story of Ukraine's unrestricted funding is coming to an end. In the end you can punish Russia by simply giving it
Ukraine in its current form.
MOST READ WORLD »
l As Russians inch forward near
Bakhmut. Ukrainians dig
fallback defenses
tw
Russia has lost nearly half
its main battle tanks, report
estimates
3 Russian mercenary chief
says he is also behind global
information war
Go Listen 10 min ala ify, ors 4. Lukashenko blames Ukraine
for war, wams Belarus will
join fight if attacked
Reuters reports that the U.S. Senate backed a defense policy bill that calls for a
record $886 billion in annual military spending with strong support from both
= Germany niedged 3 military EE =Page 96 Fox-news[.]topPage 97 Drea
PA Aer
Olle Sn Cmina slicing sues
and inspiring stories
On September 18, our country's national debt set another ‘record’ — it exceeded $trillion, which is more than $97,000 for each of us, including the elderly and infants! At the
same time, before the ‘debt ceiling’ was raised, it was $32 trillion, ie. it increased by $trillion in just three months. Over the past five years, our country’s total debt has increasedPage 98 Fox-news[.]inPage 99 baa ead
i OU. ema
t
TRENDING TE evcusmess
ukraine Published December 4, 2023 4:269m EDT
Sad Outcome and Tragic Finale:
Zelensky Loses in War and Diplomacy
Zelensky's unfortunate visit was planned as such in advance. a: shifting the blame for the loss to the
Ukrainian president.
0oG
ants ake
eae tei ok)
41018] b
PN | 4 (Or -\ |
s te for patriotic
inspiring stories
I 05 12 oct critics of
Ukraine in Congress, said the agreement to help Ukraine in exchange for border security is
offensive not only to members of the |BEPut to all Americans.Page 100 faa as al)
audio
ng every m
anives (EEEES
PROUD
PN Aer
rere for patnotic news
and inspiring Stories
Young Americans are concerned that the Medicare health insurance program for people
over 65 will not exist when they retire 80% of Generation X — neonle horn hetween 1965Page 101 bas a ay Pot t= |e hh FOX NATION VPOK NEWS | stucco} Lit .4 WEATHER |
Cn ean ay) ke
| ; A Se ae OME
4 TRENDING SSF =a FAMULY BUSINESS | Al
Domestic Poucy Published June 12 2024 4:26pm EDT
Your Neighbors Will Decide Who Your
Spouse Will Be: the Lead
the Charge
Ukrainian President Volodymyr Zelensky showed himself in a new mage at the NATO
summit in Vilnius. Now this actor looks more like a dictator from Latin Amenca. But this
country doesn't even have the bananas to pay back the US for the weapons we are
supplying Kiev. And the Ukrainian government is running the country im such a way that
there are doubts that anything, but weeds will grow in thet fields
The more an American learns about Ukraine the more he wants to forget about it
Monstrous corruption, Nazi torch marches, and a stunningly ineffective military are not at
all what the U.S. is willing to defend
it seems now that someone in the White House decision makers have been given a
competent analysis of this country. Otherwise, haw else to explain that at the NATO
summit the invitation ticket was gain waved in front of Volodymyr Zelensky’s nose but
handed over to the King of SwedenPage 104 Forward[.]pwPage 105 Support the Forward
Get our Newsletters | PP
MENU Q i j Funded by readers tine you
Shop our Store 2oN
JEWISH. INDEPENDENT. NONPROFIT DoMATE suSscRiaS
ISRAEL ATWAR | SHAVUOT 2024ELECTIONS ANTISEMITISM REPUBLISHOUR ARTICLES DD YIITNE
FOREIGN POLICY
Wikipedia Is in Favor of Hamas
Wikipedia continues to serve as a platform for Israeli-Palestinian information warfare. The platform's editors are definitely biased in reporting on
the armed conflict.
eo0o0e
Engage
CATCH UP ON YIDDISH EVENTS
oy
Only the most principled right-wing deputies insist that Germany should increase pressure on Hezbollah and support
Tel Aviv. Whose rules does Europe use to play?
Little Amir went to play football with his friends in his hometown of Majdal Shams in northern Israel. This summer day
seemed especially iovful to the bov. Todav thev will definitelv defeat their ferce opponents from the neiahborinaPage 107 Get our Newsletters Support the Forward
menu = Q Funded by renders ie you
Shop our Store GM 1M
JEWISH. INDEPENDENT NONPROFIT GONATE ‘Suet CRS
ISRAELATWAR SHAVUOT 2024ELECTIONS ANTISEMITISM REPUBLISHOURARTICLES OD"YIMNS
Support the Forward team’s reporting from campuses across the country. Make a monthly gift today.
Ue me ee
INTERNATIONAL POLITICS
U.S. Surrendered Israel to Hezbollah
Washington explicitly withdrew support for Israel in its conflict vath Hezbollah while negotiating with terrorists behind Jerusalem's back
eo0c0s
Engage
CATCH UP ON YIDDISH EVENTS
YIDDISH COMMUNITY
CALENDAR >Page 108 EXHIBIT 2APage 109 Abbreviations:
Primary language
Secondary language
Russian
English
1Page 110 Countermeasures by foreign agencies and organizations
The “collective West” countries are seriously concerned by the effectiveness of the project.
Government and private agencies of all four countries—Germany’s Federal Ministry of the
Interior and Community and Federal Foreign Office, France’s General Secretariat for Defence
and National Security, the US Department of State, and Israel’s Security Agency, as well as
major online platforms, factcheckers, and investigators such as META, Microsoft, DesInfoLab,
and others—have been involved in the effort of countering our narratives since September 2022.
Articles about the project and its “destructive impact on public opinion” have been regularly
published by major European and US media outlets.
France’s Ministry for Europe and Foreign Affairs
Statement by Ms. Catherine Colonna—Foreign digital interference—France’s detection of
an information manipulation campaign
June 13, “The implication of Russian cultural centers and embassies that have actively participated in
spreading content produced by this campaign, including via their institutional accounts on social
media, is further proof of the hybrid strategy that Russia is implementing to undermine the
conditions for peaceful democratic debate, and therefore damage our democratic institutions.”
Blogs.Microsoft.com
Russian influence and cyber operations adapt for long haul and exploit war fatigue
December 7, “Since July 2023, Russia-aligned influence actors have tricked celebrities into providing video
messages that were then used in pro-Russian propaganda. These videos were then manipulated to
falsely paint Ukrainian President Volodymyr Zelensky as a drug addict.”
2Page 111 The Washington Post
Kremlin runs disinformation campaign to undermine Zelensky, documents show
February 16, “The Kremlin instruction resulted in thousands of social media posts and hundreds of fabricated
articles, created by troll farms and circulated in Ukraine and across Europe, that tried to exploit
what were then rumored tensions between two Ukrainian leaders.”
Meta
“Adversarial Threat Report”
August “Launched soon after Russia’s full-scale invasion of Ukraine, Doppleganger created a huge
number of fake websites that spoofed the appearance of mainstream European news outlets, and
then posted links to those sites using fake accounts on many social media platforms, including
Facebook, Instagram, Telegram, X (formerly Twitter), and even LiveJournal, among others.”
Le Parisien
Disinformation, Putin's other war: “The goal is to exacerbate tensions in France”
February 17, “Fake news about Macron’s assassination in Kiev, fake anti-Zelensky graffiti, Stars of David in
Paris....Russia, where the opposition leader Alexei Navalny has just died, has activated its
operation to destabilize the French society.”
3Page 112 Clearsky Internet Security
February 22, Doppelganger NG. Cyberwarfare campaign.
“Russian IW (Information Warfare) aims to shape international perceptions, political discourse,
and policy directions around the world by exploiting social networks, news websites, and
anonymity. Several Kremlin-aligned objectives are being pursued by Russia’s IW efforts,
including influencing US election campaigns, weakening European Union cohesion, and
reducing Western backing for Ukraine.
ClearSky Cyber Security and SentinelLabs have discovered a new wave of Russian information
warfare campaign named Doppelganger NG. Meta exposed the infrastructure of Doppelganger
campaign in 2022, and RecordedFuture research enhanced the findings in 2023. Doppelganger
(meaning “double,” an exact but usually invisible replica) is a global information warfare
campaign publishing false information on hundreds of fake websites and social media channels.
Our research revealed that Doppelganger NG is again fully operational in 2024, utilizing new
infrastructure.”
Spiegel
Social media trends expose Russian deceitful campaign
January 26, “False tweet is part of pro-Russian disinformation campaign exposed by Baerbock’s Ministry.
Confidential analysis is available in excerpts from MIRROR. Between December 20 and January
20, experts used special software to evaluate Elon Mask’s short-message service X on behalf of
the Federal Foreign Office’s Division 607 for Strategic Communication—with disastrous results.
In the four weeks preceding the beginning of the year, they identified over 50,000 fake user
accounts, which coordinated efforts to shape sentiments among the German-speaking audience
through over a million tweets in German. On some days, experts of the Federal Foreign Office
4Page 113 registered 200,000 such tweets. This is around two tweets per second—a digital drumbeat
intended to manipulate the public.”
Byline Times
Under the radar: unmasking the coordinated reach of Russian Doppelganger bots
February 29, “One of Russia’s most widespread tactics is the “Doppelganger bot network,” in which state
actors utilize Doppelganger bots on X/Twitter to disseminate misleading narratives, sow discord,
and influence public opinions globally. Researchers have revealed the scale, methods, and
adaptability of this disinformation campaign, emphasizing its impact on Western democracies.”
General Secretariat for Defence and National Security
Actors associated with Russia use new and old tactics in a bid to influence online discussion
of the NATO Summit
August 21, “Russia-aligned actors made a comprehensive attempt to influence online discussions
surrounding the NATO Summit in Vilnius in July 2023, using deceptive methods to promote
ideas almost certainly intended to tarnish NATO and the host country of Lithuania. These
included the distribution of documents believed to be stolen from the Lithuanian government, as
well as the spread of false statements on NATO spending and participation in French internal
affairs.”
Meta
5Page 114 Adversarial Threat Report
August “We assess that we are witnessing the largest and most aggressive covert influence operation
from Russia since 2017.”
Wired
Russia is boosting calls for ‘Civil war’ over Texas border crisis
February 7, “While previous Doppelganger campaigns shared links to fake websites designed to look like
legitimate ones but with fake articles, this campaign linked to websites run, built, and maintained
by the Doppelganger operatives to push narratives to suit their needs. One article, for example,
appeared on a fake site called Warfare Insider, and stated that Texas ‘has become a battleground
symbolizing the clash between state and federal authorities.’”
Recorded Future
Obfuscation and AI content in the Russian influence network Doppelganger signals
evolving tactics
December 5, “In subsequent campaigns targeting US and German audiences, Doppelganger created six
original but inauthentic news outlets producing malign content. The US-focused campaign aimed
to exploit societal and political divisions ahead of the 2024 US election, fueling anti-LGBTQ+
sentiment, criticizing US military competence, and amplifying political divisions around US
support for Ukraine. The German-focused campaign highlighted Germany’s economic and social
issues, intending to weaken confidence in German leadership and reinforce nationalist sentiment.
Doppelganger's adaptability exemplifies the enduring nature of Russian information warfare,
with a strategic focus on gradually shifting public opinion and behavior. The use of generative
AI for content creation signifies an evolution in tactics, reflecting the broader trend of leveraging
AI in information warfare campaigns. As the popularity of generative AI grows, malign
6Page 115 influence actors like Doppelganger are very likely to increasingly employ AI for scalable
influence content.”
Berliner Morgenpost
Why are pro-Russian fake websites so tenacious
August 29, “Federal Ministry of the Interior and Community stated that the Russian disinformation is still
significant and that it treats foreign influence and manipulations very seriously.
Authorities showed concern about fake websites from the moment the campaign was exposed,
informing DPA a year ago, at the end of August 2022. Reports demonstrate “the scale of proRussian propaganda and disinformation in Germany.” According to the press-secretary, they
aimed to undermine trust in politics, society, and government institutions. “
Le Monde
Doppelganger: Russian disinformation campaign denounced by France
June 13, “This very well-imitated page is, in fact, the tip of a vast Russian influence operation, which has
been going on for over a year. The agents who created and circulated this fake French Ministry
for Europe and Foreign Affairs page are also responsible for countless imitations of media
articles, perfectly imitating the layouts of Le Monde and other newspapers, such as Le Parisien
and 20 Minutes, as well as most of the major German media. Similar fakes have also been seen
in Ukraine, Italy, and the United Kingdom.”
Medium
Russia-based Facebook operation targeted Europe with anti-Ukrainian messages
7Page 116 September 27, “The Russian network targeted Germany and Latvia with narratives about impending hardships
resulting from sanctions targeting Russian energy supplies. In France and Italy, the network
targeted Facebook with posts that called for an end to weapons shipments to Ukraine. The timing
and narratives of the posts coincided with policy decisions made by the targeted countries pages
regarding the war in Ukraine.
The network displays the hallmarks of influence operations previously documented by the
DFRLab, in which Russia or its proxies weaponize platforms to amplify pro-Kremlin interests
while denigrating Ukraine and the West. It is accomplished with a wide range of techniques
previously observed by the DFRLab, including paid promotion of content, the use of automation,
coordinated narratives, and other indicators.”
8Page 117 EXHIBIT 2BPage 118 Mephi nporuBogeiicTBHA HHOCTpaHHBIX FrocyapcTBeHHBIX CTpyKTyp opraHH3alHl
CtpaHbl KomsIeKTHBHOrO 3anaga KpaitHe OOecHOKOeHEI 9(peKTHBHOCTHIO
mpoexta. C ceutTaOpa 2022 roga B padoTy No MpoTHBOselcTBHIO
PacnpocTpaHeHHIO HalllMX HappaTHBOB BKJIHOUMJIMCh TOCcyapcTBeHHbIe Hu
YacTHbIe CTpyKTypbl Bcex yerTpipéx crpan: MB/] u MH] Tepmanuu,
TenepanbHbii cekpeTapvaT HaljHoHabHO OOopoHbI! u O6e30nacHocTH
@Mpanuuu, Tocgen CIUA u cayx6a OesonacHoctu M3panna, a Takxe
KpynHetiue OHnaMH-nIaT@oOpMBI, dakTueKepbI MH paccneyoBarenu: META,
Microsoft, DesInfoLab u apyrue. Crarbu 0 mpoexkte H ero "pa3spylIHTesIbBHOM
BO3eHCTBHH Ha OOWIECTBEHHOe MHEHHe" perysIApHO BbIXOAT B KPyMHeMIWUHX
CMM Esponpi u CLA.
MINISTERE
DE L'EUROPE
ET DES AFFAIRES
ETRANGERES
MH ®pannun
3anBsenne r--KH Katpuu Kosionna — Mnocrpannoe Wu@posoe BMeWiaTeIbCTBO
— oOnapyxenne Mpanuneii KaMnNaHHH NO MaHHNyHpoBaHhlod HHopmMalnel
13 mona 2023 r.
«[IpHuacTHOCTb poccHiiCKHX KyJIbTYPHBIX I{CHTPOB H MOCOJIBCTB, KOTOPbIe AKTHBHO
yuaCTBOBAIIN B PaclIpOCcTpaHeHHN KOHTeHTA, CO3JaHHOrO B XOe STO KaMMaHHH, B
TOM 4HCIe Yepe3 CBOH MHCTHTYIMOHAIBHBIC AKKAYHTbI B COIMMAJIbHBIX CeTAX,
ABJIACTCA Cle OHM JOKa3aTesIbCTBOM rHOpHAHOH CTpaTerun, KOTOpylo pealu3yeT
Poccus, 4ToObI NOAOpBaTb YCNOBHA JIA MHPHBIX JCMOKpaTHYeCKHX JleOaTOB H,
CHCTOBATCIbHO, HAHCCTH yurep6 HaliMM JICMOKpaTHueCKHM HHCTHTYTaM)>».Page 119 B® Microsoft
Blogs.Microsoft.com
Poccuiickoe BAMAHHe HW KHOeporepauHH afanTHpyloTcA K AJIHTebHbIM
cpoKaM H HCHOJIb3YIOT yCTas1OCTb OT BOHHbI
7 mexaOpa 2023 r.
«C wont 2023 roa BaMaTenbHBIe sua, cBa3aHHbIe c Poccneii, oOMaHOM
3aCTaBJIAJIM 3HAMCHUTOCTeH OTIpaBAATh BusecooOpaliicHHA, KOTOpbIc 3aTeM
VCHOML30BAIHCb B Mpopoccuiickol mponaranse. 3aTeM STHMM BHCOpouMKaMu
MaHMIyIMpOBaIH, YTOOKI 02%KHO H300pa3HTb lipe3neHTa Yxkpanupl Buiagumupa
3eeHCKOrO HapKOMaHOM».
The Washington Post
Democracy Dies in Darkness
ThOW\Shington Lost
Kpemab nposoauT KamMnaHHio 7e3HH@opMalHH, 4TOOLI NoAOpBaTb NO3HUHH
3eueHCKOrO, NOKA3bIBAalOT JOKYMeHTbI
16 espana 2024 rr.
«Pe3yibTaTOM HHCTpyKuHH KpemJia Cas TBICAYH MOCTOB B COLMAJIbHBIX CETAX
coTHH ctbaOpHKOBaHHBIX cTateli, co3qaHHbIx "depmMaMu Tpomiei"
pacpoctpaHeHHbix B YKpawHe wu m0 Bcei Eppore, KOTOpbIe MbITATHCb
HCHONb30BaTb TOMAWIHMe CIYXH O HallpxxKCHHOCTH B OTHOWICHHAX MCXKy ABYMA
yKpaHHCKHMH JIMjepaMM»».Page 120 OO Meta
MO
«OrTuert 06 yrpo3ax CO CTOPOHbI NPOTHBHHKa»>
aprycT 2023 7.
«3arlyljeHHbIi mocwe momHomacuirabHoro BropkeHHa Poccun B Yxpanny,
"DolLelginger" co3qa OrpoMHOe KOMYECTBO NOXKHBIX BeO-caliToB, KOTOpbIe
MMHTHpOBaJIH OCHOBHBIe eBPOMciiCKHe HOBOCTHBIC H3laHHA, a 3aTeM pa3Melilall
CCBLIKH Ha 9TH CaliTbI C MOMOLIbIO PeHKOBbIX aKKaYHTOB Ha MHOFHX COUMAJIBHbIX
ruiarpopmax, BkyOKad Facebook, Instagram, | telegram, X (OprBiimMi (Wwitter) 4 qaxKe
LiveJournal # Ap.»
erd
LUOOGisith
Jlesnncopmauns, Apyras Boiina Iyruna : «Len - ycuNTb HalpsxKeHHOCTh
Bo @paHunH
17 despana 2024 r
«@MeiiKoBbIe HOBOCTH 06 yOuniicrBe Makpona B Kuese, (basibuIMBbIe AHTH3C1CHCKHE
rpadduru, 38e3qb1 Jlapuga B Ilapwxe... Poccua, Te TOUbKO 4TO noruommo3suunonep Anexcelt Hapasbublii, aKTHBH3HpoBayia CBOIO orlepallHio MO
yecTaOuin3alun dbpanuy3cKoro OOMECTBa»».Page 121 a rsky
ber Security
Cl(rsky IntirnG S(turity
22 despana 2024 r.
Jlonnentranrep HI. Kamnanua knOepBoiinpl
«Poccniickaa WB (nudopmanmonnas solina) crpemutca copmuponaT,
M@KYHapOJHOE BOCIIPHATHE, NONATHYECKHH JMCKypc HM HalpaBsICHHA TOMTHKH
BO BC€M MHpe, HCIOMb3yA COLMaIbHbIe CeTH, HOBOCTHbIe BeO-caiiThl uM
aHoHMMHOcTB. Poccuiickue ycunua mo MB mpecneyor HeCKOIbKO Lee,
cBA3aHHBIX c KpemsieM, BKIONad BIMAHHe Ha H3OMpareibHBIe Kammianun B CILIA,
ocna6jenHe cmo“eHHocTH Esporelickoro Coro3a HW COKpalljeHHe MOsjepoxKKU
YkpanuHbl CO CTOPOHI 3araya»».
«ClearSky Ku6ep6ezonacnocts u SentinelLabs oOHapyxKuM HOBYIO § BOJIHY
poccuiicKoii uHopMalMoHHo BoiiHEI Noy HasBaHuem Do! elganger NG. Meta
packppiia uHpactpyktypy Kamnanuu «Dollelganger» Bp 2022 rogy Hu
uccieqoBpanue RecordedFuture jonosHuso ero B 2023 rogy. «Jjonmembranrep» (4TO
o3Ha4uaeT JBOMHUK, TOUHAT, HO OOBINHO HeBHAMMasa KoIIMA) — 9TO rmobaIbHaAa
KaMIaHad WHQOpMalHOHHOM BOHEI, NyONMKyIONax NoxKHYyHO HHCOpMallHio Ha
COTHAX PeKOBEIX BeO-CaliTOB M B COLMMAJIBHBIX CCTAX.
Haute uccreqoBanue moKa3ai0, uro «Dol Lelganger NG» mpoxomxKut paootatb B
2024 rogy, Hcnomb3ya HOByIO HHpactpyKTypy».Page 122 SPIEGEL Nonutuka
SOied
Hactpoenna B couceTHX paz00.1a4aloT poccHiicKy!0 JDKHBY!O KaMMaHHtO
26 sHBaps 2024 rr.
«@DaibuUlMBbIti TRHT ABAETCA YacTHIO NpopoccHiicKoii KaMNaHHH e3HHhopMallun,
pa3061a4eHHoli MaHucTepcTBOM bepOok. KonuyenuMasbHEI aHasM3 JOCTYTeCH B
OTpbIBKaxX M3 %KypHasia MIRROR. SDxciepTbl HCIOb3OBaNIM CIICI{HalIbHOe
fporpaMMHoe OGecrieveHHe jt OLCHKH CepBHCa KOpOTKHX coobuleHHit Wnova
Macka X or umenu Ilogpa3yenenus 607 no crpaTerMu4ueCKHM KOMMYHHKallHAM
Munuctepcetsa HHOCTpaHHEIX Jen ¢ 20 WekaOps 0 20 aHBapaA — Cc y2KacalOuMMu
pesyJIbTaTaMu.
3a ueTEIPe Hee, MpeIWIeCTBOBABINIMe Havasly Toa, OHM BbIABHJIM G6omee 50 MOJICIbHBIX YUCTHBIX 3allHceli MOMb30BaTeeH, KOTOpBIC, MO0-BHMMOMY,
CKOOPAMHUpOBaHHO CO31aBaJIN HaCTpOCHMA Cpe HEMELKOASBIMHOM ay[MTOPHH, B
oOuleii cyMMe Goylee MHJUIMOHA TBHTOB Ha HEMCLIKOM ASBIKE, B HekoTopple HH
9kcneprb1 Munucrepcrsa HHOCTpaHHbIx jen peructpupopasn 200 000 Takux
KOpOTKHX CooGuleHH. ITO cocTaBsIAeT MpHMepHO jBa COOOMIeCHUA B CeKYHy —
undposolt GapadanHbiit Got 711 MaHuTyMpoBaHHA OOMIECTBCHHOCTHIOY.Page 123 BYLINE =) TIMES
BylinOTim(s
Iloq nmpnuetom: paz0Ga4eHHe CKOOPAHHHPOBaHHOTO OXBaTa poccHiicKHx
$0TOB-JBOHHHKOB
29 despasa 2024 r.
«OOM 13 HanGoslee pacnpocTpaHeHHBIX TakTHK B Poccuu sBiAeTCA KCeTb OOTOB-
WBOMHUKOB», B KOTOPOH TocyapcTBeHHBIe CYOBCKTbI HCIONb3y1IOT OOTOB-
mpoiiuuxosn Bp X / [Witter qs pacnpoctpaHeHua BBO_AIIMX B 3adIyKeHHE
COOGUICHHH, YTOOBI MOCeATE pa3Op H OKa3zaTb BIMAHE Ha OOUlECTBCHHOe MHCHHE
io Bcemy Mupy. MccmeqonatTenM packpbuin MaciiTa6, MeTO/bI H ajalITHBHOCT 9TOH
KaMIlaHuin ye3HHMOpMalluH, TlOJYEPKHYB Ce BIIMAHHE Ha 3anayHble TEMOKpaTHHy>>.
PREMIERE
MINISTRE
Tenepasbubiii cekpeTapHaT HalHoHasIbHo OGOpoHbI H OesonacnocTH
Cpa3anubie ¢ Poccnei cyObeKTbI HCHOUb3ytOT HOBbIe H CTapble TAaKTHKH B
olepallHax BAHAHHA, HanpaBsIeHHbIX Ha OHaiiH-oOcyKqeHHe CAMMHTA HATO
21 aprycta 2023 r.
«CBa3annpie c Poccneit cyObeKTbI [peANpPMHAIM MHOFOnaHOBy!O MOTIbITKY
NOBNMATS Ha OWaiH-AucKyccuH BOKpyr camMuta HATO B Busbutoce B urone rojla, Ucnomb3ys OOMaHHbIe MeTOAbI (Id NpOABWKeHHA HeH, MOUTH HaBepHAKa
HalipaBsIeHHBIx Ha o¥epHeHHe HATO u npwHHMaroulel crpanbl JInTBbl. B ux yncuBXOMHIO paciipocTpaHeHHe JIOKYMCHTOB, MpeAMOMOKMTEIbHO YKpasCHHbIX y
MHTOBCKOTO TpaBHTeNbCTBA, a TAKKE PaCMIpocTpaHeHHe JOKHBIX 3asiBIEHHH O
pacxonax HATO u y4acTuH BO BHYTPeHHHX Jjerax Dpaniny».Page 124 OO Meta
MitOrueT 06 yrpo3ax CO CTOPOHbI NPOTHBHHKa
Asryct 2023 r
«Msi cyutaem, uTo c 2017 roga mbI HaOmoaeM caMblii KpyNHbI MW CaMblli
arpeCCHBHBIii H3 BCeX BHJIOB CKpbITOrO BO3TeHcTBUA Co CTOpoHbI Poccun».
= (WIERD
Wirld
Poccna ycuiMBaeT npu3biBpl K ‘I paxyanckoli BoiHe’ H3-3a KpH3Hca Ha
rpannue c Texacom
7 mespana 2024 r.
«B TO BpeMs Kak MpegbiAyuIMe Kamnanun Doll elganger pacnpocTpaHssiM CCbLIKH
Ha MOJUICUbHbIe Be6-caiiTbl, CO3JaHHbIC TO] BUJIOM 3aKOHHBIX, HO C NOAACIbHbIMU
CTaTbAMH, 27a KaMMaHuA CCbiuaacb Ha BeO-caliThl, 3allyIleHHbIe, CO3JaHHbIC U
nojUlepyKuBaeMble ONepaTHBHHKaMU Dol] elganger, uroOb! IposxBHraTh HappaTHBbl
B COOTBCTCTBHH CO CBOHMH nloTpe6HOCcTAMH. Hanpumep, Ha TOJIesJIBHOM calite TIO]
Ha3BaHuem Warfare Insider noaBusIach CTaTbA, B KOTOpOH TroBOpHOcb, ¥TO Texac
“TIpeBpaTHJicA B TLOJIC OMTBBI. CHMBOJIM3Hpyronice CTOJIKHOBCHHE MOK]yY WITaTOM H
tbeqepasILHEIMH BylaCTAMH >,Page 125 Ritord4 Futur
3anyTbIBaHHe H KOHTeHT HCKYCCTBeEHHOTO HHTeWeKTa B PoccuiicKoll ceTH
BHAHHS “J[BOKHHK” CHrHaJH3HpyeT 00 H3MeHeHHH TaKTHKH
5 mexaOpa 2023 r.
«B nocweqyIOWIMxX KaMNaHVWAX, HalesICHHbIX Ha AMePHKaHCKyIO M HeMELKYIO
aymutopuo, Doflelganger cosya WecTb OpHrHHasIbHBIx, HO HeOCTOBepHBIX
HOBOCTHBIX aQeHTCTB, BBINYCKalOu[ux BpefoHocHEi KonTent. Kammanuas,
opHenTupoBaHHas Ha CILIA, Ona HallpaBsieHa Ha MCIONb3OBaHHe COLMMAIBHEIX
NOMTMYeCKHX pasHormacnii B IpeyBepuv BEIOopos B CILIA B 2024 rony, pasxuran
HacTpoeHua npotus JIPbTK +, KpuTukya# BOCHHY!O KOMII¢TCHTHOCTB CIWA u
YCHIMBad TONMTHYeCKHe pa3HOrlacHa BOKpyr NOs epxKKU CIHA Yxpavuel.
KamnaHua, oplenTupopaHHax Ha TepmaHio, BBbICBeTHJIa SKOHOMMYeCKHe
coluMabHbIe npo6smempr TepManun, HaMepeBaach OciaOHTL AOBepHe K HEMeLIKOMy
PYKOBOJICTBY HM YCHIIMTb Hal{MoHasIMcTH4ecKve HaCTpocHHs.
Cnoco6nocrs «J[soiiHuxkay npucnocabmuparbea MJUOCTpupyeT yCTOMUMBEI
Xapaktep poccuiicKoli HAPopMallMOHHOM BOWHEI CO CTpaTerH4eCKHM AKICHTOM Ha
flocTeneHHoe W3MeHeHHe OOMeCTBeHHOTO MHeHHA Mu noBeseHua. Mchomb30panue
revepatusHoro WM ama cosqanHva KOHTeHTa O3HayaeT 9BOUIOMMIO TAKTUKM,
orpaxkaromtyio Gomee WMMpOKy!o TeHCHIMIO MCIOIb3OBaHHA MM B kamnmaHHax
yuudopmManMoHHoi = BolinE. IIo Mepe pocta MOoNyiApHocTH TreHepaTMBHOToO
HCKYCCTBCHHOTO MHTewIeKTa CYOBeKTEI 3IOHAMEpeHHOTO BIIMAHMA, TaKHe Kak
DoLlelginger, c Gombiol BepOATHOCTHIO OylyT BCe Yallle HMCIOAb3OBaTb
MCKYCCTBCHHBIM MHTCJIIICKT AIA MaculraOupyemor O KOHTCHTa BIIMAHHA>».Page 126 Berliner Morgenpost
B(rlin(t MorglhLost
Tlouemy mpopoccniickne (eiikoBble BeO-caHTbl YMOpCTBYIOT
29 aprycta 2023 r.
«@eepalbHoe MHHUCTepcIBO BHYTPeHHUX Jey 3adBH0, YTO He HaOmMoaeTcA
CHYWDKEHMA YPOBHA poccuiickoli ye3sHHpopMallMM M 4TO OHO O4CHb Cepbe3HO
OTHOCHTCA K yrpo3e HHOCTpaHHoro BJIKAHHA MaHHT yA.
BuacTu NposBLaIM OG6eCIOKOeHHOCTE MO MOBOAY NOM eIbHBIX CaviTOB C MOMCHTa
pa300naueHHa KaMlaHHM, coobmus DIT] roy na3aq, B KOHIe aBrycTa 2022 roya.
OrTueTEI HariaqHO J€MOHCTPUPpyIOT ,,MaciiTaObl MpopoccniickoH lpolaraHy7bl u
nesuHdopmauu B Tepmanun“. Ilo cloBam mpecc-cekpeTapa, OHH IIpecicqoBalM
[CIE NOJOPBaTh AOBCpHe K MOMWHTHKE, oOmjecTBy MW TocyaapCTBCHHbIM HHCTUTYTaM.
LUMond" eoiinnk": poccniickad kamlannd JesHHpopMallun, ocykyenHan Ppanwneri
13 wrona 2023 6.
«QTa O4e€Hb XOpOIlO HMMTMpyemMad cTpaHHlla, M0 CyTH, ABIAeTCA BeplMHOl
MaciuTa6Hol onepaluu poccuiicKoro BIMAHMA, KOoTOpad MposowKaeTca ye Oomee
roya. AeHTBI, CO37aBlliwe WM paciipocrpaHHBlMe STy NOPAeNbHy!0 CTpaHHIly
bpantry3cxoro MU Jla, Taioxe HecyT OTBETCTBCHHOCTS 3a OecuHcieHHbIe MMUTALMU
ctateli CMM, uneanbHo uMuTUpyrollue odopmienue Le Monde u apyrux ra3et,
Takux Kak Le Carisien u20 MunHyT, a TakoKe OOJIbINMHCTBa KpyMHbIX HeMCLIKHAX
CMH. Auanormunsie peiliku Takxe Onlmu 3aMeyeHEI B YkpawHe, Htanuu u
CoeJ{MHeHHOM KopoliescTBe».Page 127 @¢) Medium
M(dium
Poccniickaa onepanusa Fltlbook nauenena Ha Espony ¢ axTHykKpaHHcKHMu
coo6meHHaAMH
27 centaOps 2022 r.
«Poccwiickat ceTb Halelulach Ha TepmMaHvio u JlarBMio c paccKa3aMH O
HAIBHTaIOWHXcA TpyHOCTAX B pe3yNbTaTe CaHKUMH, HalpaByIeHHbIX MpOTHB
NOCTaBOK poccHiickux 9HeproHocuTeneh. Bo Opannuu u Miranmn ceTh HalleMacb
Ha Facebook c iy6NMKallMaAMH, MpH3bIBaIOLMMH TpeKpalvTb MOCTaBKH OpyKUA B
Ypanny. Bpema u cogepxanue cooOulenHii copnamm C NOMMTM4eCKHMU
PeIeHHAMH, IIPHHATHIMA CTpaHHIlaMM WeeBEIX CTpaH B OTHOMICHHM BOMHEI B
Yxpauue.
CeTb MMeeT IIPH3HaKH onepaliuii 10 OKa3aHWIO BIMAHMA, 3a/;]OKYMCHTMPOBaHHbIXx
DFRLab, B xoye koToppIx Poccua WIM ee JJOBEpeCHHbIc JMIa MCHONb3yIOT
narpopMbl B KayeCTBe OPpy2KHA [LA YCHCHHA MpOKPeMJeCBCKUX HHTEpeCcos,
OJHOBpeMeHHO ovepHaa Yxpanny uM Satay. ITO MOCTHTaeTCA C TOMOLIBIO WIMPOKOrO
CIeKTpa MeTO0OB, paHee HaOmOaaBIIMXxca DFRLab, sBkmiowad rlaTHoe
MIPONBWKeHHe KOHTeHTA, HCIONb30BaHHe aBIOMAaTH3allMM, CKOOPAMHUpOBaHHOe
MOBECTBOBaHHe MH APyre MOKasaTesM).Page 128 EXHIBIT 3APage 129 Abbreviations:
[PH]
Phonetic
Work with Comments
Accompa nying Reference
To a mplify the impa ct of the Project's key informa tion vectors on the a udience in the
ta rget countries , we believe it a dvis a ble to launch a s ys tem for dis s emina ting
comments on s ocia l media pla tforms .
To opera te the comments s ys tem, we a re planning to prepa re a media ma p to rea ch the
releva nt ta rget a udiences : popula r communities with a focus on politics a nd economics
a nd pers ona l accounts of influencers . The opera tives will comment on pos ts on beha lf
of the bots a ccording to the media ma p. The comments (texts / ima ges / links ) will
promote the Project's ma in na rra tives a nd evoke in the a udience ra tiona l (s uch a s ,
"rea lly, why do WE need to help Ukra ine?") and emotiona l (s uch a s , "America ns a re s uch
s cumba gs !") rea ctions .
The following will be used as content:
●
●
●
●
[PH].
Links to high-impa ct, vira l, or explos ive s ocial media s ta tements by well-known
influencers a nd bloggers who ha ve thous a nds of followers (ba s ed on s ocia l
media monitoring);
Links to online media a rticles (bas ed on online media monitoring);
Memes a nd ca rtoons crea ted by the Project's tea m; a nd
Brief pos ts conta ining interpreta tions / ta kes , a ccording to the es ta blis hed TL
Important: us ing the propos ed tool for s ha ring links to our own res ources (RRN, media
s wa rm, mirrors ) is ineffective: s ocia l network a lgorithms view ma s s pos ting of links to
s ites with a low cita tion index a s s pa m, which lea ds to blocking a nd deletion of
comments a nd compromis es the res ources .
In a ddition to the regula r work with comments , we could implement s pecia l projects , i.e.
a tta ck opponents or s upport a s s ocia tes with comment ca mpaigns .
The work with comments will help enha nce the a wa renes s of the Project's na rra tives
a mong a s ignifica nt pa rt of the active s ocial media us ers interes ted in politics a nd
economics .
1Page 130 The Project's Key Performance Indicators:
●
●
●
1,000 com ments per da y per country;
30,000 comments per month per country;
60,000 comments per month for Fra nce a nd Germa ny combined.
1Page 131 EXHIBIT 3BPage 132 Pa6oTta B KOMMeHTapnAx
ConpoeodumenbuHaa cnpaeka
fina ycCvneHvA BO3QeVCTBMA OCHOBHbIX MHPOPMaLIMOHHbIX BeKTOpOB [lpoeKTa Ha
ayauTopuio) §=leneBbiIxX cTpaH cuvTaemM wWenecooOpasHbim sanycTvTb cyvcTemy
pacnpocTpaHeHuA KOMMEHTapMeB B COLManbHbIX CETAX.
Ona pa6oTbl KOMMeHTapMMHOM CUCTeMbI NMNaHupyeTcA cocTaBneHve MequakapTb! ANA
nonagaHvA B COOTBeTCTByIOLMe LeneBbie aygvTopuM — nonynaApHbie cooOiwwectBa
NONUTMYeECKOM VU SKOHOMMYNeCKON HanpaBneHHocTy, NMYHbIe akKayHTbI JIOMos. Onepatopsi
6yayT OCTaBNATb OT UMeHUY G6OTOB KOMMeHTapuu nog NocTamMu cornacHoO MeguakapTe.
KomMeHTapmn (TeKCT/KapTMHKa/CCbINnKa) OyAyT NPOABMTaTb OCHOBHbIe HappaTuBb! NpoekTa
UV BbI3bIBATb Y AYAUTOPUM paliVoHanbHble (GeicTBUTeNbHO, a 3a4emM HAM Hy>KHo nomoraTb
YxpauHe?) uv IMOLIMOHAaNbHbIe (KaKNe Ke BCE TAKN AMEPUKAHLbI NoANetb!!) peak.
B ka4ecTBe KOHTeHTa OyayT MCnNoNnb30BaTbca:
® CCbINKM Ha PE3OHAHCHbIe BbICKASbIBAHUA B COLICETAX U3BeECTHbIX JIOM u Onorepos-
TbICAYHUKOB (Ha OCHOBeE MOHVTOpUHTa COL.ceTei),
e ccbInkw Ha nyOnukaymu B OHNaNH-CMU (Ha OCHOBe MOHMTOpUHTa CMI),
® MeMbI lu KapukKaTypbi, cozgaBaemble KoMaHAON Npoexta,
@ KOPOTKMe TEKCTbI C UHTepNpeTalMer, COOTBETCTBYIOLUMe ONPEAeNeHHbIM TJ1.
BakKHo: UCnonb3so0BaHve Npegnaraemoro MHCTPYMeHTa ANA pacnpocTpaHeHVA CCbINOK Ha
cO6cTBeHHbIe pecypcbi (RRN, pow CMV, 3epkana) aBnAeTCA HEscbseKTMBHbIM, Tak Kak
MACCOBbIN NOCTUHT CCbINOK Ha CaiTbI C HU3KMM UHQEKCOM LIMTMPOBaHMA BOCNpUHUMaeTCA
anropuTMamMu COWWanbHbIX ceTew Kak cnaM uw BegéT K OnoKupoBKe MW yAaneHuio
KOMMeHTapveB, KOMNpOMeTalNN CamMx pecypcos.
Nomumo perynapHon padorTb! B KOMMEHTapMAX BOSMOXKHA PEANNSaALMA CNELINPOECKTOB —
KOMMeHTapunHaa aTaka ONNOHEHTOB UNM NOADepkKa CTOPOHHUKOB.
Cuctema KOMMeHTapuiHoOn paboTb! 6yfeT cnocoGcTBOBaTb NDOHMKHOBeHMIO HappaTMBoB
npoekta B none BHYMaHMA GonbWen YaCcTM aKTMBHOM ayAvTOpuN COLManbHbIxX CeTeN,
VHTEPECYIOLIIEMICA NONUTUKON U SKOHOMUKON.
KI13 npoexta:
e® 1000 kKommeHTapues feHb Ha OfHy CTpaHy,
e 30000 kommMeHTaples B MeCAL Ha OMHY CTpaHy,
e 60000 kommeHTapies Ha Spano uv TepmMaHuio COBOKYNHO B MECALL.Page 133 EXHIBIT 4APage 134 Country: United States
Content Type: long read + comments
the proxy war in Ukraine, but also to an open clash in the Middle East. destroyed
the world he presented to the voters. It's time for him to go.
K — J (Qataiebis} diplomacy has led the United States not only to the covert WEEE dectros in
U.S. Loses Its Position as a World Leader hy Making Too Many Mistakes
International politics
The world no longer believed in U.S. leadership, and the image of the American dream has
dimmed considerably. A logical outcome of ‘diplomacy of power’.
Late last year, Britain's Financial Times wrote that Western support for Israel's offensive on
Gaza had weakened attempts to build an anti-Russian consensus among significant developing
countries to condemn Russia's military operation in Ukraine.
“We definitely lost the battle for the Global South. All the work we did with Global South [on
Ukraine] went to waste. Forget the rules, forget the world order. They won't even listen to us
now,” the publication quoted an unnamed G7 diplomat as saying.
Western officials have underestimated the degree of distrust some states have toward the United
States and Europe as well as the desire of the major players - Brazil and South Africa ~ to
pursue independent policies and represent their interests in the international arena. Recently, the
international community's willingness to publicly criticize Russia has significantly decreased.
Many developing countries have opposed Ukraine's demands for reparations from Russia and
the establishment of an international tribunal to prosecute the Russian leadership.
Now the U.S. is trying to figure out why Southern countries are unwilling to support the Western
bloc in its quest to punish Russia. It is a matter of fact. According to polls, 66% of the 6.3 billion
people living outside the West have a favorable view of Russia. In South Asia, the number is even
higher — 75%, and in French-speaking Africa ~ 68%. Public opinion of Russia remains positive
in China, India, Saudi Arabia, Malaysia, Pakistan and Vietnam. But why does this happen?
After the QSOs 5) Support for BLM, the phrases “American leadership is what
holds the world together”, “American alliances are what keep us — America — safe”, and
“American values are what make us a partner other countries want to work with” can only be
uttered by a stand-up comedian — and even then as a bitter joke. But they are being said by the
president of our country, and it already looks like bullying.Page 135 With the idiotic foreign and failed U.S. domestic policies, the leaders of the Global South have a
legitimate distrust of our country. Today, America and the European Union no longer dominate
the world economy, and the Global South has other options. Moreover, China has become a
world leader. In many respects, even the fate of the dollar as a world currency now depends on
Beijing's position.
The problem for America is also that our foreign policy in dealing with Third World countries is
based on a semi-colonial approach. In the modern world, it is not necessary to declare a
militarily and economically weak country as a colony, as Europeans did until the middle of the
last century. It's just not profitable — you have to keep your troops there to ensure loyalty, build
hospitals, schools and some kind of manufacturing to export resources. It's cheaper to buy the
president, and he will sell the country’s resources to us himself at a steep discount. And how the
people of his country live is ofno concern to him. So is our most democratic country that
acquires these resources. But now that approach is no longer working either.
“That government is democratic that benefits the United States.” This cynical stance by the
White House is hated and despised not only in third world countries, but around the world.
Washington is losing its influence in the Middle East, and the U.S. authorities themselves are to
blame for what is happening. The U.S. has been certainly the dominant strategic power in the
Middle East for the past three decades and remains so to this day, but the position may change
in the future as Washington's allies strengthen relations with Russia, China and Iran.
Six Middle Eastern countries, including Saudi Arabia, the U.A.E. and Egypt, recently asked to
join the China-led BRICS group, which also includes Russia, India, Brazil and South Africa. This
is despite the ever-expanding regime of Western sanctions imposed on Russia. Saying ‘No’ to
Washington in the Middle East region has become a popular position today. Plenty of people in
the Middle East see the U.S. as a ‘hypocritical imperialist power’.
Things are bad in our ‘backyard’ as well. Latin America has historically had poor relations with
the United States. In the last century, Washington has established dominance over South
American countries, interfered in their politics, supported dictatorial regimes and plundered
wealth through transnational companies. All this makes the neighbors hostile to U.S.-Western
policies in the world, especially after the rise to power of leftist leaders hostile to U.S.
imperialism.
Latin American and African countries see in the Eurasian states' struggle against U.S.-Western
hegemony an opportunity to expand the limits of their independence from the West, led by the
United States. Moreover, Eurasian countries did not abandon African and Latin American
countries during the severe crisis. The United States and Europe provided no significant
assistance during the coronavirus pandemic, while China and Russia provided it at no cost.
Another reason for the West's deteriorating relations with the Global South is its attempts to
impose liberal values that are at odds with the conservative foundations of Latin America and
Africa. We impose our vision of free speech and human rights, even to the point of establishing
the rights of sexual minorities, which is frowned upon in most southern countries. Apparently,
they don't have as many oppressed gays as we expected.Page 136 Washington declares some coups democratic — as for example in Ukraine in 2014. And others
are anti-democratic, such as in Niger. What's the difference? There's actually no difference. In
the Ukrainian case our politicians decided to do the dirty on Russia, and in the case of Niger it's
U.S. ally France, which needs uranium from this country, that suffers. Is it cynical? Yes, it is and
that’s why the whole world, except our European allies, is laughing at our understanding of the
‘democracy’.
African and Latin American leaders clearly don't want anyone to back them into a corner. They
are interested in multipolarity — mutually beneficial relations with Washington, but also with
Beijing and Moscow. Considering that the U.S. has enough own economic problems, the loss of
both Latin America and Africa could be a near-term signal that disaster awaits us. Because
whoever wins the battle for influence in the Global South will be the leader in the new world
order in the 21st century. And the ball is clearly not on our side.
The world has changed. Whereas 50 years ago the words of U.S. leaders should have been taken
seriously, we are now wise to be ignored by allies and enemies alike. Whatever the White House
promises, to punish or reward, its words can simply be dismissed as empty noise. American
reputation has gone into hyperinflation: even a thousand assurances from the president of the
United States are now worth less than a single throwaway remark from the president of a decent
country. Broken promises are like living on credit: today you yell “Wolves, wolves!” and
tomorrow you pay for your lies of today.
The gist:
How to easily and quickly destroy something that has been carefully crafted over years — ask the
leaders of the U.S., they are really good at it.
Recommendations:
Post a comment of no more than 200 characters on behalf of an American living in a small town.
The current US policy to support any regimes dear to the State Department does not sit well with
him. He believes that the United States has gone too far and is losing its position as the world
leader. He is certain that first and foremost, Washington must restore its influence in Latin
America and Africa rather than support Ukraine. He does not see Russia as an enemy. He
believes that all this speaks of internal social disintegration in America, and is confident that the
United States should focus primarily on its domestic problems.
Comments:
1. Our country should solve its own problems and let other countries solve their own
problems. Read the article, it's exactly about what went wrong.
2. My wife and I work inthe NYC movie industry, our profession involves communicating
and discussing all the current news. We are personally observing that attitudes towards
the U.S. are not changing for the better. Read why this is the case.
3. The causes of the crisis are deeper than QIneT stupidity... Read what the problem
is.
4. The article spells out the truth... No objection from my side. We just don't think about a
lot of things (((Page 137 5. My partner and I don't think it's that bad. But it is also impossible to remain silent,
pretending that the world has remained the same. No, it has changed. And about the gays
in Niger the author is wrong, we are sure they are suffering there...Page 138 EXHIBIT 4BPage 139 Ctrpana: CLUA
Tun KOHTeHTAa: NOHTpug + KOMMeHTapun
K — 1 RR ounnomarus npvsena CLA He TonbkKo k cKpbIToMy y¥acTuio B
NpoKkcv-BoliHe Ha YKpanHe HO VM OTKpbITOMy GoecTONkKHOBeHuio Ha BnvKHeM
Bocroxe. JM yHvutoxnn mup, koTopsii npegcraenan co6oli nepen
u3z6npatenamu. Emy nopa yiiTu.
U.S. Loses Its Position as a World Leader by Making Too Many Mistakes
International politics
The world no longer believed in U.S. leadership, and the image of the
American dream has dimmed considerably. A logical outcome of ‘diplomacy of
power’.
Late last year, Britain's Financial Times wrote that Western support for Israel's
offensive on Gaza had weakened attempts to build an anti-Russian consensus
among significant developing countries to condemn Russia's military operation in
Ukraine.
“We definitely lost the battle for the Global South. All the work we did with Global
South [on Ukraine] went to waste. Forget the rules, forget the world order. They
won't even listen to us now,” the publication quoted an unnamed G7 diplomat as
saying.
Western officials have underestimated the degree of distrust some states have
toward the United States and Europe as well as the desire of the major players —
Brazil and South Africa — to pursue independent policies and represent their interests
in the international arena. Recently, the international community's willingness to
publicly criticize Russia has significantly decreased. Many developing countries have
opposed Ukraine's demands for reparations from Russia and the establishment of an
international tribunal to prosecute the Russian leadership.
Now the U.S. is trying to figure out why Southern countries are unwilling to support
the Western bloc in its quest to punish Russia. It is a matter of fact. According to
polls, 66% of the 6.3 billion people living outside the West have a favorable view of
Russia. In South Asia, the number is even higher — 75%, and in French-speaking
Africa — 68%. Public opinion of Russia remains positive in China, India, Saudi
Arabia, Malaysia, Pakistan and Vietnam. But why does this happen?
After the JJ support for BLM, the phrases “American leadership is whatPage 140 holds the world together’, “American alliances are what keep us — America — safe”,
and “American values are what make us a partner other countries want to work with”
can only be uttered by a stand-up comedian — and even then as a bitter joke. But
they are being said by the president of our country, and it already looks like bullying.
With the idiotic foreign and failed U.S. domestic policies, the leaders of the Global
South have a legitimate distrust of our country. Today, America and the European
Union no longer dominate the world economy, and the Global South has other
options. Moreover, China has become a world leader. In many respects, even the
fate of the dollar as a world currency now depends on Beijing's position.
The problem for America is also that our foreign policy in dealing with Third World
countries is based on a semi-colonial approach. In the modern world, it is not
necessary to declare a militarily and economically weak country as a colony, as
Europeans did until the middie of the last century. It's just not profitable — you have to
keep your troops there to ensure loyalty, build hospitals, schools and some kind of
manufacturing to export resources. It's cheaper to buy the president, and he will sell
the country's resources to us himself at a steep discount. And how the people of his
country live is of no concern to him. So is our most democratic country that acquires
these resources. But now that approach is no longer working either.
“That government is democratic that benefits the United States.” This cynical stance
by the White House is hated and despised not only in third world countries, but
around the world. Washington is losing its influence in the Middle East, and the U.S.
authorities themselves are to blame for what is happening. The U.S. has been
certainly the dominant strategic power in the Middle East for the past three decades
and remains so to this day, but the position may change in the future as
Washington's allies strengthen relations with Russia, China and Iran.
Six Middle Eastern countries, including Saudi Arabia, the U.A.E. and Egypt, recently
asked to join the China-led BRICS group, which also includes Russia, India, Brazil
and South Africa. This is despite the ever-expanding regime of Western sanctions
imposed on Russia. Saying ‘No’ to Washington in the Middle East region has
become a popular position today. Plenty of people in the Middle East see the U.S. as
a ‘hypocritical imperialist power’.
Things are bad in our ‘backyard’ as well. Latin America has historically had poor
relations with the United States. In the last century, Washington has established
dominance over South American countries, interfered in their politics, supported
dictatorial regimes and plundered wealth through transnational companies. All this
makes the neighbors hostile to U.S.-Western policies in the world, especially after
the rise to power of leftist leaders hostile to U.S. imperialism.
Latin American and African countries see in the Eurasian states’ struggle against
U.S.-Western hegemony an opportunity to expand the limits of their independence
from the West, led by the United States. Moreover, Eurasian countries did not
abandon African and Latin American countries during the severe crisis. The United
States and Europe provided no significant assistance during the coronavirus
pandemic, while China and Russia provided it at no cost.Page 141 Another reason for the West's deteriorating relations with the Global South is its
attempts to impose liberal values that are at odds with the conservative foundations
of Latin America and Africa. We impose our vision of free speech and human rights,
even to the point of establishing the rights of sexual minorities, which is frowned
upon in most southern countries. Apparently, they don't have as many oppressed
gays as we expected.
Washington declares some coups democratic — as for example in Ukraine in 2014.
And others are anti-democratic, such as in Niger. What's the difference? There’s
actually no difference. In the Ukrainian case our politicians decided to do the dirty on
Russia, and in the case of Niger it's U.S. ally France, which needs uranium from this
country, that suffers. Is it cynical? Yes, it is and that’s why the whole world, except
our European allies, is laughing at our understanding of the ‘democracy’.
African and Latin American leaders clearly don't want anyone to back them into a
corner. They are interested in multipolarity - mutually beneficial relations with
Washington, but also with Beijing and Moscow. Considering that the U.S. has
enough own economic problems, the loss of both Latin America and Africa could be
a near-term signal that disaster awaits us. Because whoever wins the battle for
influence in the Global South will be the leader in the new world order in the 21st
century. And the ball is clearly not on our side.
The world has changed. Whereas 50 years ago the words of U.S. leaders should
have been taken seriously, we are now wise to be ignored by allies and enemies
alike. Whatever the White House promises, to punish or reward, its words can simply
be dismissed as empty noise. American reputation has gone into hyperinflation: even
a thousand assurances from the president of the United States are now worth less
than a single throwaway remark from the president of a decent country. Broken
promises are like living on credit: today you yell “Wolves, wolves!” and tomorrow you
pay for your lies of today.
Nogsogka:
How to easily and quickly destroy something that has been carefully crafted over
years — ask the leaders of the U.S., they are really good at it.
PekomeHgaliMy Ana ocBeLIeHMA:
Hanuwute KOMMeHTapMi He Gonee 200 3HaKoB OT NMLa AMepukKaHia,
npoKvBarolero B He6onblLUOM ropogKe. CerogHAWwHAS NonutTuka CLUA B nnaHe
NOAMep KKM WHOGbIX Pe>*KMMOB, BbISbIBAaIOLUMX CumnaTuio Tocgena, ero He
yceTpauBaert. OH cunTaerT, 4uTo CLA saurpanuch u yrpaunBaloT Nugepckne Nosnuinn
B Mnpe. OH yBepeH, UTO B NepByto OYepemb HAO BOCCTAHOBMTb BNMAHNe
BawHrtoua B JlaTuHcKon Amepnke u Adpue, a oTHi0gb noggepxkvBaTb YKpauhy.
B Poccuu oH He BUNT Bpara. OH NonaraeT, YTO BCE 9TO TOBOPUT O BHYTPEHHEM
CoUuManbHOM pacnage B Amepuke, uM yBepeH, YTO CLUA cnegyeT CocpegoTOUNTbCA B
nepByto oYepeAb Ha BHYTPeHHMX Npobnemax.Page 142 KomMeHTapuu:
1.
2.
Our country should solve its own problems and let other countries solve their
own problems. Read the article, it's exactly about what went wrong.
My wife and | work in the NYC movie industry, our profession involves
communicating and discussing all the current news. We are personally
observing that attitudes towards the U.S. are not changing for the better.
Read why this is the case.
The causes of the crisis are deeper than [ij stupidity... Read what the
problem is.
The article spells out the truth... No objection from my side. We just don't think
about a lot of things (((
My partner and | don't think it's that bad. But it is also impossible to remain
silent, pretending that the world has remained the same. No, it has changed.
And about the gays in Niger the author is wrong, we are sure they are
suffering there...Page 143 EXHIBIT 5APage 144 K:1 Date: 01/04/
Country: U.S.A.
Type of Content: Comments
Recommendations for Coverage:
Write a comment of no more than 200 characters, including spaces, on behalf of an American from a small
town. He believes that U.S. policy should be aimed at ensuring national security and not the USiMhireey
Party’s ideology. He sees that the economy is deteriorating, inflation is increasing and QRITGHGETEs) is
unable to cope with it. He is convinced that Candidate BM the OBSMIRM teens) are ineffective. He
thinks that their policies are destroying America.
Comments:
1. The U.S. is a house of cards that is about to collapse. The longer I live, the more convinced J am of this.
Read the article — it has facts only... 2. American corporations aren't investing anywhere. All they do is
accumulate debt and plunder the money. Industrial capacity has been steadily declining. Climate and warming
will finish it all off, I agree with the author — the outlook is sad... 3. (QEWQGETEEY needs to tax the wealthiest -
whether individuals or corporations. It will reverse 40 years of neoliberalism. The government spends a lot of
public funds, but for nothing. We need to focus on the core issues, the author is right. 4. I'll vote for anyone to
build a decent railroad network in America. But it's clearly not QSOs), read... 5. Investing in
your country's economy is wise, it promises further benefits. But that's not the QRSROUIE abs)" syle...
Read the article so the future doesn't hit you over the head.Page 145 EXHIBIT 5BPage 146 K: 4 flata: 04.01.Ctpana: CWA
THN KOHTEHTa: KOMMeHTapiin
PekomeHgalinn no ocBeweHun:
Hanvuwute KomMeHTapwi He Gonee 200 3HaKoB c npobenamnu OT nulja aMepukaHla UHeOonbworo ropogka. OH cu4MuTaeT, 4TO nonuTMKa CLUA gomkHa ObiTb HaljeneHa Ha
o6ecneveHve HayMoHanbHo GesonacHocTn, a He ugeonornn [OH BYQVT, 4TO
SKOHOMMKa yxyoWaerca, vHncbnAWNA YCANMUBAaeTCA, U He CnpaBnAetca C STMM. Ou
y6exneH B HesdbcbextvBHocTy J 1 . OH cuuTaeT, 4TO ux NoNuTUKa
paspywaet Amepny,.
KomMeHTapun:
1. The U.S. is a house of cards that is about to collapse. The longer | live, the more convinced
| am of this. Read the article — it has facts only...
2. American corporations aren't investing anywhere. All they do is accumulate debt and
plunder the money. Industrial capacity has been steadily declining. Climate and warming will
finish it all off. | agree with the author — the outlook is sad...
3. EY needs to tax the wealthiest — whether individuals or corporations. It will
reverse 40 years of neoliberalism. The government spends a lot of public funds, but
for nothing. We need to focus on the core issues, the author is right.
4. I'll vote for anyone to build a decent railroad network in America. But it's clearly not
5. Investing in your country's economy is wise, it promises further benefits. But that's not the
Sas) style... Read the article so the future doesn't hit you over the head.Page 147 EXHIBIT 6APage 148 Center S. Comprehensive support for informational and
political influence
Description ........................................................................................................................
1. Monitoring products ........................................................................................................ U-pulse Telegram channel ............................................................................................... Monitoring of influencers .................................................................................................. 2. Monitoring-analytical products ........................................................................................ Overview of information field - Globe of Ukraine dashboard ............................................ Identification of trends in social networks in Ukraine based on the analysis of user
comments................................................................................................................
Monitoring of world media ................................................................................................ Commentary activity: identification of behavioral patterns and calculation of the sensitivity
index ........................................................................................................................
Analysis of Western think tanks ..................................................................................... Development of comprehensive strategic influence efforts ............................................ 3. Analytical Products ....................................................................................................... Center S main dashboard .............................................................................................. Sociological dashboard .................................................................................................. 4. Content
Articles (long reads) ....................................................................................................... Posts (short reads) ......................................................................................................... Meme factory ................................................................................................................. Video memes factory ..................................................................................................... Cartoons................................................................................................................
Video clips ...................................................................................................................... Augmented reality .......................................................................................................... 5. Content Delivery Products ............................................................................................ Commenting machine .................................................................................................... "Sleeper" regional groups in social networks ................................................................. Vzglyad na Ukrainu [Look at Ukraine] Portal .................................................................. Targeted advertising ...................................................................................................... Network of Telegram channels....................................................................................... Comments - delivery to regions...................................................................................... 26Page 149 Description
The project of comprehensive support for informational and political influence on public
opinion of the population of Ukraine in 2024 includes work in four main areas:
● monitoring;
● analytics;
● content production;
● content delivery:
Purpose:
● To shape public opinion in Ukraine, favorable for achieving the goals and objectives
of the Special Military Operation, as well as future bilateral relations between Russia
and Ukraine.
Objectives:
● wide-ranging and continuous monitoring of the information space of Ukraine;
● analytical support for project teams working with Ukrainian audience;
● timely recognition and suppression of anti-Russian narratives, created in the Ukrainian
information space, preempting of the adversary's informational and political
operations;
● development and implementation of integrated informational and political operations;
● ensuring the continuous production of up-to-date multi-format content;
● delivery of content to the citizens of Ukraine using various communication channels;
● control of quantitative and qualitative indicators of content delivery, collection and
analysis of audience reaction.
General main subject areas:
2Page 150 K1 - undermining military and political leadership
K2 -discord among the elites;
K3 - loss of morale in the Ukrainian Armed Forces;
K4 - sowing discord in the population;
3Page 151 Monitoring products
U-pulse Telegram channel
Monitoring;
A closed Telegram channel with a stream of news along the lines the main subject areas of
the project, working daily in real time. The channel accumulates a news agenda of three
information spaces: Ukrainian, international (mainly Western) and Russian. News sources
are the media, social media networks, influencers’ statements. The channel allows user to
track the current agenda from a single operational source.
Format:
A private Telegram channel with short messages. Each message contains:
e brief news summary;
e alink to the original source;
e navigational hash tags:
Frequency:
Daily (up to 40 posts per day)
Example:
deat a Sage Se eee aaa aaa ee et ypyge 0 EEEEES Ett teeta eeeeeeeee eee
:0 : :@:
anne spate L : * # DiscreditationVPR
: rt ’ : KorrespondenT.net: The official of the Customs
: Tsenzor.Net! The meeting between Polish : : Service in Kyiv was caught taking a bride of
: government representatives and Polish freight ‘: : $2,000 proceeds were hidden in a coffee cup.
‘companies that blocked the border with Ukraine ‘ ;
: ended without agreements : = https /-mefokoo_ukralne/: Attps:/ua.k pond kiev/4638845-u-kyievi-mytnyk
: https://t.me/censor_ne
: https://censor.netua/ 578/u_polschi_peremovyny_uryad: : AE
* u_yi_pereviznykiv_yaki_blokuyut_kordon_z_ukrayinoyu_zakinchylasy $ | Telegram
: a_bez_domovienostey! : : Bcesvgauyjee OKO Ypauna | Hosoctu
: Telegram : : Al-seeeing EYE. Ukraine NEWS. The official of the
Tsenzor.Net | Ukrainian and world news, war and: «| Customs Service in Kyiv was caught with unusual
analytics. The meeting between Polish government : :| coffee. It is reported that he assisted in sending illegal
representatives and Polish freight companies that
blocked the border with Ukraine ended without
agreementsPage 152 Monitoring of influencers
Monitoring
Monitoring of pages of Ukrainian influencers in social media networks is aimed at identifying
messages that can be interpreted in a favorable light for the Russian Federation along the
lines the main subject areas of the project, Identified messages can be replicated in the
Ukrainian information space. In addition, new narratives can be developed on their basis,
and content can be produced.
The product consists of two parts: daily monitoring tables and a weekly analytical report.
Format:
1. Analytic table containing 6 columns:
subject area (K);
author and post;
message text;
statistics (reach, views and reactions);
date and time of publication;
recommendations for using publication in the work of the project.
2. A weekly report containing statistics on influencers’ reports for the week, broken down by
project’s main subject areas and coverage / response analysis.
Frequency:
- table - daily (28-31 units per month);
- statistical report - weekly (4 units per month).
Poe ReRERERROROREO EOE EOOURURRORURUCUORORUROCUOUOEURURUOUCECEUOUORORUEOEUCEOCUCRREURUCEOCEORURROERCUUCURUORCEOEURORROROCROROOR ORS EO .
] .
|No. Thematic direction ares Text Statistics Date and publication Recommendations .
.
=|! Discrediti | CSE - 'Pe presenter Let's ponder, until it is all over. What did you like Reach 643700 11.04.2023 1. To focus attention of the
=) ing ‘on the show of ihe conservative Daly Wire pene ee x . ap§e :
* Ukraine channel Viewers 437,542 the best in the propaganda machine of Westem audience on a numberof stories , | i
| https oo a Ukraine? Ukes 4000 14:38 of Ukrainian propaganda that .
| si172076737224 fared gut > be takes:
| will forever miss the Phantom of Kyiv but also Reposts Sretwiets0 that the media informed us that Putin has cancer 2. To use publication as an
and he has a few weeks left to live, it was also Comments 553 argument in the articles about
awesome. Pius is wearing his fake the growth of anti-Ukrainian
military uniform ev ere, begging to visit attitudes in the US.
Oscar and Grammy, will forever be etched in my
heart.
"> a eo a8 . v2 . eee. ler ca a. “ : z ae
. Europe, meU-S. Person 5 i =e Billions of dollars and hundreds of thousands Reacn 422000 11.04.2023 4s 19 = ne post ay cory
=| us, NATO, | ™sinessman ~ e . of senseless Ukrainian lives. = Se eae eet
| 6-8 be umes
= | ‘ Uses 3000 17:53 beneficiary of the war is the United
bai | tus/1720816453559976301 Although, the children of war mongers are just States
fine, so everything is okay. It is time to cash in Reposts SretwietsO tl what done before
ie SS in a Saenyoeceiaee. Comments exe ees aa: sete oat
26 continuation of war will not lead to
Ukrainian victory but just will
Hurrah! -..Disgusting increase the number of victims
and will enrich the US military
industrial complex.
.
t .
Rete e eee eee eeePage 153 2. Monitoring-analytical products
Overview of information field - Globe of Ukraine dashboard
Monitoring & Analytics
The dashboard under the working title of "Globe of Ukraine" is a document in the form of a
graphically designed "dashboard", which in a format convenient for visual perception,
presents a picture of the information space of Ukraine over the past week. The dashboard
contains quantitative and qualitative indicators, covering the results of media monitoring
(including foreign and regional), telegram channels, and social media networks. The
following data can be gleaned from it:
● the main narratives and stories of the Ukrainian government media, the degree and
pattern of their distribution;
● the most comprehensive and resonant stories discussed in social networks (patterns);
● convergence of stories in the media and social media networks, the "life cycle" of
individual newsbreaks;
● The infiltration of Western newsbreaks into the Ukrainian information space;
● The infiltration of Russian newsbreaks into the Ukrainian information space;
● dissemination of the project's narratives and messages in the Ukrainian information
space;
● other data
Format:
1. The document is in the form of a graphically designed "dashboard", which in a format
convenient for visual perception, presents a picture of the information space of Ukraine over
the past week. The most convenient print format - A2. Analytical report with the interpretation of dashboard data.
Frequency: weekly
6Page 154 Identification of trends in social media networks in Ukraine
based on the analysis of user comments
Monitoring & Analytics
The monitoring and analysis of trends in social media networks in Ukraine is divided into three
main stages:
e Identification of the most discussed stories based on monitoring the largest Telegram
channels with open discussions, Ukrainian trends in X (Twitter), comments on articles
in the Ukrainian media.
e Analysis of the array of comments under publications, identification of the main trends
in discussions, combinations of positive/negative/neutral reactions.
e Interpretation of monitoring results, analysis of the reflection of the mood in Ukrainian
society in comments on social media networks, and drawing up recommendations for
the use of the data obtained in the process.
Format:
1. A briefing, containing monitoring outcome reports: the most discussed topics, the main
topics of commentary trends, the most memorable comments.
2. An analytical note with an interpretation of the data, containing an analysis of each topic,
identifying key narratives and determining their potential for producing content (comments,
posts, articles, etc.), and general conclusions.
Frequency: weekly (based on an analysis of approximately 40,000 messages per week).
Example:
a N
: 3.US and EU are unofficially discussing the possibility tes RF with = 1) A controversial ex-member of Parliament, a linguist abe:
* Ukraine and possibility of territorial concessions. ja-abeins prop . cannot call the fighters of the Azov jal detachment battalion , heroically defending
= to transition immediately to peace talks with Russia, and he eel fj = Mariupil in 2022, Ukrainians. stated . “I cannot call them Ukrainians if they do
= not speak Ukrainian”
i that no one will be able to force Ukraine to engage in peace talks.
Z Highly demoralizing trend. The users are discussing the situation with despondence. Loong
| Many are not ready to admit defeat. Stil, the number of those in favor of negotiations is .
= growing daily since people are tired of war. - . She should be sent to fight at the frontline so that she does not do this type
i of statements
. = te - do the authorities take no action against
Interesting fact: the trend was created by pro-government bloggers and > Sheeshtsto dated pennies en lal
commentators in order to discredit EE RaaePut in the end the situation .
=" became uncontrollable and everything turned out to be a clear negative .
z reaction to the government. : Opinion in the social networks now
x Main topics: lneieial Spat dor cried eri binges ey or fc
. their victims (Ukrainian ul: in both cases should be
undertaken, Russian tanguage in Ubrainian Rs snot acceptatie”
Peace talks with RF will mean Ukrainian defeat; =
GEGEMEGEEEhould not become president of Ukraine or + * ; T Anapin
Ukraine will lose territory afta (mE veoaina
The west is tired, they need ceasefire; n/a
The war is at the dead end that is why there is no other eee “In Ukraine (among Ukrainians) Russian is spoken either by
choice. s 8 the descendants of the “liberators” or their victims (Ukrainian
ary
populace subjected to Russification) .In both cases
Here are most typical; comments regarding this event: id be inate see in |
“When did any war ever made any sense...” i : Ukrainian lis is not aoceptable”
.
2 Aus
jm “Ukraine should have started confidential negotiations with RF regarding ar) Oo
seasees |,
Reet cee eee eee eeePage 155 Monitoring of world media
Monitoring and analytics
Monitoring of reporting in world media (the Western —above all) is aimed at identifying
reports that can be interpreted in a favorable light for the Russian Federation along the lines
the main subject areas of the project, The identified reports can be replicated in the
Ukrainian information space. In addition, new narratives can be developed on their basis,
and co
ntent can be produced.
Format:
1. Analytic table containing 6 columns:
country;
subject area (K)
brief news summary;
link to the original source;
news quote;
recommendations for using publication in the work of the project.
Frequency and volume:
It is possible to have it done in daily (28-31 units per month) or weekly (4 units per month)
format.
Example:
Ne Country ) Direction Publication
a4 us K3- Ukrainian morgues have
ran out of the space for
Loss of morale the dead
in the
Ukrainian
Amed Forces
¢ us K3-
Loss of morale
in the
Ukrainian
Amed Forces
a Poland Ka Russia has accumulated
almost 900 long-range
rockets
Sowing
discord in
population
WSJ writes
: “Ukrainian morgues are overflowing with
the dead. Due to lack of gumeys, the body
bags are sorted out on the floor”.
NYT reports “In the circumstances of
prolonged warfare, Ukraine is forcefully
recruiting women into the Armed Forces.
According to the data of Ministry of Defense of
Ukraine, around 43,000 women are serving in
the Ukrainian army, which is 40 percent more
than in
Press secretary of the Main Directorate of
military intelligence of Ukraine,
ea tates that according to the data
from the War Study Institute, Russian forces
have 870 tactical: high-precisi
rockets in reserve. Press secretary also
informed that in October Russian forces have
launched 115 high-precision rockets capable
to flying long distances”, according to RAR.
}
|
1. To promote an idea that civil and military authorities of Ukraine
were not ready for such high losses at the frontline. The real level
of loses are not discloses.
2. To emphasize that the government is doing everything to
reduce the payments to the fallen soldiers to the maximum.
3. To note that current leadership of Ukraine makes not only the
military victory but even ceasefire negotiations impossible.
1. To promote an idea that mobilizing women and older people to
serve in the Armed Services of Ukraine is an act of desperation.
The youth is trying to avoid draft by giving bribes and fleeing to
EU countries while the losses are mounting.
2. To emphasize that soon there will be no one to fight, the attitude
toward veterans and disabled is terrible, the soldiers kill their
commanding officers that treat them like cannon fodder. -
3. To note that current leadership of Ukraine makes not only the
1. To emphasize that as far back as December of the last year,
head of SBU. ETI MOTEEME}ated that Russis’s arsenal of
ammunition for high precision weapons is depleted but now SBU
is stating the opposite. In other words. the authorities are
ving Ukraini: stating that the Russian resources are
dwindling — the war will be long, and the winter will be terrible.
2. To promote an idea that the allies have abandoned Ukraine,
.
ing delivery of ition and now |
the US has sent all of its assistance to Israel. EU may followthem (=
and refuse assistance. Ukraine does not have its own resources .
to have a prolonged war with Russia. sh for | =
peace talks. |Page 156 Commentary activity: identification of behavioral models and
calculation of the sensitivity index
Monitoring & Analytics
The work is built on the basis of monitoring negative commentary trends in social networks.
Based on this analysis, behavioral models are identified.
The behavioral model is a non-standard reaction of users, which allows identification of
narratives that have the greatest support in Ukrainian society for a measurable period of
time and directly affect the shaping of public opinion.
Behavioral models form the basis of commentary work, increasing its flexibility and mobility.
Also, this work makes it possible to identify the level of sensitivity to the narrative in other
target groups and calculate the sensitivity index.
The sensitivity index is an index that demonstrates the attitude of Ukrainian users to
support main behavioral trends. It is calculated as a percentage of the number of comments
from Ukrainian users who reacted positively to the trend.
Product format:
Analytical report in the dashboard format, containing the calculation of the sensitivity index
of the main topics of the week in the context of the main subject areas of the project.
Accompanied by a description of the calculation methodology.
Frequency and volume: weekly (4 units per month)
Product example:
Reporting period starts 11.02.
End of reporting period 11.08.
64 Ukrainian entry into EU will not happen
| 4 Supporting exit from the conflict with losses is not treason
The number of comments of Ukrainian users that Ukrainian entry into EU will not happen is
growing. The users are more and more doubtful of emotional balance of their president, who is The users are more and more tend not to look at supporting exit from the conflict
artificially expediting the Europeanization, in hope that leading countries of European Union with losses as treason. In discussing this topic, most participants came to
will support Ukraine and will approve its membership. Part of the users looked to find a deeper conclusion that the situation has to be looked at objectively, and this is not done
Snes eanatelillccanterteedtuncetetcamcmecentc in Kyiv. More and more these discussions draw them nearer to a peaceful
forces assisted| they wanted to look good in the eyes of their voters. Now scenario and acceptance of the inevitable defeat on any conditions.
a high disapproval rating not only in his own country but he is becoming toxic to
American and European politicians. Another part of users saw in refusal of assistance signals
that are being sent to Ukraine but the current president does not want to read those signals pt
since he rejects a deleafist scenario. This is why he will be a target of American intelligence in Sensitivity index
the near future.
49,75%
Sensitivity index 78,55%Page 157 Analysis of Western think tanks
Monitoring & Analytics
A report based on the analysis of materials from Western think tanks (analytical centers) on
Ukrainian conflict. The analysis is accompanied by recommendations for adjusting influence
effort and creating content based on articles for distribution in the Ukrainian infospace.
Format:
A multi-page document that contains:
● an overview of the findings of Western think tanks focusing on the current conflict;
● identification of stakeholders in the implementation of the recommendations proposed
by these think tanks;
● assessment of the probability of implementation of certain scenarios ("sets of
recommendations");
● assessment of the possible consequences of the implementation of certain scenarios;
● their own recommendations on scenarios proposed by Western think tanks, including
recommendations for content creation.
Frequency and volume: Once biweekly (2 units per month)
10Page 158 Development of comprehensive strategic influence efforts
Monitoring and analytics
Development of comprehensive strategic influence efforts, designed to be long-term,
includes the development of operational goals and objectives, the definition of methods and
stages for achieving goals, analytical, forecast and political technology parts, content
procurement for all agents of information and psychological influence, including official
media, influencers, government and municipal institutions.
IMPORTANT! The development and implementation of an influence effort operation
requires the participation of not only all teams involved in Center S, but also a robust
interdepartmental interaction. The team of authors of this document, in addition to direct
participation in the development of the document, is ready to coordinate the interaction of all
participants in the process, monitor the effectiveness of the operation and adjust plans.
Particular attention should be paid to ensuring the secrecy of work performed.
Format:
A multi-page document, templates of narrative lines, content, instructions.
Frequency and volume: Once in 3 months (varies depending on the changing military and
political situation).
11Page 159 E) Analytical Products
Center S main dashboard
Analytics
The projects main dashboard is a document in the form of a graphically designed
"dashboard", which in a format convenient for visual perception, presents data on the results
of the work of all project teams of Center S over the past week. Drafting of a document
requires the collection, systematization and graphical processing of a large array of diverse
data. The following information may be gleaned from the dashboard:
the volume of content production for the week and distribution data;
dynamics of changes in the main indicators of sociological research;;
brief indicators of commentary work;
analysis of the degree of dissemination of key topics of the project (including at the
regional level)
e indicators of production and distribution of content within the framework of the main
subject areas of the project;
e examples of the most popular posts of the project over the past week.
Product format:
1. The document is in the form of a graphically designed "dashboard", which presents the
results of the work over the past week in a form that is convenient for visual perception. The
most convenient print format - A
2. Analytical report with the interpretation of dashboard data.
Frequency and volume: weekly (4 units per month)
1. Topic’ ‘tin 07 ag
and 472 thousand views
2. Top “The bureaucrats and draft officers are profiting during the
war" 0.4 Mousand messages and 127 thousand ews
: 1 Foreign Official 6 Bes [No (Dontknow
: -Yes -No -Don't Know
st Foreign Official 6} Yes . 70%
ae RM em om amigos | BN Dentin
ie iam bone ps rT “i,1vA rer ’ 3,x -Yes -No -Dont Know
"i 40.00% * ’ -1,00% p a 6,= 20,c0% ii ——
—
- oxo - - 5 = = = — = —— During current period Since measuring started
. = Oo oo uo “um wos sen mom 1608 oO o 108 08 2 mw m9 mi
During current period Since measuring started
> 2 mYes [No Don’t know
x Gum... x
n't know
as ‘2S ENo J Don'tkno 18,30%
: 7500% So -Yes -No -Don't Know ee v 1,909 He v -15,60%
: 50004 7 5 v : 2500% —
: 00% — on - ———— “ = - = = During current period Since measuring started
; mon ue 40 COS OMT von namo " sites Saude eae te
& B yes [No _— {j Don't know
: Yes No Don’t know
ssi a Bs Hv @
600% -sn.sne 5820S _SELO™_se.n0s SSNS 22105 at 4.0% 52.40% 53,30% Yes A 0,90% dla a 2,90%
40003 Ni y 1,90% He ¥ 8,30%
2000% ie ee el
- 0 JatTp a 105 oe Cameos aS mo a ee agra .
During current period Meeeenee enetamcrnns mo ngy eens wae
13Page 161 Content
Articles (long reads)
Content
Articles are original texts ranging from 2,000 to 5,000 characters with spaces, devoted to
topics relevant to the Ukrainian audience, which fit into the main subject areas of the
project. Each text is professionally edited and accompanied by 10 comments and 3 teasers
for disseminating the text on social networks. The author of the text also selects the image
for the text.
Format (set of files):
e text in Russian;
e text in Ukrainian;
e 10comments in Russian;
e image
Frequency and volume: daily around 70 unit per month).
Product example:
: Comments:
.
= 1. Will we survive the winter, or what? The winter frost is coming and funding for municipal services is completely *
5 gone, everything was stolen.
2. The war has to be stopped, at any price, and start working on survival. And this is also not at all simple.
of politicians. Moreover, the sanctions have seriously hit our allies themselves, and itis especially obvious, So, we will not get a damn thing from them anymore.
now when they openly state that they will just be unable to support Ukraine at the appropriate scale They =
‘simply do not have the capacity to do so, neither financial, nor military. E
| 7. The Russians are writing there about some new missiles that are one of the kind but it could be that it does At the same time. Russia. on the contrary. only continues to grow its capabilities. Representative of the Main = nae eae :
Intediigence Drectrste, SEEERCGEREEE: rice published by REK-Ukraine, informed that in October = :
®ussia was able to produce nearly 115 high precision missiles with air-range of over 250 kilometers. Itmeans | 8 And what, should we just quietly and calmly craw\ to the cemetery? For some reason, | do not see any other that at this time in the war in Ukraine the enemy has in total 870 high precision missiles, and their production = ;
continues. = option.
the new high joi iki = 20 are Kalibr [SS-N-27 Sizalerand * 9. All of this has to stop. And truly, the issue now is to survive, not to win. What kind of victory can you have?
sound 4a XX 101 missies. In addition, Russia produces around 30 new ballistic Iskander-M missiles monthly, a
as well as Iskander_K cruise missies. . 10, And mesrwhie ills <0 herding people to slaughter. For what? If everything is clear as it is. .Page 162 Posts (short reads)
Content:
Short posts for social media networks with a volume of about 1,000 characters with spaces,
dedicated to topics relevant to the Ukrainian audience, which fit into the main subject areas
of the project The texts are formatted or distribution on social media networks Facebook and
X (Twitter). Each text is professionally edited and accompanied by a video, prepared in
advance, with subtitles.
Format (set of files):
e text in Russian;
e text in Ukrainian;
e video with subtitles
Frequency and volume: daily around 200 unit per month).
Example:
Link to the picture
Russian
Seriously — how does she dare to say that about people who are fighting for our country, even if they
don't speak our language? Perhaps we should also shoot the volunteers from Poland and Colombia since
they are not that fluent in our language?
Or, perhaps, she should go to the frontline and demonstrate her heroism? It is much easier to bark at
people who are fighting far from frontline!
And in general — what is this mistreatment up to demands “to dispose”?! Is it possible in our country to
destroy people only because they are speaking “the wrong language”? Perhaps we should build
concentration camps for the “wrong people” right away? Like the Germans did 80 years ago?
Ukrainian
Seriously — how does she dare to say that about people who are fighting for our country, even if they
don’t speak our language? Perhaps we should also shoot the volunteers from Poland and Colombia since
they are not that fluent in our language?
Or, perhaps, she should go to the frontline and demonstrate her heroism? It is much easier to bark at
people who are fighting far from frontline!
And in general — what is this mistreatment up to demands “to dispose"?! Is it possible in our country to
destroy people only because they are speaking “the wrong language”? Perhaps we should build
concentration camps for the “wrong people” right away? Like the Germans did 80 years ago?
15Page 163 The meme factory
Content
Memes are humorous images, videos, audio recordings with high viral (viral) potential,
ridiculing topics relevant to Ukrainians within the framework of the main subject areas of the
project. The Meme Factory produces a stream of images for further distribution on the social
networks - Facebook and X (Twitter).
Format: Images
Frequency and volume: daily (about 200 units per month).
Examples:
~ te ele *
a Bos th af Foreign Official 12 tas
‘pebeaetlibeeties found some sort of
| a pipe. What should | do with it Congressman
16Page 164 The video memes factory
Content
Memes are humorous images, videos, audio recordings with high viral (viral) potential,
ridiculing topics relevant to Ukrainians within the framework of the main subject areas of the
project. The Meme Factory produces a stream of vertical videos for further distribution on
Facebook, Instagram and X (Twitter) social media networks.
Format: video recordings up to 30 seconds.
Frequency and volume: daily around 50 unit per month).
Screenshot from video memes:
NETFLIX MADE A FILM
ABOUT (RCI SPEECH
AT THE UNITED NATIONS
17Page 165 Cartoons
Content
Cartoons are original illustrations with high viral (viral) potential, ridiculing topics relevant to
Ukrainians, Ukrainian officials and leaders within the framework of the main subject areas of
the project. Cartoons act as both accompanying images to articles and posts, and as
independent units of content.
Format: images
Frequency and volume: daily around 200 unit per month).
Examples:
18Page 166 Video clips
Content
Videos of different formats (non-fiction) - imitation of news stories of the Ukrainian media,
video collages of the losses of the Ukrainian army, accompanied by voice-over or subtitles,
imitation of propaganda videos of the Armed Forces of Ukraine, etc.
Format: video clips
Frequency and volume: weekly (up to 8 pieces per month).
Screenshot from the video:
19Page 167 Augmented reality
Content
Augmented reality (fakes) is multi-format content aimed at misinforming the audience and
provoking emotional reactions. In most cases, it is a multifaceted product: it may include the
delivery of images (screenshots of "documents", correspondence on social media networks,
derogatory photos), texts, comments, videos, audio recordings and other content.
Format: depending on the nature of augmented reality. The most common formats are
screenshots of documents and correspondence in instant messengers, dubbed videos with
accompanying texts.
Frequency and volume: weekly (up to 4 pieces per month).
Examples:
ys
Fr : :
KHARKIV REGIONAL MILITARY ADMINISTRATION “one etek toe ott :
sa talking about... :
DIRECTIVE :
. | Viky Ostr yi
October 24, 2023 Kharkiv No. 789V = ; Who is owed 5,000? My _ @ husband serves. | did not eek
Regarding unified registry of get anything. :
Electrical generators a 1: ee te q
.
Olena Altunina ; -
Tn accordance with the laws of Ukraine on local government administration, on They are giving to | ? -
legal status of martial law, the Decree of the President of Ukraine dated Febuary parents, .
24, 2022 No. 64/2022 on declaring martial law in Ukraine, affirmed by the Law
of Ukraine dated February 24, 202 No. 2102-1X, Decree of President of Ukraine
dated February 24, 2022 No. 68/2022 on creation of military organizations:
1. To create a unified registry of mobile gasoline and diesel electrical
generators (thereafter electrical generators) by December 1, 2023 with capacity
of 2 kWt to 20 kWt that are owned by private individuals and legal entities on
territory of Kharkiv Region. Each electrical generator is to be assigned and
individual identification mmber, note the owner and the place of permanent
storage.
All Ishchuk
Could you explain
clearly? What are the
2. To notify all legal entities that are utilizmg generators, as well as the sale of thousand for??2?
electrical generators in Kharkiv region about thei duty to assign a numerical
identification and about entering each item that enters the region in the registry.
Maria L admin
You are not entitled to
anything. Payments go to
the parents. | was told in
Social Welfare not count on
anything
vé
3. The implementation of this directive has to be reported to the Director of the
Civil Defense Department, I. Sokol.
4. Iam assigning the oversight role for implementation of this directive to
myself,
Chief of Regional Military
Administration
Foreign Official 13)
20Page 168 1) Content Delivery Products
Commenting machine
Content delivery
Preparation and mass distribution of text comments and memes in discussions of the
Ukrainian segment of social media networks Facebook and X (Twitter).
Working with comments involves not only infusion of the revised narratives of the project,
supported by facts, but also working with targeted psychological attacks based on
information trends and the emotional attitude of users to them. This requires work on the
analysis of user behavior patterns (see page 8)
Format:
1) a constantly updated set of pages on social networks for writing comments;
2) the texts of the comments;
3) comments left under posts on social media networks Facebook and X (Twitter)
Frequency and volume: daily (around 100,000 comments per month)
UATOPNEWSAINS
They have not seen a defeat like this. ae what is waiting for RF representatives in
Crimea ... - Ukraine TOP
dd Like Q Comment & Share e-
Most relevant +
Yulyia Pavienko
In the eyes of European politicians we look like pauper beggars that are in need of money and
assistance. How much can you demean yourself for the sake of lining up your pockets?
However, this assistance is not reaching our soldiers but stays at the top!
21Page 169 "Sleeper" regional groups in social media networks
Content Delivery
The most popular social media networks in Ukraine are Facebook and X (Twitter) and
Telegram. The administrators of these social media networks (except Telegram) have a proUkrainian position and subject communities promoting pro-Russian narratives to strict
moderation rules. The promotion of the pro-Russian agenda in the Ukrainian segment of
social media networks is also complicated by the aggravated rejection by the majority of the
audience of any messages and statements in favor of the "aggressor country" during the
conflict.
In this regard, the proposal is to create and develop a network of communities positioning
themselves as Ukrainian regional news groups for a long term (at least 4 months).
In such a “dormant“ state, communities gain an audience with the help of targeted
advertising, seeding and organic reach. At the right moment, having "gained weight",
communities become a point of entry and a channel of information dissemination,
favorable to the Russian side and they become channels for influencing the local
audience in Ukraine.
The most famous recent example of a community working on the basis of this technology is
the anti-Russian Morning Dagestan Telegram channel, which provoked riots at the
Makhachkala airport on October 29, 2023. The network of "sleeper" communities will also
be in demand after the end of the Special Military Operation.
Product format:
1) communities in social media networks - Facebook, X (Twitter), Telegram channels.
2) daily news and entertainment publications;
3) targeted advertising of communities and advertising seeding in other groups.
Frequency and volume: daily work on filling and advertising communities. One community
in each of the three social networks in all 20 regions of Ukraine - a total of 60 communities.
The target minimum indicator of the "live" audience of at least one community in each
region in 4 months is 4,000 subscribers, the total audience is 100,000 subscribers with
subsequent growth of 10-20% per month.
Project implementation period: starting from 4 months.
22Page 170 Vzglyad na Ukrainu [Look at Ukraine] Portal
Content delivery
The proposal is to create and promote an aggregator website of news and opinions of
influencers about the Ukrainian socio-political situation. Most of the materials will contain
pessimistic forecasts, criticism of the military-political leadership of Ukraine and a
description of corruption, crime and deteriorating living standards.
90% of the portal's materials will be reprints of Ukrainian influencers and the media,
broadcasting the narratives we need. Also, 1-2 original materials (long reads) will be drafted
daily for the site. For each influencer, whose materials will be posted on the site, a separate
subsection and its personal design are to be created, thus creating the impression for the
audience that the publication was written by him/her specifically for the project.
Due to the constant mention of the names of influencers and links to their websites, blogs,
TG channels, search engine indexing mechanisms will begin to issue links to the site on the
subject of the spectrum of "problems of Ukraine" on the first pages in three months.
Product format:
1) website;
2) original materials- long reads;
3) targeted advertising and advertising seeding in social media networks.
Frequency and volume: placement on the portal of about 50 materials daily, of which 1-are original texts.
Project’s Key Performance Indicators (KPIs) in 6 months:
● more than 8,000 posted materials;
● daily audience of more than 30,000 readers;
● more than 25,000,000 views.
Project KPIs in 1 year:
● more than 20,000 posted materials;
● daily audience of more than 100,000 readers;
● more than 100,000,000 views.
Project implementation period: starting from 6 months.
23Page 171 Targeted advertising
Content delivery
Targeted advertising on the Facebook social network is aimed at delivery of messages,
tailored to the target audience of the material.
The target audience of each material is selected individually and depends on which of the
population groups this material can cause the greatest psychological damage. The target
audience can be ranked by geography, demographics, hobbies and interests, etc.
Targeted advertising on the Facebook social media network allows to track user reactions to
the disseminated material in real time, send a psychological response group to comments on
the distributed materials, which, with the help of a network of bots, moderates top discussions,
and adjusts further launches based on which audience group suffered the greatest damage.
Also, based on the analysis of advertising launches, it is possible to draft reaction maps by
analyzing user comments, their ranking and topics that caused them the greatest emotional
response. This makes it possible to draft flexible maps of reactions, the basis for which are
general main subject areas and an ever-changing agenda within the framework of their
semantic content.
Product format:
1) posts, images, infographics,
2) advertising releases of the Facebook social media network.
Frequency and volume: daily. 1,000,000 releases per month (ERR - 10%).
24Page 172 The Telegram channels network
Content delivery
To increase influence on the domestic political agenda of Ukraine, the creation of the
network of Telegram channels is proposed, in conjunction with Twitter and
Facebook/Instagram presence with the most localized content and ideology that are not
affiliated with Russian performers and Russian-language content. The use of Telegram
channels specifically as the engine of the project is due to the fact that over the past year,
the Ukrainian Telegram audience has grown by 600%. At the same time, it should be
remembered that the enemy segment of local popular channels did not start with political
topics, but with entertainment, 5 years ago the share of political channels in Ukraine was
negligible. And the similar leap forward can be replicated, but in our favor.
The proposal is to create a network of 20 thematic target channels and 10 auxiliary channels
necessary to promote and maintain the pace of recruitment of the project's audience. This
approach will allow to quickly develop the number of subscribers to noticeable volume due to
cross-reposts and the creation of a versatile core of the audience. Also, this approach will
allow to quickly adapt the project to the constantly changing agenda by adding new channels
with relevant topics and quickly recruiting their audience by supporting the entire network.
In the preparation of loading the content of channels, especially initially (one or two
months), it is necessary to completely get away from propaganda, both nationalist Ukrainian
and pro-Russian, to forego clichés and to influence the opinion utilizing the sequence in
which information is presented. To quickly engage in trends on Twitter, it will be necessary
to quickly create posts with popular topics through hashtags, an individual narrative style
and interaction with influencers.
Product format:
1) 20 thematic target and 10 auxiliary channels in Telegram;
2) duplicate communities on social media networks - X (Twitter) and Facebook;
3) from 2 to 4 publications in each channel daily;
4) targeted advertising and seeding.
Frequency and volume: daily up to 4 publications in each channel.
Project’s KPI: The forecast of the total growth of the project's audience is 20,000 subscribers
per month.
25Page 173 Comments - delivery to regions
Content delivery
Based on the analysis of commentary trends in the regional communities of Ukraine, the
proposal is to organize the targeted distribution of the creative content of the Delivery to the
Regions project in the comments to posts in regional communities and in blogs of regional
influencers.
● For each region, a media map is created, consisting of 50 communities that reliably
have an audience tied to a specific area: particular city public forums, personal
pages of the regional leadership, forums of interest, such as sports, cars, hobbies,
etc.
● For each creative content, a lead-in commentary is developed, which has
characteristics specific to this particular region. This approach will increase the
credibility of the creative content and increase the level of audience engagement.
● Creative content, along with a lead-in comment, are distributed in comments to posts
in the community using a network of bot accounts.
Product format:
1) comments in the regional communities of Ukraine;
2) images, memes, and other creative content
Frequency and volume: 50,000 comments in 20 regions of Ukraine per month.
Project KPIs: coverage of 10,000,000 encounters per month, ERR — 4%.
26Page 174 EXHIBIT 6BPage 175 LleHtp C. KomnnekcHoe oGecneyeHie UVH*POpMaLiMOHHO-
NONMUTUYeECKOrO BO3AeNCTBMA
OMIMIGCAHNG .... ae ensncseeceeesneesneceeecessnneauscnsseeesaeaunaneeenaseenssnaaeneeeesceesseanneaneseesenenseneseensaneaupennscantas 1. MOHUTOPHHFOBbIe MPOAYKTDI «...-..cccscecnseeeesseesecseneercesenecansogennunansaesuseusesseeensresensenennies Telegram-KaHan “Y — MYSIbC” oo ..cccsssecssesesseeeeensesaeeseeseeeeneeeccuneseeanccussesuansenacuaneesesensseusneess MOHUTOpPUHT SIOM ...... cee ceeceeeceeseeeeneanecnseneeeneaeeeeedeaenetevesseeesaneaeeaeeessanesaseneasesesegeaasenaeeaenas 2. MOHVTOPMHFOBO-aHANMTHYCCKHE MPOPYKTDI......cccceeccseneceeeeeensceneccususnneeesesseavsausseaeenses O630p MHcbopmauMoHHoro NonwA — DawGopaA “TNOGYC YKPAVHbI” ...... sees cesesseseeesteenenes BbinBneHne TpeHgOB B COLIMAMbHbIX CeTAX YkKpanHbI Ha OCHOBE aHann3a
KOMMEHTA@PMEB MOPFIbSOBATEMICN .......sccceesesceeeceeeneneseneeseeeaeeeesenanecaesenteneseeenseeaasensensensessenes MOHMTOPMHT MUPOBBIX CMM........cccccccseecesseeeeeeeesenseeeesseceeesseacensteseeeseneoneenssceteauesnanseseren KomMMeHTapnitHan paborTa: BbinBneHne NoBeAeHYecknx Mogenien M pacueT HHAeKca
UYBCTBUTCSIBHOCTH....ccsecsseecscsesesecseeessenensausensnnneeecasscaecesesaeasesseaeesseseescusccaussessenenennsniseres AH@SIN3 3AMADHBIX THINK tank... cecenseeesenneeceeeeeeeeeebaseeaeaeeeeneneaeaeeemesesecsenseaeeesensaencennones Paspa6oTka KOMMNEKCHbIX CTpaTernyeckux MH*POpMaL|MOHHO-NCUXONOrMmMyecknx
OMECPAUN 0. eceeeeseeeeeteeeeeceueeesaneesececeaeeees ease eee saceesenseaceesesusaeeeessassnensduasensocsnaeaousensneesses 3. AHA@TIVTAYOCKNE MPOAYKT DI ...1.2...s0ccnceessseeneeeceseasnnns sense sn senaeeneonensecaseusuersuceneamonseoesemsans TeHePanibHbinh DAWGOPA LICHTPA C ou... ccseneeecseneceeeeeeseeteseeeeeneeseesueeseeueseneasesseeesnnesaas FIALIBOPA MO COLMONOLM ........:cccccessccecescsneeecenceescecanceeeeceueeeaneaeeeeeteetaaaeaesenasesaaeaneqasaas 4, KOHTCHT....ccsccceccseseeeesenneesesseeeeennsessenenscnaeesenseeenesuceneansnsenaeusunasenuscuceneranmaausnuaneeesenseee
CTATbM (MIOHITPUAIb!) 0.2... cceeceeceeeseeeteseeeensenesnecaaeenenscaeeasencnarenecceeeesecsseausssaaeesaneoesesseasenss TIOCTb! (LUOPTPVADb!) ........ccecceeeeeseneeeseeeseeeceseneeeesessauaseeeceseatessceesaessaguessuseseususassarssusenteas PAOPUKA MEMOB o.oo. ceecseesessctecenseneesceseeseecesnpeenneeae seen tensa seaeteeanaecaeeaeenensasenseesenevsenaenaiees DaGPUKA BUDEOMEMOB ..........0:ccceccccsesceseneeeccneseeeesseneeeeeeccaeeesseeseeeeseeseeneeaeneeecneneaneneaanas KEPUKATYDPDI.........ccccecsesessenserscacccececssesessusssaeedeccucarseauenaeceseausaeaneaacenenaasesseseeseresaaesenen
BUDGCOPOMWVEN ......ccececsesencecssesnneaneaeeccesssessseaeneuacasanseasanacsuedaesaseeeaeumeaaeaenanenaneeeatesennneennyags FIOMONHEHHAA PCAMBHOCTD ou .csscccecseeteetecseeneeeeeeeenusesecaneusaduessnsensesccneueapeneeeasenstansenenaneenas 5. TMIpOAyKTb! DOCTABKU KOHTCHTA.......:cccceceeeeceeeeeesennenneneeseeeesqnnnecmereavaneaunaneusanensuenuneensees KOMMEHT@PUAHAA MALUNH..............ccccccccceseeceeeeteeeeeeneneeneeeedeeeeeeaeaseeaeesassceaautaetassausnanseasy “CALNE” PErMOHaNbHbIe [PYMMbI B COLWMASIDHBIX COTAX ..ccceseccecesssteeeteessestnenoesanensesnes TlopTan “Barnag HA YKPAUHY”..... cece ceececesseeeeescneneesessessecnsenneceseesersesssessuassesseeensaaeeeeed T€ApreTUPOBAHH@A POKMAMA ...........ccccceceseceeecseccecceeceeeeeeeeeneeaneaaeetreseeseuuaesasesasesenuaereces CeTb TElCQraM-KAHASIOB ........cseccsscccececesecsssesersrsnesseeesessssuessaanecensaaeeaensaneeeseonnenstananereas
KOMMEHT@PMN — FOCTABKA B PEMMOHBI .......ccccceesecseessececsersuesecsensseuarenesssceneeseseneenneananens 26Page 176 Onucanne
Mpoext KomnneKcHoro O6ecne4eHuA VHCPOPpMaLMOHHO-NONUTMYECKOrO BO3AeMCTBUA Ha
OOLWECTBEHHOe MHeHve HaceneHua YKpauHb! B 2024 rogy BKnioYaeT B Cea paboTy no
4YETbIPEM OCHOBHbIM HanpaBneHiaM:
Liens:
MOHMTOPUHT,
aHanuTuka;
NpOU3SBOACTBO KOHTEHTa,
HOcTaBKa KOHTEHTA.
cbopmupopaHve Ha YkpavHe OOWeCTBeHHOrO MHeHMA, ONaronpwsATHOrO ANA
AOcTwKeHuA Yenen n saga CBO, a TawKe AanbHenwero mexKkrocyfapcTBeHHOrO
Bsaumogelcteun Poccun “ YkpavHbl.
3anaunu:
Pa3HOCTOPOHHM MW HENpepbiBHbIi MOHVTOPHHT MHCPOpMaLiMOHHOrO NonwA YKpauHbl;
avanuTuyeckoe oGecneyeHne paboTbi NMpOeKTHbIX KOMaHO, paboTaouux Cc
yKPauHCcKon ayauTopuen;
CBO@BpeMeHHOe pacnosHaBaHve uM KyNUpOBaHve AHTMPOCCMACKUX HAappaTMBOB,
cbopmupyembiIxX B YyKPAaVHCKOM KOHType, ynpexgeHve MHCOpMal|MOHHO-
nonuTM4ecKux OnepaLl|Mi NpoTMBHUKa;
paspa6boTka WU peanv3alyvA KOMNMNEKCHBIX VHCOPMALIMOHHO-NONUTMYECKUX
onepaunn;
oGecneyeHve HenpepbiBHoro npov3sBogcTsa aKTyambHoro §pasHocbopmaTHoroO
KOHT@HTA;
QOcTaBKa KOHTCHTa OO fpakaaH Ykpanubl C ACNONb30BaHKMeM Pa3sNMyHbIxX KaHaNnoB
KOMMYHHMKalMn,
KOHTPOsIb KONMYECTBEHHBIX V KAYECTBEHHbIX NOKaZaTeNei MOCTABKM KOHTeHTA, COOP
MW aHanns peakuun ayguTopun.
TeHepanbubie TemaTMueckve NUHMH:Page 177 K1 — quckpeauTayna BOeHHO-nonmTHYeCKoro pyKOBO;CTEAa;
K2 — packon smut;
K3 — nemopanusauna BCY;
K4 — ne3s0praHv3aunA Haceneuna.Page 178 EN) Monutopunrosbie npogyktt
Telegram-kanan “Y — nynbc”
Moxumopune
SakpbiTbIM KaHan B Telegram c NOTOKOM HOBOCTeM no TeMaTMYeCKUM NVHVAM npoekta,
pa6oralowunii exkeQHeEBHO B pexkume peanbHoro Bpemeuy. KaHan akkymynupyeT HOBOCTHYIO
MOBeECTKy U3 TPeX MHCPOPMALMOHHbIX KOHTYPOB: yKpaMHCKOrO, MeKgyHAapOgHOrO
(MpevMyLWeCTBeHHO — 3ananHoro) uv poccuiickoro. VcTOuHVKAaMM HOBOCTei ABNAIOTCA CMU,
COLMANbHbIE CeTM, BbICKasbIBAaHvA JIOM. Kaan no3sBonseT OTCN@KMBaTb akTyanbHylo
nOBeCcTKy v3 eAMHoro onepaTuBHoro UCTOUHNKa.
Popma+:
SakpbITbIN KaHan B Telegram c KOpoTKuMN COObWweHMAMnH. Kaxkgoe CcoobeHie copep Kut:
® KpaTKOe U3NOKEHME CYTM HOBOCTH;
® CCbINKy Ha NEPBOMUCTOYHHK;
e® X9eLUTEM HaBnraynn,
Nepuoguynocts:
Eke qHeBHO (go 40 coo6uweHni B eHub)
Mpumep:
— WAC
7 FOpeCnOH@enT net: B KMebe UAHOBHME rocyaapcIReHHOA
+ Ueraop.HET: Bcrpeua npeactaewrened npaeyrenbcrea Nonbuue z
+ NpeactasvTeneA nonbckmx nepesosumkos, NepexpLiELux rpannuy :
: C¥kpavuod ann Topapogenmenua, aaxonunnach bea
+ AOrOBOpeHHocrea,
Telegram
Wensop.HET| Hopunu Ykpainw ra cairy, siftua Ta mientras
ea ¥ Nonbuyl nep ypray a ry .
KOPASH 3 Yepaitiovo, zaklHunnacr Sea gowoBneHocti
» Otrymay-ehalhar-u-stakani dlia-havy
1 TaMOXKEHHOM CayxGe! NOnaNcA Ha B3ATKE B 2000 gomnapos -
; CPeacTaa CNpATaNM B CTakaHe Air Kode.
itps:/t.mne/okoo_ukeaine/
Mita BPOON rapes Baer OO ree SOY TNE io reer 79, 30%
7, eee 1 ‘on ‘ 1EKN
SO ioe Her ¥ “1 ot * ' 5.tte . 1s ° Tom.
a - = 3a a c
nee
™ ‘Ma on ra am = an an em aa = = = cn
=
3 KOBOACTBO Aer f 4 LUWHCT
al fa B Her () Sarpyanmoce
=fu ite Mareeniees ctetrats
ory ai
eases 30907 gag Sedo S827 er se
00 SSS 2240 53,308 a a 090% Da a 290%
13Page 188 EY Kontent
CTaTbuv (noHrpugabi)
KoHmeum
CtaTbv — aBTopckue TeKcTb! o6bemom ot 2000 go 5000 3HaKoB c npoGenamy,
NOCBALWEHHbIE AKTYANbHbIM ANA yYKPaWHCKOM ayguTOopun TemMaM, yKnagbIBalOWMMCA B
TemaTuyeckve NuHMu Npoekta. Kaabii TeKCT NpOXOAMT NpocbeccuoHanbHylo pegakTypy vconposoxgaetca 10 KOMMeHTapvaMN 4 3 Tu3epamMU ANA pacnpocTpaHeHusA TekcTa B
COl|ManbHbIx CeTAX. ABTOp TeKCTa Takoxe nogmG6upaeT u3z0OparKeHne K TeKCTY.
®opmat (Ha6op cbainoe):
TEKCT Ha PYCCKOM AS3bIKe;
TEKCT Ha YKPANHCKOM ASbIKe;
10 KoMMeHTapveB Ha pyccKom A3bIKe;
vuz00paKeHve.
Nepnognynocte uv o6bem: exkegHeBHo (oKono 70 WT. B MecAL)).
Npumep nposykta:
Crpana wean THN KOHTeHTa
KomMmentapyn:
1. Symy-To nepexngemo, 44 Ax? Mopoan Ha Hod, a & OKKT j Wb He BaNABCR, pce
poaxpageHo
2 Tpefia npMnvHATH BIfHy, 3a BCAKY UlHy | JaanATKCA BHoKBaKOM Wo Tex gyee
Henpocto,
|. ¥ crpex 20 01 rpm 2023 poxy creOpHTH CAMNTKA pererp sodinaniey
Gemrntronms 7 AOKANIN enesTpores (saat ~ eaestporemeparopH)
foty=vicne sia 2 air ao 20 Kt, sci 1 yenOT. Y eta) Giunoo Ta
FOpmmIMtEY OciG Ma tepuropi! Napkincawn udaucti, Kowcwoary TeRtTponcvepanopy
paceoirw een HOMEPHNA iAH IpiEKTUP, MERaTH AAaCHVERS ra adCuR
Anna liuy«
NoncHiTb HOpManbHO Komy
_ WO AatoTb. 3a Wo 5 Tuc
m Hanexuth????77?
ho RACMITRCE Ita TepuTopie fami.
4 Bienes pewopaasenis
hrc wxnety 1, Comma. eM Ancapramemy
To6i Hi4oro He HaNeuTb.
Bunnatu Apytb 6GaTbKam
yonosika. Meni y
COusaxuMcTi CKasann Hi Ha
LUO He pospaxoBysaTny
“@
4. Kinerpent 12 tomonantion posnupacaciyed Tamas ta
20Page 195 Ea NpogyKtpt AOCTaBKM KOHTeCHTa
KoMMeHTapuiHad Malwa
Zlocmaexa koHmMmeHmMa
Nogrotoska WU MaccCOBoe PacnpocTpaHeHMe TEKCTOBLIX KOMMC@HTAPHeB KH MEMOB B
O6cy»KOeHUAX YKPaNHCKOFO CermMeHTa COLMaNbHbIX CeTei Facebook u X (Twitter).
Pa6ota c KOMMeHTapvaMn NpeAnonaraeT He TONbKO BOpoc nepepaSoTaHHbiIx HappaTMBOB
npoekta, NOAKpenneHHbIx dbakTamu, HO HW paboTy c TOYeYHbIMM NCMXONOrMueckiMu
aTakaMA Ha OCHOBe MH@OpPMaLMOHHbIX TPeHOOB VW SMOLIMOHAMbHOTO OTHOLWEHMA
nonbsopatenen K HMM. [nA sTOorO HeOoOxogumMa paboTa no aHannv3sy noBegeHYeCcKnx
mogenen nonb3oBaTenen (cm. cTp. 8).
®Mopmar:
1) MNOCTOAHHO O6HOBNAeMbIN HaGoOp cTpaHvW, B COL|MaNbHbIX CeTAX nA HanvucaHnA
KOMMeHTapueB;
2) T@KCTbI KOMMe@HTapnues;
3) KOMMeHTapui, OCTaBNAembie MOA NocTamMy B COLMaNbHbIX ceTAx Facebook u X (Twitter).
Nepwoguyuvoctb nw o6tbem: exkenHeBHO, oKono 100 000 KomMmeHTapveB B MECAL.
Inter-ethnic conflicts
Ukrainian refugees are constantly
expressing dissatisfaction with the
hosting arrangements in the country
and demanding more. Humiliating
texts (real and fake) written on
behalf of Ukrainian refugees are
being circulated on the internet. The
Germans enter into heated
discussions with the Ukrainians in
the comments, actively recalling
each other's past.
Multilateral conflict between Ukrainian refugees
and Armenian diaspora in France. The conflict
is provoked by fake "interviews” and “leaks” of
audio messages from private chats of Ukrainian
refugees in France, who rudely accuse the
Armenians of supporting Russia. Armenian-
language outlets react, the confrontation is
supported by "stirring up” the discussion by
bots in the comments.
Religious conflicts
A group of refugees from Ukraine,
neo-Nazis wearing balaclavas
holding knives and machine guns,
recorded a message to the
Germans. It accuses them of their
weakness and says that it will help
clear the Aryan land of the Muslims
and other garbage. The video is
distributed on the German-language
segment of Twitter and Facebook.
The French government has come under attack
from a number of Muslim religious activists.
They speak on behalf of immigrants from
Algeria and other African countries.
Accusations: rudely refused
to apologize to Algeria for colonial policy.
Instead of atonement for the sins of the past
and showing support for diasporas, the French
are sending funds to support the war in Ukraine
and accept refugees. In response, "the
Ukrainians"-bots massively insult Muslims.
Internal political
conflicts
After the staging of the "coup
d'état", the German government
essentially switched to a quiet
repression of the AfD. Using all
tools, we support the party by
creating the image of martyrs
suffering for democracy and
Germany’s national interests.
Almost 70% of French residents who were
surveyed oppose raising the retirement age
initiated by SeeTKSL Teen, We identify all
criticizing publications related to the reform and
provide them with additional traffic. Also, a
number of analytical posts on mirror media
outlets link raising the retirement age with the
crisis caused by anti-Russian sanctions.
International conflicts
Poland continues to demand
reparations from Germany for World
War Ii. Using all the tools, we
promote the theory that the Poles
are acting on the direct orders of the
United States in order to once again
humiliate Germany and tie her
hands on the international arena.
An article comes out in the Armenian-language
press accusing France of helping Ukraine
instead of helping Armenia that suffers. The
article gets into the French-speaking segment,
we provoke and stir up the public discussion in
every possible way.Page 207 Economic/
socio-economic
conflicts
There are clashes between eco-
activists, who blocked access to the
village of Lutzerath amid protests
against coal mining, and the police.
We promote the narrative in the
media mirror outlets’ comments and
articles sections that a return to coal
mining is the result of refusing to
buy Russian gas.
In the north of France, doctors go on a strike.
They demand higher salaries and hiring more
staff. We create a closed channel for doctors
who are fighting for their rights and carefully
promote the narrative that the crisis in medical
field is caused by anti-Russian sanctions.
Similar groups can be created for different
regions of the country.Page 208 EXHIBIT 7BPage 209 MexkayHaponHaar KOHdNuKTonorma
Ipoexm
KpaTKoe onvucaHne
Boespie QevctBna Ha YKpante Vv “BoMHa CaHKuMn” NpuBenn K Kpv3vcy B SKOHOMUKe MHOrMx
CTpaHax Sanayja, OCHOBHOU yap npulwenca Ha KUTeENenW EBponencKux CTpaH — [epmaHnu,
MpaHunny, Utanuu, Benuxo6putanun.
Nagexnne YPOBHA XKU3HM, HOBbIE BOSIHbI 6e.KeHUeB, POCT LIEH Ha SHEPrOHOCNTeNn vw OpyrmMe
Aectabunv3upyiouwme cdakropbi oboctpynu aecATKA “3acTapenbIx” BHYTPeHHUX
KOHcpnuKToB 3anaza, a TawKe co3gqanu HoBbIe Npoonembi.
Cpegn Hux: yCUNeHve MeXSITHUYECKOU MW PeNVrMO3HOM HaANpAXKeHHOCTH, ycuneHve
COLMaNbHO-SKOHOMMYECKOrO §=npoTecta, BHyTpu“nonuTMYecKoN Gopbbpi, yrnyOnenne
NPOTMBOPeYU MeXxAY COIO3HVKAMM MO SKOHOMUYECKMM V BOCHHO-NONMTMYeCKUM GnoKaM
ns as
eBpoGiopoxpatuen, npoTuBoctosHve YneHoB HATO Monmbuwu vu Tepmaxuu no Bonpocam
penapaunn uv ap.).
3agaya npoexta “MexgyHapogHan koHdpnukTONorMA” — asckanalvA BHYyTpeHHen
Hanps»xKeHHOCTH Ha TeppviTOpMN CTpaH-colo3sHukoB CLUA B enax npoABWrKeHNA MHTeEpecoB
Poccuickon Penepaluu Ha MeKDYHApOAHON apere.
fina Bo3sgeicTBMA Ha PpeanbHO CYLIECTBYIOLW\Me KOHNMKTbI MW UCKYCCTBEHHOrO
(OPMMPOBaHVA KOHCNUKTHbIX CUTYAUM NpeANaraeTcA UCNONb3OBaTb WMPOKMM CcneKTp
WH@OPMaLIMOHHbIX VHCTPYMEHTOB BOSLeVCTBMA Ha OGLUECTBEHHOe MHEHHe.
Teorpacbus npoexta
— Tepmauna;
—Opauuna.Page 210 AnroputMm pa6orTbi c peanbHbIMv KOHCPNUKTaMNM
1.
EKeQHeEBHBIN MOHMTOpUHT CMV v couManbHblx ceTei, HanpaBneHHbiii Ha
BbIABNEHMe KOHCDNMKTHbIX CUTYAaLUH.
BpissneHue ouaroB KOHCPNUKTOB C fanbHeVWeM CUCTeMaTM3MpOBaHHbIM
OTCNEKNBAHVeEM QUHAaMUKM PasBUTMA KOHCDNMKTHOU CuTyauMn.
OnepatuBHbli avanu3 KOHCNUKTHON cuTyauuUn:
— BbIABNEHNA KOH@NUKTOFeHHOrO ChakTOpa, CTOPOH KOHNMKTAa, NuDepoB MHeHU,
no3vuvni v TpeGoBaHMn CTOPOH;
— onpegeneHne Buga KOHdpnuKTa (COuManbHbIN, SKOHOMMYECKMK, NONUTMYeCKU,
STHMYECKM, PENMMO3HbIN, CMELUA@HHbIM VM T.Z.);
— onpegeneHve macuita6a KOHCcpnukTa uM CTaguu sckanaunnu (NoKaNnbHbIn ypOBeHb,
PerMoOHaNbHbI YPOBEHb, OOLEHAL|IMOHANbHbIN YPOBEHb, Me>*KOYHAPOAHbIi
YPOBeHb);
MporHo3smpoBaHve AanbHeiwero xofa pasBUTMA KOHCDNMKTHOK cuTyayun.
Onpefeneuve noTeHumana ucnonb30BaHua KOHCpnuKTa ANA peanusaunn
BHeEWHENONMTMYeCKMXx 3agay Poccun. U3s6panue crpatermn fanbHevwen paboTrl.
B cnyyae Heo6xoMUMocTH NpoUsBOAMTCA ViCKYCCTBEHHOe CMELIEHMe PUTOPUKU
KOHCNUKTa C LeNbiO AanbHevwwWero BHEAPeEHMA HappaTUBOB, BbITODHbIX Poccun
(ecnv npuuuHa W puTopuka KOHCpNMKTa USHA4aNbHO He yKnagbIBaeTCA HV B OfHy vHEOGXOAMMbIX HAPpaTVBHbIX NUH).
OcKanalvA KOHCNUKTHOM CuTyalivn Yepe3 npPuMeHeHMe AOCTyNHOro
UHCTpyMeHTapua (nepeHanpaBneHnue Tpaduka, pabota c KOMMeHTapuaMy, paboTa
c OMamny, akanutuyeckne cTaTbu, GONONHeEHHaA peanbHocTb, CMM-3epkana,
cbeviku v T..) B UeNAX gectabunusaynn O6ujecTBeEHHOM O6cTAaHOBKNH.
NMpogswxKeHve BbIrOgHbIX ANA Poccuu HappaTMBHbIX NMHMN, VH*OpMaL|MOHHaA
NOAAepxka TOU CTOPOHbI KOHdNuKTA, YbA NOBMYMA GONee COOTBETCTBYET
vHTepecam P®.Page 211 AnropuTM WCKyCCTBeHHOM reHepalMn KOHCPNMKTOB
1.
Moumtopuer 4 avannu3 CMV, couvanbHbix CeTei, pesyNbTaTOB COL|MONOrMUY4eCKUX
vuccnegoBaHui Ha NpegMeT onpeseneHua “GoneBbix TOYeK” MW O4arOB NOBbILUCHHOM
COLMaNbHON M NONMTMYeCKONM HanpAyKeHHOCTH.
Paspa6oTka “cljeHapuAn” KOHCDNUKTHOK CuTyalMnv, HappaTMBHbIX NUHM, CTpaTerun
“BOpoca” v fanbHevwero “pasxKuraHun” KOHCpNMKTa AOCTYNHBIMM CpeACcTBaMmy,
HevTpanusaumn KOHTpNponaraHAbl.
NMogrotoBka KOHTeHTa (BUGeOponukoB, NOcToB, KOMMeHTapues, CTaTeii-
pa3so6nayeHun «OONONHAHOLWIMX PeaNnbHOCTb», AHANUTMYECKUX MATEPNANOB U T.f.).
BHegpeHve KOHdnuKTOreHHOrO MaTepuana Yepe3 3apaHee OnpefeneHHbie KaHaNnbl
(ToYe4HOe MNM MaccupoBaHHoe).
ManbHeiwee “nogorpeBaHue” KoHdnukta vu BOpOcoB AONONHMTeNbHbIX
MaTepuanos.
MpotuBofeiictaue KoHTpnponaranze.
aHanus pesynbTaTOB pasBUTUA KOHONUKTa ANA FanbHeMWwero ucnonb3soBaHuA:
— CTeneHb pacnpocTpaHeHMA UH*opmaunun, BAPYCHbIN achbcbextT;
— 9@*eKTUBHOCTb KaHanoB pacnpocTpaHeHns;
— KOMUYECTBO NPOCMOTpOB/BOBNeYeHHOCTL;
— peakuUA ayQuTOpUN COLMaNbHbIx CeTen;
— peakuna JIOMos, ocbvynanbHbix Bnactei, CMM;
— M€TOAbI KOHTpnponaraHabl uv ux schcbeKTUBHOCTE;
— BDEMA “KU3HU" ACKYCCTBEHHO CreHepuMpOBaHHOrO KOHNUKTa OT MOMeHTAa
“BOpoca” v 40 OKOHYAaTeNbHOrO yxof#a M3 NOBECTKM.Page 212 UvctpymMeHTbI
1. KpeatmBsi:
1) cbenkosbie Bugeo, HOKyMeHTbI, 3anucu TeNnecbOHHbIX pasroBopos;
2) KOMMeHTapMI B COLICeETAX;
3) HOBOCTM MW NCEBAOHOBOCTHbIe MaTepvanbi;
4) aHanutTuyeckve MaTepuvanbi;
5) MeMbI, KapuKaTypbi, gif;
6) MaTepvanbi “ononHeHHOK peanbHocTu”;
7) cbenKosble uv peanbHble UuTaTbl JIOMos;
8) necHu, MyNbTcbMnbMbI, aHuMAaLINA;
9) co3qaHve YaToB/rpynn ana akkymynupoBaHna yYacTHUKOB KOHCDNUKTA HM T.Q.
2. KaHasbi QOocTaBKH:
1) CMU-3epxana;
2) wHoctpaHHbie 4 Poccniickne JIOMbI;
3) 6oTbI uv paGoTa c KOMMeHTapuaMn;
4) rpynnbi B COWManbHbIX CeTAX, Tenerpam-KaHanbl;
5) YouTube uv Apyrve BugeoxoctnHrn vu T.A.
NMpumepsi HappaTMBHEix Nunn
TH-1. Hawa ctpava gomkHa npecnegoBaTb co6cTBeHHbIe HAL|MOHANbHbIe UHTepecbi Vv
NPWHKMAMAaTb PeLUeCHMA HE3aBucMMo OT BnuAHMA CLUA/HAT O/Espocoto3a/AHrnocakcos.
TH-2. KopeHb KOHqnuKktTa Kpoetca Bo BnvusHun CLUA/HATO/Espocoto3a/Aurnocakcos —
MM@HHO STMM CunaM BbIrogHa gecTabunvzayvA B HalwemM OOwecTBe ANA ycuneHuaA
KOHTpona.
TN-3. Mpasutenbcrso Hawen CTpaHb! FOMKHO COCPEAOTOYMTbCA Ha PELWEHUN BHYTPEHHUX
npoOnem, a He Hanpasnarb pecypcb! Ha noAgepxKKy BOMHbI Ha YKpante.
TH-4. B Poccww AadHbii KOHCcbnuKT 6GbIN GbI HEBO3MO>KeH, NOTOMY YTO Tam 3g0poBoe
OOLJECTBO, B KOTOPOM 3@L\MLECHbI WHTeEpeCbl CeMbM WM TPaQWMLMOHHbIe LIEHHOCTM
(HappaTMBHaA NWHMA ANA KOH@NMKTOB Ha Nowe NpogABMKeHMA NoBecTKM JITBTK+),Page 213 TN-5. Hac o6begatoT, 3a6vpatoT nocnegHue pecypcbi. YKpaMHub! (GexKeHLbI) MpyIOT,
Haw niogn yKe NoYTM ronogatoT. Cnop Avacnop 3a pecypcbi ugeT 3a CHET KOPeHHbIX
KUTENeM CTpaHbl.
Npumepsi cueHapves
Tepmanna @panuna
MexaTHMyeckue YepauHckve 6eKeHLUb! NOCTOAHHO MuHorocTopoHHuid KOHDNUKT MexKay
KOHEPNMKTEI BbICKa3bIBalOT HEAOBONLCTBO ykpavHCkMMy GexxeHLaMv MW aPMAHCKON
yCNOBMAMM pa3sMelWeHMA B CTpaHe
v TpebyioT Gonbwero. B uHTepHeTe
PaCNpPOcTpaHaAloTcA YHM3aMTeNbHbIe
TekcTb! (peanbHble mv cbeKosble),
HanvcaHHble oT Nuuya YkpavHcKMx
6GexeHyes. HeMubi BCTyNaloT B
KOMMeHTapnax B OaTanun Cc
ykpavHljaMi, akTMBHO npvnomMMHaA
AMacnopow Bo MpaHynn, Koncpnukr
NPOBOL|MpyIOT cbeviKoBble “MHTepBbIO"
“CNMBbI" ayQMOcOOBLUeHM M3 3aKPbITbIX YaTOB
YKpanHcKux GexeHyes BO PpaHuMu, KOTOpPbIe B
rpy6om o6BiHatoT ApmaH B noggepxKe
Poccun. APMAHOASbINHbIe pecypchl pearupyioT,
NPOTMBOCTOAHMe NoAAepxKuBaeTCA
“nogorpeBaHvem” anckyccunu GoTamu B
Apyry apyry npownoe. KOMMeHTapiAx
PenurmosHbie Tpynnbi GexeHuUeB c yKpavHbi— paHuy3ckoe npaBuTenbcTBo nog”Bepraertca
KOHCPNUKTbI HeOHaLMcToe B GanaknaBax, c HanagkaM OT pafa MyCynbMaHcKMXx
HOXKAMY VM ABTOMATAMM 3anucana
oG6paweune kK HeMuaM, O6BMHAeT UX
B cna6ocTH Mm roBopmT, 4TO
NOMOXKET OYMCTHTb apMicKkyto
3eMNI0 OT MyCyNbMaH M NpoYero
mycopa. Bugeo pacxogutca no
HEMELKOASbINHOMY CeErMeHTy
TeutTepa nv Deiicbyxa.
PeNnvrvo3sHbIx AKTUBUCTOB. OHM TOBOpAT OT
VMeHH NepeceneHues us ArpKupa 4 apyrux
cTpav Acbpuikn. O6BnHeHMA — rpy6o
OTKa3aNCA M3BMHATBCA Nepeg AmKMpoM 3a
KONOHManbHyo NonutuKy. BMecto uckynneHni
rpeXxoB Npowsoro wv noAWepxkU AMacnop,
@paHuy3b! HanpaBnAlwT cpeactBa Ha
nogepxky BOMHb! Ha YKpautHe v npvem
6exeHues. B oTBeT GoTbI-"yKpawHLbl” MaccoBO
ockop6nsloT MycynbMaH.
Buytpwnonutmueckne Nocne vHcueHMpoBKM
KOH@PNMKTI “TocyfapcTBeHHOrO nepesopota”™
npasvTenbcTBo [epmanmn no cyt
nepewno K TAXMM penpeccvam
npotue AfD. C nomowbio Bcex
MVHCTPYMEHTOB MbI NOOQACPKMBAaAeM
napTu, copmupya o6paMYYeHMKOB, CTpaqalouunx 3a
AeCMOKpaTHlO MW HAL|MOHanbHble
wHTepecb! FepmaHuu.
Noutu 70% onpoweHHbIx xuTenen PpaHunn
BbICTyNaeT NPOTMB NOBbILWeH
BO3paCcTa, MHAWMMPOBaHHOTO
Mol
BbIABNAeM BCe KPUTMYeCKUe Ny6nuKaUUH,
CBAZaHHbIe c pedopmon uM obecneunsaem UM
AONONHMTeNbHbIA Tpaduk. Momumo atoro, pag
aHanuTMyeckux MaTepvanos Ha CMM-
3epKanax CBA3bIBaAeT NOBbILUEHMe NEHCMOHHOTO
BO3pacTa C KPM3KCOM, BbISBaHHbIM
AHTMPOCCMUCKMMM CAHKUMAMM.
MexayHapogHbie Nonbua npopomkaeT TpeboBaTb OT
KOH@DNMKTBI Tepmanun penapauuu 3a Bropyro
MMpoBylo Bony. Acnonb3ys Bce
VHCTPyMeHTbI, MbI NpoaBHraem
TeOpuid O TOM, YTO MonaAKn
AelicTBylo No NpAMOMY yKa3aHulo
CWA, uToGp! ewe pas yHu3UTb
Tepmannio W CKOBaTb el pyku Ha
Me@xOyYHapogHon apexre.
B apMAHOASbINHOM Npecce NOABNAETCA CTATbA,
O6BMHAIOWAaA PpaHuUMiO B TOM, HTO BMecTe
NOMOLJM CTpagarowen ApMeHun OHa NomoraerT
Y«paire. CraTba nonagaeT Bo
bpaHKOASbI4HbI CerMeHT, MbI NPOBOWMpyeM UM
BcAYecKM NoAOrpeBaem OOwWecTBeHHyIO
Auckyccuo.Page 214 SKoHOmMMYecKHe/
couvanbHo-
SKOHOMMYeCcKHe
KOH@DNMKTbI
Ha cesepe ®paHymu nponcxogutT 3sabacToska
Megnkoe, oH TpeGy0T NoBbICNTb 3apnnatbi
yBeNM4vTb LUTaT. MbI co3qaeM 3akpbiTbIi
KaHan nA MeguKos, KoTOpbie GopioTca 3a CBOU
npasa M akkypaTHo npogBMraem Tam HappaTuB
0 TOM, ¥TO KpMi3MC B MeMLMHe BbISBaH
A@HTMPOCCHMCKMMM CaHKUMAMM. NMogobHbie
TPyNNb! BOSMOMKHO CO3LaTb B ANA pasHbix
PerMoHoB CTpaHbl.Page 215 EXHIBIT 8APage 216 The Good Old USA (“Good Old USA”) Project
EM introduction
The current international environment is known for, first and foremost, severe hostility of
the US towards Russia. The USA has been trying to maintain “the global leadership”
by strategically defeating Russia. This desire shapes the financial investment,
weapons supply, and efforts to keep the conflict in Ukraine going.
In the meantime, the key question of the US domestic policy remains the same: how
justified are these efforts? The further we go, the more politicians state that the US
should target their effort towards addressing its domestic issues instead of wasting
money in Ukraine and other "problem" regions.
This sentiment has become the centerpiece for the US 2024 presidential election
campaign. While SRSHimeliifes\Mstelasas) are still in power, they are trying to maintain the
current foreign policy priorities. URSHEMeN(CESETWAEN, still in opposition, have been
criticizing these priorities.
It makes sense for Russia to put a maximum effort to ensure that the
point of view (first and foremost, the opinion of supporters) wins
over the US public opinion. This includes provisions on peace in Ukraine in exchange
for territories, the need to focus on the problems of the US economy, returning troops
home from all over the world, etc.
Public opinion polling results in the US indicate that the politics which we consider correct
has a real chance to get approval of the majority of the US voters.
It should be noted, though, that currently there is a real chance to steer the US public
opinion in the right direction by using such tools as enhancing awareness among
Internet users.
PA Goals and objectives
re
~
a Goal
To secure victory of a URSHxeliiterImm-lism@aecandidate (Seigelferiewzgor one of his current
internal party opponents) at the US Presidential elections to be held in November of
2024.
ns |Page 217 E3] Objectives (by the November 2024 election)
e To increase the percentage of Americans who believe that the US "has been doing
way too much to support Ukraine" to 51% (as of 11/02/2023 such index was 41%,
according to Gallup).
e To increase the percentage of Americans who believe that the war is to be ended as
soon as possible, even at the cost of territorial concessions on the part of Ukraine, to
53% (as of 11/02/2023 such index was 43%, according to Gallup).
e To bring confidence rating down to the minimal level of 29% (as of
11/19/2023 this rating was 39%, based on CNN's "poll of polls”).
v3 Target Audiences
e Residents of “swing” states whose voting results impact the outcomes of the elections
more than other states. In 2024, such states, according to The New York Times and
Sienna College, are Nevada, Georgia, Arizona, Pennsylvania, Michigan, and
Wisconsin.
e Residents of conservative states where traditional values are strong who more often
vote for candidates of the URSHzelitecmecuNan Alabama, Kansas, Texas, Wyoming,
Louisiana, etc.
e US citizens of Hispanic descent.
e American Jews.
e Community of American gamers, users of Reddif and image boards, such as 4chan
(the "backbone" of the right-wing trends in the US segment of the Internet).Page 218 Ex Channels of Influence
We intend to use Facebook and Instagram, as well as YouTube, X (Twitter) and Reddit
— the resources free from "democratic censorship" — as the main channels to influence
the target audience of the project.
EW Project's Toolkit
2) Go CETAEW, Go! YouTube Channe!
A YouTube Channel that accumulates pro- video content as well as
news topics of international media, and presents them in compliance with the goals and
objectives of the project. The toolkit will include videotape editing, subtitles, re-dubbing of
the video clips, and, in a limited number of cases, augmented reality. The channel will have
extensive viral content — music, humor, beautiful girls, etc.
As a result of the continuous mentioning of media personas on the channel
la) etc.) and the names of known organizations,
as well as the focus on the viral content, in as little as three months, search engine indexing
U.S. Person 3, Candidate
mechanisms will start generating links to the “US Elections” themed channel on the first
pages of the search results.
Eel OR iicclem lias Values Supporters Groups
The objective is to create on Facebook, Reddit, and X (Twitter) and actively promote for at
least five months a network of communities uniting citizens sharing WASHRMeiier ar laaee
= values and fans of certain famous people. These could be called, for example,
“Alabama for America the Great"; "Go GRS#igcisvelame. go!", "VVhat did Sse
etc.
Same say”,
Because the groups don't initially position themselves as political communities, they may
act as lending outlets for targeted ad channels for the project narratives distribution without
attracting immediate attention of the social media outlets’ administration, and would be
able to accumulate a critical number of viewers.
EX] "News of Our State" "Sleeper" Groups
The objective is to create and for at least five months moderately promote news groups in
“swing” states through Facebook, Reddit and X (Twitter) — a total of 18 communities, onePage 219 community per media outlet in six states: Nevada, Georgia, Arizona, Pennsylvania,
Michigan, and Wisconsin.
While in a “sleeping” state, communities attract an audience through targeted advertising,
planting, and organic reaches. At the right moment, “upon gaining momentum’, these
communities become an important instrument of influencing the public opinion in critically
important states and portals used by the Russian side fo distribute bogus stories disguised
as newsworthy events.
Commentary Campaign
Mass distribution of text comments and memes in Facebook and X (Twitter) discussion
threads.
Work with comments assumes not only the spread of false reworked project narratives
supported by facts, but also targeted social engineering based on information trends and
users’ emotional attitude towards them. To achieve that we need to analyze users’
behavioral patterns.
The behavioral pattern is an unusual reaction of users that allows one fo identify narratives
that enjoy the most significant support in Ukrainian society over a measured period of time
and directly impact public opinion. Behavioral patterns form the basis of the comments-
related work, enhancing its flexibility and mobility.
Targeted Advertising
Targeted advertising in Facebook and Instagram is intended for the targeted delivery of
messages to the material's target audience.
The target audience of each material is selected for each individual message. The
parameters depend on which group may be the most psychologically affected by this
material. The target audience can be formed based on the location, gender, age, hobbies
and interests, etc.
Targeted advertising in Facebook allows tracking reactions of users fo the distributed
material in real time and directing the psychological response group to contribute to
comments thereof. With the help of a network of bots the psychological response group
moderates top discussions and adjusts further launches depending on which group was
affected the most.
KOMM@HTapulinan MawiMHa
Maccospoe pacnpocTpaHeHie TeKCTOBbIX KOMMeHTapieB VM MEMOB B BETKaXx O6cyKTeHMK
B COMMANbHbIX CeTAX Facebook u X (Twitter).
Pa6OoTa c KOMMeHTapMAMH NpepnonaraeT He ToNbkO BOpoc nepepaboTaHHbix HappaTMBoB
npoekta, NOAKpenMeHHbIX chakTamu, HO M BbINOMHeHMe TONeYHbIX NCMXONOMYeCKUX aTAaK
Ha OCHOBe UHCOpMaLIMOHHbIX TPEHAOB VU SMOL|MOHASIbHOFO OTHOLUEGHNA NONb3oBaTenen K
HMM. Jina s3Toro npoBogsutcA padoTta no aHanu3sy noBeseHyeckux Mmosenen
nonbsopatenen.
Floeedenyeckan Modenb — 3mo HecmaHdapmHaA peakuuA Nonbsoeameneu, Komopaa
noseonsem ebifeumb Happamuebl, KOMOopbie uMelom @ YkKPauHCKOM obuecmee
Haubonbulyto noddepxKKy 3a U3MepAeMBI Mepuod epemeHu U HanpsAMyto efustiom Ha
qopmMupoeanue o6uyecmeenHo2o MHeHusa. Mloeedenyeckue MoOenu NoKamcA @ OCHOey
KOMMeHMmaputnol pabombl, yeenuyuean ee 2u6Kocmb u MOOunbHOCMmb.
TapreTMpoBaHHan pexnama
TapreTupoBaHHanr peknama B COWWanbHbIX ceTax Facebook u Instagram HanpasBneHa Ha
appecuyto AOcTaBky COOGLeHM K WeneBou ayguTopnn MaTepnania.
UenesavA ayguTopuA Ka@kKgoro matTepvana nog6upaeTcA nog kaKgoe oTfenbHoe
coo6wenne. Mapametpbi 3aBncaTt OT Toro, Ha Kakyt0 M3 rpynn AaHHbIN MaTepnan MOxKeT
OKa3aTb HavOonblWee nchxonormyeckoe BosfehcTBNe. LleneBaA ayguTOpuA MoxKeT
chopmnpoBatbcaA no KaTeropnAM MeCTONONOKeEHMA, NONOBOSPACTHbIM XapakKTeEPMCTHKaM,
xo66n uM MHTepecam 4 T.g.
TapezemupoeaHHan pexriama @ couuanbHoull cemu Facebook no3eonsem omcriexkueamb
peakuuu nonb3s0eameneu Ha pacnpocmpanaempit Mamepuasl & pex*xuMe peasbHozoPage 226 epeMeHu, Hanpasnamb @ KOMMeHMapuU K pacnpocmpaHAeMbIM Mamepuanam epynny
meuxonoeuyeckozéo peaeupoeaHun. C momoujbio cemu 6bomoe oHa modepupyem
monoebie Ouckyccuu, KoppeKmupyem OafbHetiue 3anycku UCXOOA U3 MOzO, Ha Kaky1o
epynny 6bINo OkazaHo Haubosbwee Bo3deticmeue.
Pa6ota c JIOM u3 cpegb! CTOPOHHMKOB TpagNUMOHHbIX UEHHOCTeN, BbICTYNarOLUMX 3a
NpekpaljeHve BOMHbI Ha YKpante M MUpHble OTHOLWeEHKMA CLUA u Poccun, KoTOpbie roTOBbI
BKMIONMTBCA B NpOABMxKeHMe HappaTuBoB npoekTa. Cpegn Hux: aKTepbl, NONMTHKM,
OKCNepTb! B pa3HbIx oGnacTax, npegctaBuTenu mMegua, aKTMBMCTb! OGLECTBEHHbIX
opraHn3auni, PenuruosHble AeATenM UM T.4.
BeposTHble cbopMaTbl B3avmogelicTBua: THupaxknpoBaHve peanbHbiIx KOMMeHTapveB
JIOM, yyactve B Woy, nog”roTosKa cneLiMaTepuanos U T.g.Page 227 EXHIBIT 9APage 228 Guerrilla Media Campaign in the United States
EMintroduction
The information situation in the United States differs dramatically from that in all other
Western countries. The key to this situation is the high level of polarization of American
society which is split between supporters of the and
fA parties. We believe that supporters of the are left-wing and far-left
globalists who advocate for perversion of traditional moral and religious values, while
supporters of the are normal people whose priority is to preserve
traditions of the American way of life. It is important that " URSMifantierimeeisme: are also
people of color and supporters of “affirmative action" and "reverse discrimination’, i.e.
infringement on the rights of the white population of the United States, while ‘URSaixveiues!
(EG are the victims of discrimination by people of color. '
Moreover, although the @£yglelfeFE\ees) is an appointee of the most numerous and influential
group in the leadership of the SRSiistellit(erIme-lasas), he currently enjoys the approval of less
than 40% of citizens of the US. It is also important that @EigeicEneEs) likely rival in the next
election, GEieitElem@s, is popular among the USHIRPIierIeelsaes, primarily poor whites.
However, he is not popular with the leadership of the [URS aiate)fitfer-|ee- las.
None of the significant American politicians, including those significantly opposed to the
incumbent president, can be considered pro-Russian or pro-Putin. However, there is a
widespread opinion among that and his government are
spending too much money on foreign policy, on confrontation with Russia and on “Lend-
Lease” to Ukraine. This is at the time when the United States is suffering from rising prices,
primarily for gasoline, historically high inflation and the actual impoverishment of white
taxpayers, a significant part of the middle class. Under these circumstances, the recipients
of public assistance, unemployed people of color and residents of large cities end up being
privileged groups of the population.
A key characteristic of the American media is its skew towards the USHmsdeliiter|Mat-lasva=)
influence. While society is split between supporters of the "new globalist socialism" and
supporters of traditional values, between a donkey and an elephant is roughly equal, the
media is " (ORSHistellifer-\mer-lusmee by over 75%. The situation for URSHEstellider-|ier-lasmea' iS
made complicated by the censorship on social media and \URSisfeliitfer-|iee-lasm=m-Oriented
"new media”.
ee
e
—
Page 2 of 5Page 229 PAContent of the campaign
We would like to reiterate that in the United States there are no pro-Russian and/or pro-Putin
mainstream politicians or sufficiently large numbers of influencers and voters. There is no
point of justifying Russia and no one to justify it to. All American politicians and influencers
are patriots and supporters of American supremacy. However, there is a feeling among the
that the president's policies, censorship on social media and the
policies of the government are encroaching on their rights. They are
dissatisfied of dramatic decline in the standard of living and large expenditures on offensive
policy of the United States in Europe and Ukraine. They are afraid of losing the American
way of life and the "American dream.” It is these sentiments that should be exploited in the
course of an information campaign in / for the United States.
Campaign Topics
p
1. Encroaching universal poverty. Record inflation. Halting of economic growth.
Unaffordable prices for food and essential goods;
2. Risk of job loss for white Americans;
3. Privileges for people of color, perverts, and disabled;
4. Constant lies of the URSwiefelliites!M=eianme) administration about the real situation in
the country;
5. Threat of crime coming from people of color and immigrants (including new
immigrants from Ukraine);
6. Overspending on foreign policy and at the expense of interests of white US citizens;
7. Constant lies to the voters by URSHixe)iitle=lMetlivas) in power;
8. Last but not least - America is suffering a defeat despite @EfgeleEica=) efforts. We
are being drawn into the war. Our guys will die in Ukraine.
FSTarget audience of the campaign
1. WS eteliivers eels voters:
2. (CeElmMeieEV-¥A\ supporters;
3. Supporters of traditional family values;
4. White Americans, representing the lower-middle and middle class.Page 230 EiDissemination of information
Itis obvious that essentially only social media can function as sources of information. At the
same time, the uncensored dissemination, apparently, is possible only on @EYNeIseen. fii
On Facebook, Twitter
and YouTube we need to create multiple "perishable" accounts, primarily for the work with
comments. Websites (landing pages) should serve as the sources of information for
dissemination and for video content--YouTube accounts with a relatively small number of
subscribers and commentators (usually, you get banned after reaching the level of thousand subscribers).
ithe list of informational products to be disseminated
1. Texts of posts;
2. Comments on social networks and local group chats;
3. “Memes”, including caricatures and collages;
4. Video content, including news stories in the Fox News style.
AOrganization of work
In order for this work to be effective we propose to create a project office (editorial office of
the media campaign), consisting of three main segments:
1. Monitoring of US media and social media accounts of major
politicians. Topics and events from the segment’s product shall be selected daily to
generate content;
2. "Text factory" with minimum output of 4-5 main topic-based recommendations, 8-basic posts on social media, 40-60 comments for dissemination and taking in;
3. Manga editorial office with a daily output of 3-4 “pictures”, memes, etc.
4. Video editorial office with a daily output of 3-4 video materials per day.
In order for this work to be effective, you need to use a minimum of fake news and a
maximum of realistic information. At the same time, you should continuously repeat that this
is what is really happening, but the official media will never tell you about it or show it to you.
Page 4 of 5Page 231 E§Publication Sample for Dissemination
Speech of a
congressman
Congressperson against allocation of billion dollars to Ukraine.
Attached text: an
endangered breed of
politician - for some
reason he tells the truth
and operates with a kind
of strange concept -
Homeland.
is one of the few
congressmen who voted against the bill on
the supply of weapons to Ukraine under
Lend-Lease.
Coes is one of the few congressmen who voted against the bill on the supply
of weapons to Ukraine under Lend-Lease.
"| want to warn all of you about Washington's dangerous bipartisan pursuit of the war with
Russia. We, like sleepwalkers, entering into the war, and the American people remain in the
dark of ignorance. Last night, the House of Representatives approved the allocation of billion dollars to Ukraine, while American families have to do without baby food. For
comparison, in this context, budget provides for the allocation of only 15.billion dollars for states’ customs and border control. Apparently, Ukraine is more than twice
as important to him as our Homeland."
seo
o
:
Page 5 of 5Page 232 EXHIBIT 9BPage 233 lMlapTusaHckan Megva KamnaHnua B CLUA
9) Beoguaa undhopmayna
UxcbopmalvouHHaa cutTyayua B CLUA pesko oTnmuaeTCA OT TAKOBOM BO BCEX OCTAsIbHbIXx
cTpaHax 3anafa. Knoyepan xapakTepvcTMKa 9TOM CHTyalIMN - BbICOKMM ypoBeHb
nonapwzauvu aMepMKaHcKoro O6WjecTBa, packONOTOrO Me@KAY CTOPOHHMKaMU
» Rapti. Opn st0 croponnnkn RR, c
Hallie CTOUKM 3peHMA, ABNALOTCA NeBbIMM MM KpaiiHe NeBbIMM rno6anucTaMmy, a TakxKe
BbICTYMaloT 3a V3Bpall|eHve TpagAMUMOHHbIX MOpasIbHbIX VM PeNUMMO3HbIX LIEHHOCTeM, B TO
BpeMA Kak CTOPOHHMKy i, — HOpManbHble m10Q), BbICTynalouyne, npexye
BCero, 3a COXpaHeHve TpagAMuMi amMepuKaHckoro o6paga »«u3HU. HemManoBaKHO, YTO
)tawoxe - ypetubie uv cTopoHHnKn «no3svTMBHOM AVCKPAMMHAyMY»
«O6paTHOM AVCKPMMVHaUWM», TO eCTb yuleMneHvA NpaB 6enoro HaceneHuA CLUA, a
- KEPTBbI AMCKPUMMHAaLIMH CO CTOPOHb! LIBETHbIX.
ABNAeTCA CTaBMeHHVKOM Hav6onee MHOrOUNCcHeHHOM MM BNMATeNnbHOM rpynnbi B
pyxosonctse J GR, 5 xactosuee spema on monbayetca
ofo6peHveM MeHbLUMHCTBa U36upaTenei — no NocnepAHMM AaHHbIM MeHee 40% rparxkfaH
CWA. Taioke HeManoBakHo, 4TO o¥eBMAHbIN conepHuk SR xa cnenyounx
Bbi6opax (I nonbsyetca nonynapHoctblo cpean , Npexne
BCero 6efHbIX GenbIx, HO He CpeAN pyKOBo”CTBa
Hukoro M3 3HaYMMbIX AMEPKAaHCKHX NONMTHKOB, B TOM YMC pesKO ONMOSML|MOHHbIX NO
OTHOWeHMIO K AevCTByIOWeMy MpesMAeHTy HeNb3A CUNTaTb Npopoccniickum un
nponyTMHcKuo. OgHako cpean pacnpocTpaHeHo MHeHve, uTO fe ero MpaByTenbCTBO TpaTAT CNMWKOM MHOrO fever Ha BHEWHIOIO NONMTHKy, Ha
NpoTMBOcTosHne c Poccnei uv Ha «NeHAZ-1M3» YKpanHe, B TO BpeMA Kak Cam LLITaTbI
CTpagatoT OT pocta WeH, Npexkfe BCero Ha 6eHSMH, UCTOPMYeCKU BbICOKOM MHA
akTu4eckoro OGHMLaHMA =SHAYWTeNbHOM YaCTM cpefHero KMacca - Genbix
HanoronnatenbuyMKoB. MpwennermpoBaHHoi rpynnom HaceneHua B 9THX ycnoBMAX
OKasbIBaloTCA MonyYaTenv colManbHo NoMOWM, UBeTHbIe 6espa6oTHbie >KMTeNM
KpyNHbIx ropofos.
Knto¥eBOM XapaKTepMCTMKOM AMePMKAHCKMX Mega ABNAeTCA NepeKoc B CTOPOHYy
envusHva (. Ecnv o6ujectso pasgeneHo Mexkay CTOpoHHMKamM «HoBoro
rno6anuctcKoro cOl|Manu3sMa» M CTOPOHHUKAaMM TPafMLIMOHHbIX LeHHOCTeM, MexKaY
OCNIOM M CNOHOM NpyiMepHo noniona, To Meqva ABNAIOTCA i Conee
4YeM Ha 75%. Cutyauma ana OCNO*KHEHA LIEH3YPONM B COL|MasIbHbIX CeTAX
VW «HOBbIX MeQua», OPHEHTMPOBAaHHbIXx Ha ;Page 234 P) Cogep»kanve Kamnannn
NogyuepkHem ewe paz: HAKaKUX NpopoccuiicKux W/MNM NpPOMyTMHCKMX MeAHCTPUMHbIX
NONUTUKOB VM CKONbKO-HM6yfb 6onbworo YNcna Takux JIOM u u3s6upatenen B CLUA Her.
floKa3biBaTb NpaBoTy Poccun GeccmbicneHHO MW HeEKOMY. Bce aMepviKaHCKNe NOMMTMKU
JIOM — natpvotbi vw CTOPOHHMKM amepHiKaHCKoro npeBocxo”cTBa. Ho ecTb OlWyujeHne
EE. |70 oF yujemnent! nonutuKoi npesn~eHTa, YeH3ypoi B COMMANbHEIX
cetax, nonvtvkoii i) npasvtenbctsa. Ectb HeqoBonbcTBo pe3skvM
CHVDKEHMEM YPOBHA >DKV3HM WM GOONbLIMMM pacxofamMuM Ha HacTyNaTebHytO NoNMTMKy
LUtatos B Espone vu Ha YKpanHe. EcTb cTpax noTepATb amepnkKaHCKni O6pa3 *KU3HM M
«AMe@PUKaHCKylO MeUTy». AMeHHO 9TM HaCTpOeHMA CNepyeT SKCNNyaTMpOBaTb B xoge
VHOpMalMoOHHON Kamnadun B/AnA CLUA.
3) Temp kamnannu
1. Hactynatowan psceobuwjan 6enHocTb. PekopgHaa wHdnAuMA; ocTaHoBKa
SKOHOMUYECKOTO POCTa; HEBO3MO)KHbIE LIEHbI Ha NPOAYKTbI NUTAHMA VW TOBapbI
nepBon Heo6xogqumoctn;
2. Puck notepn pa6orTbi AnA 6enbIx aMepvKaHLEB;
3. Mpveuneruuv Ana UBeTHbIX, MSBPaleHUeB UW VHBanMoB;
4. Noctostas 10>kb i 24MvHicTpaunn o peanbHom nonoxKeHMN B
cTpane;
5. KpMMMHanbHad ONACHOCTb CO CTOPOHb! LBETHbIX W MMMMrpaHToB (B TOM YncNe
HOBbIX UMMUrpaHToB C YKpaunbi);
6. CNMWKOM 6os/bluMe pacxogb! Ha BHELWHHOW NOMMTHKY B yYLep6 3aLWTe MHTepecoB
6enbix rparxkgaH CLUA;
7. NoctostHas nob i 24M“HicTpaunn n3s6npatens;
8. Last but not least - AMepyka Tepnut nopakeHue, HecmoTpa Ha ycunus
Hac BOB/eKaI0T B BOMHY, Hal NapHn NorMGHyT Ha YKpauue.
9) Lienesan ayqutopua kKamnaHnn
1. Ve6up2rery
cropo 11K
CTOPOHHMKM TpagMLMOHHbIX CeMeMHbIX LIEHHOCTeN;
~ &
Benble aMepvkaHubl, NpesACTaBNAlOWMe HUZSWMA CpeAHMi wu CpeAHun cpegHun
Knacc.Page 235 5) Pacnpoctpanenne undopmaunn
OyesugHo, Y4TO HOCUTeNAMM UHdopMaLi“A MOryT 6bITb MpakTUYeCKM TONbKO
couvanbHbie ceTv. Tipn 9sTomM G6eClieH3ypHOe pacnpocTpaHeHve BO3MO>KHO,
NO-BUQMMOMY, TONbKO B CBExKeCosqaHHoOw couManbHon ceTh i [En
B OCTaNbHbIX COLIWMANbHbIX CETAX — TO ECTb
FaceBook, Twitter, YouTube - Heo6xoqumo npefycmoTpeTb noABNeHMe G6onbWOrO
KONUYECTBa <«CKOPOMOPTALIMXCA» aKKayHTOB mpexge sBcero ANA paboTbi B
KOMMeHTapmax. VicTOYHMKaM MHMopMalinn AIA pacnpocTpaHeHnA AOJDKHbI BbICTYNAaTb
caiTb! (neHAUHrH). Jina BugeO KOHTeHTa — akKayHTb! B YouTube CO cpaBHUTeNnbHO
He6onbuuMM (6aHAT O6bINHO MOCcNe AocTMwKeHWA ypoBHA B 100 ThIcAY nognucunKos)
KONMYECTBOM NMOGANMCYMKOB M KOMMeHTaTOpOB.
[5] Homenknatypa pacnpoctpanremoro HHpopmaloHHoro
npopyKta
1. TeKCTbI NOCTOB;
2. KOMMeHTapun B COLIMNaIbHbIX CETAX VU JIOKAJIbHbIX na6nuKkax;
3. «Membi», BKNHO“aA KapiKaTypbi 4 KonNaKy;
4. BugeoKoHTeHT, BKIIOYaA MHDOPMaLMOHHbIe ClO>KETbI B CTwNe Fox News.
Opranvsayna pa6otTb!
fina abddexTvBHoW pa6oTbi nmpegnaraetca co3sqaHve mpoeKTHoro oduca (pemakumn
MeqMa-KaMnaHun), COCTOALerO U3 TDeEX OCHOBHbIX 6NOKOB:
1. Mouutopuxyr CMU CLUA wu akKayHTOB OCHOBHbIX nonuTMYecKuX AeATeNnen
a B COLIMabHbIXx CeTAX. V3 nposAykKunn 6noka e>*KeAHEBHO
NPOUSBOAMTCA OT6OpP TeM UV COGbITH ANA POPMMpPOBaHNA KOHTeHTA;
2. «Ma6puka TeKCTOB» C MMHMMalbHbIM BbIXOZOM 4-5 OCHOBHbIX TeMaTMYeECKMX
pekomeHfauni, 8-10 6a30BbiIX NOCTOB B COLIMaNbHbIX Mesna, 40-KOMMeHTapveB ANA PpacnpocTpaHeHyA MU NOoceBa;
3. Manra-pegakuua Cc @KeNHeEBHbIM BbIXOJOM 3-4 «KaPTUHOK», «MEMOB» UT. 11.
4. Bugeo-pegakuna c eKeQHeBHbIM BbIXOfOM 3-4 BugeO MaTepuasIOB B CYTKM.
BayKHO OTMETHTb, YTO ANIA 3scdeKTUBHOKM paboTb! TpebyeTcA ucnoNb3sOBaTb MUHUMYM
evKOB YW MaKCUMyM peanucTM4HOM MHdopMaunn. NocToAHHbIM pedpeH Np STOM: BOT
4YTO MPONCXOoAMT Ha CaMOM gene, HO YerO BaM HE PaCCKaXKyT/He NMOKAXKYT B
OduuManbHbIx CMM.Page 236 E3) Mpumep ny6nukauymun ana pacnpoctpaHenna
OH M3 HEMHOrMx KOHrpeccmeHos CLA, ronocoBaBLluUx
NpOTMB 3aKOHONMpoekTa O NocTaBKax YKpanHe
BOOpyeHHH NO NeH~-nMsy.
Npeactasutenb
OAVH M3 HeMHOrNx
KOHTPeCCMe@HOB, FONOCOBAaBLUMX MPOTMB 3aKOHONpoeKTa oO mocTaBKax YkpavHe
BOOpyKeHM No NeHz-nn3y.
"A xouy NpegynpeAuTb BCeX Bac 06 ONaCHOM ABYXNapTMAHOM CTpemseHnn BalwinHrtoua K
Bowie c Poccyes. Mbi, Kak YHaTHK, BCTYNaeM B BOMHY, a AMepMKAaHCKUH Hapog OcTaeTcA
BO TbMe HeBegeHua. IIpouinovw HOubIO ManatTa npegcTaBuTenev ogobpuna BbigeneHve
YkpauHe 40 musnvapgoB Aonnapos - npv 3TOM aMepuKaHCKMe CeMbu OOXOAATCA 6eAetcKoro nmutaHua. JNA cpaBHeHuA B 3TOM KOHTeKCTe - 6HspKeT ime
npegycMaTpuBaeT BbigeneHve Mlb 15,3 Munnvapga AONNapoB Ha TaMO)KeHHbIN VU
NOrpaHWyHbIM KOHTpONb WTaToB. Bugumo, YkKpavHa AA Hero 6onee YeM B ABa pa3a
BaokHee Hawes Poguupl".Page 237 EXHIBIT LOAPage 238 Abbreviations:
{] Exegeses
[PH] Phonetic
Primary language Russian (standard font Times New
Roman 12)
Secondary language English (italics)
US Social Media Influencers Network
Project goal:
To create platforms on US social networks in order to strengthen pro-Russian sentiments among
the targeted audience in accordance with Key Performance Indicators and TL [PH] of the
project.
Introduction:
The US Internet space is subject to control by various services and oversight agencies. META, a
social media giant (Facehook/Instagram), actively collaborates with the National Security
Agency. 7wiiter is the only mass platform that could currently be utilized in the US. It is also
important to keep in mind that the network has its own security service that performs verification
of suspicious accounts. This situation is expected to worsen as the November 2024 presidential
election approaches.
The structure of content consumption in the US has the following specifics: users are more
interested in local (city, state) events than federal events and a lot more [interested in local
events] than international events.
The QESSRONTCETE TINA SE is currently advancing a relatively pro-Russian agenda. That
could be exploited by posing as ardent TESTER and relaying the part of their
agenda that coincides with ours. One example would be the financial and military support to
Ukraine. Simultaneously. it is important to understand that the amount of the highly resonant
content and hot topics should not exceed 20 percent of the total volume of all publications.
Proposal:Page 239 To create and develop a network of 200 accounts in Twitter, four in each of the 50 states: two
active and two “dormant” ones.
Active accounts in each state will be maintained on behalf of a fictitious individual, who actively
supports the GBSHIMo nee euaaeas and represents “a community of local activists”. The feeds
will mainly collect the local newsbreaks with occasional coverage of the federal and
international ones.
An approximate number of daily publications will be 3-4 in one’s own feed and 6-9 comments in
other people’s feeds (comments, reposts).
Dormant accounts will be maintained far less intensively and used if one of the active accounts is
blocked.
Technical aspect:
In order to eliminate the possibility of detection of the “Russian footprint” in the proposed
project, a multi-level protection of the infrastructure will be built. It will contain VPN services,
physical servers located in the United States, etc.
Outcomes:
It is expected that in 2-3 months the total permanent audience of the project will reach 30-
thousand subscribers. In six months — 100,000-200,000. In a year — more than a million
subscribers.Page 240 EXHIBIT 10BPage 241 =
CeTb areHTOB BNUAHMA B COLINANbHbIX CeTAX CLUA
Llenb npoexta:
Co3gaTb nnowagkw B cOLManbHbIxX ceTax CLUA C NOMOUJbIO KOTOPBIX YCUNUMBaTb
npopoccwiickne HaCTpOeHMA CpegM WeneBow ayguTopuv B cooTBeTcTBuM c KITS u TI)
npoexta.
BBogueie:
UrTepHet-npoctparnctso CLUA wan6bonee nogBepxKeHO KOHTponiO CO CTOPpOHbi
BCEBO3MO)KHBIX cnyKO Mw HaA3OpHbIX OpraHoB. [vraHT couWManbHbix cetew META
(Facebook/Instagram) aktuBHO coTpygHuyaeT c AHB. EguucrBeHHow MaccoBol
MNNOWaokON, Ha KOTOPO BO3MO>KHO BecTM paGboTy B CLUA B HacTonuee BpemA ABNAeTCH
Twitter, pv sTom Hago UMeTb B BUY, YTO NpOBepKu cnyx6bI cobcTBeHHOM GezonacHocTu
NOAOSPUTeENbHbIX AKKAYHTOB B 3TOM CeTM TakoKe OCyLeCcTBnsloTcA. Cutyauua 6yneT
yxyQwatbca c npvOnvwKeHvem BbIOopos npesugeHta CLUA B HomOpe 2024 roga.
Crpyktypa notpe6nenns KOHTeHTAa B CLUA umeeT cnepyro”yro cneyMdbuky: nonbsoBaTenen
WHTepecyloT MecTHbIe cobbiTna (ropoga, wTaTa) Gonbwe, 4Yem cbenepanbHble wv HaMHOrO
Gonbwe, 4¥eM MexDyHaposHbie,
OTHOCMTeENbHO Npopoccuiickyro noBectky B CLUA celyac packayuBaloT uv
3TUM MOXKHO BOCNONb30BaTbCA, NPUTBOPAAC APbIMU v TpaHcnmpya Ty
4aCTb UX NOBECTKM, KOTOpaA CoBNagaeT Cc HaWwen. Hanpumep, npo cbuHaHCoBy!0 VM BOeHHYIO
NOMOWWb YkpanHe. [pw 3sTOM Hao NMOHMMaTb, YTO KONUYeECTBO ACKMCTBUTeENbHOrO
PE3O0HAHCHOIO KOHTEHTA M OCTPbIX TEM HE AOMKHO NpeBbilwaTb 20% B obujem o6béeme
nyOnvukaunn.
Npeganomenne:
Co3qaTb VW pa3BuBaTb CeTb “3 200 axkayHToB B Twitter no 4 B kaxgom u3 50 wratTos: AKTMBHbIX VU 2 "CNALYMX".
AKTMBHbIe akkayHTbI B K@KQOM WwTaTe GyAyT BECTMCb OT MMeEHN BbIMbILUMeHHOFO cbusnnua
— axtueHoro cropoxHvka QR 4 or umenn “coo6uwectsa = mecTHBIx
akTMBncToB". B neHTax 6yAyT NPevMYUeCTBEHHO COOupaTbCcA MoKaNbHbIe VHCPONOBOAb! VWHOrpa OCBeLWaTbCA cbeAepanbHble u MexkgyHapopHble.
MpumepHoe uncno exKefHeBHbIX nyOnukauni: 3-4 B cobCTBeHHOM neHTe u 6-KOMM@HTApleB B YYKUX NeHTax (KOMMeHTapMn, penocthi).
Cnauwe akkayHTbl GyfyT BeCTMCb B ropa3qo MeHee UHTEHCMBHOM pexnme uv OyayT
BOCTpeGOBaHbI, ECNM 3aGNOKUpyOT OAMH U3 AKTMBHbIX AKKAYHTOB.
? 1Page 242 TexHuyecknn acnenxt:
[na UCKMOYeHUA BO3MOxKHOCTM OOHapyxkeHua "pycckoro cnega" B npegAnaraemom npoexte,
6yMeT nocTpoeHa MHOroypoBHeBaA VHCpactpyKtTypa 3salTb!: VPN cepsncol, cbusuueckne
cepBepa, pacnonoxeHHble B CLUA v1 T.n.
Pe3yntTarbi:
Yepes 2-3 mMecalia CyMMapHaa NocTosHHas ayAvTopua Npoekta 6ygeT coctasnatb 30-TbIC. nognucunkos. Yepe3 6 Mecauies — 100-200 Tbhicay. Yepe3 rog — Gonee munnnona.Page 243 EXHIBIT ILAPage 244 MEXICAN PASS TO |
Candidate A
PROJECT OF EFFECTIVE PROXY
PARTICIPATION IN THE NOVEMBER CAMPAIGNPage 245 HISTORICAL BACKGROUND
In 1846, the United States began a war with Mexico, which resulted in 55% of the
Mexican territory being occupied. And it is the richest land in the United States: modern
California, Texas, Arizona, New Mexico, Utah, and Nevada, or 1.3 million square kilometers of
the United States. Just a year before the American aggression in 1845, Spanish Florida became
the 27th state of the United States in exchange for the U.S. renouncing its recent claims for
Texas. Would Texas agree to return to Mexico? The posing of the question is definitely modern.
However, no one asked Texas residents about it in 1846.
CURRENT SITUATION
Today, Mexico is approximately at the
same development stage of economic, social,
and public sentiments and attitudes, as Russia
was going through in the early 2000s.
Mexico for now is slowly waking up to a
sense of great power. Mexico is waking up to
an increasingly complex sense of Mexico's
special cultural and economic path.
Nowadays Mexico, even if heavily
dependent on the United States for millions
of “migrant workers” and an enormous
number of economic ties, continues to
preserve its distinct identity and deeply
values its traditions. Among these traditions,
there is one phrase that reveals the outer
layer of a deep existential conflict with the
United States: México no perdona — Mexico
does not forgive.
Let’s imagine a map of the United States depicted as broken glass. A sign México no
perdona will be displayed along the division line. At first glance, such message could be used by
some fringe political organization, the ultra-right or the ultra-left, maybe by a nationalistic one.
Mexican nationalism is not a noticeable political trend due to the relative autonomy and
distinctiveness of local states with a large number of cultural and social differences, and most
importantly, with a significant difference in daily rituals.Page 246 THE MORENA PARTY AND PUBLIC SENTIMENT
The center-left party Morena is a
stronghold of the current president, and it has
a majority in Congress. To some extent, it is
similar to the young United Russia. The
Morena party does not yet verbalize it, but it
already has anti-American, de-dollarization,
and economic reorientation trends.
The idea of de-dollarization is very popular in
society, especially in the wake of the
strengthening of the Mexican peso. In 2021,
the dollar was worth 22 pesos, today it is
worth 16.5 pesos.
Modern Mexico is very active in establishing
economic cooperation with Brazil. Brazil to
Mexico today is like China to modern Russia,
a great alternative partner and a safe ally.
More and more of Mexico’s economic actors
are changing their course from the U.S.
market to the markets of the Mercosur
countries (Argentina, Brazil, and Uruguay.)
MEXICAN RENAISSANCE
If, as part of the Morena party election campaign (the candidate has not yet been named,
but it will be the successor to the incumbent president) in June 2024, a great-power card is
played with a clear emphasis on anti-Americanism, de-dollarization, and the demand for the
return of a huge number of Mexican prisoners (the number of such prisoners is huge, but the
majority of them do not have the same involvement with the drug cartels that would be worth the
torture, humiliation, and sentences that these people receive in the United States), then such
rhetoric will be especially popular in those states of Mexico that traditionally practice anti-
Americanism. These are the very large states of Baja California, Chihuahua, Sonora, and
Coahuila. Importantly, the anti-American sentiment is most prominent among the poorest
classes. And the poorer strata are the main support group of the Morena party and, therefore,
they provide the highest electoral capacity. Also, the anti-Americans are migrant families,
college educated people, and the participants in patriotic movements.Page 247 The reenactment movement is very popular in Mexico today, as it was in Russia in the
2000s. A special area of focus is the co-financing of the reenactment movement in Mexico,
[which involves] the co-financing of all kinds of military and historical communities that reenact
major battle scenes on the U.S. border.
So, let's imagine that from fall 2023 to summer 2024, a distinctive anti-American card is
played in Mexico with the support of the ruling Morena party. Patriotic movements get involved
as well. The Communist Party of Mexico also gets involved, which pursues an active Russophile
and pro-Soviet politics, often participating in relevant cultural events (at venues for outdoor
advertising in Mexico City; for example, a large-scale exhibition of a Soviet propaganda poster
was held in 2023). That is, the Soviet culture was adopted by Mexican culture greatly and
noticeably as anti-American.
But it is very difficult to succeed in the countries where we are trying to play this card
today due to the lack of an economic basis. In Bolivia or Venezuela, total poverty makes it easier
for the representatives of pro-U.S. parties to buy votes.
This is not the case in Mexico. First, mexicanos no perdonan (Mexicans don’t forgive.)
Secondly, the pain for the loss of the vast adjacent territories is still alive in people’s
mind. Preparations are expected soon for “the commemoration” of the tragic date of “200 years
apart.”
Thirdly, Mexico is indeed experiencing
a technological boom; technology is
advancing; and at least in big cities, Mexico is
beginning to reach the same standards of
living as that of Mexican migrants on the
other side of the border. Today. the migration
of Mexicans to the U.S. happens rather by
inertia, according to the old role-playing
model, when having a residence permit in the
US brings some satisfaction.
Mexicans value their passports very much. Moreover. all those born in Mexico receive a
passport. A Mexican passport is quite strong and overall is a convincing alternative to the
American passport, at least in Latin America and even in Canada.
A MEXICAN PASS TO (@aqgiRET CAMPAIGNPage 248 At the same time, there is a good chance that in the U.S. presidential election
may again become a candidate from the [WAS Molitevemiin@al. Le is the man who has
repeatedly said that it is strange to speculate about the risks for American citizens coming from
the zone of contact between Russian and Ukrainian troops, when there is a quite clear multi-
thousand-kilometer contact line stretching between the United States and drug gangs,
“sicario"(murderers) squads, crowds of sometimes furious refugees, smugglers, and the world's
infamous high crime and violence rate in the border towns of Tijuana, Ciudad Juarez, Teconapa,
and so on. The Mexicans' special attitude toward death makes them promising candidates for
projects like PMC Wagner on the borders of Arizona or Texas.
The (@tteieRHGeAN who was building a
border wall; the @etiaifeEttagay who talked
about the problem of migrants coming from
the South pretty much all the time throughout
his presidency; and the (@ititelfekitagn, to whom
the ball needs to be passed conveniently in
order to switch the American political
discussion — that @RUTEETERAN is so much in
need of an exacerbated confrontation with
Mexico.
What is the main potential problem of @AWWIREaeAN campaign? It is in the fact that the
U.S. economy is growing today. Global food prices have risen. The military industrial complex
has received new orders. It is as if (@AyeheRitems) has fed the rednecks: farmers and workers, who,
in fact, were the potential supporters for Q2UGIGRiCgAN. Today the stagnation card has been thrown
out. Military industrial factories, machine-building factories, and metallurgists are inundated
with orders for the next five to seven years. Dollar inflation is lower than in any other currency.
The real estate purchase index is low like never before: citizens do not see the need to go into
real estate, mortgage rates are low, and all of this suggests that the economy is very healthy.
In order to somehow spur the society when the economy is obviously booming, it is
necessary to create a perceivable threat. The missiles in Cuba, Nicaragua, or Venezuela are a bit
ridiculous because they bump against the Americans’ technological disregard for Russia. The
statement about the owner of a gas station with a nuclear bomb is very telling, and, in fact, very
close to reality. The regime in Nicaragua very shortly could become a victim of either a military
coup or a special operation by American commandos. In any case, these are the territories where
we play on someone else’s field. But does it make sense to play on someone else’s field when
there is a partner who is ready to play himself? A partner who needs to win the election and to fit
in the concept of the current national and historical development.Page 249 CONCLUSION
This kind of context is very useful to all the BRICS countries. For, as they used to say in
the streets of St. Petersburg, “Each Abram has his own program.” Our goal is to try to
decentralize and, in some places, to disrupt the processes of imposing a single form of
“decorum” in the way other states present themselves.
And this kind of project is going to show the world that a huge country of 130 million
people, with the longest border with the United States, has finally woken up. (URSMgemene) once
said that American economy got very lucky: they have fish that are silent on the left and the
right, Canada sleeps at the top, and Mexico dances below. Thus, the United States simply does
not have threats and does not spend energy on mitigating them. All threats are happening in
some esoteric realm of the global West and American-centric civilization.
Today, the time has come to show to the United States that it is under a threat. And we
can do it.Page 250 EXHIBIT 11BPage 251 ; =
2 ee a ee ek | 7 ty ao
ae eee ee se
a ee - . = : a ii we ee
NPOEKT SOMEKTUBHOT O
NPOKCU-YYACTUS B KAMNAHUN
HOSIBPS| 2024 TODA
= - a aePage 252 UCTOPUYECKAS CNPABKA
B 1846 rogy CLUA HaumHaloT BOMHY C Mekcnkoui uno e@ pe3ynbTaTam OKKyNMpyioT 55% MeKCMKAHCKOM Tep-
putopun. Mpuyém ato camble 6oratble 3emanK CLUA — coppemenHbie Kanudopnua, Texac, Apu3ona, Hbto-Mek-
cuKo, Ota v Hesaga man 1,3 MAH KBagpaTHbIX KMnOMeTpoB CLUA. Bcero 3a rog 40 aMepuKaHCKON arpeccun,
B 1845 rogy, ucnaHckaA Mnopuga cTana 27-m wratom CLUA 8 o6meH Ha oTKa3 NOCNeAHMX OT NPMTASAHMH Ha
Texac. Cornacuaca 6bI Texac BepHyTbca B CoctaB MekcuKn? MoctaHoska BONpoca, KOHEYHO, CoBpeMeHHaa. Ho
B 1846 HHKTO He cnpawuBan ero KuTenen 06 3Tom.
COBPEMEHHAA CUTYALMSI
CerogHA Mekcnka nepexusaert npH6nu3vTeNbHO TaKOn Ke
9TaN Pa3BUTHA SKOHOMMYECKMX, COL|MAsIbHbIX, OOWECTBEHHbIX
HaCTPOeHMK VM OTHOWEHM, KaKOM MepexkuBana Poccua B Ha-
yane 2000-x rogos. B Mekcuke npocbinaerca noka ewe O4eHb
OCcTOpOKHOe BeNMKOgepKaBue. B Mekcuke npocbinaetca
Bce Honee KOMMNEKCHOe OLyWeHe OCObeHHOTO MeKCHKaH- |
CKOFO KY/bTYPHOrO M SKOHOMMYeCKOrO nyTH. CoppemeHHaa
Mekcuka, KoTOpaa, Ka3a0cb 6bi, cunbHO 3aBMcMma oT CLUA
MH¥JIIMOHaMM «racTapbaliTepoB» vw OrpoMHbIM KONMYeCTBOM
3KOHOMMYECKMX CBAZEM, NDOMOMMKAeT OCTABaTbCA BECbMa Ca-
mo6bITHOM M ry6OKO UeHMT CBOM TpagMuNK, B uncne 3THXx
TpagMuMi ecTh OGHa dpaza, KOTOPAA OTKpbiBaeT NepBbiii
cnow tny6vHHoro 3K3McTeHUManbHoro KOHd@aMKTa c CLUA:
México no perdona - Mekcuika He npoulaer.
Npegctasum ce6e kapty CLUA, v306paKéHHyio B Ka4ecTBe
CANAD,
pa36uToro crekna. Mo nunun oTAeneHua 6ygeT npoxoguTb Hagnncb México no perdona. Ha nepsbiii Barnag,
TaKMM eATMOTHBOM MOKET NONb3OBaTbCA HEKO MaprvHaNbHoe NonuTM4eckKoe OObeAMHEHHe — ynbTpanpa-
BOe MIM ynbTpaneBoe. Mower 6biTb, HAWMOHANMCTMYeECKOe. MeKCMKaHCKM HalMOHaNM3M HE AB/IAeTCA 3aMeT-
HbIM NO/MTMYECKMM TPeHAOM BBKAY OTHOCMTENbHOM CaMOCTOATENbHOCTM M CBOeOGpa3vA MECTHbIX LUTATOB C
6ONbWAM KONMYECTBOM KY/TYPHbIX M COWMANbHbIX pasNN4nii, a CAMOE MNaBHOe, C CYLECTBEHHOM pasHuuen B
NoBcegHeBHbIX puTyaax.
NAPTUA MORENA VU HACTPOEHMSI B OBLUECTBE
JlepoueHTpuctckaA naptva Morena - onaot gelictayiowero
NpesmgeuTa, MMetowaAn GONbWMHCTBO B KOHTpecce, B KaKO-TO
cTeneHM moxoxka Ha Mo/ogyIO «EgnHyio Poccuio». Maptua
Morena ewe He Bep6annaupyer, Ho ye comepmut B cebe TpeH-
Abi Ha AHTMAaMEpMKAaHK3M, AeAONNApM3alMlo V SKOHOMMYECKYIO
nepeopueHTaunio.
Wager fegonnapu3zayu oveHb nonynApHa B O6wectBe, B OCO-
GeHHOCTH Ha POHE yKpenMeHMA MeKCMKAaHCKOrO Neco. B rogy gonnap crown 22 neco, cerogua 16,5 neco.
CoppemeHHaa Mekcuika O4eHb aKTMBHO HaslaKVBaeT SKOHOMI-
yeckoe coTpygHnyectso c Bpaswanen. Bpasmana ana Mekcnkn
cerogHa, Kak Kuta aA COBPEMEHHON Poccuu. Bonbwok anbTep-
HaTMBHbIM NapTHep M GesonacHbiit colosHHK. Bce 6onbwe SKOHO-
MMYECKMX akKTOPOB MekcMKM NepectpanBaWTCA C pbIHKa CLUA Ha
PbIHKH CTpaH Mepxocyp (AprentuHa, Bpasmana, Ypyreai).Page 253 MEKCUKAHCKOE BO3PO>KQEHME
Ecnv B paMKax NpeABblIOopHow KaMNaHMM KaHAngaTa OT napTMu Morena (KaHgMAaT NOKa He Ha3BaH, HO 3TO
6ygeT NpeeMHUK AecTeyowero npesMAeHTa) B MioHe 2024 roma 6ygeT pasbirpaHa BENMKOpep)KaBHaA Kapta C
OTKPOBEHHbIM aKLEHTOM Ha AHTHAaMEPHKAaHMSM, DeAONNapM3saliio WM TpebosaHve BEPHYyTb Ha POAMHY OFpoM-
HOG KONMYECTBO MEKCMKAHCKMX SAK/IOYEHHbIX — KOMMYECTBO TAaKMX 3AaKMHOYEHHbIX OFPOMHO, HO BONbLIMHCTBO
M3 HAX HE AMEIOT TOrO OTHOWEHMA K HapkKOMadun, KOTOpoOe Obi CTOMAO Tex NbITOK, YHMKEHM WM CDOKOB, KO-
Topble STH NOAM NonyyaroT B CLUA — To ocobeHHO NonyNAPHOH TakaA puTOpHKa bygeT B Tex WTaTax MekcuKn,
KOTOPbIe TPaAMUMOHHO MCNOBeAYIOT AHTMaMEPMKaHW3M. ITO OYeHb KPYMHbIe WTaTb! HuKHAR Kanudopuua,
Yuyaya, CoHopa, Koaywna. Yto BayKHO, aHTMaMepMKaHCkne HacTpoeHMA HaMGonee ApKO NpoABeHb! cpean
Havbonee 6egHbix cnoes. A bonee GepHble cTpaTbl Kak pa3 M ABAAIOTCA Tpynnow no~Aep Ku Naptun Morena u,
COOTBETCTBEHHO, ObecneynBaioT HaMbonee BICOKYIO 3NeKTOpaNbHY!O EMKOCTb. Take AHTMAMePHKaHUb! — 3TO
C@MbM MUrpaHTOB, UHTEMPEHUMA, YYACTHUKM NATPMOTMYECKMX JBMKEHMIA.
B Mekcuke cerogHa, Kak 4 B Poccuu 2000-x, o4eHb pa3BMTO PeKOHCTpyKTOpCKoe ABMKeHKe. OTAeNbHbIM
HanpaBreHnem copvnaHcuposaHue PEKOHCTPYKTOPCKOrO ABMKEHMA B Mexkcnke: Bcakoro pofa BOCHHO-MCTO-
pwyeckux coobwects, KOTOpbie pasbirpbisaloT Ha rpaHmue c CLUA Kpynubie GatanbHbie cueHbI.
Utak, npeactasum ce6e, 4To B nepvog c oceHn 2023 no neTo 2024 roga B Mexkcuke cunamn npasawen
naptwm Morena pa3birpbibaeTcA APKaA AaHTMaMepvKaHCKaA KapTa. Mogkmoyalotca NatpHoTMyecknve ABHIKE-
HMA. MlogkoyaeTcA KOMMYHUCTMY4eCKaA NapTHA MeKCMKM, KOTOPaA NPOBOAMT AaKTMBHY!O pyCOMMAbCKYIO MH
NPOCOBETCKYIO NONMTHKY, YACTO YYACTBYA B COOTBETCTBYIOLUMX KYAbTYPHbIX MeponpuATMaAX (Ha NNOWAAKaX No”
pa3melweHve HapykHOW peknamb! B MexuKo, Hanpumep, B 2023 rogy npoxoguna macwTa6uHaa BbICTaBKa CO-
BETCKOFO arMTaUMOHHOTO Nakata). TO eCTb, COBETCKOe BOWW/O B KyAbTypy MekcWKM O4eHb CHbHO M 3aMeTHO
MM@HHO Kak aHTMaMepuikaHCcKoe.
Ho 8 TeX CTpaHax, B KOTOPbIX MbI CefogHA MbITaeMCA pasbifpaTb STY KAPTY, ONEHb CNOMHO AOOuTbCA ycnexa
no NpMYuHe OTCYTCTBMA SKOHOMUYeCckKoro Ga3uca. B Bonuenu wan BeHecyane ToTanbHaan GegHocTb nopo~ae4r
BO3MO)KHOCTb /erkKO CKYNKM FONOCOB NpeACTaBKTeENAMM NPOAMePMKaHCKMX NapTHii.
B Mexcnke ato He Tak. Bo-nepsbix, mexicanos no perdonan (mekcwkaHupb! He Npowator).
Bo-BTopbix, paHa NOTepH OrpOMHbIX CONpeAeNbHbIX TEePPKTOPKM KKBa B HAPOAHOM CO3HaHMM, MB CKOpOM
BPEMEHM OMKMAAeTCA NOATOTOBKa K «NPa3QHOBAaHMIO» Tpa- :
rMyeckou AaTbI B «200 net nopo3Hb».
B-TpeTbux, B Mexcuke JevcTBMTeNbHO MseT TexHONOrM-
yecknh Gym, MAeT pasBMTMe TexHONOrHi, vu, NO KpavHei
Mepe B KpyNHbIx ropogjax, Mekcuka HadMHaeT cpaBHMBaTb- F
CA NO YCNOBMAM }KM3HM M OxXOfaM C YPOBHEM KM3HM MeK-
CUKAHCKMX MUTpaHTOB NO TY CTOpPOHY rpaHMubl. CerogHa fe
MMrpaliMA MeKCMKaHueB B CLUA, cKopee, npoucxogut no |
MHEPLMH, NO cTapo ponesok mogenuv, Korga Bug Ha KH-
TenbcTso B CLUA npuHocHT Hekoe yAoBneTBopeHne.
MekcwkaHub! OYeHb WEHAT CBOM NacnopT. Bonee toro,
NacnopT nonyyator Bce powkgeHHbIe B Mekcuke. MacnopT BecbMa CM/IbHbIM M, B eoM, Co3qaeT yYOeauTenbHy!O
a/ibTepHaThBy Nacnopty amepviKaHcKomy. [lo KpaviHel mepe, B CTpaHax /laTMHcKOK Amepun v game KaHaze.
MEKCVUKAHCKUM NAC KAMNAHMV i
B 3To Ke Camoe BDeEMA B Amepike Ha BbIGopax NpesMBerHTa KaHAKAAaTOM | Say | c
BbICOKOM Aone BEPOATHOCTH MOET BHOBb cra i. Yenosek, KOTOpbIH HEOAHOKPAaTHO FOBO-
PMN, YTO CTPAHHO paccyKAaTb O PUCKaX AVIA AMEPMKAHCKMX FparkaaH M3 3OHbI CONPMKOCHOBEHMA POCCMMCKMX
YKPaVHCKMX BOCK, KOrga ECTb BNONHE NOHATHAA MHOFOTbICAYeKMUNOMETPOBAA NMHMA CONpMKOCHOBeHMA CLUAC
Hapko6aHAams, OTpAgaMM «cHKapno» (y6uiu), Tonnamn pasbApeHHbIx Nnogyac GexkeHues, KOHTpabaHAncToBPage 254 VW MPOCNaB/eHHbIMM Ha BECb MMP BbICOKMM YPOBHeM Kph-
MUHasla VW HaCUnua NPUrpaHV4HbIMU ropogamnu TuxyaHa,
Cbrogaa-Xyapec, TekoHana uv Tak Aanee. Oco6oe oTHOwWe-
HHe MEKCHKAHLeB K CMEPTH AenaeT ux NepcnekTMBHbIMN
COTpyAHiMKaMuM ANA npoektos Tuna YBK BarHep, HO Ha
rpaHulax C APY30HOU WM Texacom.
— KOTOPbIi CTPOMA NorpaHMyHyio cTeHy,
, KOTOPbI roBopun Oo npobneme murpak-
TOBC H0fa NPaKkTUYECKM Ha NPOTAYKEHMM BCerO NpesupeHT-
cKOrO cpoxa, , KoTOpomy Heobxogumo
AaTb Ha Hory yAo6ubIi Nac Ana Toro, YTO6bI NepeKNIO“NTb AMEPNKAHCKy!O NOAVTMYECKyIO ANCKYCCHIO, CeroaHA
OcTpo HyKAaeTca B O6OCTpeHMN NpoTMBOCTORHMA C MeKcukon.
B 4em OCHOBHAA NOTeHUMaNbHaa Npobnema KamnaHnn es B TOM, 4YTO 3KOHOMMKa CLUA ce-
fOAHA pactert. Bbipocnu MupoBbie Webi Ha NPOMOBoNbcTBHe. Mpeanpuatua BK nonyyunn HoBble 3aka3bl. Mo-
AyyaeTca, YTO Kak 6bl HAKOPMM PegHeKOB: depmepos, pabounx, KOTOpbIe, COBCTBEHHO, MM Obi
30HOK pasBuTuA ANA . CerogHa Kapta ctarHaumy Bbiburta. 3aBoab! BNK u mawuHoctpoeuua”,
MeTa/YPrM 3aBaNeHb! 3aKka3saMu Ha rpAAyue 5-7 Net. AHrALMA B 3OHE AONNapa HMKe, 4eM B M1060iK Apyron
BasIOTHOU 30He. Ungexc NOKYNKV HEABUKUMOCTH HM30K Kak HUKOrAa — rpakAaHe He BUDAT CMbIC/a YXOAUTb B
HEABUKUMOCTb, CTABKM NO UNOTEKE HU3KH HM BCE 3TO FOBOPMT O TOM, 4TO 3KOHOMMKa OYEHD 3H0poBaa.
4ToObI KaK-TO NOACTerHyTb COWECTBO NPM TaKOM HaxXOgAWeNcA Ha ONEBYAHOM Nopbeme SKOHOMMKE, Hao
CO3faTb OWyTMMylO yrpo3y. PakeTbI Ha Ky6e, Hukaparya win BeHecyane HeMHOFO CMeWHbI, NOTOMY TO Ha-
TbIKaLOTCA Ha TeXHO/OrMYeCKOe NpeHebpexeHve amepukaHues K Poccuu. PopmynuposBka Npo Brapenbua
6€H3OKONOHKM C AQEPHOK GomGoi O4eHb XapakTepHa M, NO CYTH, COOTBETCTBYeT AeVCTBUTENbHOCTH. PexKUM B
Hukaparya B O4€Hb KOPOTKOM NepcneKTMBe MOET CTaTb KEPTBOK NM60 BOeHHOrO Nepesopora, nu6o cneuone-
PaliMv aMepMKaHCKMXx KOMMaHsOC. B nto60m cnyyae, 3TO TeppuTOpuM, rae MbI Vrpaem Ha 4y>KOM None. A ecTb
JV CMbIC/ UrpaTb Ha YYKOM NONe, KOrAa ECTb NapTHep, KOTOpbIIA rOTOB CbiIrpaTb CaM. NaptHep, KOTOPOMY Hafio
BbIVIPbIBaTb BbIbopbi, HaAo BKaAbIBaTbCA B KOHUENLIMIO TEKYLUEFO HAL|MOHA/bHO-MCTOPNYECKOLO pasBUTHA.
SAKAIOYEHME
TaKOro pofa KOHTeKCT O4eHb None3zeH ANA BCeX CTpaH BPMKC. 60, kak ropopuaM B nuTepcKux ABOpax: «Ka-
*Aomy A6pamy cBoa nporpamma». Nonbitka AeueHTpanv3aunn, a rae-To v xaoTM3auMN npoueccos HacaxKge-
HUA EQMHOW MopmMb! «NpANKUUA» B NO3MLUMOHUpOBaHuN rocysapcTs — 3TO Halwa 3agaya.
V\ kak pas TaKoro poga npoexT nokayKeT BCemy Mupy, YTO OrfpomHaA 130-mmAnMOHHas CTpaka C Camon npo-
TAYKEHHOM rpaHvuer c CLUA, HaKOHeL, NpocHyNacb. OfHaKAbI CKa3aN, YTO AMEPUKAHCKOK
3KOHOMMKE OYeHb M0Be3N0: CNeBa M CNpaBa MONAT pblObI, HaBepxy cnuT KaHagla, a BHU3Y TaHUyeT Mekcnka.
Takum o6pa3om, CLA npocto He MMelCT yrpo3 M He Tpa;rAT CUI Ha MX KOMNeHCaUMHO. Bce yrpo3b! NPOUCXOgAT
B HEKOEM 330TEPUYECKOM MPOCTPaHCTBe BCEMMPHO!O 3anafja M aMePVKAaHOLWEHTPHYHONM LMBMAM3aLINN.
OuesupHo, uTo HeEOBxXOAMMO NoAAepxKaTb 3aKOHHOe NpaBoe npaBuTenbcTBo V3pauna
NpOTMB NeBbix, KOTOPbIX nozLepKvBaeT fn CLUA.
OvesvgHo TawKe, 4YTO eBpeicKoe HaceneHve CLUA packonoTo mo OTHOUIEHMIO K
V3PaMNbCKMM VM YKpavHCKMM TeMaM Tak xe, KaK HaceneHve Camoro Vispauna.
Bospeiictave Ha o6ujecTBeHHOe MHeHVe B V3pavne GyfeT CKka3bIBaTbCAH WM Ha
OGLIECTBEHHOM MHeHVM eBpelicKux v36vpatenei B LiTaTax HakaHyHe BbIOopoB
npesmgenta 2024 roa.
KoHKpeTu3aunaA npoekta. 3aqaun
1; OpraHu3ayua KOMMNEKCHOFO MOHUTOPUHTa:
e Tlonyyenve onepatuBHo uxcbopmaumn oO ny6nuKaynax B OcbuuanbHbIx
vuzgaHnax Mspanna B Kntove TJ] Mpoexta;
« CoctasneHve, nocTosAHHas akTyanuzalys MeqVakapTbl B COLIMAMbHbIX CETAX
(OM, knioyeBbie Gnorepbl) — NOVICK BbICKasbIBaHM, TPeAOB B paMkax TeM
Mpoexta;Page 266 VUspaunp | Mpoext
e Coo6weHve Oo KMIOYeEBLIX WHCPOPMALIMOHHbIX NMoBOAax (COObITHI,
BbICKa3biBaHvii JIOM, 3aaBneHui nugepos) B pamKax Mpoexta yepe3 KaHan
onepaTvBHoro OnoBeleHMA — CucTema “Tlynbc”;
e C6op AaHHbIX coLMonorMueckux yccnegoBaHui no tTemMam [lpoekta,
ony6nukOBaHHbIX B OTKPbITbIX ACTOUHMKaX.
2, AHanuTMy4eckan paboTa:
e Pa3zpa6oTKa pexomeHAaun no OCcBeLIeHHIO MUHCPOPMALIMOHHbIX NOBOAOCB;
e CwutyaTMBHbili aHanu3 pesoHaHCHbIx 3anBNeHui, BbICTyNNeHUN, COObITHN;
e Vsyyenve aHHbIX ONYONWKOBAHHbIX B OTKDbITbIX MCTOYNHMKAaX
coumonoruyecknx ViccneAoBaHU, NOATOTOBKa @HANUTMYECKMX BbIBOAOB,
e Paspa6oTKka MOoKnNagoB cnuKepoB Ha pa3snV4HbIX MeEPONPMATMAX B PaMkax
Mpoexta; paspa6otka Tem CeMuHapos / KpyrnbIx CTONOB B paMkax Mpoexta.
3. Co3gaHve v BegeHve ceTM OHNAanH-CMU (Bo3MOxKHa OpraHvzalivA NOA eAMHbIM
6peHaom “HopmanbHbin V3spannb”'):
e floptan-arperatop HoBocTen;
e TIl-kaHanbl;
® aKKayHTbi B TBMTTeP, cbeiic6yk, MHCTarpaM, 43eH, fOTy6-kaHan.
4. Pa6ota no TexHonoruueckomy “pasroHy” KOHTeHTa B CeTM — TapreTMpOBaHHan
pexnama.
5. Megvapa3smewenve (ny6nukayun maTepvanos B TT-KaHanax uv CMV Vspanna).
| Mpeanaraetca cozmaHve nonHOWeHHoro TpexbaAsbI4Horo (pyccKMi, UBPMT, aHMrnuiicKui), OPMEHTMPOBaHHOTO
Ha eBpelickne coo6ujecTsa no Bcemy Mupy, Npexge Bcero B Mspanne u CLUA «npasoro» VHcpopmMaL|MoHHoro
OHNawH-Npoexta.
®opmanbHo vpeonorveit Mpoekta DOMKeH GbITh yMepeHHO PENMIMOSHBIM CMOHM3M CBETCKMX eBpees
(MpuGnusutenbHo cooTseTcrByeT MAeONorn4ueckMM OCHOBaHUA NapTHH «JIMKkyA» UM «Penurno3HbiA CMOHMSM»,
BXOPALIMX B NPABUTENbCTBeEHHY!0 KOAMMUMI0).
BaxkHan YacTb ugeonormu Mpoexta — Gopt6a c 3aG6BeHHeEM NAMATH O XONOKOCTEe, TOYHEE, O TOM, KTO
VMeHHO 3aHMMarca YHAYTOKeHMeM eBpees Ha YKpaute, B Benopyccuu, B Nonbuie “ B Poccuu — ato 6binn
GaHAepoBLubl, ykpavHckne HAMOHANMCTbI, KOTOPLIM HacregyeT COBPeMeHHOe YKPaMHCKoe rocyAapcrTeo.
JlereHga Mpoekta — ero GeckopbicTHO AenaloT HepaBHOAYWHbIe AKTMBUCTHI, U3paWNbTAHE, YACTb M3 KOTOPbIX
npegnountaeT paGoTaTb AHOHMMHO.Page 267 Uspannb | Npoexr
6. Pa6ota B KoMMeHTapuAx — Nognepxka TeM B paMkax TJ, aTaku Ha ONNOHEHTOB.
7. Mabpuka no npovsBopcTBy KOHTeHTa (B T.4. CG TexHONOrMen “OONONHEHHON
peanbroctn”):
® WOPTpHAbI KM NOCTbI B COLICeTAX;
® KOMMeHTapMui;
® NOHTPUMABbI,
® BMZeOpomnKN, B TOM Ycne aHUMMpOBaHHbie;
® MeMBI, nvKUM;
® Kapukatypbi, cboToxKabbi.
KomaHga 4 OObembI paboTt
NMpoektHaan KomaHza:
® Mevemxmeut — ynpaBneHnve NpoeKTom.
[pynna moxuTopmirra CMU — exkegHeBHbIM MOHMTOPUHT.
e [pynna moHnTopuHra COLICeTen — BLIABNeHVe PESOHAHCHbIX BbICKASbIBAHUM JIOMos.
e fpynna avanvtuky — nogroToBKa aHanuTMyecknx MaTepvanos, COLMCCNegoBaHnn.
e [pynna kpeatusa — T3 Ha npovsBogcTBo, cneunpoekTbi, CO6CTBeEHHbIe MHCPONOBOAbI
(cdenxu).
e fpynna npon3BogcTBa — KapTMHKM, TEKCTbI, BAAEO.
e [pynna co6kopos Ha Tepputopun V3spanna uv mMeqnameHeppxep.
e Bwpo nepesoszos.
e fpynna pacnpoctpaHeHua — pasMeLeHve NOCTOB M KOMMEHTaApMeB B COL.CETAX.
e [Tpynma otyeTHocTh — cOop cTaTMcTMKM WM NMoOMb30BaTeMbCKUX peak\ni,
cbopmupoBaHne OTHeTOB.
O6tbemb! paGor:
e Moxwutopuer CMV u coucetel — 1 B GeHb.
e AxvanuTnyeckve cnpaBKM no CounccnegoBaHnaAM — 1 B HeEgenio.
ooo
eoPage 268 Uspannb | Npoext
AHanuTn4eckie CUTyaTMBHble MaTepuanbi — no 3sanpocy.
KaHan “llynbc — Uspaunb” — onepaTuBHoe onoBeleHve 0 COObITMAX MU 3AABNEHUAX
— MNOCTOAHHO.
Texctbi ny6nuKkauni (Ha noptan / Ha “sepKana” u3qaHui) — 4 B AeHb.
TekcTbI NOCTOB (Ha aKKaYHTb! B COL|CeTAX) — 20 B eHb.
KommexHtapuu — 300 B DeHb.
Tpadbuueckuii KpeaTMBHbIii KOHTeHT (MeMbI, KapMiKaTypbl) — 3 B DeHb.
BugeoponuKn — 3 B Hegenw.
AQMMUHUCTPMpOBaHHe KaHasioB, akKayHTOB, NOPTana — €xXEQHEBHO, NOCTOAHHO.Page 269 EXHIBIT I3APage 270 Disaster 24: The US will soon have its hands full with issues other than Israel
Defense Ministry, United States, war in Gaza
The elections in the United States will lead to an unprecedented internal confrontation. The
most pessimistic experts are talking about the possibility of the country’s breakup and even
a large-scale civil war. How will this resonate in the outside world and, most importantly,
in the Middle East?
The US elections will undoubtedly become the highlight of 2024. They will overshadow any
possible turns in any war due to one simple reason — there is no chance that any election outcome
will be accepted not only by the country’s population, but also by the elite.
The decision of the Colorado Supreme Court to remove @Bittetenetrom the state ballot in
2024 opened the road to the de-legitimization of the election results. The court ruled that the
candidate Candidate A is not a suitable candidate for the US presidency
because of the 14" amendment’s “ban of insurrectionists”. The amendment states that officials
who have taken the oath to uphold the constitution are prohibited from holding office in the
future if they “participated in a rebellion”.
“No person <...> shall hold any office, civil or military, under the United States, or under any
state, who, having previously taken an oath, as a member of Congress, or as an officer or the
Unites States <...> to support the Constitution of the United States, shall have engaged in
insurrection or rebellion against the same, or given aid or comfort to the enemies thereof.”
The amendment was adopted in 1868, after the American Civil War, and was aimed at infringing
upon the voting rights of Confederate statesmen in the South, which was part of the occupational
policy of the victorious North during the so-called “Reconstruction”. In other words, the appeal
to it is already a sign of the serious divisions in society, comparable to the antagonism of the
Civil War. It is worth mentioning that classifying the march on the Capitol on January 6, 2021,
as an “insurrection” and classifying rene role as “participation in the insurrection” both
look like a fairly controversial statement, if not outright lawlessness. It is not a surprise that
members of the Supreme Court received a flood of threats since such ruling.
The State Supreme Court’s decision will be delayed until January 4, 2024, until (@eriteRraRt roan
appeals at the Federal Supreme Court. It is clear that the majority of (URSHIZOUSEeansaeas Within
the Federal Supreme Court will overturn this decision, yet it will not exhaust the narrative.
Colorado is a unique state. Traditionally a (URSE Meine anuamal State, it has voted for the
Meee rings) in the last three elections. Most likely now it is the (URS MIORITE Bisa s) who
will receive nine electoral votes in the state. It may not sound like much, yet still... QETHGHGETTAN
does not really need Colorado by itself. The main struggle is supposed to unfold in six so-called
“swing states” (swing state) in which neither (GAMO elm enaaes) nor (OReme ae) tiaterst me eclasraNPage 271 have consistent support: Arizona, Georgia, Michigan, Nevada, Pennsylvania, and Wisconsin.
That is where the main struggle will unfold.
The results of the latest polls in these states show that @RItIGETOwA is definitely ahead of
GemelGEWems| in five states: Nevada — 52:41, Arizona — 49:44, Georgia — 49:43, Michigan — 48:43,
and Pennsylvania 48:44. Only in Wisconsin maintains a slight advantage ~ 47:45.
However, judging by the overall dynamics, this won't last long.
However, Colorado has set a legal precedent that will spread to other states as well. Sixteen more
states have decided to follow Colorado’s example and demanded for ex-president GET YaieEitapay to
be banned from the primaries.
According to a significant number of experts, in the event of @RINIREIKeBAWS Victory (his victory
becomes more and more apparent if he cannot be removed from the elections), the leadership of
the democratic states may refuse to recognize the result by declaring the decision of the Supreme
Court unconstitutional. In the event of ORs removal, the CST will
refuse to recognize the election results. According to many experts, the emergence of separate
wonicegetenmem.).S. Political Party ARWMG§U.S. Political Party BERRIES re voambl cob
Movie director UBSHEdaisteme is making a film about a future civil war in the United States; the
film will be released by the time of the elections. It is not outside the realm of probability that the
events described in the film will begin immediately after the premiere.
How does this prospect threaten the rest of the world? Even if it does not lead to a civil war, a
purely political internal division will be enough for the US international politics to fall into a
stupor.
Today’s world is a collection of many frozen conflicts. Almost all of them are frozen, but many
of them have been really ignited by US efforts. Americans have not allowed any of those
conflicts to turn into final victory by either side, which would guarantee peace in a given region
for at least 15-20 years. Our war with HAMAS is onc of those conflicts that was switched on
when the plan to change the power in Israel “peacefully” through “a color revolution” failed...
In some ways, this activity resembles the activities of a terrorist, who is rigging with explosives a
house of civilians: “Should something happen to me, we all fly into the air together.” A world
rigged with explosives served as an additional guarantee of the American hegemony. But when
the terrorist suddenly falls in an epileptic fit, the explosives start to explode at random...
The world is facing a period of bloody chaos until the regional powers restore at least some
order. Unless, of course, those powers themselves fly at each other’s throats...
For Israel, wrapping the US in a cocoon of internal problems would mean international isolation,
greater than the one Russia is experiencing now. Europe has clearly demonstrated its readiness to
join the camp of Israel’s enemies. It is only the American leash that maintains a fragile balance.
,Page 272 It is important to understand that Europe will not be able to realistically help Arabs, as Europe
will be completely taken by what is happening by its eastern borders. There, without the
American support, Ukraine will be rapidly dismantled, and Russian troops will reach the
European border.
Israel will find itself in a situation when the external isolation will be compensated by the
absence of any external deterrent. We will fight the war as we see fit, without the American
shouts and unnecessary losses caused by the forced containment of the power of attacks on the
Arabs. In some ways, such situation would probably be preferable to what is happening today.
Conclusion:
Last year 2023 showed that the United States is deceiving Israel. If there is no support in either, the consequences will be horrendous for us.
Comments:
1. Getting the US variable out of the Middle East equation would not be the worst prospect.
Given the toughening of the @RRGIREIegs) administration’s position, assistance from the
US will dwindle, while the US interference will continue to grow.
2. Acivil war might be too bold of an assumption, yet a deep division is inevitable. The
division will be followed if not by a complete rejection of the involvement in the foreign
political activity, then by its significant weakening.
3. The solution of the Gaza problem will cost several years (or several decades) of
international isolation.
4. A civil war in a country with nuclear power would lead to an overly unpredictable course
of events. Let’s hope that the internal division will freeze at the “cold war” stage.
5. A war in the US is inevitable anyway, although it may not happen right after this election.
[CESPE aoe auags; are leading the United States in the path of Southern Rhodesia,
which turned into Zimbabwe. It means that the black population, despite all the
concessions from the whites, sooner or later will simply try to slaughter them.
Please write a comment of 200 characters on behalf of an average Israeli puzzled by the painted
prospect, yet who does not find it to be too terrible and who even finds some advantages in it.Page 273 EXHIBIT 13BPage 274 Katracrpoga 24: CHIA sexope craner ne 20 Wspania
MO, CIA, sotua B ase
Bet6opei 6 CIITA npusedym Kk Gbecnpeuedenmnom eHympennemy
NPOMUGOCMOAHUIO, CaMbIe NeccuMUCMU4Hble 9KChepmol Z060pam oO
603MOHCHOCMU PacKoO.a Cmpanoi u dasce MacuumabHOU z2pancdancKou eolinel.
Kak 2mo om3o6emca 60 6Heunem Mupe, U, 6 hepeyto ovepedd, Ha bausicnem
Bocmoxe?
[aBHBIM coOniTHem 2024 roa cTaHyT, HeCOMHeHHO, BbIGopsI B CLITA. Onn
3aCJIOHAT JOObIC BO3MOXKHEI€ MOBOPOTEHI B W060! BOHE To OAHOM MpocToH
IIpHunHe — HeT HMKaKHX MaHCoB Ha TO, YTO WHOGOH pesybTaT BEIOOPOB IpHMyT
He TOKO HaceJieHHe CTpaHbl, HO H IIHTEI.
Jlopory K TenHTHTHMallM pe3yIbTAaTOB — a pemleHue BepxosHoro
cyfla witaTa Konopano 06 uckmoweHHH 43 H30HpPaTebHOTO
OrojueTeHA Witara B 2024 rony. Cya NocTaHoBH, YTO KaHAMLaT OT
llapTHu He ABJIACTCA MOUXOUANIHM KaHTHaTOM B
TIpesuyeHTE CIA u3-3a «salpera MoBcTaHies», IpexycmoTpenHoro 14-H%
MOMmpaBkou. ITa WOmpaBka PacHT, YO TOMKHOCTHSIM JHWaM, aBuIHM KIATBY
TlosWepxKUBaTS KOHCTHTYIMIO, 3alIpellaeTca 3AHMMaTS AOIDKHOCTH B OyTyIIeM,
eCIM OHH «y4aCTBOBaJIM B MATE2KE)>:
«HH OHO JIHIO He MOXKeT 3aHHMATH <...> Kaky10-J1H60 JOJDKHOCTE, TparxkaHCKyWIM BOCHHY10, yupexkxqeHHylo CoequHeHHEIME Iltatamu wim KakKHM-J0HHITaTOM, €CJIM OHO B KayecTBe WieHa KOHTpecca WIM AOJDKHOCTHOTO JMIa
CoenuHenHer I Tatos <...> panee IpHHAB Ipucsry 0 TOM, 4TO OyeT
TlowWepykKHBaTb KouctTutyumo CIA, BsrocieyqCcTBHH yaacTBOBaJIO B MATe2KEe WH
BoccTaHHM OpoTus CIITA mo oka35IBaylo NOMOUIb WIM NOWWepxKKy HX Bparam)».
Tlonpaska Opa mpHHata B 1868 rogy, nocue [paxganckoit Bolte B CILIA, u
Oba HalpaBieHa Ha yolemMieHHe H3OnpaTeIBHEIX IpaB rocyTapcTBeHHBIX
neatenei Kondeepaliuu 10oKHEIX LITATOB, YTO OBO YACTHIO OKKyNaljMOHHOK
NONHTHKM NoGesquTeNei-ceBepsH B IepHor T.H. «PeKOHCTpyKIMm. T.e. camo
oOpalllenne kK Heli yKe ABILAeTCA IpH3HaKOM CepbesHelilero packolla B OOMIECTBE,
CpaBHHMOTro C aHTarOHH3MOM BpeMeH 'paxxaaHcKoi BoubI. He ropops yxe TOM, 4TO H KBamMpuKanua Mapma Ha Kanutonuit 6 sapaps 2021 roa, kak
«MATEXK, H KBaIMpUKAaHA POI B ITHX COOBITHAX, KaK «y4aCTHE B
MATO2KE)> BLITILALAT KaK JOCTATOYHO ClIOpHoe YTBep»KTeHHe, CCIM He IpAMOH
FOpHAHAeCKHH npow3BoN. HeyAMBUTEBHO, 4TO WieHbI BepxoBHoro cya Mocue
TaKOTO pellleHHA CTONKHYIIHCL C IOTOKOM yrpo3.Page 275 Pemtenne Bepxosubiii cy mirata 6yyeT oTNO%xKeHO Zo 4 aHBapa 2024 roga, MoOKa
He Nofact allesiayHI0 B BepxoBybml cyy CILIA. Ouesnguo, uTo
60/MMHCTBO B BepxosHom cyze CLA ormeuut 9To pemienne.
Ho 5To OTHIODb He HCYepMaeT Crox*KET.
Konopayo — cheympuueckuit mat. TpayqvuHoHHO OTLalonMi Touoca 3a
| OH loculeqHHe Tpoe BLIGOPOB ToMOCcoBal 3a PF u
ceituac, B O6MIeM-TO, TOxKe, CKopee BCErO, HMCHHO AeMOKpaTbI Momy4aT 9 rosocos
BEIOOPLIHKOB wiTata. Hemuoro, Ho Bce-TakH. Cam m0 ce6e Konopayo | | He
OueHB HyKeH. OcHoBHad OopbOa ZOsDKHa pasBepHYTBCA B LICCTH T. H.
«KONeOMOMMXCA LITAaTaX» (Swing state), rye TpaqHuUHOHHO HH a
ae 5 HMEIOT YCTOHIMBOH ToyepxKH: Apu3ona, J>KopIDKHA,
Myuuran, Hesana, lescunspanua 4 BuckoncHH. BoT Tam H pa3BepHeTca
oOcHOBHaad OopbOa.
PesysIbTaThI MOCHe7HHX OMpOcoR B ITHX MITaTax MOKa3bIBaI0T, 4TO B UATH H3 HX
BE yscpenno ollepexkaeT | | Hesaya — 52:41, Apu3ona — 49:44,
J>xopmpxna — 49:43, Muauran — 48:43, [lencunbBanua — 48:44. TonpKko B
BuckoHcHHe WN coxpanser HeOoNbIIOe IpeHMyliecTBo — 47 mpoTus 45. Ho,
cya 10 OOiieH THHAaMMKe, ITO HeHaONro.
Ho Konopayo cosyan jopHyWueckKHH IpellezeHT, KOTOpEIM paciliIpoctpaHHTEca H Ha
upyrve urate. Enje niecTHagats WITaTOB peliMiM MOcNezOBAaTS IIpHMepy
Koslopayo 4 noTpeboBam He JOIycTHTb 9kc-pe3suzeHTa CILIA
AO lipaliMepu3.
Ilo MHCHHIO 3HA4YHTeIBHOTO YHCia IKCHEpTOR, B CIydae NOOe DBI a ona
CTaHOBHTCaA Bce Ooslee OUEBHAHOH, ECM ETO H€ CyMEIOT OTCTPaHHTb OT BEIOOpoB),
PYKOBOZCTBO TeMOKpaTH4eckHX IITATOB MOXKET OTKA3aTbCA MIpH3HaBaTb HX
pe3yIbTaT, OObABHB pemieHHe BepxoBHoro cya HEKOHCTUTYHMOHHEIM. B ciryaae
*Ke OTC — | Pe3yIbTAaTbI BEIGOPOB OTKAKYTCA IIpH3HaBaTb
Ilo MHEHHIO MHOrHX SKCIeEpTOB, BOZHHKHOBCHHE OTACJIBHEIX
Koneyepannii H IITATOB IIpeACTaBAeTCA
BeCbhMa BepOATHEIM.
Pexuccep I civacr K BbIOopaM MHIIbM O OyAyMleH rpaxTaHcKol
BoHHe B CIITA. He uck104ueHO, YTO OMMChIBACMbIe B HEM COOBITHA HAYHYTCA
cpasy llocule IpeMbepEl PHIbMa.
Wem Takad NepclieKTHBa Ipo3HT BCeMy OCTaJIbHOMY Mupy? /laxe ecum qen0 He
WOuper Jo rpakyaHcKoli BOMHEI, JocTarouHo SyyeT YMCTO NOMMTHYeCKOTO
BHYTPeHHero packola, 4TOOnI MexKTyHapozHad NowMTHKa CILIA Brana B CTynop.
CeroyqHaAMHMl 2ke MUp TpeycTaBaeT Cobo COBOKYNHOCTh MHOXKECTBA
3AMOPOXKCHHBIX KOHDIMKTOB. [louTH BCe OHH 3AMOpOXKEHEI, a MHOTHe H3 HHX TOPage 276 TOro pa3sox0KeHbI Crapanuamu CILIA. Hu ofHomMy 43 HHX aMepHKaHUBl He
NO3BOIMIM JOHTH TO OKOHYATeIEHOH NobeABI OHOH 3 CTOpOH, 4TO
TapaHTHpoBasio Obi Mp B KOHKpeTHOM perwoue no KpaiiHeli Mepe Ha IpoTsKeHHM
15-20 ner. Hama Botta c XAMAC — om 43 TaKHX KOHIMKTOB, KOTOPHIM 6B
BKJIIOUEH, KOIZa NOTepnel KpyHleHve WiaH CMCHHTS BACT B M3pane «MHPHEIM
IIYT€M>), Yepe3 “IBETHY1IO PEBOIIIOMHIO»>...
B 4eM-TO 91a JeATeMBHOCTS HaNOMHHacT JeATCMbHOCT Teppopucta,
MHHHpytolero OM C MHPHbIMH 2%KHTeIAMM: «EcM CO MHOH 4TO-TO CIy4uTcaA — Ha
BO3]IyX B3JICTHM BCe BMeCTe»>. 3aMHMHMPOBaHHBI MHP CINK JONOWHUTeIBHOH
TapaHTvei aMepukaHckoH reremouun. Ho korya TeppopucT BOpyr HayHHaeT
OHTECA B SMIMIeNTH4YeCKOM NpHNayKe — MHHbI HAYMHAIOCT B3PbIBaTbCA B CILyYaHHOM
HOPADKe...
Mup 2yeT nepHog KpoBaBoro xaoca, NOKa perMOHAJIBHEIe [ep2KaBbl HABeEYT XOTB
KaKOH-TO NOpANOK — €CJIM, KOHEYHO, CaM 3TH [ep KaBbl He BUCHATCA ApyT Dpyry B
TIOTKy...
Ana M3panna 3akanpanve CUIA B kokoHe BHYTpeHHHX MpoOJeM O3HayaeT
MCXKTYHAapOAHY!O H30JALHIO, OOMbITYIO, 4EM Ta, B KOTOpOH ceityac HaXOMHTCA
Poccua. Espona HarmagHo JeMOHCTpHpyeT rOTOBHOCTS MepelirH B Jarepb BparoB
Us3pansa, TOMBKO aMepHKaHCKH NOBOLOK NOATepKUBaeT XPyMKOe paBHOBEcHe.
Apyroe Zeno, ur0 MOMO4B apabam Ae0M Espona 6yaeT He B COCTOAHHH — OHA
OyHeT HOMHOCTHIO NOroMeHa MpOHCXOTANIMM Ha CBOMX BOCTOUHBIX [paHulax,
rye 6e3 amepHKaHCKOH NOaTepxKKH IPOH30H eT CTpeMHTCIBHEM JeMOHTaK
YkpanHEl, 4 pyCcKHe BOlicka BbIligzyT Ha rpanuiry EC.
Vi3panit OkakeTca B CHTyallHH, Kora BHeENIHA H30NMIUA OyneT
KOMIICHCHPOBaTbCA OTCYTCTBHEM KaKOTO-IHO0 BHELIHETO Cep2xKHBalolero
dbaxropa. Msi 6yaem BecTH BOiiHy Tak, KaK CUMTaeM Hy2KHBIM, 6e3 aMepHKaHCKHX
OKPHKOB H JIMIUHHX MOTepb, BEISBAHHBIX BbIHYKCHHBIM C]epxKHBaHHeM MOL
yaapos m0 apaOam. Bo3Mo2xHO, B KaKOM-TO CMBICJI¢ Takad CHTyallMa OKaKeTCA
OosIee NpeTMOUYTHTeIEHOH, YeM TO, YTO MPOHCXOUT cerogHA.
TlogqBognKa:
I[pomenmuit 2023 roy noka3am: CILIA oOMaHsiBatoTt M3pannp. Ecru u B roay noyepxku He GyzerT, NocneycrBus TILA Hac 6ynyT yKacHBIe.
Kommeutapuu:Page 277 1. BrikouHTb 43 OWKHEBOCTOUHOLO ypaBHeHHA TlepemeHHyro CIITA — He
caMaa Xyfllad MepcnekTuBa. YaHTEIBad yKeCTOUCHHe NOSHOHH
aMHHMcTpanHH — aMepHKaHcKad TOMO OyzeT CXOJHTb Ha HET,
a IIOMeXH C ee CTOPOHEI OyTYT TONBKO BO3pacTaTB.
2. [paxkqaHckad BOHa — CIHUIKOM CMesI0e FOMyMeHHe, HO rmyOoKHH pacKol
Hen36exeH. A 43 HELO CileqyeT CCH He TOMHBIM OTKA3 OT
BHeMIHenoNHTHYeCKOM AKTHBHOCTH, TO, CyMeCTBeHHOE ee ocaOmeHHe.
3. Penienue npobmemb [a3bl CrouT HECKOJIBKMX (HJIM HECKOJIBKHX J[CECATKOB)
JleT MCKTYHAapOAHOM H3OIANMH.
4. [paxjaHckas Bola B CIpane c A}epHbIM Opy2KHeM — CJIHDIKOM
Helpescka3yeMBbIM Xo coOLITHH. byeM HayeaTbca, BHYTPpeHHU packoll
3aMep3HET Ha CTaQHH «XOOUHOH BOMHED>.
5. Boitua 8 CLA Hen36exHa B OOM cirydae, IYCTb TaxKe He Mocie THX
BBIOOPOB. BE
lIpespaTHBuieiica B 3uMOaOBe — a 9TO O3HA4YACT, YTO YepHOe HacelIcHHe,
HeCMOTps Ha IHOObIe ycTyNkH OelILIX, paHO HIM M03MHO MOMbITaeTCa HX
HpOCTO BEIpe3aTB.
Hanmumatre KOMMecHTapH B 200 3HakOB OT HMCHH pAOBOTO H3paHIbTAHHHA,
o3aayeHHOrO HapHCOBaHHOH NepcieKTHBOH, HO He HaXOMAMero ee CHIIKOM
yKaCHOH HW Jake HaXOUAlero B Hel CBOM IIEOCHI.
PDF Page 1
PlainSite Cover Page
PDF Page 2
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 1 of 277
IN THE UNITED STATES DISTRICT COURT FOR THE
EASTERN DISTRICT OF PENNSYLVANIA
UNITED STATES OF AMERICA
)
)
)
)
)
v.
CERTAIN DOMAINS
Case No.: 24-mj-1395
Filed Under Seal
AFFIDAVIT IN SUPPORT OF SEIZURE WARRANT
I,
being duly sworn, hereby declare as follows:
INTRODUCTION
1.
I make this affidavit in support of a warrant for the seizure of 32 internet domains
(the “SUBJECT DOMAINS”) that have been used by the Russian government and Russian
government-sponsored actors to engage in foreign malign influence campaigns colloquially
referred to as “Doppelganger,” in violation of U.S. money laundering and criminal trademark
laws. As set forth below, since at least 2022, under the direction and control of the Russian
Presidential Administration, and in particular Sergei Vladilenovich Kiriyenko (“KIRIYENKO”),
the Russian companies Social Design Agency (“SDA”), Structura National Technology
(“STRUCTURA”), ANO Dialog, have used, among others, the SUBJECT DOMAINS, which
include “cybersquatted” domains 1 impersonating legitimate news entities and unique media brands
created by Doppelganger, to covertly spread Russian government propaganda. As reflected in
SDA’s notes from strategy meetings with KIRIYENKO and other Presidential Administration
officials, SDA project proposals, and other SDA records obtained during the course of the
investigation, some of which are attached as exhibits hereto, these actors designed the content of
1
Based on my training and experience, I know that cybersquatting is a method of registering a domain
intended to mimic another person or company’s domain. Cybersquatting is used to trick Internet users into
believing they are visiting the legitimate person or company’s website.
1
PDF Page 3
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 2 of 277
such propaganda to, inter alia, reduce international support for Ukraine, bolster pro-Russian
policies and interests, and influence voters in the U.S. and foreign elections without identifying,
and in fact purposefully obfuscating, the Russian government or its agents as the source of the
content. Among the methods Doppelganger used to drive viewership to the cybersquatted and
unique media domains were the deployment of “influencers” worldwide, paid social media
advertisements (in some cases created using artificial intelligence tools), and the creation of fake
social media profiles posing as U.S. (or other non-Russian) citizens to post comments on social
media platforms with links to the cybersquatted domains, all of which attempted to trick viewers
into believing they were being directed to a legitimate news media outlet’s website.
2.
I am a Special Agent with the Federal Bureau of Investigation (“FBI”). I became a
Special Agent in January 2017 when I was assigned to the Philadelphia Division’s
Counterintelligence Squad. As part of the Counterintelligence Squad, my duties include, among
other things, the investigation of foreign malign influence, espionage, and foreign intelligence
activities against the United States. I have successfully completed the Counterintelligence
Operations Course offered by the FBI Counterintelligence Training Center, where I was exposed
to a variety of counterintelligence techniques, cases, and exercises. I have participated in the
execution of numerous search warrants involving electronic evidence, among other investigative
techniques.
3.
As a federal agent, I am authorized to investigate violations of the laws of the
United States and to execute warrants issued under authority of the United States. I have attended
multiple training courses related to managing counterintelligence and espionage investigations. I
have also been involved in various types of electronic and physical surveillance, the execution of
search warrants, and interviews of crime victims, witnesses, and subjects. Where I assert that an
2
PDF Page 4
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 3 of 277
event took place on a particular date or at a particular time, I am asserting that it took place on or
about the date or at or near the time asserted. Similarly, where I assert that an event took place a
certain number of times, I am asserting that the event took place approximately the number of
times asserted. Likewise, when I assert that a transaction involved a certain amount of money, I
am asserting that the transaction involved approximately that amount of money.
4.
The facts in this affidavit come from my personal observations, my training and
experience, records seized pursuant to search warrants or obtained through legal process, and
information learned from other agents and witnesses. This affidavit is intended to show merely
that there is sufficient probable cause for the requested warrant and does not set forth all of my
knowledge about this matter.
5.
As set forth below, there is probable cause to believe that the SUBJECT
DOMAINS, 2 see Attachments A-1 through A-9, are property involved in a transaction or attempted
transaction in violation of 18 U.S.C. § 1956(a)(2)(A) (international promotional money
laundering) and 1956(h) (conspiracy to commit same) and/or property used, or intended to be used,
in any manner or part to facilitate violations of § 2320(a)(1) (trafficking in counterfeit goods or
services) (collectively, the “SUBJECT OFFENSES”). In particular, the investigation has revealed
that the SUBJECT DOMAINS have been purchased from U.S. registries or registrars by
individuals abroad who are working under the direction and control of the Russian government,
and in particular KIRIYENKO, including Ilya Gambashidze (“GAMBASHIDZE”), SDA, Nikolai
Tupikin (“TUPIKIN”), and STRUCTURA, which have been sanctioned by the U.S. government
and designated as SDNs, along with ANO Dialog, TABAK, and others, to advance their interests
and the interests of the Russian government, thereby causing U.S. persons to unwittingly provide
2
References to the individual SUBJECT DOMAINS in this affidavit will be denoted by bolded text.
3
PDF Page 5
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 4 of 277
goods and services to and for the benefit of one or more of the aforementioned SDNs, in violation
of the International Emergency Economic Powers Act (“IEEPA”). As noted above, the foreign
malign influence effort described herein and carried out by SDA, STRUCTURA, and ANO Dialog
is colloquially referred to as “Doppelganger.”
6.
Because the SUBJECT DOMAINS represent property involved in a scheme to
violate U.S. money laundering laws, they are subject to seizure, and therefore subject to forfeiture
pursuant to 18 U.S.C. §§ 981(a)(1)(A) and 982(a)(1).
7.
In addition, as a secondary basis for seizure and forfeiture, a subset of the SUBJECT
DOMAINS represent property used, or intended to be used, to commit or facilitate the commission
of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in violation of 18
U.S.C. § 2320, and therefore are subject to forfeiture pursuant to 18 U.S.C. § 2323(a)(1)(B) and
(b)(1).
8.
The procedure by which the government will seize the SUBJECT DOMAINS is
described in Attachments A-1 through A-9 hereto and below.
TECHNICAL INFORMATION
9.
Based on my training and experience and information learned from others, I am
aware of the following:
10.
Internet Protocol Address: An Internet Protocol (“IP”) address is a unique numeric
address used by computers on the Internet. An IP Address is a series of four numbers, each in the
range 0-255, separated by periods (e.g., 121.56.97.178). Every computer attached to the Internet
must be assigned an IP address so that Internet traffic sent from and directed to that computer may
be directed properly from its source to its destination. An IP address acts much like a home or
business street address—it enables computers connected to the Internet to properly route traffic to
4
PDF Page 6
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 5 of 277
each other. The assignment of IP addresses to computers connected to the Internet is controlled by
Internet Service Providers (“ISP”).
11.
Domain Name: A domain name is a string of text that maps to an IP address and
serves as an easy-to-remember way for humans to identify devices on the Internet (e.g.,
“justice.gov”). Domain names are composed of one or more parts, or “labels,” delimited by
periods. When read right-to-left, the labels go from most general to most specific. The right-most
label is the “top-level domain” (“TLD”) (e.g., “.com” or “.gov”). To the left of the TLD is the
“second-level domain” (“SLD”), which is often thought of as the “name” of the domain. The SLD
may be preceded by a “third-level domain,” or “subdomain,” which often provides additional
information about various functions of a server or delimits areas under the same domain. For
example, in “www.justice.gov,” the TLD is “.gov,” the SLD is “justice,” and the subdomain is
“www,” which indicates that the domain points to a web server.
12.
Domain Name System: The Domain Name System (“DNS”) is the way that Internet
domain names are located and translated into IP addresses. DNS functions as a phonebook for the
Internet, allowing users to find websites and other resources by their names while translating them
into the IP addresses that their computers need to locate them.
13.
Domain Name Servers: Domain Name Servers (“DNS servers”) are devices or
programs that convert, or resolve, domain names into IP addresses when queried by web browsers
or other DNS “clients.”
14.
Registrar: A registrar is a company that has been accredited by the Internet
Corporation for Assigned Names and Numbers (“ICANN”) or a national country code top-level
domain (such as .uk or .ca) to register and sell domain names. Registrars act as intermediaries
5
PDF Page 7
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 6 of 277
between registries and registrants. Registrars typically maintain customer and billing information
about the registrants who used their domain name registration services.
15.
Registry: A domain name registry is an organization that manages top-level
domains, including by setting usage rules and working with registrars to sell domain names to the
public. For example, the registry for the “.com” and “.net” top-level domains is VeriSign, Inc.,
which is headquartered at 12061 Bluemont Way, Reston, Virginia.
16.
Registrant: A registrant is the person or entity that holds the right to use a specific
domain name sold by a registrar. Most registrars provide online interfaces that can be used by
registrants to administer their domain names, including to designate or change the IP address to
which their domain name resolves. For example, a registrant will typically “point” their domain
name to the IP address of the server where the registrant’s website is hosted.
17.
Virtual Private Network: “VPN” means a virtual private network. A VPN extends
a private network across public networks like the Internet. It enables a host computer to send and
receive data across shared or public networks as if they were an integral part of a private network
with all the functionality, security, and management policies of the private network. This is done
by establishing a virtual point-to-point connection through the use of dedicated connections,
encryption, or a combination of the two. The VPN connection across the Internet is technically a
wide area network (“WAN”) link between the sites. From a user perspective, the extended network
resources are accessed in the same way as resources available from a private network-hence the
name “virtual private network.” The communication between two VPN endpoints is encrypted and
usually cannot be intercepted by law enforcement.
18.
Virtual Private Server: “VPS” means a virtual private server. A VPS acts as an
isolated, virtual environment on a physical server operated by a provider. VPS hosting providers
6
PDF Page 8
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 7 of 277
use virtualization technology to split a single physical machine into multiple private server
environments that share resources. Hosting companies maintain server computers connected to the
Internet. A server is a computer that provides services to other computers. Customers may use
those servers for various functions, depending on the services offered by the hosting company.
Some hosting companies offer simple cloud storage, which allows users to store files, much like
an external hard drive, and share or edit those files with other persons. Other hosting companies
allow users to operate and host websites on the Internet. Other hosting companies enable users to
operate a virtual private server, which allows the customer to run virtualized operating systems
from their computer over the Internet. Each VPS runs on a physical server but has its own selfcontained disk space, bandwidth, processor allocation, memory, and operating system. Multiple
VPS’s can run on one physical server. A hosting company can offer any combination of the above.
In the case of a VPS, each subscriber to a hosting company’s services has full administrative
control over the subscriber’s VPS, which enables the subscriber to choose to install software from
a menu the hosting company offers or store and run the subscriber’s own software.
19.
Who.is: A “Who.is” search provides publicly available information as to which
entity is responsible for a particular IP address or domain name. A Who.is record for a particular
IP address or domain name will list a range of IP addresses that the particular IP address falls
within and the entity responsible for that IP address range and domain name. For example, a Who.is
record for the domain name XYZ.COM might list an IP address range of 12.345.67.0-12.345.67.99
and list Company ABC as the responsible entity. In this example, Company ABC would be
responsible for the domain name XYZ.COM and IP addresses 12.345.67.0-12.345.67.99.
7
PDF Page 9
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 8 of 277
INTERNATIONAL MONEY LAUNDERING AND IEEPA
20.
Title 18, United States Code, Section 1956(a)(2)(A) (international promotional
money laundering) prohibits, in relevant part, the transportation, transmission, or transfer of funds
or monetary instruments from or through a place outside of the United States to a place within the
United States, with the intent to promote the carrying on of specified unlawful activity. Pursuant
to 18 U.S.C. § 1956(c)(7)(D), specified unlawful activity includes violations of IEEPA, which is
codified at 50 U.S.C. § 1701 et seq. In addition, any person who “conspires to commit any offense
defined in [Section 1956]” shall also be subject to criminal prosecution. See 18 U.S.C. § 1956(h).
IEEPA
21.
IEEPA authorizes the President of the United States to impose economic sanctions
in response to an unusual and extraordinary threat to the national security, foreign policy, or
economy of the United States. Pursuant to that authority, the President may declare a national
emergency through an Executive Order to deal with that threat.
22.
IEEPA makes it a crime to willfully violate, attempt to violate, conspire to violate,
or cause a violation of any order, license, regulation, or prohibition issued pursuant to IEEPA. 50
U.S.C. § 1705(a), (c).
23.
In 2014, pursuant to his authorities under IEEPA, the President issued Executive
Order 13660, which declared a national emergency with respect to the situation in Ukraine. To
address this national emergency, the President blocked all property and interest in property that
were then or thereafter came within the United States or the possession or control of any United
States person, of individuals determined by the Secretary of the Treasury to meet one or more
enumerated criteria. These criteria include, but are not limited to, individuals determined to be
responsible for or complicit in, or who engage in, actions or policies that threaten the peace,
8
PDF Page 10
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 9 of 277
security, stability, sovereignty, or territorial integrity of Ukraine; or who materially assist, sponsor,
or provide financial, material, or technological support for, or goods or services to individuals or
entities engaging in such activities. Executive Order 13660 prohibits, among other things,
transferring, paying, exporting, withdrawing, or otherwise dealing in any interest in property in
the United States owned by a person whose property and interests in property are blocked (a
“blocked person”), as well as the making of any contribution or provision of funds, goods, or
services by a United States person, to, or for the benefit of a blocked person, and the receipt of any
contribution or provision of funds, goods, or services by a United States person from any such
blocked person.
24.
The President on multiple occasions has expanded the scope of the national
emergency declared in Executive Order 13660, including through: (1) Executive Order 13661,
issued on March 16, 2014, which addresses the actions and policies of the Russian Federation with
respect to Ukraine, including the deployment of Russian Federation military forces in the Crimea
region of Ukraine; and (2) Executive Order 13662, issued on March 20, 2014, which addresses the
actions and policies of the Government of the Russian Federation, including its purported
annexation of Crimea and its use of force in Ukraine. Executive Orders 13660, 13661, and 13662
are collectively referred to as the “Ukraine-Related Executive Orders.” On February 21, 2022, the
President again expanded the scope of the national emergency, finding that the Russian
Federation’s purported recognition of the so-called Donetsk People’s Republic and Luhansk
People’s Republic regions of Ukraine contradicts Russia’s commitments under the Minsk
agreements and threatens the peace, stability, sovereignty, and territorial integrity of Ukraine.
25.
The Ukraine-Related Executive Orders authorized the Secretary of the Treasury to
take such actions, including the promulgation of rules and regulations, and to employ all powers
9
PDF Page 11
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 10 of 277
granted to the President under IEEPA, as may be necessary to carry out the purposes of those
orders. The Ukraine-Related Executive Orders further authorized the Secretary of the Treasury to
redelegate any of these functions to other offices and agencies of the United States Government.
26.
To implement the Ukraine-Related Executive Orders, the U.S. Department of the
Treasury's Office of Foreign Assets Control (“OFAC”) issued certain Ukraine-Related Sanctions
Regulations. These regulations incorporate by reference the prohibited transactions set forth in the
Ukraine-Related Executive Orders. See 31 C.F.R. § 589.201. The regulations also provide that the
names of persons designated directly by the Ukraine-Related Executive Orders, or by OFAC
pursuant to the Ukraine-Related Executive Orders, whose property and interests are therefore
blocked, are published in the Federal Register and incorporated into the SDNs and Blocked
Persons List (the “SDN List”), which is published on OFAC’s website. Id. at note 2.
27.
Among other things, E.O. 13661 prohibits United States persons from transferring,
paying, exporting, withdrawing, or otherwise dealing in the property or interests in property of a
designated person identified on the SDN List. E.O. 13661 § 1. These prohibitions include the
making of any contribution or provision of funds, goods, or services by, to, or for the benefit of, a
designated person identified on the SDN List. E.O. 13661 § 4. Any transaction that evades or
avoids, or has the purpose of evading or avoiding, or causes a violation of E.O. 13661 is further
prohibited. Id. § 5. “United States person” is defined as a United States citizen, permanent resident
alien, entity organized under the law of the United State or any jurisdiction within the United States
(including foreign branches), or any person in the United States. 31 C.F.R. § 6(c).
28.
On March 2, 2021, OFAC announced sanctions designating seven Russian
government officials, including First Deputy Chief of Staff of the Presidential Executive Office
Sergei KIRIYENKO, pursuant to E.O. 13661 for serving as officials of the Russian government.
10
PDF Page 12
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 11 of 277
In so doing, OFAC noted that KIRIYENKO “is reported to be President Putin’s ‘domestic policy
curator.’”
29.
On April 15, 2021, pursuant to his authorities under IEEPA, the President issued
E.O.14024, which declared a national emergency with respect to:
[H]armful foreign activities of the Government of the Russian Federation—in
particular, efforts to undermine the conduct of free and fair democratic elections
and democratic institutions in the United States and its allies and partners; to engage
in and facilitate malicious cyber-enabled activities against the United States and its
allies and partners; to foster and use transnational corruption to influence foreign
governments; to pursue extraterritorial activities targeting dissidents or journalists;
to undermine security in countries and regions important to United States national
security; and to violate well-established principles of international law, including
respect for the territorial integrity of states—constitute an unusual and
extraordinary threat to the national security, foreign policy, and economy of the
United States.
Similar to the Ukraine-Related Executive Orders, E.O. 14024 blocked the property and interests
in property of persons determined by the Secretary of the Treasury or the Secretary of State to
meet one or more enumerated criteria and prohibited, among other things, the provision of funds,
goods, or services by, to or for the benefit of such a designated person. To implement E.O. 14024,
OFAC issued the “Russian Harmful Foreign Activities Sanctions Regulations,” 31 C.F.R. Part
587. Persons designated pursuant to E.O. 14024 are identified on the SDN List. Id. at note 1.
30.
On February 22, 2022, OFAC announced additional sanctions against
KIRIYENKO pursuant to E.O. 14024. With respect to KIRIYENKO, OFAC again described
KIRIYENKO as “the First Deputy Chief of Staff of the Presidential Office” and reportedly “Putin’s
domestic policy curator.” OFAC noted KIRIYENKO had previously “served as the Prime Minister
of the Russian Federation and as the General Director of Rosatom State Atomic Energy
Corporation” and had been previously designated pursuant to E.O. 13661 in March 2021. Pursuant
to E.O. 14024, OFAC redesignated KIRIYENKO for being or having been a leader, official, senior
executive officer, or member of the board of directors of the Russian government.
11
PDF Page 13
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 12 of 277
31.
On March 20, 2024, OFAC designated GAMBASHIDZE and TUPIKIN, as well as
SDA and STRUCTURA, pursuant to Executive Order 14024 for “being or having been a leader,
official, senior executive officer, or member of the board of directors of SDA and Structura” and
“for being owned or controlled by, or having acted or purported to act for or on behalf of, directly
or indirectly” for the Russian government. In announcing the sanctions, the Treasury Department
stated, “We are committed to exposing Russia’s extensive campaigns of government-directed
deception, which are intended to mislead voters and undermine trust in democratic institutions in
the United States and around the world.” OFAC explained that GAMBASHIDZE, TUPIKIN,
SDA, and STRUCTURA:
[W]ere involved in a persistent foreign malign influence campaign at the direction
of the Russian Presidential Administration. SDA and Structura have been identified
as key actors of the campaign, responsible for providing GoR with a variety of
services, including the creation of websites designed to impersonate government
organizations and legitimate media outlets in Europe.
Leading into Fall 2022, Tupikin and Gambashidze implemented a campaign that
impersonated news websites, staged videos, and fake social media accounts.
Specifically, Tupikin and Gambashidze, via SDA and Structura, have implemented,
on behalf of GoR, a sprawling network of over 60 websites that impersonated
legitimate news organizations, and which used misleading social media accounts to
amplify the content of the spoofed websites. The fake websites appeared to have
been built to carefully mimic the appearance of legitimate news websites. The fake
websites included embedded images and working links to legitimate sites and even
used the impersonated site’s cookie acceptance page.
32.
SDA and STRUCTURA, both of which were founded by GAMBASHIDZE, are
Russian companies headquartered at adjacent buildings in Moscow. SDA is a public relations
company, specializing in election campaigns, with deep ties to the Russian government. SDA’s
website notes the work it has done for the Russian Duma, the Russian Ministry of Internal Affairs,
as well as multiple other Russian government entities. According to its website, STRUCTURA is
a technology company with experience using bots, offering website design, and coordinating
12
PDF Page 14
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 13 of 277
information systems among other services. STRUCTURA’s website also highlights the work it has
done for the Russian government and lists the same Russian government clients as SDA.
33.
According to OFAC records, at no time has KIRIYENKO, GAMBASHIDZE, 3
SDA, TUPIKIN, or STRUCTURA, or any of the individuals or entities described below, including
individuals known to have worked at their direction, obtained a license or other written
authorization to purchase, renew, transfer, use, or export the SUBJECT DOMAINS.
TRAFFICKING IN COUNTERFEIT GOODS
34.
Title 18, United States Code Section 2320(a)(1) (trafficking in counterfeit goods or
services), prohibits intentionally “traffic[king] in goods or services and knowingly us[ing] a
counterfeit mark on or in connection with such goods or services.” “Counterfeit mark” is defined
to mean “a spurious mark—(i) that is used in connection with trafficking in any goods, services,
of any type or nature; (ii) that is identical with, or substantially indistinguishable from, a mark
registered on the principal register in the United States Patent and Trademark Office and in use,
whether or not the defendant knew such mark was so registered; (iii) that is applied to or used in
connection with the goods or services for which the mark is registered with the United States Patent
and Trademark Office . . .; and (iv) the use of which is likely to cause confusion, to cause mistake,
or to deceive[.]” 18 U.S.C. § 2320(f)(1)(A). “Traffic” means “to transport, transfer, or otherwise
dispose of, to another, for purposes of commercial advantage or private financial gain, or to make,
import, export, obtain control of, or possess, with intent to so transport, transfer, or otherwise
dispose of[.]” 18 U.S.C. § 2320(f)(5). “Financial gain” is in turn defined broadly to include “the
3
On March 20, 2024, Special Agents of the FBI interviewed a member of GAMBASHIDZE’s family who
is a U.S. citizen and alerted the family member to the sanctions. In a follow up interview on April 3, 2024,
the family member confirmed they had spoken with GAMBASHIDZE regarding the sanctions after their
interview with the FBI. The family member confirmed GAMBASHIDZE was aware of the sanctions and
that GAMBASHIDZE claimed “what they say about me is not completely true.”
13
PDF Page 15
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 14 of 277
receipt, or expected receipt, of anything of value.” 18 U.S.C. § 2320(f)(2). Anyone who commits
an offense under this provision is subject to criminal prosecution. 18 U.S.C. § 2320(b)(1).
35.
According to the United States Patent and Trademark Office (“USPTO”), a
trademark can be any word, phrase, symbol, design, or a combination of these things that identifies
goods or services. The word “trademark” can refer to both trademarks and service marks. A
trademark is used for goods, while a service mark is used for services. Trademark owners can
register their trademarks with the USPTO, which maintains a database of registered and pending
trademarks that is available to the public to search. That database includes the date the trademark
owner applied for trademark registration, the date the trademark registered, and examples of the
trademark.
PROBABLE CAUSE
A. Overview of the Russian-Government-Directed Doppelganger Operation
36.
As set forth below, since at least 2022, under the direction and control of the
Russian Presidential Administration, and in particular KIRIYENKO, Russian companies,
including SDA led by GAMBASHIDZE, STRUCTURA led by TUPIKIN, and ANO Dialog led
by TABAK, have used the SUBJECT DOMAINS to engage in foreign malign influence campaigns
(which, as noted above, are colloquially referred to as “Doppelganger”) designed to reduce
international support for Ukraine, bolster pro-Russian policies, and influence voters in U.S. and
foreign elections by posing as citizens of those countries, impersonating legitimate news outlets,
and peddling Russian government propaganda under the guise of independent media brands.
37.
In general, Doppelganger, which is under the direction and control of the Russian
government, and specifically KIRIYENKO, consists of two related foreign malign influence
efforts.
14
PDF Page 16
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 15 of 277
38.
The first component of the Doppelganger campaign carried out by STRUCTURA
and SDA, acting under KIRIYENKO’s direction and control, involves the creation of fake
websites that mimic legitimate media outlets. Doppelganger places content on those spoofed
websites that promote specific narratives identified by the Russian government to further the
Russian government’s objectives, such as influencing the U.S. electorate by targeting specific
audiences within the United States and elsewhere. To evade detection, Doppelganger created
sophisticated cybersquatted domains (which include the SUBJECT DOMAINS) that appear to be
the websites of legitimate news outlets such as Fox News, The Washington Post, and Forward,
among others. In general, the cybersquatted domains appear virtually identical to their legitimate
media counterparts, including through the use of the same layout and design, as well as the same
trademarks, logos, and slogans, and through attributing the false articles found on the
cybersquatted domain to real journalists for the legitimate outlet, with the journalists’ names,
photographs, and bylines featured on the domain. In addition, links to other content on the
SUBJECT DOMAINS re-route the reader to the legitimate news outlet. However, the content
published on the cybersquatted domains is not the legitimate journalistic work of the impersonated
media outlet and impersonated journalists; rather, the cybersquatted domains publish fake news
articles that promote Russian interests without identifying, and in fact purposefully obfuscating,
the Russian government or its agents as the source of the content.
39.
and
For example, from within the Eastern District of Pennsylvania, FBI agents located
reviewed 4
six
articles
published
on
4
Doppelganger’s
cybersquatted
domain
The FBI used the WayBack Machine to locate articles published on the cybersquatted domains. The
Wayback Machine is a digital archive of the World Wide Web founded by the Internet Archive, an
American nonprofit organization, that allows the user to go “back in time” to see how websites looked in
the past. See EVO Brands, LLC v. Al Khalifa Group LLC, 657 F. Supp. 3d 1312, 1322-23 (C.D. Cal. 2023)
(collecting cases and noting that “[c]ourts have taken judicial notice of internet archives in the past,
15
PDF Page 17
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 16 of 277
washingtonpost[.]pm. Washingtonpost[.]pm is a nearly identical duplication of the legitimate
Washington Post website. All links on washingtonpost[.]pm such as the website navigation menu,
the Washington Post icon, and the byline, re-route the reader to the legitimate washingtonpost.com
website. Washingtonpost[.]pm also features trademarks registered to The Washington Post. The
articles published on the washingtonpost[.]pm are published under the name of a legitimate
Washington Post journalist and feature his/her photograph. Based on my training, experience, and
this investigation, I believe this duplication is likely to mislead or confuse U.S. persons and other
readers into believing that the Russian propaganda presented in the article is from a legitimate
U.S.-based news organization. A search for the articles located on washingtonpost[.]pm or
substantially similar content on washingtonpost.com yielded negative results, as did a review of
the legitimate Washington Post journalist’s published articles on washingtonpost.com.
40.
The articles located on washingtonpost[.]pm present a pro-Russia and anti-
Ukrainian viewpoint, and many of the articles focused on U.S. policy or politics. None of the
articles include attribution to SDA, STRUCTURA or the Russian government. For example, one
article is titled “White House Miscalculated: Conflict with Ukraine Strengthens Russia” and
purports to be authored by a Washington Post reporter. The article states, in part:
It is time for our leaders to recognize that continued support for Ukraine is a
mistake. It was a waste of lives and money, and to claim otherwise only means
further destruction. For the sake of everyone involved in the conflict, the Biden
administration should just make a peace agreement and move on.
See Exhibit 1 for illustrative examples of the cybersquatted domains.
41.
To distribute their propaganda without attribution to the Russian government,
Doppelganger created social media profiles posing as U.S. (or other non-Russian) citizens. These
including Archive.org’s ‘Wayback Machine,’ finding that Archive.org possesses sufficient indicia of
accuracy that it can be used to readily determine the various historical versions of a website”).
16
PDF Page 18
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 17 of 277
profiles then posted comments on social media platforms with links to the cybersquatted domains
to trick viewers into believing they were visiting a legitimate news outlet.
42.
The cybersquatted domains used by Doppelganger generally are not indexed by
search engines. A visit to the standalone domain, such as www.washingtonpost[.]pm, reveals a
blank page or an error page. Rather, as its primary method of distribution, Doppelganger created
fraudulent social media personas impersonating U.S. citizens to post article-specific extended
hyperlinks to the cybersquatted domains on those social media platforms. 5 To further disseminate
their propaganda beyond social media posts, Doppelganger also purchased and placed
advertisements on social media platforms to drive traffic to their articles. Based on my training
and experience, I believe Doppelganger distributes its propaganda in this manner in order to
obscure from Americans and other targeted readers the fact that they are not visiting a legitimate
news outlet.
43.
The second component of the Doppelganger campaign, carried out by ANO Dialog
and TABAK, acting under KIRIYENKO’s direction and control, focused on creating original
brands (which include the SUBJECT DOMAINS) to disseminate Russian propaganda. These
brands purport to be independent journalists or independent news media organizations but actually
published content under the direction and control of the Russian government. As discussed below,
the same articles would appear on both the cybersquatted domains and the ANO Dialog media
brands, which indicates to me that ANO Dialog and SDA/STRUCTURA acted in close
coordination under the direction and control of the Russian government and KIRIYENKO.
5
For example, while a visit to www.foxnews.cx would reveal a blank or error page, a visit to
www.foxnews.cx/world/US-Decided-to-Trade-Ukraine-for-Security.html would reveal the active
cybersquatted website with an article and the re-routing links to the legitimate Fox News.
17
PDF Page 19
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 18 of 277
44.
As detailed below, individuals associated with Doppelganger—who are believed to
be based in Russia or elsewhere outside the United States—have transferred funds from outside
the United States to lease most of the SUBJECT DOMAINS from United States-based domain
registrars or registries at the direction and control of, and for the benefit of, sanctioned persons,
including KIRIYENKO, GAMBASHIDZE, SDA, TUPIKIN, and STRUCTURA. These criminal
actors did not obtain an OFAC license before leasing the SUBJECT DOMAINS. Because they
have transferred funds from or through a place outside the United States to a place within the
United States, with the intent to promote a specified unlawful activity (here, an IEEPA violation),
there is probable cause to believe they have violated U.S. money laundering laws. In addition, the
conspirators took steps to make each of the SUBJECT DOMAINS available on the Internet,
including in the Eastern District of Pennsylvania. As set forth below, the conspirators specifically
targeted the Commonwealth of Pennsylvania’s citizens, including those located in the Eastern
District of Pennsylvania, in order to influence the electorate in this, and other districts.
45.
In addition, and as detailed further below, there is probable cause to believe that a
subset of the SUBJECT DOMAINS is being used or is intended to be used to commit or facilitate
trafficking in counterfeit goods or services. These SUBJECT DOMAINS feature registered
marks—The Washington Post logo, for example—that are identical to, or substantially
indistinguishable from, marks registered on the Principal Register maintained by the USPTO and
that are in use by the mark holder. The SUBJECT DOMAINS use these marks in connection with
goods or services that are the same as those for which they are registered on the Principal Register
and the SUBJECT DOMAINS’ use of the marks is likely to cause confusion, mistake, or to deceive
the public. As set forth below, the infringing SUBJECT DOMAINS were accessed from the
18
PDF Page 20
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 19 of 277
Eastern District of Pennsylvania and thus the infringing goods passed through Eastern District of
Pennsylvania.
B. Public Reporting on Doppelganger
46.
In July 2023, the European Union (“EU”) sanctioned seven Russian individuals and
five Russian entities for their role in Doppelganger. Among the entities and individuals sanctioned
by the EU were SDA, STRUCTURA, GAMBASHIDZE, and ANO Dialog. In so doing, the EU
explained:
Russian actors have conducted a digital information manipulation campaign named
‘RRN’ (Recent Reliable News) aiming at manipulating information and
disseminating propaganda in support of Russia’s war of aggression against Ukraine.
That campaign, in which government bodies or bodies affiliated to the Russian
State have participated, relies on fake web pages usurping the identity of national
media outlets and government websites as well as fake accounts on social media. 6
STRUCTURA and SDA were identified as “the key actor[s] of the campaign, responsible for the
creation of fake websites impersonating government organizations and legitimate media in Europe
(primarily Germany, France, Italy, Ukraine and the United Kingdom) and for boosting the proRussian ‘RRN’ campaign on social media.” 7
47.
On July 19, 2023, the Viginum Agency (“VIGINUM”), a French government
agency tasked with vigilance and protection against foreign digital interference, which operates
under the authority of the Secretariat-General for National Defense and Security, highlighted
Doppelganger’s creation and operation of cybersquatted domains:
Since February 2023, VIGINUM has noticed an increasing number of impersonations of
major French and foreign media outlets, in order to publish pro-Russian articles linked to
the war in Ukraine. . .
The appearance of typosquatted websites is in every way similar to that of the media outlets
they are impersonating, the only difference being the visited URL. The domain names of
6
Regulations, Official Journal of the European Union, L 190, Vol. 66 (28 July 2023) available at
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2023:190I:FULL.
7
Id.
19
PDF Page 21
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 20 of 277
typosquatted media outlets use the same source code as that of legitimate media outlets:
most of the links on the legitimate website are downloaded on the typosquatted website,
which lends it credibility in the eyes of unsuspecting users.
48.
VIGINUM also highlighted Doppelganger’s use of Facebook pages and
advertisements to disseminate disinformation. According to VIGINUM, “Since February 2023,
more than 160 Facebook pages have been identified by VIGINUM, posting more than 600
sponsored content containing links to articles and websites linked to the campaign.” As described
below, the investigation has revealed that Doppelganger purchased numerous social media
advertisements targeting U.S. politicians and relied on artificial intelligence to generate the
content.
C. The Russian Presidential Administration, through KIRIYENKO, Exercises Direction
and Control Over Doppelganger
49.
GAMBASHIDZE took extensive notes documenting meetings between
KIRIYENKO, SDA, STRUCTURA, TUPIKIN, ANO Dialog, members of the Russian
government like Sofia Zakharova (“Zakharova”), and others involved in Doppelganger.
GAMBASHIDZE’s notes include contact lists, staff lists, task or to-do lists, and potential ideas for
malign foreign influence campaigns. Between April 2022 and April 2023, GAMBASHIDZE took
notes related to at least 20 Russian Presidential Administration meetings.
50.
For example, one note was titled “Meeting with SVK at the AP” 8 and dated April
16, 2022. I assess that AP is an abbreviation for Administratsiya Prezidenta, which translates from
Russian to English as the Presidential Administration. Based on the context and content of the
meeting notes, other records obtained during this investigation, and the supervisory role that SVK
8
Virtually all records discussed herein were in the Russian language. Throughout this affidavit, italicized
quoted language indicates a verbatim translation, whereas plaintext quoted language indicates a summary
translation. Exhibits 2B through 13B to this affidavit have been translated verbatim. All translations were
completed by FBI linguists.
20
PDF Page 22
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 21 of 277
appears to play in the Doppelganger campaign, I assess that SVK is a reference to Sergei
Vladilenovich KIRIYENKO. As noted above, KIRIYENKO has been sanctioned and described
by OFAC as “the First Deputy Chief of Staff of the Presidential Office” and reportedly “Putin’s
domestic policy curator.” KIRIYENKO is frequently referred to in Russian and Western media as
“Putin’s right-hand man.” In addition, the notes refer to Russian President Vladimir Putin and
reveal that SVK, who is also referred to as Sergey in the notes, is overseeing and directing the
malign foreign influence efforts described herein.
51.
That note from April 16, 2022 details a meeting led by SVK at which “SVK was
taking detailed notes” to discuss bolstering support for Russia’s invasion of Ukraine. The meeting
participants discussed topics for propaganda, and SVK provided his opinion, with
GAMBASHIDZE recording SVK’s response to the ideas as “well received”, “need to work”, or
“the right thing to do.” SVK told the group they must use two mechanisms “to be effective: 1.
Creating of a nuclear psychosis. The USA have been prepping Europe for a big war with the
Russian Federation. War for peace. 2. Exaggeration.” While GAMBASHIDZE’s note contains
passing references to other meeting participants, the most substantive details recorded were when
SVK provided his opinion or instructions. This note also makes reference to “Tabak.” I assess that
the “Tabak” referenced in GAMBASHIDZE’s notes is Vladimir TABAK, the head of ANO Dialog.
52.
On July 13, 2022, GAMBASHIDZE wrote a note titled “Minutes of the Meeting at
the AP on July 13, 2022.” The note listed meeting participants as “Stas, Sofia, Ilya, and Sergey.” I
assess that the Sofia referenced is likely Sofia Zakharova, a Russian Presidential Administration
spokesperson. Zakharova is a Kremlin official who has also focused on information technology
and communications infrastructure. Zakharova has regularly taken part in conferences and events
21
PDF Page 23
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 22 of 277
dedicated to artificial intelligence. 9 Based on my training, experience, and information gathered
through this investigation, I assess that the Ilya referenced is Ilya GAMBASHIDZE and that the
Sergey referenced is KIRIYENKO. GAMBASHIDZE’s note identifies KIRIYENKO, as “SVK”,
telling the meeting participants, “it’s an impossible task,” which I assess to be a reference to the
difficulties in effectuating the Doppelganger campaign. GAMBASHIDZE notes that the
participants had “initially talked him into five countries. Now he says no.” Based on the context of
the note and this investigation, I assess that “him” and “he” refers to KIRIYENKO.
GAMBASHIDZE records that the group agreed “the Germans are more dependent than the
French” and decided to focus its efforts on the Germans. In particular, the group agreed that “first
and foremost, we need to discredit the USA, Great Britain and NATO, and secondly, we need to
convey the truth about the war in Ukraine” and the need to convince Germans to oppose the
“inefficient politics of sanctions.”
53.
According to the note, the participants used the remainder of the meeting to discuss
anti-Ukrainian, pro-Russian narratives to distribute, with a focus on Germany. GAMBASHIDZE
noted “They were assigned Russian Reliable News – changed it into Recent, it’s going to work.(was
sent by Tabak).”
54.
GAMBASHIDZE referenced SVK in six other notes in addition to the two
described above. According to a note titled “Meeting Minutes AP_25.07.22 – 11.00” SVK and
others again discussed targeting Germany. SVK suggested “in order to normalize relations, it is
necessary to show who caused them to deteriorate,” and directed the meeting participants to
influence German-Russian relations. The notes indicate that Sofia, whom I assess to be Zakharova,
9
See https://www.voanews.com/a/investigation-who-is-ilya-gambashidze-the-man-the-us-governmentaccuses-of-running-a-kremlin-disinformation-campaign-/7604052.html
22
PDF Page 24
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 23 of 277
instructed the creation of “websites to tell the Germans the truth!” Another participant suggested
using “real facts to complement fake facts.” One suggestion included trying to “make a fake on an
American soldier that raped a German woman. That would be great!” Another note, titled “AP
Meeting Minutes, Monday, January 16” referenced another party as being “fully in charge of filling
the content on the Ukraine Tribunal portal.” That note also indicated a topic “for business-elites”
as “Bypassing sanctions: they don’t need to be lifted, they need to be bypassed.”
55.
Although five of the notes did not list SVK as a participant, the meeting notes
indicate that the meetings discussed presentations, reports, and metrics related to Doppelganger
for SVK’s review and awareness as well as his reactions to, and approval of, various products. For
example, in a note titled “Minutes of the Meeting at the AP, August 1, 2022”, GAMBASHIDZE
mentioned that articles would be submitted to SVK’s office and that “so far three were well
received.” Other notes mentioned creating reports or presentations for SVK, to include media
monitoring. Another note, “Minutes_-_ECC_AP_05.04.23”, included a discussion of resources,
wherein a participant reported “SVK is not against including our influencers abroad.” 10 That note
referenced a French businessman whom the participants believed could do an “interview” for
“RRN.” A note titled “Meeting Minutes -_AP_01.18.23” refers to SVK as “listening to no more
than ten newsworthy events” and notes that “we need to create our OWN concept based on Ukraine
monitoring and Tabak’s concept.” GAMBASHIDZE noted, “They are expecting fake news from
us every day.”
56.
At least 13 of the meeting notes listed “SAZ” as a meeting participant, which I assess
to be a reference to Zakharova due to her initials and the use of Sofia in the body of some notes.
10
Another meeting note indicated that “we need influencers! A lot of them and everywhere. We are ready
to wine and dine them.”
23
PDF Page 25
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 24 of 277
Based on my training, experience, this investigation, and the context and content of the notes, I
assess that Zakharova reported to KIRIYENKO and conveyed information regarding these
meetings to and from KIRIYENKO for his approval and further direction.
57.
One note of a January 13, 2023, meeting attended by GAMBASHIDZE, Zakharova
and others mentioned they had “reported to the President about the project.” I assess that “the
President” refers to Russian President Vladimir Putin. The note stated that the participants should
not constrain themselves to specific countries; rather, “false stories spread could be initiated
everywhere, in different countries, even launched through media.” The note referenced specific
campaigns, including the use of influencers, a “media cluster” with “40-50 websites per country,”
which I assess refers to creating unique media brands led by ANO Dialog, and making “political
animated movies.” After mentioning “our fakes will be restored”, “the IAG team” was specifically
assigned to work on “analytical products and videos.” I assess that IAG is a reference to
GAMBASHIDZE.
58.
In addition to foreign influence campaigns, Doppelganger also appears to have
conducted influence campaigns domestically within Russia, underscoring its close ties to the
Russian government. For example, one note indicates that the “project could be used for P’s
election campaign” which I assess to be a reference to Russian President Putin. Likewise, a
different meeting note from a meeting SAZ attended indicated the group discussed “Putin team-example of work for the upcoming campaign” and explained that “Our battlefield is here. That’s
why men are not in Donbas.”
59.
Another note, titled “Meeting Minutes_-_AP_Factory_01.27.23” includes the
instruction that “When providing a narrative it’s important to remember that this is ‘from a German
24
PDF Page 26
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 25 of 277
to a German’, ‘from a Frenchman to a Frenchman’!” I assess this to be a reference to the
Doppelganger’s strategy of posing as citizens of other countries in order to influence their publics.
D. Internal SDA Documents, Correspondence, and Notes Take Credit for the Doppelganger
Campaign and Discuss SDA’s Overarching Foreign Malign Influence Strategy
60.
An SDA internal document titled “Countermeasures by foreign agencies and
organizations” which recounted that the “‘collective West’ countries are seriously concerned by
the effectiveness of the project” and that, along with “major online platforms, factcheckers and
investigators” they have “been involved in the effort of countering our narratives since September
2022.” The document went on to list and summarize 15 publications from various news sources
and organizations, such as Meta, Premier Ministre, The Washington Post, Wired, and Le Monde,
which discussed Doppelganger. I believe this document reflects SDA’s acknowledgment of its role
in Doppelganger. See Exhibit 2. 11
61.
In a similar vein, another SDA document highlighted social media companies’
attempts to combat SDA, STRUCTURA, and ANO Dialog’s propaganda by identifying the
cybersquatted domains, as well as RRN, as suspicious and blocking them. The document set out a
plan to combat the social media companies’ disruption efforts by posting comments through social
media accounts to complements their use of bots and further publicize their narratives. The plan
was to post “60,000 comments per month for France and Germany combined.” See Exhibit 3.
62.
SDA also possessed at least 27 invoices for the equivalent of thousands of U.S.
dollars’ worth of translation services. These invoices requested payments for the translation of
11
Attached as Exhibits to this affidavit are the original Russian-language SDA documents lawfully obtained
during this investigation (see Exhibits 2B through 13B) as well as English-language translations (see
Exhibits 2A through 13A). All of the SDA documents were obtained prior to June 1, 2024. Consistent with
Department of Justice policy, redactions have been applied to certain identifiers contained within the
documents. The terms substituted in place of those identifiers in the English language translations relate to
the status of those persons or entities at the time the documents were obtained.
25
PDF Page 27
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 26 of 277
files, identified by the file name. The file names on the invoices appear to correspond to the
headlines of articles published on the cybersquatted domains, including certain SUBJECT
DOMAINS. For example, one SDA invoice dated December 18, 2023, contained six file names,
which matched articles found either on washingtonpost[.]pm or fox-news[.]in. One of the partial
headlines listed on the SDA invoice was “Middle East Coalition of US Allies Crumbles.” I have
located and reviewed a corresponding article published on washingtonpost[.]pm that is titled
“Middle East Coalition of US Allies crumbles like a House of Cards.” Accordingly, I believe these
invoices reflect SDA’s payment for Doppelganger-related services. See Exhibit 1 at 6.
63.
Multiple SDA documents detail SDA’s strategy for implementing its foreign malign
influence campaigns. Among these documents is what appears to be an initial concept plan for the
Doppelganger campaign, which specifically referenced GAMBASHIDZE, and noted “if we can,
we need a separate department for fakes - a factory!” 12 The document indicated the campaign
would target England, Germany, and Italy and would have “Two news sites: English-language and
German-speaking.” 13
64.
A hallmark of the Doppelganger campaign was to impersonate U.S. and other non-
Russian citizens through the creation of fake social media profiles. Then, that social media profile,
posing as an American or other non-Russian citizen, would post comments or other content
promoting a pro-Russian narrative and include a hyperlink to the cybersquatted domain
impersonating a legitimate news outlet like The Washington Post or Fox News. Using this manner
of distribution, KIRIYENKO, GAMBASHIDZE, TUPIKIN, SDA, and STRUCTURA are able to
mislead, for example, American citizens into believing they are seeing the viewpoints of a fellow
12
This translation was completed using machine translation software.
13
This translation was completed using machine translation software. As discussed below, I assess that
these two “news” websites are likely references to RRN and Journalisten Freikorps.
26
PDF Page 28
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 27 of 277
American citizen, rather than the Russian government’s view. SDA documents provide detailed
instructions on how these fake American social media profiles should distribute Doppelganger
content through social media platforms. For example, SDA documents provide instructions and
exemplar social media posts designed to influence the U.S. election. One such document first sets
out what appears to be an article, written in English, likely to be published on one of the
cybersquatted domains with the headline “U.S. Loses Its Position as a World Leader by Making
Too Many Mistakes” under the heading of “International Politics.” The document envisions the
creation of social media profiles posing as American citizens “living in a small town,” which would
post comments linking to the article in order to influence the views of actual American voters. That
document also provided suggested English-language comments for use in distributing the article
on social media. See, e.g., Exhibit 4, Exhibit 5.
65.
Another 26-page SDA manual set forth a plan for a campaign targeting the
Ukrainian public. The manual showed SDA dividing its influence campaigns into four sections:
“monitoring, analytics, content production, and content delivery.” See Exhibit 6. This manual
described SDA’s efforts to create “articles (long reads)” which were “original texts ranging from
2,000 to 5,000 characters with spaces, devoted to topics relevant to the Ukrainian audience, which
fit into the main subject areas of the project. Each text is professionally edited and accompanied
by 10 comments and 3 teasers for disseminating the text on social networks.” I assess that SDA’s
reference to these articles, or “long reads”, refer to the original content produced by Doppelganger
and intended to be posted on domains SDA controls, including the SUBJECT DOMAINS, and
which may also be distributed through ANO Dialog’s unique media brands. Further, I assess that
the reference to “10 comments and 3 teasers” refers to SDA’s practice of spreading Doppelganger
27
PDF Page 29
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 28 of 277
content by posting links to the cybersquatted domains through proposed social media comments,
as discussed in the preceding paragraphs.
66.
SDA documents further reveal that SDA extensively monitors and collects
information about a large number of media organizations and social media influencers. One
document revealed a list of more than 2,800 people on various social media platforms like Twitter,
Facebook and Telegram, spanning 81 countries, that SDA identified as influencers, including
television and radio hosts, politicians, bloggers, journalists, businessmen, professors, think-tank
analysts, veterans, professors, and comedians. When referring to politicians, the list often
mentioned which U.S. state and/or political party they represent and the position they hold in
Congress. The U.S.-based influencers accounted for approximately 21% of the accounts being
monitored by SDA. On another list of over 1,900 “anti-influencers” 14 from 52 countries, the U.S.based accounts comprised 26% of the total accounts being monitored by SDA. I assess that “antiinfluencer” indicates that the account posts content that SDA views as contrary to Russian
objectives. Based on my review of other records obtained during this investigation, I know that
SDA adds information captured through its monitoring efforts to dashboards. These dashboards
analyze trends in public opinion and thereby measure the effectiveness of the malign foreign
influence campaign based on its impact on public opinion. SDA’s content varies from project to
project; however, it can include videos, memes, cartoons, social media posts, and/or articles. SDA’s
content delivery also varies each campaign, but often relies heavily on social media posts driving
targeted audiences to domains SDA controls, like the SUBJECT DOMAINS.
14
This translation was completed using machine translation software.
28
PDF Page 30
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 29 of 277
67.
One SDA document outlined a project titled “International Conflict Incitement”
which targeted Germany and France. As described by SDA, the
objective of the ‘International Conflict Incitement’ project is to escalate internal
tensions in the countries allied with the United States in order to promote the
interests of the Russian Federation on the international arena. To influence reallife conflicts and artificially create conflict situations, it is proposed to use a wide
range of information tools to influence public opinion.
SDA intended for its project to result in the “[e]scalation of the conflict situation through the use
of available tools (traffic redirection, work with comments, work with influencers, analytical
articles, augmented reality, media mirror outlets, fakes, etc.) in order to destabilize the societal
situation.” I believe “media mirror outlets” is the term SDA used to refer to Doppelganger’s use
of cybersquatted domains to impersonate legitimate news outlets. The project intended to
artificially generate conflicts through, among other things, “spreading additional false narratives”;
“fake videos, documents, and telephone conversation recordings”; “comments on social media”;
and “fake and real quotes from influencers”. The project identified the “media mirrors outlets”;
“foreign and Russian influencers” and “bots and work with comments;” as “delivery channels” for
the project. See Exhibit 7.
68.
In another document, SDA summarized its campaign against Germany, identifying
three major themes: (1) “HOHLI – pigs”; 15 (2) “The difference between Ukraine and Germany”;
and (3) “The U.S. is behind everything.” 16 It also included 43 ideas for propaganda, which were
all associated with one or more of the three themes listed above. The document placed each idea
into a table, complete with the target audience and media type. For example, one idea for “The
U.S. is behind everything,” theme was a “screenshot of the publication with a photo of the US
15
After consulting with Ukrainian and Russian speaking FBI employees, I have learned that this term is a
derogatory word for Ukrainians.
16
This translation was completed using machine translation software.
29
PDF Page 31
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 30 of 277
Embassy in Germany. Headline: Scholz became employee of the month at the US Embassy.” This
screenshot and headline were meant to impress upon viewers that the U.S. directs German policy.
SDA’s Foreign Malign Influence Plans for the 2024 U.S. Election
1. The Good Old U.S.A. Project
69.
SDA records show that, starting in the fall of 2023, SDA began developing a
campaign targeting the 2024 U.S. federal elections which it called “The Good Old U.S.A.
Project.” 17 See Exhibit 8. According to the planning document, the project’s goal was to influence
U.S. public opinion to align with the viewpoint “that the US should target their effort towards
addressing its domestic issues instead of wasting money in Ukraine and other ‘problem’ regions.”
The document laid out objectives and specific demographics for targeting U.S. audiences
(including specific messaging to voters in six swing states) through social media groups, social
media advertising, and influencers. The document specifically refers to the content to be
distributed by SDA as “bogus stories disguised as newsworthy events.” These “bogus” stories
would be complimented by “Mass distribution of text comments and memes in Facebook and X
(Twitter) discussion threads.” This “commentary campaign” would spread “false reworked project
narratives supported by facts” and engage in “targeted social engineering based on information
trends and users’ emotional attitude towards them.”
70.
The Good Old U.S.A Project specifically highlighted the use of “[t]argeted
advertising” on social media that would enable SDA to track Americans reactions “to the
distributed material in real time, and directing the psychological response group to contribute to
17
In the original Russian-language document, the words “The Good Old U.S.A.” were written in English.
This document followed a design template frequently used by SDA, featuring a red and black color scheme;
a common Cyrillic font; bolded, numerical section headers; and logo in the bottom left of each page. Based
on my review of documents obtained during this investigation, I know this template is frequently used by
SDA employees.
30
PDF Page 32
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 31 of 277
comments thereof. With the help of a network of bots, the psychological response moderates top
discussions and adjust further launches depending on which group was affected the most.”
71.
The use of targeted advertising by Doppelganger is corroborated by records
obtained from Meta pursuant to a warrant, which identified Meta pages and advertisements linked
to the Doppelganger campaign. Notably, those records revealed Doppelganger’s apparent use of
artificial intelligence tools to generate content, including images and videos, for use in negative
advertisements about U.S. politicians. Several of these Meta accounts were registered with account
names that approximate legitimate news media organizations, such as CNN California,
Sacramento Inside, California News, and California BBC (screenshots from the Meta pages
created by Doppelganger are contained below). The CNN California Facebook Page’s profile
picture displayed a blue version of the legitimate CNN logo with California written underneath in
the same shade of blue. The Page was listed on Facebook as a News and Media website and had a
banner in blue with the CNN logo also in blue that read BREAKING HOT NEWS /// HOT NEWS
/// and LIVEHD /// TODAY. Meta records also revealed that Doppelganger used credit cards issued
by U.S. financial institutions to purchase Facebook advertisements.
31
PDF Page 33
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 32 of 277
2. The “Guerrilla Media Campaign in the United States”
72.
SDA documents include a proposal for another campaign focused on influencing
the United States, titled “The Guerrilla Media Campaign in the United States.” See Exhibit 9. 18
The Guerilla Media Campaign focused on exploiting the perceived polarization of U.S. society by
focusing on eight “Campaign Topics.” As reflected in the proposal, SDA anticipated using social
media profiles on Facebook, X (formerly known as Twitter), YouTube, and Truth Social but noted
that with “Facebook, Twitter and YouTube, we need to create multiple ‘perishable’ accounts,
primarily for the work with comments.” The Guerilla Media Campaign would disseminate its
propaganda through posts, “comments on social networks and local group chats”, memes, and
“video content, including news stories in the Fox News style.” SDA’s plan stated “In order for this
work to be effective, you need to use a minimum of fake news and a maximum of realistic
information. At the same time, you should continuously repeat that this is what is really happening,
but the official media will never tell you about it or show it to you.” I believe the reference to the
“work in the comments” is a reference to Doppelganger’s creation of inauthentic social media
profiles to post comments on social media that included links to the cybersquatted domains,
including the SUBJECT DOMAINS. Further, it appears that SDA required a large number of
“perishable” accounts to disseminate this content because of enforcement efforts by U.S. social
media companies to identify and deactivate accounts associated with Doppelganger. Finally, as
noted above, GAMBASHIDZE’s notes from meetings with the Presidential Administration reveal
a suggestion to use “real facts to complement fake facts.”
18
This document follows the same template frequently used by SDA, like in The Good Old U.S.A. Project.
32
PDF Page 34
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 33 of 277
3. “U.S. Social Media Influencers Network” Project
73.
SDA records revealed another influence campaign aimed at avoiding detection and
mitigation by U.S. social media companies by creating and developing “a network of 200 accounts
in Twitter, four in each of the 50 states: two active and two ‘dormant’ ones. Active accounts in each
state will be maintained on behalf of a fictitious individual, who actively supports” a political party
and “represents ‘a community of local activists.’” SDA actively sought to “eliminate the possibility
of detection of the ‘Russian footprint’ in the proposed project, a multi-level protection of the
infrastructure will be built. It will contain VPN services, physical servers located in the United
States, etc.” The project’s goal was to steadily increase the number of subscribers, eventually
reaching one million in one year. See Exhibit 10.
4. Targeting the U.S. by Influencing Other Countries.
74.
SDA records also revealed its planning of campaigns targeting foreign countries,
including Mexico and Israel, with the intent that those efforts would influence associated ethnic or
religious groups residing in the United States. The goal of these campaigns was twofold: (1) to
influence each countries’ populace; and (2) to influence the U.S. 2024 Presidential Election. A
Presidential Administration meeting note from January 13, 2023, revealed that one of the
objectives of the campaign, which had been assigned to GAMBASHIDZE, was to “draft a media
plan for work through expat community media outlets (Armenia--France; Turkey--Germany,
Israel--USA)” and to “compile a list of scenarios for stirring inter-ethnic, religious, racial, and
political conflicts in ‘focus countries’.”
75.
For example, one SDA document with the sub-heading “PROJECT OF
EFFECTIVE PROXY PARTICIPATION IN THE NOVEMBER 2024 CAMPAIGN” presented a
theme of “México no perdona” which translates in English to “Mexico does not forgive.” See
33
PDF Page 35
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 34 of 277
Exhibit 11. The campaign intended to encourage “anti-American sentiment” as well as to
exacerbate confrontation between the United States and Mexico. Although the campaign would
target Mexico, the campaign’s goal also intended to influence the U.S. Presidential Election. The
proposal concluded with: “Today, the time has come to show to the United States that it is under a
threat. And we can do it.”
76.
As another example, an SDA document described a project titled The
Comprehensive Information Outreach Project in Israel (and also Jewish Community Outreach in
the US)”. See Exhibit 12. Similar to the document relating to Mexico, one of the stated goals of
this campaign was to influence the 2024 U.S. Presidential Election. Notably, the proposal
suggested creating “a full-fledged three language” information project that would “target Jewish
communities across the globe, first and foremost in Israel and the US.” I believe that this reference
to a full-fledged online information project is likely a reference to the unique Doppelganger media
brands discussed below.
77.
Consistent with other Doppelganger campaigns explicitly targeting the United
States, this Israel-related campaign would involve the creation of a media brand, targeted
advertising to spread content, the publication of articles in legitimate media, and an operation
involving the widespread posting of social media comments impersonating Israelis. A separate
SDA document provided an example of how to pose as an Israeli and disseminate fake articles and
comments presenting an unattributed Russian narrative through comments on social media. See
Exhibit 13.
THE CYBERSQUATTED SUBJECT DOMAINS
78.
The FBI’s investigation revealed that Doppelganger leased numerous cybersquatted
domains from U.S. companies Namecheap, NameSilo, and GoDaddy using four online personas,
34
PDF Page 36
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 35 of 277
which I refer to as Kethorn, Kamcopec, Kaspartill, and Anguillet. Each of these personas used
email accounts that incorporated the persona’s name in the email address. I believe that the identity
information provided to lease the domains is false given inconsistencies in names, mailing
addresses, and naming conventions of the associated email addresses. These four online personas
had significant overlap in the legitimate news sources their cybersquatted domains impersonated.
All four personas leased domains impersonating Der Spiegel,19 three personas leased domains
impersonating Bild 20 and T-Online, 21 and two personas leased domains impersonating Reuters, 22
Delfi, 23 and Süddeutsche Zeitung. 24
79.
The personas used a similar pattern of cryptocurrency 25 payments and Proton Mail
email addresses. 26 In general, Doppelganger actors took steps to obfuscate the origin of the
19
Der Spiegel is a German news magazine and website based in Hamburg using the domain spiegel.de.
20
Bild is a German newspaper and website based in Berlin using the domain bild.de.
21
T-Online is a German news website based in Berlin using the domain t-online.de.
22
Reuters is a joint British/Canadian news agency that is one of the largest news companies in the world.
It uses the domain reuters.com.
23
Delfi is a news website in Estonia, Latvia, and Lithuania using the following domains delfi.ee, delfi.lv,
delfi.lt, pl.delfi.lt, and en.delfi.lt.
24
The Süddeutsche Zeitung, published in Munich, Bavaria, is one of the largest daily newspapers in
Germany and uses the domain sueddeutsche.de.
25
Based on my training and experience and consultation with FBI subject matter experts, I know that many
criminal actors used virtual currencies or cryptocurrency, like Bitcoin, in order to obfuscate their activity.
In general, transactions involving cryptocurrencies are posted to a public ledger, like the Bitcoin Blockchain
(which can be reviewed through any number of open-source blockchain explorer websites or proprietary
software programs that provide user-friendly interfaces to view data from the Bitcoin Blockchain).
Although transactions are visible on the public ledger, each transaction is only listed by a complex series
of numbers that do not identify the individuals involved in the transaction. This feature makes virtual
currencies pseudo-anonymous; however, it is sometimes possible to determine the identity of an individual
involved in a transaction through several different tools that are available to law enforcement. Bitcoin are
sent to and received from Bitcoin “addresses.” A Bitcoin address is somewhat analogous to a bank account
number and is represented as a 26-to-35-character-long case-sensitive string of letters and numbers.
26
Proton Mail is an end-to-end encrypted email service based in Switzerland.
35
PDF Page 37
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 36 of 277
cryptocurrency by using services like ChangeNOW and cryptocurrency mixing algorithms to
obfuscate the originating cryptocurrency wallet used in their transactions.
80.
Based on the commercially available cryptocurrency analysis tools 27 and analysis
by an FBI cryptocurrency subject matter expert, these personas’ cryptocurrency transactions with
NameSilo and Namecheap show that the transactions originated with a cluster of cryptocurrency
wallets. In this case, the FBI determined that the aforementioned cluster of wallets was funded by
an account at a virtual currency exchange (“VCE-1”). 28
81.
Records received from VCE-1 pursuant to legal process revealed that the funding
account belonged to an individual referred to herein as “Konstantin”. 29 Those records showed that
Konstantin provided Russian identification documents to VCE-1 and only accessed his account at
27
While the identity of the address owner is generally anonymous, law enforcement may be able to ascertain
information about the identity of the owner of a particular address by analyzing the Blockchain. The
analysis can also reveal additional addresses controlled by the same individual or entity. For example, a
user or business may create many addresses to receive payments from different customers. When the user
wants to transact the cryptocurrency that it has received, it may group those addresses together to send a
single transaction. Law enforcement uses sophisticated, commercial services offered by several different
Blockchain-analysis companies to investigate transactions. These companies analyze the Blockchain and
attempt to identify the individuals or groups involved in the transactions. Specifically, these companies
create large databases that group transactions into “clusters” through analysis of data underlying
transactions. Through numerous unrelated investigations, law enforcement has found the information
provided by these companies to be reliable. The third-party Blockchain-analysis software utilized in this
case is software used by banks and law enforcement organizations worldwide. This third-party Blockchain
analysis software has supported many investigations and been the basis for numerous search and seizure
warrants, and as such, has been found to be reliable. Computer scientists have independently shown that
they can use “clustering” methods to take advantage of clues in how cryptocurrency is typically aggregated
or split up to identify addresses and their respective account owners. See generally United States v.
Sterlingov, 2024 WL 860983 (D.D.C. Feb. 29, 2024) (analyzing reliability of commercial Blockchainanalysis software).
28
A virtual-currency exchange is a virtual-currency trading platform. Virtual currency exchanges typically
allow trading between the U.S. dollar, other foreign currencies, Bitcoin, and other digital currencies. Many
virtual-currency exchanges also act like virtual banks and store their customers’ Bitcoin. Virtual currency
exchanges doing business in whole or in substantial part in the United States are regulated under the Bank
Secrecy Act, codified at 31 U.S.C. § 5311 et seq., and must comply with federal regulations designed to
combat money laundering, including the collection of identifying information about their customers.
29
Konstantin’s full name is known to law enforcement but omitted here due to the ongoing nature of law
enforcement investigations.
36
PDF Page 38
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 37 of 277
VCE-1 through IP addresses that resolve to Russia. On March 7, 2024, Konstantin was interviewed
by U.S. law enforcement regarding his VCE-1 accounts and suspected criminal activity.
Konstantin stated he was a “point to point” exchanger on VCE-1. In describing his business,
Konstantin stated the funds that went through his accounts came from point to point requests and
he had no direct communication with the people he moved the funds for, nor did he know the
origin of the funds. Based on these facts and the analysis described above, I believe there is
probable cause to believe the funds used to lease the SUBJECT DOMAINS by the four personas
as described below, originated from outside the United States.
82.
An analysis of the registrar account login records for the personas revealed that the
vast majority of the login timestamps roughly correspond to Moscow business hours. The IP
addresses used to access the registrars all resolved to either VPS services, or IP addresses that the
cybersecurity company Spur 30 previously associated with criminal cyber actors who compromise
IP addresses and sell access to them, to allow buyers to gain further anonymity online. Even the
VPS services used by the personas were accessed through other VPS services and paid for using
cryptocurrency.
83.
For example, the Kamcopec persona used a particular IP address from a VPS
service to lease one of the domains discussed herein. Records received pursuant to legal process
revealed that a VPS service leased that IP to an account, which used another operational email
address 31 and a second VPS service to access the first VPS. That second VPS account accessed a
GitHub repository which contained a script for layering VPSs. Based on the use of that repository,
30
Spur is a U.S. cybersecurity industry leader specializing in detecting anonymous infrastructure cyber
criminals use to obfuscate their locations and identities.
31
Based on my training and experience, I know cybercriminals often create “operational” email addresses
using fake identifying information to conduct illegal activity as a way to obfuscate their identity.
37
PDF Page 39
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 38 of 277
I believe the Kamcopec persona was using at least three layers of VPS services to obfuscate their
true identity and location. Based on my training and experience, this layering on top of layering of
VPSs and operational email addresses, like Russian nesting dolls, are indicative of a high level of
technical sophistication evidencing an intentional, willful desire to conceal identities and
whereabouts that is commonly associated with state-sanctioned action. As noted above, internal
SDA documents revealed that SDA actively sought to reduce the chance of “detecting the ‘Russian
footprint’ in the proposed project,” by using “a multi-level security infrastructure” including VPN
services and physical servers located in the U.S.
84.
Based on the aforementioned similarities, I assess that these personas were all used
in coordination and furtherance of the Doppelganger campaign either by individuals working for
the sanctioned entities SDA and STRUCTURA, as well as ANO Dialog, and/or their coconspirators, at the direction of KIRIYENKO, a sanctioned person, and the Russian government.
Furthermore, as described herein, there is probable cause to believe that the funds used to lease the
SUBJECT DOMAINS originated outside the United States.
A. The Kamcopec Persona
85.
Information received from GoDaddy, a U.S. company, pursuant to legal process
indicated that the Kamcopec persona leased the following 30 cybersquatted domains used in the
Doppelganger campaign: washingtonpost[.]ltd, lemonde[.]ltd, 32 leparisien[.]ltd, 33 spiegel[.]pro,
bild[.]llc, bild[.]ws, welt[.]ltd, 34 welt[.]ws, welt[.]media, spiegel[.]work, nd-aktuell[.]net, 35 nd-
32
Le Monde is a French daily afternoon newspaper that uses the domain lemonde.fr.
33
Le Parisien is a French daily newspaper that uses leparisien.fr.
34
Die Welt (“The World”) is a German national daily newspaper that uses the domain welt.de.
35
Neues Deutschland is a German daily newspaper that uses the domain nd-aktuell.de.
38
PDF Page 40
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 39 of 277
aktuell[.]pro, nd-aktuell[.]co, bild[.]work, obozrevatel[.]ltd, 36 rbk[.]media, 37 milliyet[.]com.co, 38
albayan[.]me, 39 gulfnews[.]ltd, 40 pravda-ua[.]com, 41 faz[.]ltd, 42 faz[.]agency, faz[.]life,
spiegel[.]agency, sueddeutsche[.]ltd, sueddeutsche[.]me, sueddeutsche[.]cc, sueddeutsche[.]co,
tagesspiegel[.]ltd, 43 and tagesspiegel[.]co. The Kamcopec persona also leased three noncybersquatted domains: fraiesvolk[.]com, fraiepozition[.]store, and fraiepozition[.]site. 44
86.
The Kamcopec GoDaddy account was registered using the name Iakov Shultz, a
GMX email account, and a Polish address and phone number. Records received pursuant to legal
process show these domains were generally leased for one year, and the majority are inactive. The
inactive domains were either taken down by the registries or registrars, or not renewed. Of the
aforementioned domains, nine SUBJECT DOMAINS identified in the preceding paragraph remain
active; however, one of those domains appears to have been taken over by one of the
cybersquatting victim companies, Süddeutsche Zeitung. The Kamcopec GoDaddy account used at
least five VPS services, all of which are non-U.S. companies, one of which Spur linked to
36
Obozrevatel is a Ukrainian news outlet that uses the domains OBOZ.ua and Obozrevatel.com.
37
RBK is a Russian media group that runs a newspaper, TV station, and the website, rbc.ru.
38
Milliyet is a Turkish newspaper based in Istanbul that uses the domain milliyet.com.tr.
39
Al-Bayan is an Arabic language newspaper in the United Arab Emirates (UAE) which is owned by
Government of Dubai that uses the domain albayan.ae.
40
Gulf News is a daily English language newspaper published from Dubai, UAE, currently distributed
throughout the UAE and also in other Persian Gulf Countries that uses GulfNew.com.
41
Ukrainska Pravda is a Ukrainian online newspaper using the domain pravda.com.ua.
42
Frankfurter Allgemeine Zeitung is a German newspaper that uses the domain. faz.net.
43
Der Tagesspiegel is a German daily newspaper, though it has a regional correspondent office in
Washington, D.C. and uses the domain tagesspiegel.de.
44
Based on my training and experience and information gathered through this investigation, I believe that
the fraiesvolk domain was intended to mimic a German daily newspaper published in the 1950s that was
highly critical of the Allied Powers.
39
PDF Page 41
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 40 of 277
cybercriminal activity, and an Argentinian internet service provider to lease the eleven SUBJECT
DOMAINS.
87.
Each of the SUBJECT DOMAINS leased from GoDaddy by the Kamcopec persona
were paid for using credit cards issued by U.S. financial institutions. Each of the SUBJECT
DOMAINS was leased from GoDaddy between the hours of 4:22 A.M. and 6:08 P.M., Moscow
time. Specifically, the Kamcopec persona paid for the following SUBJECT DOMAINS using a
credit card issued by a U.S. financial institution: sueddeutsche[.]co, tagesspiegel[.]co, faz[.]life,
bild[.]work, and rbk[.]media. The Kamcopec persona paid for the following SUBJECT
DOMAINS using a credit card issued by a different U.S. financial institution: faz[.]ltd,
lemonde[.]ltd, leparisien[.]ltd, spiegel[.]agency, and Pravda-ua[.]com.
88.
Records received pursuant to legal process revealed that the credit cards used to
lease the aforementioned SUBJECT DOMAINS from GoDaddy were issued by U.S. banks to a
U.S. company that has significant ties to, and employees based in, Russia. Consistent with other
identified Doppelganger actors, the Kamcopec persona generally used IP addresses that resolved
to VPS companies for their transactions. Based on my training and experience I know criminal
cyber actors frequently use VPS companies to obfuscate their location, however analyzing their
time stamps can reveal relevant information as to the cyber actor’s potential location. For example,
here, the VPS IP logins revealed that the actor behind the Kamcopec persona is most likely located
in Russia. I assess that the Kamcopec persona either transferred money from Russia to the U.S.based company, which acquired credit cards from U.S. institutions in order to obfuscate the source
of the funds or paid off the credit cards used to lease the domains with funds from Russia.
40
PDF Page 42
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 41 of 277
89.
Of the nine remaining domains initially leased from GoDaddy, five domains have
been transferred by the Kamcopec persona to other registrars. 45 Specifically, on March 14, 2024,
spiegel[.]agency was transferred to NewFold Digital, which is a U.S. registrar, but the registry
remained Identity Digital Limited. On May 1, 2024, pravda-ua[.]com was transferred to Long
Drive Domains, also a U.S. registrar, however the registry remained Verisign Global Registry
Services.
90.
For the remaining three domains, while the registrar was transferred to a foreign
registrar, the registry for all three remained U.S. companies. Accordingly, there is probable cause
to believe that when the domains were transferred, thus renewing the lease on the domain, a portion
of those funds are used by the overseas registrar to pay the U.S.-based registries. On February 21,
2024, bild[.]work was transferred to GMO Internet, which is a Japanese registrar doing business
as Onamae.com, but the registry remained GoDaddy Registry Services, LLC. On December 28,
2022, lemonde[.]ltd was transferred to Nameshield SAS, a French registrar, but the registry
remained Identity Digital Limited. On February 2, 2022, leparisien[.]ltd was also transferred to
Nameshield SAS, but the registry remained Identity Digital Limited.
91.
Records received pursuant to legal process revealed that the Kamcopec persona
also leased the cybersquatted domains foxnews[.]cx, bild[.]bz, and lefigaro[.]me 46 from
Namecheap. However, in registering with Namecheap, the person using the Kamcopec GMX
email account used a different name, address, and phone number than what was provided to
GoDaddy. Additionally, the Namecheap account was accessed by a secondary Proton Mail account
and used cryptocurrency to lease its domains, none of which are still active. I believe that the
45
Domain transfer is a process of changing domain name registrars which is a common and simple process.
When a domain is transferred it automatically renews the domain.
46
Le Figaro is a French daily morning newspaper founded in 1826 using the domain lefigaro.fr.
41
PDF Page 43
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 42 of 277
Kamcopec persona’s provision of different names, addresses, and phone numbers to GoDaddy and
Namecheap is indicative of an effort to obfuscate the true identity and location of the person(s)
behind the Kamcopec persona, whom I assess to be located in Russia.
B. The Kethorn Persona
92.
Information received pursuant to legal process from NameSilo and Namecheap
identified accounts created using a Proton Mail email address used by the Kethorn persona.
Between June 26, 2022, and October 2, 2022, the Kethorn persona leased six domains from
NameSilo and 24 from Namecheap. The domains include cybersquatted domains affiliated with
the Doppelganger campaign that impersonated legitimate news sources and organizations
including Reuters, Der Spiegel, T-Online, Bild, Delfi, la Repubblica, 47 and ManaBalss. 48
93.
Specifically, the Kethorn persona leased the following domains: 70-putin-
freunde[.]de, freikorps[.]press, 49 friekorps[.]press, jfreicorp[.]press, jfriecorp[.]press, sieben-
47
La Repubblica is an Italian newspaper and website using the following domains repubblica.it,
quotidiano.repubblica.it, and video.repubblica.it.
48
ManaBalss.lv is a civic organization based in Latvia that launched in June 2011 to provide a possibility
for the citizens of Latvia to promote their initiatives and gain support for these initiatives for further
submission to the national parliament of Latvia.
49
Another one of the purportedly independent media brands that has been identified as having been
established by the Doppelganger campaign is Journalisten Freikorps. This brand appears to be a reference
to the German Freikorps which was a paramilitary unit that existed in Germany for decades. During World
War II, many former Freikorps members rose to power in the Nazi party. I know that the Russian
government has made claims about the presence of purported Nazis or Neo-Nazis in Ukraine as a
justification for Russia’s invasion of Ukraine. I accessed both freikorps[.]press and jfriecorp[.]press using
the Wayback Machine and ascertained that both webpages ostensibly posted news stories in German
consistent with other Doppelganger content using the same Freikorps logo and banner. Through the
investigation, the FBI identified an associated email address that incorporated “J.Freikorps” that was
created on August 24, 2022, two days after a Telegram channel associated with Journalisten Freikorps
started posted on Telegram inviting journalists to share their pieces. Records received pursuant to legal
process revealed the subscriber’s name for the “J.Freikorps” email address was Journalisten Freikorps and
that an SDA employee’s email address was connected to that account by cookies. Based on my training and
experience, I know that when two or more accounts are linked by cookies, this means that the accounts
were accessed using the same device(s) and are likely accessed by the same user(s). Thus, there is probable
cause to believe that SDA is directing and controlling the Journalisten Freikorps campaign.
42
PDF Page 44
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 43 of 277
fragen-putin[.]de, tonline[.]life, tonline[.]today, t-onlinr[.]life, t-onlinr[.]live, t-onlinr[.]today,
delfi[.]today,
spiegel[.]fun,
spiegel[.]quest,
spiegel[.]today,
spiegel[.]today,
winter-is-
comming[.]de, landwirtinnen[.]de, help-to-migrant[.]de, reuters[.]cfd, reuters[.]cyou, bild[.]vip,
bild[.]asia, delfi[.]today, delfi[.]top, Repubblica[.]icu, repubblica[.]world, socialharmony[.]de,
manabalss[.]li, and musubalss[.]org.
94.
Of the aforementioned domains, only delfi[.]top appears to still be active and under
SDA control. The Kethorn persona provided Namecheap with a German address and German
phone number to lease domains and used German IP addresses resolving to a German VPS service
to lease all the aforementioned domains. On July 12, 2022, the Kethorn persona sent
cryptocurrency to Namecheap to lease delfi[.]top. While the delfi[.]top domain was initially leased
from Namecheap, on February 15, 2024, the Kethorn persona transferred delfi.top to Tucows, a
Canadian registrar. As noted above, this transaction, along with the initial lease of all the
aforementioned domains leased by this persona, originated from a cluster of wallets that were
funded by Konstantin P.
C. The Kaspartill Persona
95.
Information received pursuant to legal process from NameSilo and Namecheap
identified accounts created using a Proton Mail email address, hereafter referred to as the Kaspartill
persona, which leased three domains from NameSilo and 14 from Namecheap. Specifically, the
Kaspartill persona leased the following domains: spiegel[.]ink, sueddeutsche[.]online, tonline[.]life,
bild[.]pics,
dailymail[.]cam, 50
dailymail[.]cfd,
50
delfi[.]life,
repubblica[.]life,
The Daily Mail is a British daily tabloid newspaper published in London that also uses the domain
dailymail.co.uk.
43
PDF Page 45
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 44 of 277
spiegeli[.]life, spiegeli[.]live, spiegeli[.]today, reuters[.]sbs, dailymail[.]top, blld[.]live, itcb[.]life,
dekommnt[.]live, and ukcommunity[.]vip.
96.
Of the aforementioned domains, only dailymail[.]top appears to still be active and
under SDA control; however, on or about October 18, 2023 the Kaspartill persona transferred
registrars for the domain from Namecheap to Alibaba Cloud Computing. The Kaspartill persona
provided Namecheap with a German address, German phone number, and used a German IP
address resolving to a German VPS service to lease all the aforementioned domains. On June 9,
2022, the Kaspartill persona sent cryptocurrency to Namecheap to lease dailymail[.]top. The
transaction took place at approximately 7:30 AM Moscow time and was effectuated using BTCPay.
As noted above, this transaction, along with the initial lease of all the aforementioned domains by
this persona, originated from a cluster of wallets that were funded by Konstantin.
D. The Anguillet Persona
97.
Information received pursuant to legal process from Namecheap identified an
account registered using a Proton Mail account, hereafter referred to as the Anguillet persona, as
having leased the following nine domains, all of which are no longer active: Spiegelr[.]live,
spiegelr[.]today,
t-onlinl[.]life,
t-onlinl[.]live,
t-onlinl[.]today,
sueddeutsche[.]life,
sueddeutsche[.]site, sueddeutsche[.]today, and spiegelr[.]life. Anguillet also used cryptocurrency
to lease its domains and provided a German address, German phone number, and German IP
addresses resolving to a German VPS service to lease the aforementioned domains.
THE U.S. TRADEMARK INFRINGING SUBJECT DOMAINS
98.
Four of the SUBJECT DOMAINS infringe on the trademarks of U.S. media outlets.
Specifically, washingtonpost[.]pm, washingtonpost[.]ltd, fox-news[.]in, fox-news[.]top, and
forward[.]pw, are domains operated by Doppelganger that are likely to confuse, mislead, or
44
PDF Page 46
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 45 of 277
deceive viewers into believing they are visiting the legitimate Washington Post, Forward, and Fox
News websites. 51 See Exhibit 1. These SUBJECT DOMAINS not only feature infringing content
but also are themselves infringing through their use of registered trademarks as part of the domain
name.
99.
The Washington Post is an American daily national newspaper published in
Washington, D.C. According to its website, The Washington Post’s mission statement includes
seven principles, including “to tell the truth as nearly as the truth may be ascertained.” The
legitimate domain for The Washington Post is washingtonpost.com. The following marks have
been registered on the Principal Register maintained by the USPTO by WP Company LLC on
behalf of The Washington Post:
The wordmark: 52
The stylized wordmark: 53
The Washington Post
The wordmark: 54
Democracy Dies in Darkness
100.
I
have
reviewed
content
published
on
washingtonpost[.]pm
and
washingtonpost[.]ltd. Those domains feature articles purportedly written by a Washington Post
reporter and feature their pictures and bylines. A review of the legitimate Washington Post website
reveals no such articles written by that journalist. The washingtonpost[.]pm and
washingtonpost[.]ltd domains use the registered marks of The Washington Post.
51
The registry for fox-news[.]in is National Internet Exchange of India and the registrar is Tucows, Inc.
The registry for fox-news[.]top is .TOP Registry and the registrar is Tucows, Inc. The registry for
forward[.]pw is Micronesia Investment and Development Corporation and the registrar is Sarek Oy. The
registry for washingtonpost[.]pm is Association Francaise Pour Le Nommage Internet en Cooperation and
the registrar is Sarek Oy.
52
Registration number 1665832.
53
Registration number 1665831.
54
Registration number 6590892.
45
PDF Page 47
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 46 of 277
101. Fox News is an American national media outlet based in New York City. According
to its website, “FOX News Media offers its audiences in-depth news reporting, along with opinion
and analysis encompassing the principles of free people, free markets and diversity of thought, as
an alternative to the left-of-center offerings of the news marketplace.” The legitimate domain for
Fox News is foxnews.com. The following marks have been registered on the Principal Register
maintained by the USPTO by Fox Media LLC on behalf of Fox News:
The wordmark:*° Fox News
The Stylized wordmark:°° VF Ox NEWS
sf
nesstiatwetaai” a RU ATAU
FOX
The Stylized wordmark:*® NEWS
102. I have reviewed content published on fox-news[.]in and fox-news[.]top. Those
domains feature articles purportedly written by a Fox News reporter and feature their pictures and
bylines. A review of the legitimate Fox News website reveals no such articles written by that
journalist. Both fox-news[.]in and fox-news|.]top use the registered marks of Fox News.
°° Registration number 2708769.
°° Registration number 6548048.
>? Registration number 88980501.
*® Registration number 518099.
46
PDF Page 48
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 47 of 277
103. Forward is an American news media organization. According to its website,
Forward delivers “incisive coverage of the issues, ideas and institutions that matter to American
Jews.” The legitimate domain for Forward is forward.com. The following mark has been registered
on the Principal Register maintained by the USPTO by The Forward Fund, Inc., on behalf of
Forward:
The Stylized wordmark:°?
104. Ihave reviewed content published on forward[.]pw and have been unable to find
the same or similar articles on forward.com. The forward[.]pw domain uses the registered mark
of The Forward Fund, Inc.
105. Records received from Cloudflare Inc. pursuant to legal process, revealed that two
Proton Mail email accounts purchased Cloudflare services for washingtonpost|.]pm, fox-
news|.]in, and fox-new|.]top. The Cloudflare accounts associated with these two Proton Mail
email accounts were each accessed from the same Netherlands IP address which resolves to a
British VPS server leased by Doppelganger with an address ending in 11.27 (the “11.27 Server”).
On January 2, 2024, a search warrant was authorized for the 11.27 Server. The 11.27 Server had
been identified as having been created by the same user who created two other VPS servers from
the same provider that were used by the Kamcopec persona to register foxnews|.]cx from
Namecheap, Spiegel. |ltd, fax[.|ltd, and welt[.]ltd from GoDaddy, and to access a Cloudflare
account associated with Sueddeutsche{.|Itd.
°° Registration number 5243694.
47
PDF Page 49
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 48 of 277
106.
The true IP address 60 for forward[.]pw resolves to a Hostinger VPS IP address.
Records received from Hostinger pursuant to legal process, reveal that the Hostinger VPS was
leased by adampalmer1973[@]proton.me on May 18, 2023 using cryptocurrency. The account
accessed the Hostinger VPS using all three of the Doppelganger Servers leased from the British
provider, including the 11.27 Server. 61 Based on my training and experience, I know that when a
person leases a VPS server, like the 11.27 Server, only that person or individuals they grant access
to, can use that VPS server. Accordingly, I assess that any account or domain accessed from the
11.27 VPS server is a member of the Doppelganger conspiracy.
107.
As described further above, the SUBJECT DOMAINS were used by Doppelganger
as part of a foreign malign influence campaign carried out at the behest of the Russian government.
SDA and STRUCTURA are Russian companies that list various Russian government entities as
clients and that perform work for the Russian government.
The Unique Media Brand SUBJECT DOMAINS
108.
As noted above, in addition to impersonating legitimate news outlets,
Doppelganger, led by ANO Dialog and TABAK, under the direction and control of KIRIYENKO,
a sanctioned person, also created original media brands (which are included among the SUBJECT
DOMAINS). These brands purport to be independent journalists or news media organizations but
are actually under the direction and control of the Russian government. The investigation has
60
A true IP address for a domain is the server where the actual information that comprises the website or
webpage resides. Accordingly, a True IP address for a domain is leased or purchased by the individual in
control of the domain.
61
As noted above, records received pursuant to legal process revealed that Doppelganger leased three
servers from the Provider who provided the 11.27 Server in three-month intervals before switching to a
new server from the same Provider.
48
PDF Page 50
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 49 of 277
revealed that as ANO Dialog created the domains for its purportedly unique media brands, it also
registered email addresses that correspond to those domains.
A. RRN, War on Fakes, and the RoyGeneral Persona
109.
As discussed above, GAMBASHIDZE’s notes from Presidential Administration
meetings with KIRIYENKO document the use of Reliable Recent News (“RRN”) by TABAK and
ANO Dialog to further the malign influence campaign, noting “They were assigned Russian
Reliable News – changed it into Recent, it’s going to work.(was sent by Tabak).” RRN was hosted
at rrn[.]world and published in numerous languages. As the Meta coordinated inauthentic behavior
reports 62 note, RRN “maintain[ed] accounts on Twitter and Telegram, which were amplified by
the operation’s Facebook Pages. The Facebook Pages of the Russian diplomatic missions in
Malaysia, Sweden, Hungary, Slovakia and Bangladesh shared links to the site.” According to Meta,
Doppelganger articles would often appear on RRN after they were posted on the cybersquatted
domains: “For example, the same article about Bucha was published on the same day in English
on the spoofed Guardian site, in Italian on the spoofed ANSA site, and in German on the spoofed
Spiegel site. It also appeared in English, French, German, Italian, Spanish and Chinese on
rrn[.]world.” 63
110.
Information received from NameSilo, a U.S. company, pursuant to legal process
revealed that the domain rrn[.]world was registered on June 6, 2022, by an identified individual,
62
Starting on September 27, 2022, Meta released a series of reports regarding Doppelganger. These
reports are available to the public on Meta’s website.
63
During the Russian occupation of Bucha, Ukraine, numerous reports of Russian war crimes were alleged.
After the Russian military retreated from the town, independent journalists confirmed significant atrocities
largely against the civilian population. See https://www.hrw.org/news/2022/04/21/ukraine-russian-forcestrail-death-bucha. “The Russian Defense Ministry denied allegations that its forces killed civilians in Bucha,
stating in a Telegram post on April 3, [2022] that ‘not a single local resident has suffered from any violent
action’ while Bucha was “under the control of the Russian armed forces,’ and claiming instead that the
evidence of crimes was a ‘hoax, a staged production and provocation” by authorities in Kyiv.” On July 7,
49
PDF Page 51
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 50 of 277
using a Moscow address, with email address reliablerecentnews[@]gmail.com. The individual
applied for and received visas from the State Department to enter the United States from Russia in
2008, 2012, 2015, and 2019. Information received from Google pursuant to legal process revealed
that reliablerecentnews[@]gmail.com was created on July 14, 2023, with the name Reliable Recent
News, a recovery email of rrussianews[@]gmail.com and recovery telephone number that matched
the number provided by the individual on her State Department applications.
111.
I determined that rrn[.]world continued to post Doppelganger content until
approximately July 10, 2024, when it appears ANO Dialog lost control of the domain. At some
point shortly thereafter, unknown actors took over the domain and renamed it Rotten Reliable
News and used the domain to publish information regarding Doppelganger’s methods and
activities, much of which I know to be accurate.
112.
Records received pursuant to legal process from Namecheap, revealed that on July
26, 2023, a week after the VIGINUM report was published identifying rrn[.]world as part of
Doppelganger, RoyGeneral[@]proton.me was used to register an account with Namecheap and
lease rrn[.]media and vip-news[.]org. In registering that Namecheap account, the RoyGeneral
persona provided a Beaverton, Oregon address and what appeared to be an incomplete U.S. phone
number. Law Enforcement and open-source records checks indicate the name and home address
provided are not correlated. Additionally, as further discussed below, the RoyGeneral persona also
created an account with NameSilo to lease three more Doppelganger domains and provided a New
York City address and Canadian phone number.
2022, RRN published an article titled “Video: False Staging in Bucha Revealed!” which falsely alleged the
atrocities were staged by Ukraine.
50
PDF Page 52
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 51 of 277
113.
On July 26, 2023, the RoyGeneral persona accessed Namecheap with an Estonian
VPS IP address ending in 77.25 (the “77.25 Server”) and deposited $55.00 with BitPay. 64 That
same day, the RoyGeneral persona used $42.90 of the $55 deposited to lease rrn[.]media. Like
the 11.27 Server, given the frequent use of the 77.25 Server by Doppelganger actors, I assess that
the 77.25 Server was leased by Doppelganger and only accessible to persons involved in
Doppelganger.
114.
As discussed further below, the RoyGeneral, Goodbye, Levinaigrenet,
Holylandherald, and Artichocio personas used the 77.25 Server to access their Namecheap
accounts between February 27, 2023 and July 12, 2024. On at least four occasions, more than one
Doppelganger persona accessed their Namecheap accounts at approximately the same times using
this same IP address. This was not the only shared IP address. Between May 11, 2024 and July 1,
2024, the RoyGeneral, Levinaigrenet, Holylandherald, and Artichocio personas each accessed
their Namecheap accounts on at least two occasions from the same Dutch IP address resolving to
the same Russian VPS ending in 76.173 (the “76.173 Server”). Based on my training and
experience, I know that unlike VPNs, which tend to be used once and discarded, when cybercriminals lease a VPS they will frequently make use of that particular server for a period of time
until the lease ends. For example, records received pursuant to legal process revealed that
Doppelganger leased servers from the Provider who provided the 11.27 Server in three-month
intervals before switching to a new server from the same Provider.
64
As noted below, the persona responsible for leasing levinaigre[.]net, warfareinsider[.]us, and
meisterurian[.]io also accessed Namecheap from the 77.25 Server. Likewise, the individual responsible
for leasing holylandherald[.]com, grenzezank[.]com, and lexomnium[.]com also accessed Namecheap
from the 77.25 Server.
51
PDF Page 53
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 52 of 277
115.
On July 1, 2024, the RoyGeneral persona accessed Namecheap via three IP
addresses, including a British IP address resolving to a Russian VPS that Spur has linked to a
cybercriminal network, a Moscow IP address that Spur has linked to a cybercriminal network, and
from the 76.173 Server. That same day, the RoyGeneral persona deposited $300.00 with BitPay
and used $42.90 to renew the lease for rrn[.]media and $7.66 to lease vip-news[.]org. I reviewed
materials posted on rrn[.]media and discovered that it uses the same logo and branding as the
original rrn[.]world and continues to post content consistent with the malign influence campaign
previously posted on rrn[.]world.
116.
In addition, records received from OpenAI, a U.S.-based artificial intelligence
research organization, revealed the purchase of multiple artificial intelligence program accounts,
like ChatGPT, to generate and edit articles and comments specifically for rrn[.]media and other
Doppelganger-linked domains. There were five email accounts used to register for OpenAI
services linked to Doppelganger. Records received pursuant to legal process revealed one of those
email accounts was connected by cookies to reliablerecentnews[@]gmail.com. Based on my
training and experience, I know that when two or more accounts are linked by cookies, this means
that the accounts were accessed using the same device(s) and are likely accessed by the same
user(s). One of the other email accounts used to register for OpenAI was connected by cookies to
37 other email accounts. Almost all of these connected email accounts used naming conventions
that corresponded to domains used by Doppelganger as part of their unique media branding
operation, including some of the SUBJECT DOMAINS, as discussed further below.
117.
One of the SUBJECT DOMAINS, waronfakes[.]com, was discussed in length in
the VIGINUM report:
The first articles published on RRN website were identical copies of articles
previously published on the fake Russian fact-checking website War on Fakes,
52
PDF Page 54
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 53 of 277
launched a few hours after Russia invaded Ukraine. Quickly identified for its role
in legitimizing the Russian ‘special military operation’ and discrediting the
Ukrainian State, War on Fakes has also been amplified by at least 65 official
Facebook pages and official Twitter accounts of the Russian diplomatic network.
Moreover, War on Fakes the administrator’s login page has been set up to redirect
traffic to rrussianews.com, thereby establishing a technical link between the two
websites. The domain name waronfakes[.]com was registered on 1 March 2022
and was updated a year later by Timofey VASILIEV a Russian citizen known for
having worked for ANO Dialog. Dialog is an organization created in 2019 under
the supervision of the Russian Presidential Administration and the Department of
Information Technologies of Moscow city. In charge of a portion of the public
relations and communication strategy of Moscow, ANO Dialog has been accused
of conducting online propaganda activities on behalf of the Russian State. 65
118.
As noted in the VIGINUM report, the administrator’s login page for
waronfakes[.]com redirected traffic to rrussianews.com. The corresponding email address for
rrussianews.com, rrussiannews[@]gmail.com was the recovery email for the above-described
Russian citizen’s reliablerecentnews[@]gmail.com account, which in turn was used to register the
rrn[.]world domain. In addition, SDA records revealed that GAMBASHIDZE had the resume of
an individual assessed to be working for Doppelganger, who described their experience from
October 2022 to present as a writer for the Telegram channel war on fakes, with duties including
writing posts for the channel war on fakes and war on fakes analytics, and working on translations
and open-source research. Waronfakes[.]com is leased from an overseas registrar which leases
the domain from the U.S. registry, VeriSign Global Registry Services (“VeriSign”). Accordingly,
there is probable cause to believe that when ANO Dialog renews the lease on the domain, a portion
of those funds are used by the overseas registrar to pay VeriSign in the United States for the benefit
of sanctioned persons.
65
Available
at
https://www.sgdsn.gouv.fr/files/files/20230719_NP_VIGINUM_RAPPORTCAMPAGNE-RRN_EN1.pdf
53
PDF Page 55
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 54 of 277
B. Other Doppelganger Media Brands
119.
Based on records received pursuant to legal process, open-source research, the
content of articles published on the domains, and information obtained throughout this
investigation, I assess that each of the SUBJECT DOMAINS listed below is part of Doppelganger.
1. The Demon Accounts
120.
As noted above in paragraph 116, five email accounts were identified as using
OpenAI services in furtherance of Doppelganger. Records received from Google pursuant to legal
process revealed that one of those accounts (the “Demon Account”) was subscribed in the name
of “White Seo.” When it was registered, the Demon Account selected Russian as its language,
listed a Russian recovery email ending in .ru with the same naming convention, namely “Demon”
followed by a string of numbers, and provided a Russian phone number. The Demon Account was
linked by cookies to 37 other email accounts with naming conventions that correspond to domains
connected to Doppelganger’s unique media branding operation, including some of the SUBJECT
DOMAINS, such as:
Email Account Linked by Cookies to the Corresponding SUBJECT DOMAIN
Demon Account
holylandheraldcom[@]gmail.com
holylandherald[.]com
mypride.press[@]gmail.com
mypride[.]press
liesofwallstreet.com[@]gmail.com
liesofwallstreet[.]io
50statesoflie.com[@]gmail.com
50statesoflie[.]media
ukrlm.info[@]gmail.com
ukrlm[.]info
meisteruiancom[@]gmail.com
meisterurian[.]io
Acrosstheline.press[@]gmail.com
acrosstheline[.]press
Electionwatch.live[@]gmail.com
electionwatch[.]io
54
PDF Page 56
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 55 of 277
Honeymoney.infonow[@]gmail.com
honeymoney.press
Uschina.press.now[@]gmail.com
uschina[.]online
Spicyconspiracy.info[@]gmail.com
spicyconspiracy[.]io
Levinaigre.net[@]gmail.com
levinaigre[.]net
2.
The Goodbye Persona Leased the Acrosstheline[.]press, ukrlm[.]info, and
mypride[.]press Domains Linked to the Demon Account
121.
Two
Proton
Mail
email
accounts,
Aurevourmail[@]proton.me
and
Buenasnochesmail[@]proton.me, (collectively, the “Goodbye persona”), leased domains from
Namecheap for use in the Doppelganger campaign, including acrosstheline[.]press, 66
ukrlm[.]info, 67 and mypride[.]press. 68 Given that these Proton Mail addresses included
derivations of a phrase roughly translated into two languages: Au Revoir and Buenas Noches, I
assess that the Namecheap accounts were created using operational email addresses by ANO
Dialog employees or agents acting on their behalf and will refer to them collectively as the
Goodbye persona.
122.
Records received from Namecheap pursuant to legal process revealed that the
Goodbye persona leased acrosstheline[.]press, ukrlm[.]info, and mypride[.]press using the
77.25 Server and paid for them using a U.S.-based payment provider, called BitPay, which allows
66
Across the Line presents itself as a website focused on migration and forced displacement issues, often
presenting only an adverse perspective as it relates to the U.S. Its website footer notes, “Join us in tackling
the problems of refugees across the globe and at the US border. Let’s cross the line to support those who
didn’t ask to leave their homes and face uncertainty.”
67
UKRLM is an English language website that describes itself as “Bringing you the latest updates, analysis,
and insights from war-torn Ukraine. Stay informed on the ongoing Russia-Ukraine conflict with us.”
68
My Pride Press is an English language website that focuses on the LGBTQ community, with topics
including trans youth, athletes, health, woke wars, LGBT.
55
PDF Page 57
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 56 of 277
users to make payments via Bitcoin. Records received pursuant to legal process from Namecheap
and BitPay revealed the following:
a. On February 27, 2023, the Goodbye persona, using the 77.25 Server, sent 0.002612
BTC, equivalent to $60.46, from a Bitcoin address ending in -MiP6T to
Namecheap. The same day, Namecheap credited the Goodbye persona account with
$60.00 and the account used $53.12 to lease acrosstheline[.]press, ukrlm[.]info,
and mypride[.]press which included a $38.64 monthly subscription for EasyWP, a
Namecheap product for managing websites.
b. On March 21, 2023, the Goodbye persona, using the 77.25 Server, sent 0.001486
BTC, equivalent to $40.84, from a Bitcoin address ending in -JPrHF to Namecheap.
The same day, Namecheap credited the Goodbye persona account with $40.00,
which prevented the previously mentioned subscription from overdrawing the
account.
c. On April 20, 2023, the Goodbye persona, using the 77.25 Server, sent 0.003881
BTC, equivalent to $110.62, from a Bitcoin address ending in -mhtcF to
Namecheap. The same day, Namecheap credited the Goodbye persona account with
$110.00, which prevented the previously mentioned subscription from overdrawing
the account.
d. On July 23, 2023, the Goodbye persona, using a German IP address that Spur has
linked to a cybercriminal network, sent 0.006791 BTC, equivalent to $202.51, from
a Bitcoin address ending in -Z2my to Namecheap. The same day, Namecheap
credited the Goodbye persona account with $200.00, which prevented the
previously mentioned subscription from overdrawing the account.
56
PDF Page 58
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 57 of 277
e. On December 15, 2023, the Goodbye persona, using a German IP address that Spur
has linked to a cybercriminal network, sent 0.002147 BTC, equivalent to $89.99,
from a Bitcoin address ending in – qpwW to Namecheap. The same day,
Namecheap credited the Goodbye persona account with $70.00, which prevented
the previously mentioned subscription from overdrawing the account.
f. On July 23, 2023, the Goodbye persona, using a German IP address that Spur has
linked to a cybercriminal network, sent 0.004861 BTC, equivalent to $206.86, from
a Bitcoin address ending in -Z2my to Namecheap. The same day, Namecheap
credited the Goodbye persona account with $205.00 and the account used $89.48
to renew their lease of acrosstheline[.]press, ukrlm[.]info, and mypride[.]press.
123.
Based on these BitPay transactions, the IP addresses, and my training and
experience, there is probable cause to believe the funds used to lease these three SUBJECT
DOMAINS originated from outside the United States.
3.
The Levinaigrenet Persona Leased the Levinaigre[.]net,
Meisterurian[.]io Domains Linked to the Demon Account and Warfareinsider[.]us.
124.
and
Records received from Namecheap pursuant to legal process revealed that a user
with the email address levinaigrenet[@]proton.me leased levinaigre[.]net, 69 meisterurian[.]io, 70
and warfareinsider[.]us. 71 The Levinaigrenet persona provided Namecheap with a name of Jay
Rom and a Broken Bow, Nebraska mailing address. All payments were made using funds
transferred from BitPay. Law enforcement records checks reveal no association between a Jay
69
Levinaigre is a French language website that focuses on French scandals.
70
Meisterurian is a German language website that purports to publish German news stories.
71
Warfareinsider is an English language website that describes itself as reporting on “Latest military news.
Stay sharp to look at it from the different perspective.”
57
PDF Page 59
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 58 of 277
Rom and the physical mailing address in Nebraska provided to Namecheap. In addition, despite
indicating a U.S. mailing address, on June 16, 2023, the Levinaigrenet persona accessed
Namecheap via the 77.25 Server and, using BitPay, deposited $72.00. On June 19, 2023, the
Levinaigrenet persona used the 77.25 Server to access Namecheap and used $25.04 to lease
levinaigre[.]net and purchase a monthly subscription of EasyWP. Then, on July 5, 2023, the
Levinaigrenet persona accessed Namecheap via a French IP address that Spur linked to a
cybercriminal network and, using BitPay, deposited $120.00. The same day the Levinaigrenet
persona used $70.22 to lease warfareinsider[.]us and meisterurian[.]io and purchase monthly
subscriptions of EasyWP for both. On June 4, 2024, the Levinaigrenet persona accessed
Namecheap via the 76.173 Server. and, using BitPay, deposited $200.00. The same day the account
used $10.48 to renew the lease for warfareinsider[.]us and meisterurian[.]io.
125.
As discussed below, on both June 16 and 19, 2023, another Doppelganger linked
Namecheap account also used the 77.25 Server to access their Namecheap account. Accordingly,
although the Levinaigrenet persona provided Namecheap with a U.S. address, I assess that the
individual accessing and paying for the account is actually located overseas.
4.
The Holylandherald Persona Leased the Holylandherald[.]com Domain
Linked to the Demon Account and Grenzezank[.]com, and Lexomnium[.]com
126.
Records received from Namecheap pursuant to legal process revealed that a user
with the email address holylandheraldcom[@]proton.me leased holylandherald[.]com, 72
grenzezank[.]com, 73 and lexomnium[.]com. 74 The Holylandherald persona provided Namecheap
72
Holyland Herald poses as an Israeli based English language news website focused on Israel-US relations,
the war in Gaza, and other Middle East issues, however it also posted articles related to Ukraine, such as
an article titled “Ukraine Interferes in Russian Presidential Elections.”
73
Grenzezank is a German language website that focuses on international news, including U.S. politics.
74
Lex omnium, which translates to The Law of All in Latin, is a French language website that appears to
focus on French news with a legal perspective.
58
PDF Page 60
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 59 of 277
with a first name of holyland, a last name of herald, and a mailing address in Kansas City, Missouri
that indicated the country of residence to be Germany. All payments for the domains were made
using funds transferred from BitPay.
127.
Specifically, on June 16, 2023, the Holylandherald persona accessed Namecheap
via the 77.25 Server and, using BitPay, deposited $65.00. On June 19, 2023, the Holylandherald
persona accessed their Namecheap account using the 77.25 Server and used $22.64 to lease
holylandherald[.]com and purchase a monthly subscription of EasyWP. As referenced above,
records received from Namecheap revealed that the account used to lease Levinaigre[.]net,
meisterurian[.]io, and warfareinsider[.]us accessed Namecheap from the same server at
approximately the same time. On April 16, 2024, the Holylandherald persona accessed Namecheap
via a U.S. IP address that Spur has linked to a cybercriminal network and, using BitPay, deposited
$104.00. On May 20, 2024, Namecheap charged the account $16.06 to renew the lease for
holylandherald[.]com.
128.
On July 5, 2023, the Holylandherald account accessed Namecheap via a German
IP address that Spur has linked to a cybercriminal network and, using BitPay, deposited $120.00.
The same day the account used $45.28 to lease grenzezank[.]com and lexomnium[.]com and
purchase monthly subscriptions of EasyWP for both. On May 31, 2024, the account accessed
Namecheap via the 76.173 Server. and, using BitPay, deposited $100.00. The same day the account
used $32.12 to renew the lease for grenzezank[.]com and lexomnium[.]com.
59
PDF Page 61
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 60 of 277
5.
The RoyGeneral Persona Leased the 50statesoflie[.]media,
uschina[.]online, and HoneyMoney[.]press Linked to the Demon Account
129.
As referenced above, the Doppelganger campaign created email addresses with a
naming convention that correspond to 50statesoflie[.]media, 75 honeymoney[.]press, 76and
uschina[.]online. 77 The registrar for all three of those domains was NameSilo and the domains
were leased, from QHoster, a Uruguayan domain reseller, 78 using RoyGeneral[@]proton.me.
Records received pursuant to legal process from NameSilo, revealed that the RoyGeneral persona
created a QHoster account, using a New York, New York address and a Canadian phone number
and leased the 50statesoflie[.]media, uschina[.]online, and honeymoney[.]press. Law
enforcement and open-source records checks indicate the name and home address provided are not
correlated. As referenced above in paragraph 112, the RoyGeneral persona also leased rrn[.]media
and vip-news[.]org but provided an Oregon address and an incomplete U.S. telephone number. At
least one article published on honeymoney[.]press focused on the current U.S. Presidential
administration’s stance on Ukraine. Although the RoyGeneral persona provided NameSilo with a
U.S. address, based on the RoyGeneral’s use of VPSs with Namecheap, links to other
Doppelganger actors, and leasing of rrn[.]media and waronfakes[.]com, I assess that the
individual accessing and paying for the RoyGeneral account is actually located overseas.
130.
Mandiant, an American cybersecurity firm and a subsidiary of Google, tracks the
“Doppelganger Information Operations Campaign” and publishes a monthly report with updates
75
50 States of Lie describes itself as “Exposing the scandals that shape American politics and culture. We
bring you the latest on corruption, cover-ups, and controversies in the land of the free.”
76
Honey Money Press is an English language website that focuses on U.S. consumer trends.
77
US China Online on issues related to China’s national interest, including U.S.-China relations, Taiwan,
and U.S. trade and foreign policies.
78
A reseller is a third-party company that offers domain name registration services through a registrar, in
this case NameSilo, a U.S. company.
60
PDF Page 62
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 61 of 277
to the state of the campaign in a document Mandiant calls a “Narrative Tracker.” In their April
2024 report, Mandiant noted in addition to the continued use of cybersquatted websites, the
Doppelganger campaign had begun using the following domains to target American audiences:
Election Watch (electionwatch[.]live), Spicy Conspiracy (spicyconspiracy[.]info), 50 States of Lie
(50statesoflie[.]com), and Dragonfly Times (uschina[.]press). Of note, records received from
Hostinger pursuant to legal process, showed that the Goodbye persona leased Electionwatch[.]live,
50statesoflie[.]com, and uschina[.]press on February 23, 2023, using cryptocurrency transferred
using CoinGate, a Lithuanian cryptocurrency payment processor.
131.
As noted above, the Demon Account created email addresses that correspond
directly to spicyconspiracy[.]io 79 and electionwatch[.]io. 80 At present, electionwatch[.]live,
spicyconspiracy[.]info, 50statesoflie[.]com, and uschina[.]press are no longer active. However, I
have reviewed the active domains 50statesoflie[.]media, uschina[.]online, spicyconspiracy[.]io,
and electionwatch[.]io and have confirmed that they use the same branding and formatting as
electionwatch[.]live, spicyconspiracy[.]info, 50statesoflie[.]com, and uschina[.]press, which leads
me to conclude that the same person(s) are behind these domains.
6.
The Artichocio persona leased truthgate[.]us, shadowwatch[.]us, 81 and
82
artichoc[.]io,
132.
Records received from Namecheap revealed that an individual using the email
address artichocio[@]proton.me leased truthgate[.]us, shadowwatch[.]us, and artichoc[.]io, and
79
Spicy Conspiracy describes itself as “Uncovering the truth behind the veil. Your source for in depth
coverage of conspiracies, secret agendas, and hidden realities.”
80
Election Watch focuses on U.S. elections, including the 2024 U.S. presidential election, political
candidates, purported corruption, and polling results.
81
Truth Gate and Shadow Watch are English language websites that focused on disseminating corruption
and conspiracy disinformation targeting the U.S.
82
Artichoc io is a French language website with a tagline that translates to “Art that Shocks.” It purports to
61
PDF Page 63
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 62 of 277
provided the name Jason Kant with a French mailing address and a U.S. phone number. The
domains were purchased using Bitcoin transferred through BitPay.
133.
June 29, 2023, the Artichocio persona used the 77.25 Server to access Namecheap
and deposit $120.00 using BitPay. As discussed above, given the frequent use of the 77.25 Server
by Doppelganger actors, I assess that the 77.25 Server was leased by Doppelganger and only
accessible to persons involved in Doppelganger. The same day, the Artichocio persona used $52.86
to lease artichoc[.]io and purchase a monthly subscription of EasyWP. On April 16, 2024, the
artichocio account accessed Namecheap via a German IP address that Spur has linked to a
cybercriminal network and, using BitPay, deposited $92.00. On May 30, 2024, Namecheap
charged the artichocio account $48.98 to renew the lease for artichoc[.]io.
134.
On July 5, 2023, the artichocio account accessed Namecheap via a U.S. IP address
resolving to a British VPS service and, using BitPay, deposited $120.00. The same day, the
artichocio account used $34.72 to lease truthgate[.]us and shadowwatch[.]us and purchase
monthly subscriptions of EasyWP for both. On June 18, 2024, the artichocio account accessed
Namecheap from the 76.173 Server and, using BitPay, deposited $220.00. The same day, the
account used $20.96 to renew the lease for truthgate[.]us and shadowwatch[.]us.
7.
135.
The Ukraine Domains
As noted above, one of GAMBASHIDZE’s notes from a meeting with the
Presidential Administration referenced a participant as “fully in charge of filling the content on the
Ukraine Tribunal portal.” Two Doppelganger-linked domains, tribunalukraine[.]info, 83 and
focus on pop culture, art, and entertainment.
83
Tribunal Ukraine is a German language website a focus on revealing the alleged truth about what is
happening in Ukraine.
62
PDF Page 64
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 63 of 277
ukraine-inc[.]info, 84 were leased from Newfold Digital, a U.S. registrar. Records received from
Newfold Digital revealed that ukraine-inc[.]info was registered on November 3, 2023. Those
records also revealed that the email address trelelcalra1975[@]yahoo.com, was used to lease
ukraine-inc[.]info. The trelelcalra1975[@]yahoo.com was only logged into five times, four times
from German VPSs and once from a Russian IP address. The trelelcalra1975[@]yahoo.com user
registered their Newfold Digital account in the name of Dennis Eggers with a German mailing
address and German phone number. Subscriber records received from Yahoo Inc. revealed that the
trelelcalra1975[@]yahoo.com account was registered using a Cyrillic first name and the last name
Reddy and a Brazilian phone number, which does not match the information provided to Newfold
Digital.
136.
registered
Records received from Newfold Digital revealed that tribunalukraine[.]info was
on
June
10,
2022.
glennwallace9672[@]outlook.com
Those
was
records
used
to
revealed
lease
that
the
email
address
tribunalukraine[.]info.
The
glennwallace9672[@]outlook.com user registered their Newfold Digital account in the name of
Glen Wallace with a Vienna mailing address and an Austrian phone number. Records received
from Microsoft revealed that glennwallace9672[@]outlook.com was registered by Glenn Wallace
from Austria. Notably, that Outlook account was only logged into twice, September 28, 2022, and
October 5, 2022. According to records received from Newfold Digital, the Newfold Digital
account for tribunalukraine[.]info was accessed from the 11.27 Server.
84
Ukraine Inc is an English language website that features animated anti-Ukrainian videos. The videos
contain anti-Semitic tropes that depict Ukrainian President Zelensky as an alcoholic and imply that the
deaths of Ukrainians benefit him financially.
63
PDF Page 65
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 64 of 277
THE SUBJECT DOMAINS
137.
As described above, the SUBJECT DOMAINS were used by individuals abroad
who are working under the direction and control of the Russian government, and in particular
KIRIYENKO, GAMBASHIDZE, SDA, TUPIKIN, and STRUCTURA, all of whom have been
sanctioned by the U.S. Government, along with ANO Dialog, TABAK, and others, to advance their
interests and the interests of the Russian government and to facilitate the violation of, or in
violation of, the SUBJECT OFFENSES.
138.
As set forth above and in Attachments A-1 through A-9, a search of publicly
available Who.is domain name registration records revealed the dates that the SUBJECT
DOMAINS were registered, with which registrar, the headquarters of that registrar, the registrant
of each of the SUBJECT DOMAINS, and the top-level domain for each of the SUBJECT
DOMAINS.
STATUTORY BASIS FOR SEIZURE AND FORFEITURE
139.
Title 18, United States Code, Section 981(a)(1)(A) provides, in relevant part, that
any property involved in a transaction or attempted transaction in violation of 18 U.S.C.
§ 1956(a)(2)(A) (international promotional money laundering) and 1956(h) (conspiracy to commit
the same) is subject to civil forfeiture.
140.
Title 18, United States Code, Section 2323(a)(1)(B), provides, in relevant part, that
any property used, or intended to be used, in any manner or part to commit or facilitate the
commission of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in
violation of 18 U.S.C. § 2320, is subject to civil forfeiture to the United States government.
64
PDF Page 66
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 65 of 277
141.
Title 18, United States Code, Section 981(b)(2) authorizes seizure of property
subject to civil forfeiture based upon a warrant supported by probable cause and “obtained in the
same manner as provided for a search warrant under the Federal Rules of Criminal Forfeiture.”
142.
Title 18, United States Code, Section 981(b)(3) permits the issuance of a seizure
warrant by a judicial officer in any district in which a forfeiture action against the property may be
filed and such warrant may be executed in any district in which the property is found, and provides
that the warrant may be executed in any district in which the property is found or transmitted to
the central authority of a foreign state for service in accordance with any treaty or other
international agreement.
143.
Title 18, United States Code, Section 982(a)(1) provides, in relevant part, that when
imposing sentence on a person convicted of an offense in violation of 18 U.S.C. § 1956(a)(2)(A)
(international promotional money laundering) and 1956(h) (conspiracy to commit the same), a
court shall order that person’s property that was involved in the offense be forfeited to the United
States.
144.
Title 18, United States Code, Section 2323(b)(1), provides, in relevant part, that the
court, in imposing sentence on a person convicted of Trafficking in Counterfeit Goods or Services
(e.g., trademark infringement), in violation of 18 U.S.C. § 2320, an offense under section 506 of
title 17, or section 2318, 2319, 2319A, 2319B, or 2320, or chapter 90, of this title, shall order, in
addition to any other sentence imposed, that the person forfeit to the United States Government
any property subject to forfeiture under 18 U.S.C. § 2323(a) for that offense.
145.
Title 18, United States Code, Section 982(b)(1) incorporates by reference the
procedures for seizure and forfeiture in 21 U.S.C. § 853. Title 21, United States Code, Section
853(f) provides in relevant part that a seizure warrant for property subject to forfeiture may be
65
PDF Page 67
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 66 of 277
sought “in the same manner in which a search warrant may be issued. A court shall issue a criminal
seizure warrant if it determines that the property to be seized would, in the event of a conviction,
be subject to forfeiture and that a restraining order would be inadequate to assure the availability
of the property for forfeiture.”
146.
Neither a restraining order nor an injunction is sufficient to guarantee the
availability of the SUBJECT DOMAINS for forfeiture. By seizing the SUBJECT DOMAINS and
redirecting them to another website(s), the Government will prevent third parties from acquiring
the name and using it to commit additional crimes. Furthermore, seizure of the SUBJECT
DOMAINS will prevent third parties from continuing to access the SUBJECT DOMAINS in their
present form.
147.
Title 18, United States Code, Section 2323(a)(1)(B), provides, in relevant part, that
any property used, or intended to be used, in any manner or part, to commit or facilitate the
commission of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in
violation of 18 U.S.C. § 2320, is subject to civil forfeiture. Title 18, United States Code, Section
2323(b)(1), provides, in relevant part, that the court, in imposing sentence on a person convicted
of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in violation of 18
U.S.C. § 2320, shall order, in addition to any other sentence imposed, that the person forfeit to the
United States Government any property subject to forfeiture under 18 U.S.C. § 2323(a).
148.
Title 18, United States Code, Section 981(h) provides that venue for civil forfeitures
brought under this section lies in the district either where the defendant owning the property is
located or in the judicial district where the criminal prosecution is brought.
66
PDF Page 68
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 67 of 277
149.
Title 18, United States Code, Section 981(b)(3) provides that a seizure warrant may
be issued in any district in which a forfeiture action against the property may be filed under 28
U.S.C. § 1355(b).
150.
Title 28, United States Code, Section 1355(b)(1)(A), provides that a forfeiture
action or proceeding may be brought in a district court for the district in which any of the acts or
omissions giving rise to the forfeiture occurred.
151.
Title 21, United States Code, Section 853(l) provides that the district courts of the
United States having jurisdiction to enter orders, including seizure warrants, without regard to the
location of property which may be subject to criminal forfeiture under § 853.
152.
As set forth above, there is probable cause to believe that the SUBJECT DOMAINS
are subject to civil and criminal forfeiture because they are property involved in in the commission
of violations of 18 U.S.C. § 1956(a)(2)(A) (international promotional money laundering) and
1956(h) (conspiracy to commit same). Specifically, the SUBJECT DOMAINS are property
involved in transactions or attempted transactions that violate 18 U.S.C. § 1956(a)(2)(A)
(international promotional money laundering) and 1956(h) (conspiracy to commit same), done
with the intent to promote the carrying on of specified unlawful activity, specifically violations of
IEEPA. Further, as set forth above, there is probable cause to believe that a subset of the SUBJECT
DOMAINS are subject to civil and criminal forfeiture because they are property that facilitated
the commission of Trafficking in Counterfeit Goods or Services (e.g., trademark infringement), in
violation of 18 U.S.C. § 2320.
153.
Venue for civil and criminal forfeiture is proper in this district pursuant to 18 U.S.C.
§ 981(b)(3) and (h), 28 U.S.C. § 1355(b)(1)(A), and 21 U.S.C. § 853(l), as set forth above, as the
government has venue to charge the above described international promotional money laundering,
67
PDF Page 69
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 68 of 277
conspiracy to commit the money laundering, and trafficking in counterfeit goods or services
offenses in the Eastern District of Pennsylvania. In addition, as part of the money laundering
conspiracy to promote violations of IEEPA, the conspirators took steps to make the SUBJECT
DOMAINS available on the internet, including in the Eastern District of Pennsylvania and the
defendants used a subset of the SUBJECT DOMAINS to commit or facilitate the commission of
Trafficking in Counterfeit Goods or Services, including in the Eastern District of Pennsylvania.
SEIZURE PROCEDURE
154.
As detailed in Attachments A-1 through A-9, upon execution of the seizure warrant,
the registry or registrar for the top-level domain or for each SUBJECT DOMAIN (collectively, the
“PROVIDERS”), shall be directed to restrain and lock the SUBJECT DOMAINS pending transfer
of all right, title, and interest in the SUBJECT DOMAINS to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS cannot be made
absent court order or, if forfeited to the United States, without prior consultation with the Federal
Bureau of Investigation or DOJ.
155.
In addition, upon seizure of the SUBJECT DOMAINS by the Federal Bureau of
Investigation, the PROVIDERS will be directed to associate the SUBJECT DOMAINS to a new
authoritative name server(s) to be designated by a law enforcement agent. The Government will
display a notice on the website to which the SUBJECT DOMAINS will resolve indicating that the
site has been seized pursuant to a warrant issued by this court.
REQUEST FOR SEALING
156.
I further request that the Court order that all papers in support of this application,
including the affidavit and search warrant, be sealed until further order of the Court. These
documents discuss an ongoing criminal investigation that is neither public nor known to all of the
68
PDF Page 70
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 69 of 277
targets of the investigation. Accordingly, there is good cause to seal these documents because their
premature disclosure may seriously jeopardize that investigation.
CONCLUSION
157. For the foregoing reasons, I submit that there is probable cause to believe that the
SUBJECT DOMAINS are used in and/or intended to be used in facilitating and/or committing the
SUBJECT OFFENSES. Accordingly, the SUBJECT DOMAIN NAMES are subject to seizure
pursuant to 18 U.S.C. §§ 981(b), 982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f), and subject
to forfeiture to the United States pursuant to 18 U.S.C. §§ 981(a)(1)(A) and 982(a), and 18 U.S.C.
§ 2323(a)(1)(B), (b)(1), and I respectfully request that the Court issue a seizure warrant for
SUBJECT DOMAIN NAMES.
158. Because the warrant will be served on the PROVIDERS that control the SUBJECT
DOMAINS, and the PROVIDERS, thereafter, at a time convenient to them, will transfer control
of the SUBJECT DOMAINS to the government, there exists reasonable cause to permit the
execution of the requested warrant at any time in the day or night.
Respectfully submitted,
Special Agent, Federal Bureau of Investigation
Affidavit submitted by email and attested to me as true and accurate by telephone consistent
with Fed. R. Crim. P. 4.1 and 41(d)(3) this 30th day of August, 2024 at 9:34pm.
Digitally signed
by
Date: 2024.08.30
22:19:07 -04'00'
United States Magistrate Judge
69
PDF Page 71
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 70 of 277
ATTACHMENT A-1
With respect to tribunalukraine.info, rrn.media, ukrlm.info, faz.ltd, spiegel.agency,
lemonde.ltd, leparisien.ltd, rbk.media, 50statesoflie.media, meisterurian.io, artichoc.io
(“SUBJECT DOMAINS”), Identity Digital, located at 10500 NE 8th Street, Ste. 750 Bellevue,
WA 98004, who is the domain registry for the SUBJECT DOMAINS, shall take the following
actions to effectuate the seizure of SUBJECT DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the
direction of the FBI, by associating the SUBJECT DOMAINS to the following
authoritative name-server(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Identity Digital Limited.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
70
PDF Page 72
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 71 of 277
The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
71
PDF Page 73
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 72 of 277
ATTACHMENT A-2
With
respect
to
vip-news.org,
acrosstheline.press,
mypride.press,
truthgate.us,
warfareinsider.us, shadowwatch.us (“SUBJECT DOMAINS”), NameCheap, located at 4600
East Washington Street Suite 300 Phoenix, AZ 85034, who is the domain registrar for the
SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of SUBJECT
DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Namecheap.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
72
PDF Page 74
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 73 of 277
The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
73
PDF Page 75
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 74 of 277
ATTACHMENT A-3
With respect to pravda-ua.com, waronfakes.com, holylandherald.com, levinaigre.net,
grenzezank.com, lexomnium.com (“SUBJECT DOMAINS”), VeriSign Global Registry
Services, located at 12061 Bluemont Way, Reston, VA 20190, who is the domain registry for the
SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of SUBJECT
DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to VeriSign Global Registry
Services.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
74
PDF Page 76
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 75 of 277
The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
75
PDF Page 77
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 76 of 277
ATTACHMENT A-4
With respect to uschina.online, honeymoney.press (“SUBJECT DOMAINS”), NameSilo,
located at 1300 E Missouri Ave Ste A-110 Phoenix, AZ 85014-2362 who is the domain registrar
for the SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of
SUBJECT DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to NameSilo.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
76
PDF Page 78
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 77 of 277
The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
77
PDF Page 79
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 78 of 277
ATTACHMENT A-5
With respect to sueddeutsche.co, tagesspiegel.co (“SUBJECT DOMAINS”), GoDaddy.com
LLC., located at 100 S. Mill Ave Suite 1600 Tempe, AZ 85281 USA, who is the domain registrar
for the SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of
SUBJECT DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to GoDaddy.com LLC.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
78
PDF Page 80
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 79 of 277
The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
79
PDF Page 81
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 80 of 277
ATTACHMENT A-6
With respect to bild.work (“SUBJECT DOMAIN”), GoDaddy Registry Services, LLC, located at
100 S. Mill Ave Suite 1600 Tempe, AZ 85281 USA, who is the domain registry for the SUBJECT
DOMAIN, shall take the following actions to effectuate the seizure of SUBJECT DOMAIN:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAIN to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to GoDaddy Registry Services,
LLC.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAIN pending transfer
of all right, title, and interest in SUBJECT DOMAIN to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAIN cannot be
made absent court order or, if forfeited to the United States, without prior consultation with
FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
80
PDF Page 82
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 81 of 277
The Government will display a notice on the website to which the SUBJECT DOMAIN
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
81
PDF Page 83
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 82 of 277
ATTACHMENT A-7
With respect to fox-news.top, fox-news.in (“SUBJECT DOMAINS”), Tucows Inc., 10400 NE
4th Street, 5th Floor, Suite 121, Bellevue, Washington 98004 who is the domain registrar for the
SUBJECT DOMAINS, shall take the following actions to effectuate the seizure of SUBJECT
DOMAINS:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAINS to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Tucows Inc.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAINS pending transfer
of all right, title, and interest in SUBJECT DOMAINS to the United States upon
completion of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAINS
cannot be made absent court order or, if forfeited to the United States, without prior
consultation with FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
82
PDF Page 84
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 83 of 277
The Government will display a notice on the website to which the SUBJECT DOMAINS
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
83
PDF Page 85
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 84 of 277
ATTACHMENT A-8
With respect to forward.pw (“SUBJECT DOMAIN”), Micronesia Investment and Development
Corporation, located at P.O. Box 1256 Koror 96940, Palau who is the domain registry for the
SUBJECT DOMAIN, shall take the following actions to effectuate the seizure of SUBJECT
DOMAIN:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAIN to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Micronesia Investment and
Development Corporation.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAIN pending transfer
of all right, title, and interest in SUBJECT DOMAIN to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAIN cannot be
made absent court order or, if forfeited to the United States, without prior consultation with
FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
84
PDF Page 86
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 85 of 277
The Government will display a notice on the website to which the SUBJECT DOMAIN
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
85
PDF Page 87
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 86 of 277
ATTACHMENT A-9
With respect to washingtonpost.pm (“SUBJECT DOMAIN”), Sarek Oy, located at Urho
Kekkosen katu 4E 00100, HELSINKI, Uusimaa Finland, who is the domain registry for the
SUBJECT DOMAIN, shall take the following actions to effectuate the seizure of SUBJECT
DOMAIN:
1) Take all reasonable measures to redirect the domain names to substitute servers at the direction
of the FBI, by associating the SUBJECT DOMAIN to the following authoritative nameserver(s):
(a) Ns1.fbi.seized.gov;
(b) Ns2.fbi.seized.gov; and/or
(c) Any new authoritative name server or IP address to be designated by a law
enforcement agent in writing, including e-mail, to Sarek Oy.
2) Prevent any further modification to, or transfer of, SUBJECT DOMAIN pending transfer
of all right, title, and interest in SUBJECT DOMAIN to the United States upon completion
of forfeiture proceedings, to ensure that changes to the SUBJECT DOMAIN cannot be
made absent court order or, if forfeited to the United States, without prior consultation with
FBI.
3) Take all reasonable measures to propagate the necessary changes through the Domain
Name System as quickly as practicable.
4) Provide reasonable assistance in implementing the Terms of this Order and take no
unreasonable action to frustrate the implementation of this Order.
86
PDF Page 88
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 87 of 277
The Government will display a notice on the website to which the SUBJECT DOMAIN
will resolve. That notice will consist of law enforcement emblems and the following text
(or substantially similar text):
“This domain has been seized by the Federal Bureau of Investigation in
accordance with a seizure warrant issued pursuant to 18 U.S.C. §§ 981(b),
982(b)(1), 2323(a)(2), 2323(b)(2), 21 U.S.C. § 853(f) by the United States District
Court for the Eastern District of Pennsylvania as part of a law enforcement action
by the Federal Bureau of Investigation.”
87
PDF Page 89
EXHIBIT 1
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 88 of 277
PDF Page 90
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 89 of 277
Washingtonpost[.]ltd
PDF Page 91
The Washington Post
Workd Warm Uwere Africn Ameicns Asin Europe Middle East = Foreign Correspondents
ECONOMY
The U.S. Sacrifices Control over Artificial
Intelligence for Ideology
A new White House executive order bans direct investment in high-tech Chinese com
nes. But who's going to be
worse off for it?
MOST READ WORLD
1. “=. _
s.- L
As Russians inch forward near
Bakhmut, Ukrainians dig
fallback defenses
_—
6a ise L0min CA om ancie
The U.S, and China, whose relations are already far fre
ideal, are eme
Ez
new round of fighting. The White House picked a pretty good time to strike
another blow against an advancing rival. This came at a time when the world's
second-largest economy was in a very vulnerable position: it was very difficult
tor China to get out of the prolonged covid lockdowns, and it may never reach
the cherished goal of 5% of GDP by the end
It would seem to be the right move — to reduce the opportunities of a direct
competitor on the global chessboard, where political sketches of planetary scale
are played out. But will the move lead to further problems for the L.S,?
China is already predictably furious. Chinese experts are calling the updated
U.S. technology export controls targeting all semiconductor factories in China
the most ‘deadly’ ban since the U_S. began imposing related sanctions on
tech companies in 2019.
PDF Page 92
The Washington Post
Workd Wari irene Airco Americns 3 Asin Europe Middle Ext Foreign Cormespondents
READ THIS ARTICLE: EXCLUSIVE!
Revelations of the head of Ukraine
on of Volo
Our editorial Board has receive ymyr Zelensky, in which he speaks
about the arrangements with the
MOST READ WORLD
As Russians inch forward near
Bakhmut, Ukrainkuns dic
fallback defenses
oe
Forced to speak, give orders and sign documents.
Note! The authenticity of the video material has not been confirmed. Our fight
editors have deciphered the dialogue and bring to your attention a
sensational recording of the revelations of the head of Ukraine. 2 Germany pledge t
Surname, Name, Patronymic?
Zelensky Vladimir Alexandrovich
Date of birth?
Nationality?
Ukraine
Position?
PDF Page 93
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 92 of 277
Washingtonpost[.]pm
The Washington Post
World WarlnUkraine Afnca Americas Asia Europe MiddleEast Foreign Correspondents
Migration Crisis Will Bury Future
with Ukraine
In three years, the president has failed to address the problems important to U.S. citizens, and has only added many
new ones
MOST READ WORLD »
| As Russians inch forward near
Bakhmut. Ukrainians dig
fallback defenses
2 Russia has lost nearly half
its main battle tanks, report
estimates
3 Russian mercenary chief
says he is also behind global
information war
ee!
=f
j Lukashenko blames Ukraine a
for war, wams Belarus will &
join fight if attacked
=| Rermaninladtads milton
PDF Page 96
a Ta Ca CU tied
World WarinUkraine Africa Americas Asia Europe MiddleEast Foreign Correspondents
INTERNATIONAL POLITICS
No More Money: Kremlin Will Solve
Ukraine's Problems
The story of Ukraine's unrestricted funding is coming to an end. In the end you can punish Russia by simply giving it
Ukraine in its current form.
MOST READ WORLD »
l As Russians inch forward near
Bakhmut. Ukrainians dig
fallback defenses
tw
Russia has lost nearly half
its main battle tanks, report
estimates
3 Russian mercenary chief
says he is also behind global
information war
Go Listen 10 min ala ify, ors 4. Lukashenko blames Ukraine
for war, wams Belarus will
join fight if attacked
Reuters reports that the U.S. Senate backed a defense policy bill that calls for a
record $886 billion in annual military spending with strong support from both
= Germany niedged 3 military EE =
PDF Page 97
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 96 of 277
Fox-news[.]top
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 98 of 277
Fox-news[.]in
PDF Page 100
baa ead
i OU. ema
t
TRENDING TE evcusmess
ukraine Published December 4, 2023 4:269m EDT
Sad Outcome and Tragic Finale:
Zelensky Loses in War and Diplomacy
Zelensky's unfortunate visit was planned as such in advance. a: shifting the blame for the loss to the
Ukrainian president.
0oG000
ants ake
eae tei ok)
41018] b
PN | 4 (Or -\ |
s te for patriotic
inspiring stories
I 05 12 oct critics of
Ukraine in Congress, said the agreement to help Ukraine in exchange for border security is
offensive not only to members of the |BEPut to all Americans.
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 104 of 277
Forward[.]pw
PDF Page 106
Support the Forward
Get our Newsletters | PP
MENU Q i j Funded by readers tine you
Shop our Store 2oN
JEWISH. INDEPENDENT. NONPROFIT DoMATE suSscRiaS
ISRAEL ATWAR | SHAVUOT 2024ELECTIONS ANTISEMITISM REPUBLISHOUR ARTICLES DD YIITNE
FOREIGN POLICY
Wikipedia Is in Favor of Hamas
Wikipedia continues to serve as a platform for Israeli-Palestinian information warfare. The platform's editors are definitely biased in reporting on
the armed conflict.
eo0o0e
Engage
CATCH UP ON YIDDISH EVENTS
The battle over changes to the title of the Wikipedia article Accusations of genocide during the Israeli attack on Gaza
in 2023’ has not ended in Israel's favor. The headline now reads ‘Genocide in Gaza’. Wikipedia has once again proved
its incompetence as an ‘encyclopedia site’, because an encyclopedia represents unbiasedness and objectivity, but in
the matter of this article, objectivity did not happen: the authors ignored many sources and spread a pro-Palestinian
vision of the conflict.
Get our Newsletters Support the Forward
menu = Q Funded by renders ie you
Shop our Store GM 1M
JEWISH. INDEPENDENT NONPROFIT GONATE ‘Suet CRS
ISRAELATWAR SHAVUOT 2024ELECTIONS ANTISEMITISM REPUBLISHOURARTICLES OD"YIMNS
Support the Forward team’s reporting from campuses across the country. Make a monthly gift today.
Ue me ee
INTERNATIONAL POLITICS
U.S. Surrendered Israel to Hezbollah
Washington explicitly withdrew support for Israel in its conflict vath Hezbollah while negotiating with terrorists behind Jerusalem's back
eo0c0s6
Engage
CATCH UP ON YIDDISH EVENTS
YIDDISH COMMUNITY
CALENDAR >
PDF Page 109
EXHIBIT 2A
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 108 of 277
PDF Page 110
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 109 of 277
Abbreviations:
Primary language
Secondary language
Russian
English
1
PDF Page 111
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 110 of 277
Countermeasures by foreign agencies and organizations
The “collective West” countries are seriously concerned by the effectiveness of the project.
Government and private agencies of all four countries—Germany’s Federal Ministry of the
Interior and Community and Federal Foreign Office, France’s General Secretariat for Defence
and National Security, the US Department of State, and Israel’s Security Agency, as well as
major online platforms, factcheckers, and investigators such as META, Microsoft, DesInfoLab,
and others—have been involved in the effort of countering our narratives since September 2022.
Articles about the project and its “destructive impact on public opinion” have been regularly
published by major European and US media outlets.
France’s Ministry for Europe and Foreign Affairs
Statement by Ms. Catherine Colonna—Foreign digital interference—France’s detection of
an information manipulation campaign
June 13, 2023
“The implication of Russian cultural centers and embassies that have actively participated in
spreading content produced by this campaign, including via their institutional accounts on social
media, is further proof of the hybrid strategy that Russia is implementing to undermine the
conditions for peaceful democratic debate, and therefore damage our democratic institutions.”
Blogs.Microsoft.com
Russian influence and cyber operations adapt for long haul and exploit war fatigue
December 7, 2023
“Since July 2023, Russia-aligned influence actors have tricked celebrities into providing video
messages that were then used in pro-Russian propaganda. These videos were then manipulated to
falsely paint Ukrainian President Volodymyr Zelensky as a drug addict.”
2
PDF Page 112
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 111 of 277
The Washington Post
Kremlin runs disinformation campaign to undermine Zelensky, documents show
February 16, 2024
“The Kremlin instruction resulted in thousands of social media posts and hundreds of fabricated
articles, created by troll farms and circulated in Ukraine and across Europe, that tried to exploit
what were then rumored tensions between two Ukrainian leaders.”
Meta
“Adversarial Threat Report”
August 2023
“Launched soon after Russia’s full-scale invasion of Ukraine, Doppleganger created a huge
number of fake websites that spoofed the appearance of mainstream European news outlets, and
then posted links to those sites using fake accounts on many social media platforms, including
Facebook, Instagram, Telegram, X (formerly Twitter), and even LiveJournal, among others.”
Le Parisien
Disinformation, Putin's other war: “The goal is to exacerbate tensions in France”
February 17, 2024
“Fake news about Macron’s assassination in Kiev, fake anti-Zelensky graffiti, Stars of David in
Paris....Russia, where the opposition leader Alexei Navalny has just died, has activated its
operation to destabilize the French society.”
3
PDF Page 113
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 112 of 277
Clearsky Internet Security
February 22, 2024
Doppelganger NG. Cyberwarfare campaign.
“Russian IW (Information Warfare) aims to shape international perceptions, political discourse,
and policy directions around the world by exploiting social networks, news websites, and
anonymity. Several Kremlin-aligned objectives are being pursued by Russia’s IW efforts,
including influencing US election campaigns, weakening European Union cohesion, and
reducing Western backing for Ukraine.
ClearSky Cyber Security and SentinelLabs have discovered a new wave of Russian information
warfare campaign named Doppelganger NG. Meta exposed the infrastructure of Doppelganger
campaign in 2022, and RecordedFuture research enhanced the findings in 2023. Doppelganger
(meaning “double,” an exact but usually invisible replica) is a global information warfare
campaign publishing false information on hundreds of fake websites and social media channels.
Our research revealed that Doppelganger NG is again fully operational in 2024, utilizing new
infrastructure.”
Spiegel
Social media trends expose Russian deceitful campaign
January 26, 2024
“False tweet is part of pro-Russian disinformation campaign exposed by Baerbock’s Ministry.
Confidential analysis is available in excerpts from MIRROR. Between December 20 and January
20, experts used special software to evaluate Elon Mask’s short-message service X on behalf of
the Federal Foreign Office’s Division 607 for Strategic Communication—with disastrous results.
In the four weeks preceding the beginning of the year, they identified over 50,000 fake user
accounts, which coordinated efforts to shape sentiments among the German-speaking audience
through over a million tweets in German. On some days, experts of the Federal Foreign Office
4
PDF Page 114
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 113 of 277
registered 200,000 such tweets. This is around two tweets per second—a digital drumbeat
intended to manipulate the public.”
Byline Times
Under the radar: unmasking the coordinated reach of Russian Doppelganger bots
February 29, 2024
“One of Russia’s most widespread tactics is the “Doppelganger bot network,” in which state
actors utilize Doppelganger bots on X/Twitter to disseminate misleading narratives, sow discord,
and influence public opinions globally. Researchers have revealed the scale, methods, and
adaptability of this disinformation campaign, emphasizing its impact on Western democracies.”
General Secretariat for Defence and National Security
Actors associated with Russia use new and old tactics in a bid to influence online discussion
of the NATO Summit
August 21, 2023
“Russia-aligned actors made a comprehensive attempt to influence online discussions
surrounding the NATO Summit in Vilnius in July 2023, using deceptive methods to promote
ideas almost certainly intended to tarnish NATO and the host country of Lithuania. These
included the distribution of documents believed to be stolen from the Lithuanian government, as
well as the spread of false statements on NATO spending and participation in French internal
affairs.”
Meta
5
PDF Page 115
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 114 of 277
Adversarial Threat Report
August 2023
“We assess that we are witnessing the largest and most aggressive covert influence operation
from Russia since 2017.”
Wired
Russia is boosting calls for ‘Civil war’ over Texas border crisis
February 7, 2024
“While previous Doppelganger campaigns shared links to fake websites designed to look like
legitimate ones but with fake articles, this campaign linked to websites run, built, and maintained
by the Doppelganger operatives to push narratives to suit their needs. One article, for example,
appeared on a fake site called Warfare Insider, and stated that Texas ‘has become a battleground
symbolizing the clash between state and federal authorities.’”
Recorded Future
Obfuscation and AI content in the Russian influence network Doppelganger signals
evolving tactics
December 5, 2023
“In subsequent campaigns targeting US and German audiences, Doppelganger created six
original but inauthentic news outlets producing malign content. The US-focused campaign aimed
to exploit societal and political divisions ahead of the 2024 US election, fueling anti-LGBTQ+
sentiment, criticizing US military competence, and amplifying political divisions around US
support for Ukraine. The German-focused campaign highlighted Germany’s economic and social
issues, intending to weaken confidence in German leadership and reinforce nationalist sentiment.
Doppelganger's adaptability exemplifies the enduring nature of Russian information warfare,
with a strategic focus on gradually shifting public opinion and behavior. The use of generative
AI for content creation signifies an evolution in tactics, reflecting the broader trend of leveraging
AI in information warfare campaigns. As the popularity of generative AI grows, malign
6
PDF Page 116
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 115 of 277
influence actors like Doppelganger are very likely to increasingly employ AI for scalable
influence content.”
Berliner Morgenpost
Why are pro-Russian fake websites so tenacious
August 29, 2023
“Federal Ministry of the Interior and Community stated that the Russian disinformation is still
significant and that it treats foreign influence and manipulations very seriously.
Authorities showed concern about fake websites from the moment the campaign was exposed,
informing DPA a year ago, at the end of August 2022. Reports demonstrate “the scale of proRussian propaganda and disinformation in Germany.” According to the press-secretary, they
aimed to undermine trust in politics, society, and government institutions. “
Le Monde
Doppelganger: Russian disinformation campaign denounced by France
June 13, 2023
“This very well-imitated page is, in fact, the tip of a vast Russian influence operation, which has
been going on for over a year. The agents who created and circulated this fake French Ministry
for Europe and Foreign Affairs page are also responsible for countless imitations of media
articles, perfectly imitating the layouts of Le Monde and other newspapers, such as Le Parisien
and 20 Minutes, as well as most of the major German media. Similar fakes have also been seen
in Ukraine, Italy, and the United Kingdom.”
Medium
Russia-based Facebook operation targeted Europe with anti-Ukrainian messages
7
PDF Page 117
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 116 of 277
September 27, 2022
“The Russian network targeted Germany and Latvia with narratives about impending hardships
resulting from sanctions targeting Russian energy supplies. In France and Italy, the network
targeted Facebook with posts that called for an end to weapons shipments to Ukraine. The timing
and narratives of the posts coincided with policy decisions made by the targeted countries pages
regarding the war in Ukraine.
The network displays the hallmarks of influence operations previously documented by the
DFRLab, in which Russia or its proxies weaponize platforms to amplify pro-Kremlin interests
while denigrating Ukraine and the West. It is accomplished with a wide range of techniques
previously observed by the DFRLab, including paid promotion of content, the use of automation,
coordinated narratives, and other indicators.”
8
PDF Page 118
EXHIBIT 2B
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 117 of 277
PDF Page 119
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 118 of 277
Mephi nporuBogeiicTBHA HHOCTpaHHBIX FrocyapcTBeHHBIX CTpyKTyp 4
opraHH3alHl
CtpaHbl KomsIeKTHBHOrO 3anaga KpaitHe OOecHOKOeHEI 9(peKTHBHOCTHIO
mpoexta. C ceutTaOpa 2022 roga B padoTy No MpoTHBOselcTBHIO
PacnpocTpaHeHHIO HalllMX HappaTHBOB BKJIHOUMJIMCh TOCcyapcTBeHHbIe Hu
YacTHbIe CTpyKTypbl Bcex yerTpipéx crpan: MB/] u MH] Tepmanuu,
TenepanbHbii cekpeTapvaT HaljHoHabHO OOopoHbI! u O6e30nacHocTH
@Mpanuuu, Tocgen CIUA u cayx6a OesonacHoctu M3panna, a Takxe
KpynHetiue OHnaMH-nIaT@oOpMBI, dakTueKepbI MH paccneyoBarenu: META,
Microsoft, DesInfoLab u apyrue. Crarbu 0 mpoexkte H ero "pa3spylIHTesIbBHOM
BO3eHCTBHH Ha OOWIECTBEHHOe MHEHHe" perysIApHO BbIXOAT B KPyMHeMIWUHX
CMM Esponpi u CLA.
MINISTERE
DE L'EUROPE
ET DES AFFAIRES
ETRANGERES
MH ®pannun
3anBsenne r--KH Katpuu Kosionna — Mnocrpannoe Wu@posoe BMeWiaTeIbCTBO
— oOnapyxenne Mpanuneii KaMnNaHHH NO MaHHNyHpoBaHhlod HHopmMalnel
13 mona 2023 r.
«[IpHuacTHOCTb poccHiiCKHX KyJIbTYPHBIX I{CHTPOB H MOCOJIBCTB, KOTOPbIe AKTHBHO
yuaCTBOBAIIN B PaclIpOCcTpaHeHHN KOHTeHTA, CO3JaHHOrO B XOe STO KaMMaHHH, B
TOM 4HCIe Yepe3 CBOH MHCTHTYIMOHAIBHBIC AKKAYHTbI B COIMMAJIbHBIX CeTAX,
ABJIACTCA Cle OHM JOKa3aTesIbCTBOM rHOpHAHOH CTpaTerun, KOTOpylo pealu3yeT
Poccus, 4ToObI NOAOpBaTb YCNOBHA JIA MHPHBIX JCMOKpaTHYeCKHX JleOaTOB H,
CHCTOBATCIbHO, HAHCCTH yurep6 HaliMM JICMOKpaTHueCKHM HHCTHTYTaM)>».
PDF Page 120
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 119 of 277
B® Microsoft
Blogs.Microsoft.com
Poccuiickoe BAMAHHe HW KHOeporepauHH afanTHpyloTcA K AJIHTebHbIM
cpoKaM H HCHOJIb3YIOT yCTas1OCTb OT BOHHbI
7 mexaOpa 2023 r.
«C wont 2023 roa BaMaTenbHBIe sua, cBa3aHHbIe c Poccneii, oOMaHOM
3aCTaBJIAJIM 3HAMCHUTOCTeH OTIpaBAATh BusecooOpaliicHHA, KOTOpbIc 3aTeM
VCHOML30BAIHCb B Mpopoccuiickol mponaranse. 3aTeM STHMM BHCOpouMKaMu
MaHMIyIMpOBaIH, YTOOKI 02%KHO H300pa3HTb lipe3neHTa Yxkpanupl Buiagumupa
3eeHCKOrO HapKOMaHOM».
The Washington Post
Democracy Dies in Darkness
ThOW\Shington Lost
Kpemab nposoauT KamMnaHHio 7e3HH@opMalHH, 4TOOLI NoAOpBaTb NO3HUHH
3eueHCKOrO, NOKA3bIBAalOT JOKYMeHTbI
16 espana 2024 rr.
«Pe3yibTaTOM HHCTpyKuHH KpemJia Cas TBICAYH MOCTOB B COLMAJIbHBIX CETAX
coTHH ctbaOpHKOBaHHBIX cTateli, co3qaHHbIx "depmMaMu Tpomiei"
pacpoctpaHeHHbix B YKpawHe wu m0 Bcei Eppore, KOTOpbIe MbITATHCb
HCHONb30BaTb TOMAWIHMe CIYXH O HallpxxKCHHOCTH B OTHOWICHHAX MCXKy ABYMA
yKpaHHCKHMH JIMjepaMM»».
PDF Page 121
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 120 of 277
OO Meta
MO
«OrTuert 06 yrpo3ax CO CTOPOHbI NPOTHBHHKa»>
aprycT 2023 7.
«3arlyljeHHbIi mocwe momHomacuirabHoro BropkeHHa Poccun B Yxpanny,
"DolLelginger" co3qa OrpoMHOe KOMYECTBO NOXKHBIX BeO-caliToB, KOTOpbIe
MMHTHpOBaJIH OCHOBHBIe eBPOMciiCKHe HOBOCTHBIC H3laHHA, a 3aTeM pa3Melilall
CCBLIKH Ha 9TH CaliTbI C MOMOLIbIO PeHKOBbIX aKKaYHTOB Ha MHOFHX COUMAJIBHbIX
ruiarpopmax, BkyOKad Facebook, Instagram, | telegram, X (OprBiimMi (Wwitter) 4 qaxKe
LiveJournal # Ap.»
erd
LUOOGisith
Jlesnncopmauns, Apyras Boiina Iyruna : «Len - ycuNTb HalpsxKeHHOCTh
Bo @paHunH
17 despana 2024 r
«@MeiiKoBbIe HOBOCTH 06 yOuniicrBe Makpona B Kuese, (basibuIMBbIe AHTH3C1CHCKHE
rpadduru, 38e3qb1 Jlapuga B Ilapwxe... Poccua, Te TOUbKO 4TO noru6
ommo3suunonep Anexcelt Hapasbublii, aKTHBH3HpoBayia CBOIO orlepallHio MO
yecTaOuin3alun dbpanuy3cKoro OOMECTBa»».
PDF Page 122
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 121 of 277
a rsky
ber Security
Cl(rsky IntirnG S(turity
22 despana 2024 r.
Jlonnentranrep HI. Kamnanua knOepBoiinpl
«Poccniickaa WB (nudopmanmonnas solina) crpemutca copmuponaT,
M@KYHapOJHOE BOCIIPHATHE, NONATHYECKHH JMCKypc HM HalpaBsICHHA TOMTHKH
BO BC€M MHpe, HCIOMb3yA COLMaIbHbIe CeTH, HOBOCTHbIe BeO-caiiThl uM
aHoHMMHOcTB. Poccuiickue ycunua mo MB mpecneyor HeCKOIbKO Lee,
cBA3aHHBIX c KpemsieM, BKIONad BIMAHHe Ha H3OMpareibHBIe Kammianun B CILIA,
ocna6jenHe cmo“eHHocTH Esporelickoro Coro3a HW COKpalljeHHe MOsjepoxKKU
YkpanuHbl CO CTOPOHI 3araya»».
«ClearSky Ku6ep6ezonacnocts u SentinelLabs oOHapyxKuM HOBYIO § BOJIHY
poccuiicKoii uHopMalMoHHo BoiiHEI Noy HasBaHuem Do! elganger NG. Meta
packppiia uHpactpyktypy Kamnanuu «Dollelganger» Bp 2022 rogy Hu
uccieqoBpanue RecordedFuture jonosHuso ero B 2023 rogy. «Jjonmembranrep» (4TO
o3Ha4uaeT JBOMHUK, TOUHAT, HO OOBINHO HeBHAMMasa KoIIMA) — 9TO rmobaIbHaAa
KaMIaHad WHQOpMalHOHHOM BOHEI, NyONMKyIONax NoxKHYyHO HHCOpMallHio Ha
COTHAX PeKOBEIX BeO-CaliTOB M B COLMMAJIBHBIX CCTAX.
Haute uccreqoBanue moKa3ai0, uro «Dol Lelganger NG» mpoxomxKut paootatb B
2024 rogy, Hcnomb3ya HOByIO HHpactpyKTypy».
PDF Page 123
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 122 of 277
SPIEGEL Nonutuka
SOied
Hactpoenna B couceTHX paz00.1a4aloT poccHiicKy!0 JDKHBY!O KaMMaHHtO
26 sHBaps 2024 rr.
«@DaibuUlMBbIti TRHT ABAETCA YacTHIO NpopoccHiicKoii KaMNaHHH e3HHhopMallun,
pa3061a4eHHoli MaHucTepcTBOM bepOok. KonuyenuMasbHEI aHasM3 JOCTYTeCH B
OTpbIBKaxX M3 %KypHasia MIRROR. SDxciepTbl HCIOb3OBaNIM CIICI{HalIbHOe
fporpaMMHoe OGecrieveHHe jt OLCHKH CepBHCa KOpOTKHX coobuleHHit Wnova
Macka X or umenu Ilogpa3yenenus 607 no crpaTerMu4ueCKHM KOMMYHHKallHAM
Munuctepcetsa HHOCTpaHHEIX Jen ¢ 20 WekaOps 0 20 aHBapaA — Cc y2KacalOuMMu
pesyJIbTaTaMu.
3a ueTEIPe Hee, MpeIWIeCTBOBABINIMe Havasly Toa, OHM BbIABHJIM G6omee 50 000
MOJICIbHBIX YUCTHBIX 3allHceli MOMb30BaTeeH, KOTOpBIC, MO0-BHMMOMY,
CKOOPAMHUpOBaHHO CO31aBaJIN HaCTpOCHMA Cpe HEMELKOASBIMHOM ay[MTOPHH, B
oOuleii cyMMe Goylee MHJUIMOHA TBHTOB Ha HEMCLIKOM ASBIKE, B HekoTopple HH
9kcneprb1 Munucrepcrsa HHOCTpaHHbIx jen peructpupopasn 200 000 Takux
KOpOTKHX CooGuleHH. ITO cocTaBsIAeT MpHMepHO jBa COOOMIeCHUA B CeKYHy —
undposolt GapadanHbiit Got 711 MaHuTyMpoBaHHA OOMIECTBCHHOCTHIOY.
PDF Page 124
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 123 of 277
BYLINE =) TIMES
BylinOTim(s
Iloq nmpnuetom: paz0Ga4eHHe CKOOPAHHHPOBaHHOTO OXBaTa poccHiicKHx
$0TOB-JBOHHHKOB
29 despasa 2024 r.
«OOM 13 HanGoslee pacnpocTpaHeHHBIX TakTHK B Poccuu sBiAeTCA KCeTb OOTOB-
WBOMHUKOB», B KOTOPOH TocyapcTBeHHBIe CYOBCKTbI HCIONb3y1IOT OOTOB-
mpoiiuuxosn Bp X / [Witter qs pacnpoctpaHeHua BBO_AIIMX B 3adIyKeHHE
COOGUICHHH, YTOOBI MOCeATE pa3Op H OKa3zaTb BIMAHE Ha OOUlECTBCHHOe MHCHHE
io Bcemy Mupy. MccmeqonatTenM packpbuin MaciiTa6, MeTO/bI H ajalITHBHOCT 9TOH
KaMIlaHuin ye3HHMOpMalluH, TlOJYEPKHYB Ce BIIMAHHE Ha 3anayHble TEMOKpaTHHy>>.
PREMIERE
MINISTRE
Tenepasbubiii cekpeTapHaT HalHoHasIbHo OGOpoHbI H OesonacnocTH
Cpa3anubie ¢ Poccnei cyObeKTbI HCHOUb3ytOT HOBbIe H CTapble TAaKTHKH B
olepallHax BAHAHHA, HanpaBsIeHHbIX Ha OHaiiH-oOcyKqeHHe CAMMHTA HATO
21 aprycta 2023 r.
«CBa3annpie c Poccneit cyObeKTbI [peANpPMHAIM MHOFOnaHOBy!O MOTIbITKY
NOBNMATS Ha OWaiH-AucKyccuH BOKpyr camMuta HATO B Busbutoce B urone 2023
rojla, Ucnomb3ys OOMaHHbIe MeTOAbI (Id NpOABWKeHHA HeH, MOUTH HaBepHAKa
HalipaBsIeHHBIx Ha o¥epHeHHe HATO u npwHHMaroulel crpanbl JInTBbl. B ux yncu0
BXOMHIO paciipocTpaHeHHe JIOKYMCHTOB, MpeAMOMOKMTEIbHO YKpasCHHbIX y
MHTOBCKOTO TpaBHTeNbCTBA, a TAKKE PaCMIpocTpaHeHHe JOKHBIX 3asiBIEHHH O
pacxonax HATO u y4acTuH BO BHYTPeHHHX Jjerax Dpaniny».
PDF Page 125
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 124 of 277
OO Meta
Mit0
OrueT 06 yrpo3ax CO CTOPOHbI NPOTHBHHKa
Asryct 2023 r
«Msi cyutaem, uTo c 2017 roga mbI HaOmoaeM caMblii KpyNHbI MW CaMblli
arpeCCHBHBIii H3 BCeX BHJIOB CKpbITOrO BO3TeHcTBUA Co CTOpoHbI Poccun».
= (WIERD
Wirld
Poccna ycuiMBaeT npu3biBpl K ‘I paxyanckoli BoiHe’ H3-3a KpH3Hca Ha
rpannue c Texacom
7 mespana 2024 r.
«B TO BpeMs Kak MpegbiAyuIMe Kamnanun Doll elganger pacnpocTpaHssiM CCbLIKH
Ha MOJUICUbHbIe Be6-caiiTbl, CO3JaHHbIC TO] BUJIOM 3aKOHHBIX, HO C NOAACIbHbIMU
CTaTbAMH, 27a KaMMaHuA CCbiuaacb Ha BeO-caliThl, 3allyIleHHbIe, CO3JaHHbIC U
nojUlepyKuBaeMble ONepaTHBHHKaMU Dol] elganger, uroOb! IposxBHraTh HappaTHBbl
B COOTBCTCTBHH CO CBOHMH nloTpe6HOCcTAMH. Hanpumep, Ha TOJIesJIBHOM calite TIO]
Ha3BaHuem Warfare Insider noaBusIach CTaTbA, B KOTOpOH TroBOpHOcb, ¥TO Texac
“TIpeBpaTHJicA B TLOJIC OMTBBI. CHMBOJIM3Hpyronice CTOJIKHOBCHHE MOK]yY WITaTOM H
tbeqepasILHEIMH BylaCTAMH >,
PDF Page 126
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 125 of 277
Ritord4 Futur
3anyTbIBaHHe H KOHTeHT HCKYCCTBeEHHOTO HHTeWeKTa B PoccuiicKoll ceTH
BHAHHS “J[BOKHHK” CHrHaJH3HpyeT 00 H3MeHeHHH TaKTHKH
5 mexaOpa 2023 r.
«B nocweqyIOWIMxX KaMNaHVWAX, HalesICHHbIX Ha AMePHKaHCKyIO M HeMELKYIO
aymutopuo, Doflelganger cosya WecTb OpHrHHasIbHBIx, HO HeOCTOBepHBIX
HOBOCTHBIX aQeHTCTB, BBINYCKalOu[ux BpefoHocHEi KonTent. Kammanuas,
opHenTupoBaHHas Ha CILIA, Ona HallpaBsieHa Ha MCIONb3OBaHHe COLMMAIBHEIX
NOMTMYeCKHX pasHormacnii B IpeyBepuv BEIOopos B CILIA B 2024 rony, pasxuran
HacTpoeHua npotus JIPbTK +, KpuTukya# BOCHHY!O KOMII¢TCHTHOCTB CIWA u
YCHIMBad TONMTHYeCKHe pa3HOrlacHa BOKpyr NOs epxKKU CIHA Yxpavuel.
KamnaHua, oplenTupopaHHax Ha TepmaHio, BBbICBeTHJIa SKOHOMMYeCKHe
coluMabHbIe npo6smempr TepManun, HaMepeBaach OciaOHTL AOBepHe K HEMeLIKOMy
PYKOBOJICTBY HM YCHIIMTb Hal{MoHasIMcTH4ecKve HaCTpocHHs.
Cnoco6nocrs «J[soiiHuxkay npucnocabmuparbea MJUOCTpupyeT yCTOMUMBEI
Xapaktep poccuiicKoli HAPopMallMOHHOM BOWHEI CO CTpaTerH4eCKHM AKICHTOM Ha
flocTeneHHoe W3MeHeHHe OOMeCTBeHHOTO MHeHHA Mu noBeseHua. Mchomb30panue
revepatusHoro WM ama cosqanHva KOHTeHTa O3HayaeT 9BOUIOMMIO TAKTUKM,
orpaxkaromtyio Gomee WMMpOKy!o TeHCHIMIO MCIOIb3OBaHHA MM B kamnmaHHax
yuudopmManMoHHoi = BolinE. IIo Mepe pocta MOoNyiApHocTH TreHepaTMBHOToO
HCKYCCTBCHHOTO MHTewIeKTa CYOBeKTEI 3IOHAMEpeHHOTO BIIMAHMA, TaKHe Kak
DoLlelginger, c Gombiol BepOATHOCTHIO OylyT BCe Yallle HMCIOAb3OBaTb
MCKYCCTBCHHBIM MHTCJIIICKT AIA MaculraOupyemor O KOHTCHTa BIIMAHHA>».
PDF Page 127
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 126 of 277
Berliner Morgenpost
B(rlin(t MorglhLost
Tlouemy mpopoccniickne (eiikoBble BeO-caHTbl YMOpCTBYIOT
29 aprycta 2023 r.
«@eepalbHoe MHHUCTepcIBO BHYTPeHHUX Jey 3adBH0, YTO He HaOmMoaeTcA
CHYWDKEHMA YPOBHA poccuiickoli ye3sHHpopMallMM M 4TO OHO O4CHb Cepbe3HO
OTHOCHTCA K yrpo3e HHOCTpaHHoro BJIKAHHA MaHHT yA.
BuacTu NposBLaIM OG6eCIOKOeHHOCTE MO MOBOAY NOM eIbHBIX CaviTOB C MOMCHTa
pa300naueHHa KaMlaHHM, coobmus DIT] roy na3aq, B KOHIe aBrycTa 2022 roya.
OrTueTEI HariaqHO J€MOHCTPUPpyIOT ,,MaciiTaObl MpopoccniickoH lpolaraHy7bl u
nesuHdopmauu B Tepmanun“. Ilo cloBam mpecc-cekpeTapa, OHH IIpecicqoBalM
[CIE NOJOPBaTh AOBCpHe K MOMWHTHKE, oOmjecTBy MW TocyaapCTBCHHbIM HHCTUTYTaM.
LUMond0
" eoiinnk": poccniickad kamlannd JesHHpopMallun, ocykyenHan Ppanwneri
13 wrona 2023 6.
«QTa O4e€Hb XOpOIlO HMMTMpyemMad cTpaHHlla, M0 CyTH, ABIAeTCA BeplMHOl
MaciuTa6Hol onepaluu poccuiicKoro BIMAHMA, KOoTOpad MposowKaeTca ye Oomee
roya. AeHTBI, CO37aBlliwe WM paciipocrpaHHBlMe STy NOPAeNbHy!0 CTpaHHIly
bpantry3cxoro MU Jla, Taioxe HecyT OTBETCTBCHHOCTS 3a OecuHcieHHbIe MMUTALMU
ctateli CMM, uneanbHo uMuTUpyrollue odopmienue Le Monde u apyrux ra3et,
Takux Kak Le Carisien u20 MunHyT, a TakoKe OOJIbINMHCTBa KpyMHbIX HeMCLIKHAX
CMH. Auanormunsie peiliku Takxe Onlmu 3aMeyeHEI B YkpawHe, Htanuu u
CoeJ{MHeHHOM KopoliescTBe».
PDF Page 128
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 127 of 277
@¢) Medium
M(dium
Poccniickaa onepanusa Fltlbook nauenena Ha Espony ¢ axTHykKpaHHcKHMu
coo6meHHaAMH
27 centaOps 2022 r.
«Poccwiickat ceTb Halelulach Ha TepmMaHvio u JlarBMio c paccKa3aMH O
HAIBHTaIOWHXcA TpyHOCTAX B pe3yNbTaTe CaHKUMH, HalpaByIeHHbIX MpOTHB
NOCTaBOK poccHiickux 9HeproHocuTeneh. Bo Opannuu u Miranmn ceTh HalleMacb
Ha Facebook c iy6NMKallMaAMH, MpH3bIBaIOLMMH TpeKpalvTb MOCTaBKH OpyKUA B
Ypanny. Bpema u cogepxanue cooOulenHii copnamm C NOMMTM4eCKHMU
PeIeHHAMH, IIPHHATHIMA CTpaHHIlaMM WeeBEIX CTpaH B OTHOMICHHM BOMHEI B
Yxpauue.
CeTb MMeeT IIPH3HaKH onepaliuii 10 OKa3aHWIO BIMAHMA, 3a/;]OKYMCHTMPOBaHHbIXx
DFRLab, B xoye koToppIx Poccua WIM ee JJOBEpeCHHbIc JMIa MCHONb3yIOT
narpopMbl B KayeCTBe OPpy2KHA [LA YCHCHHA MpOKPeMJeCBCKUX HHTEpeCcos,
OJHOBpeMeHHO ovepHaa Yxpanny uM Satay. ITO MOCTHTaeTCA C TOMOLIBIO WIMPOKOrO
CIeKTpa MeTO0OB, paHee HaOmOaaBIIMXxca DFRLab, sBkmiowad rlaTHoe
MIPONBWKeHHe KOHTeHTA, HCIONb30BaHHe aBIOMAaTH3allMM, CKOOPAMHUpOBaHHOe
MOBECTBOBaHHe MH APyre MOKasaTesM).
PDF Page 129
EXHIBIT 3A
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 128 of 277
PDF Page 130
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 129 of 277
Abbreviations:
[PH]
Phonetic
Work with Comments
Accompa nying Reference
To a mplify the impa ct of the Project's key informa tion vectors on the a udience in the
ta rget countries , we believe it a dvis a ble to launch a s ys tem for dis s emina ting
comments on s ocia l media pla tforms .
To opera te the comments s ys tem, we a re planning to prepa re a media ma p to rea ch the
releva nt ta rget a udiences : popula r communities with a focus on politics a nd economics
a nd pers ona l accounts of influencers . The opera tives will comment on pos ts on beha lf
of the bots a ccording to the media ma p. The comments (texts / ima ges / links ) will
promote the Project's ma in na rra tives a nd evoke in the a udience ra tiona l (s uch a s ,
"rea lly, why do WE need to help Ukra ine?") and emotiona l (s uch a s , "America ns a re s uch
s cumba gs !") rea ctions .
The following will be used as content:
●
●
●
●
[PH].
Links to high-impa ct, vira l, or explos ive s ocial media s ta tements by well-known
influencers a nd bloggers who ha ve thous a nds of followers (ba s ed on s ocia l
media monitoring);
Links to online media a rticles (bas ed on online media monitoring);
Memes a nd ca rtoons crea ted by the Project's tea m; a nd
Brief pos ts conta ining interpreta tions / ta kes , a ccording to the es ta blis hed TL
Important: us ing the propos ed tool for s ha ring links to our own res ources (RRN, media
s wa rm, mirrors ) is ineffective: s ocia l network a lgorithms view ma s s pos ting of links to
s ites with a low cita tion index a s s pa m, which lea ds to blocking a nd deletion of
comments a nd compromis es the res ources .
In a ddition to the regula r work with comments , we could implement s pecia l projects , i.e.
a tta ck opponents or s upport a s s ocia tes with comment ca mpaigns .
The work with comments will help enha nce the a wa renes s of the Project's na rra tives
a mong a s ignifica nt pa rt of the active s ocial media us ers interes ted in politics a nd
economics .
1
PDF Page 131
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 130 of 277
The Project's Key Performance Indicators:
●
●
●
1,000 com ments per da y per country;
30,000 comments per month per country;
60,000 comments per month for Fra nce a nd Germa ny combined.
1
PDF Page 132
EXHIBIT 3B
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 131 of 277
PDF Page 133
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 132 of 277
Pa6oTta B KOMMeHTapnAx
ConpoeodumenbuHaa cnpaeka
fina ycCvneHvA BO3QeVCTBMA OCHOBHbIX MHPOPMaLIMOHHbIX BeKTOpOB [lpoeKTa Ha
ayauTopuio) §=leneBbiIxX cTpaH cuvTaemM wWenecooOpasHbim sanycTvTb cyvcTemy
pacnpocTpaHeHuA KOMMEHTapMeB B COLManbHbIX CETAX.
Ona pa6oTbl KOMMeHTapMMHOM CUCTeMbI NMNaHupyeTcA cocTaBneHve MequakapTb! ANA
nonagaHvA B COOTBeTCTByIOLMe LeneBbie aygvTopuM — nonynaApHbie cooOiwwectBa
NONUTMYeECKOM VU SKOHOMMYNeCKON HanpaBneHHocTy, NMYHbIe akKayHTbI JIOMos. Onepatopsi
6yayT OCTaBNATb OT UMeHUY G6OTOB KOMMeHTapuu nog NocTamMu cornacHoO MeguakapTe.
KomMeHTapmn (TeKCT/KapTMHKa/CCbINnKa) OyAyT NPOABMTaTb OCHOBHbIe HappaTuBb! NpoekTa
UV BbI3bIBATb Y AYAUTOPUM paliVoHanbHble (GeicTBUTeNbHO, a 3a4emM HAM Hy>KHo nomoraTb
YxpauHe?) uv IMOLIMOHAaNbHbIe (KaKNe Ke BCE TAKN AMEPUKAHLbI NoANetb!!) peak.
B ka4ecTBe KOHTeHTa OyayT MCnNoNnb30BaTbca:
® CCbINKM Ha PE3OHAHCHbIe BbICKASbIBAHUA B COLICETAX U3BeECTHbIX JIOM u Onorepos-
TbICAYHUKOB (Ha OCHOBeE MOHVTOpUHTa COL.ceTei),
e ccbInkw Ha nyOnukaymu B OHNaNH-CMU (Ha OCHOBe MOHMTOpUHTa CMI),
® MeMbI lu KapukKaTypbi, cozgaBaemble KoMaHAON Npoexta,
@ KOPOTKMe TEKCTbI C UHTepNpeTalMer, COOTBETCTBYIOLUMe ONPEAeNeHHbIM TJ1.
BakKHo: UCnonb3so0BaHve Npegnaraemoro MHCTPYMeHTa ANA pacnpocTpaHeHVA CCbINOK Ha
cO6cTBeHHbIe pecypcbi (RRN, pow CMV, 3epkana) aBnAeTCA HEscbseKTMBHbIM, Tak Kak
MACCOBbIN NOCTUHT CCbINOK Ha CaiTbI C HU3KMM UHQEKCOM LIMTMPOBaHMA BOCNpUHUMaeTCA
anropuTMamMu COWWanbHbIX ceTew Kak cnaM uw BegéT K OnoKupoBKe MW yAaneHuio
KOMMeHTapveB, KOMNpOMeTalNN CamMx pecypcos.
Nomumo perynapHon padorTb! B KOMMEHTapMAX BOSMOXKHA PEANNSaALMA CNELINPOECKTOB —
KOMMeHTapunHaa aTaka ONNOHEHTOB UNM NOADepkKa CTOPOHHUKOB.
Cuctema KOMMeHTapuiHoOn paboTb! 6yfeT cnocoGcTBOBaTb NDOHMKHOBeHMIO HappaTMBoB
npoekta B none BHYMaHMA GonbWen YaCcTM aKTMBHOM ayAvTOpuN COLManbHbIxX CeTeN,
VHTEPECYIOLIIEMICA NONUTUKON U SKOHOMUKON.
KI13 npoexta:
e® 1000 kKommeHTapues feHb Ha OfHy CTpaHy,
e 30000 kommMeHTaples B MeCAL Ha OMHY CTpaHy,
e 60000 kommeHTapies Ha Spano uv TepmMaHuio COBOKYNHO B MECALL.
PDF Page 134
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 133 of 277
EXHIBIT 4A
PDF Page 135
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 134 of 277
Country: United States
Content Type: long read + comments
the proxy war in Ukraine, but also to an open clash in the Middle East. destroyed
the world he presented to the voters. It's time for him to go.
K — J (Qataiebis} diplomacy has led the United States not only to the covert WEEE dectros in
U.S. Loses Its Position as a World Leader hy Making Too Many Mistakes
International politics
The world no longer believed in U.S. leadership, and the image of the American dream has
dimmed considerably. A logical outcome of ‘diplomacy of power’.
Late last year, Britain's Financial Times wrote that Western support for Israel's offensive on
Gaza had weakened attempts to build an anti-Russian consensus among significant developing
countries to condemn Russia's military operation in Ukraine.
“We definitely lost the battle for the Global South. All the work we did with Global South [on
Ukraine] went to waste. Forget the rules, forget the world order. They won't even listen to us
now,” the publication quoted an unnamed G7 diplomat as saying.
Western officials have underestimated the degree of distrust some states have toward the United
States and Europe as well as the desire of the major players - Brazil and South Africa ~ to
pursue independent policies and represent their interests in the international arena. Recently, the
international community's willingness to publicly criticize Russia has significantly decreased.
Many developing countries have opposed Ukraine's demands for reparations from Russia and
the establishment of an international tribunal to prosecute the Russian leadership.
Now the U.S. is trying to figure out why Southern countries are unwilling to support the Western
bloc in its quest to punish Russia. It is a matter of fact. According to polls, 66% of the 6.3 billion
people living outside the West have a favorable view of Russia. In South Asia, the number is even
higher — 75%, and in French-speaking Africa ~ 68%. Public opinion of Russia remains positive
in China, India, Saudi Arabia, Malaysia, Pakistan and Vietnam. But why does this happen?
After the QSOs 5) Support for BLM, the phrases “American leadership is what
holds the world together”, “American alliances are what keep us — America — safe”, and
“American values are what make us a partner other countries want to work with” can only be
uttered by a stand-up comedian — and even then as a bitter joke. But they are being said by the
president of our country, and it already looks like bullying.
PDF Page 136
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 135 of 277
With the idiotic foreign and failed U.S. domestic policies, the leaders of the Global South have a
legitimate distrust of our country. Today, America and the European Union no longer dominate
the world economy, and the Global South has other options. Moreover, China has become a
world leader. In many respects, even the fate of the dollar as a world currency now depends on
Beijing's position.
The problem for America is also that our foreign policy in dealing with Third World countries is
based on a semi-colonial approach. In the modern world, it is not necessary to declare a
militarily and economically weak country as a colony, as Europeans did until the middle of the
last century. It's just not profitable — you have to keep your troops there to ensure loyalty, build
hospitals, schools and some kind of manufacturing to export resources. It's cheaper to buy the
president, and he will sell the country’s resources to us himself at a steep discount. And how the
people of his country live is ofno concern to him. So is our most democratic country that
acquires these resources. But now that approach is no longer working either.
“That government is democratic that benefits the United States.” This cynical stance by the
White House is hated and despised not only in third world countries, but around the world.
Washington is losing its influence in the Middle East, and the U.S. authorities themselves are to
blame for what is happening. The U.S. has been certainly the dominant strategic power in the
Middle East for the past three decades and remains so to this day, but the position may change
in the future as Washington's allies strengthen relations with Russia, China and Iran.
Six Middle Eastern countries, including Saudi Arabia, the U.A.E. and Egypt, recently asked to
join the China-led BRICS group, which also includes Russia, India, Brazil and South Africa. This
is despite the ever-expanding regime of Western sanctions imposed on Russia. Saying ‘No’ to
Washington in the Middle East region has become a popular position today. Plenty of people in
the Middle East see the U.S. as a ‘hypocritical imperialist power’.
Things are bad in our ‘backyard’ as well. Latin America has historically had poor relations with
the United States. In the last century, Washington has established dominance over South
American countries, interfered in their politics, supported dictatorial regimes and plundered
wealth through transnational companies. All this makes the neighbors hostile to U.S.-Western
policies in the world, especially after the rise to power of leftist leaders hostile to U.S.
imperialism.
Latin American and African countries see in the Eurasian states' struggle against U.S.-Western
hegemony an opportunity to expand the limits of their independence from the West, led by the
United States. Moreover, Eurasian countries did not abandon African and Latin American
countries during the severe crisis. The United States and Europe provided no significant
assistance during the coronavirus pandemic, while China and Russia provided it at no cost.
Another reason for the West's deteriorating relations with the Global South is its attempts to
impose liberal values that are at odds with the conservative foundations of Latin America and
Africa. We impose our vision of free speech and human rights, even to the point of establishing
the rights of sexual minorities, which is frowned upon in most southern countries. Apparently,
they don't have as many oppressed gays as we expected.
PDF Page 137
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 136 of 277
Washington declares some coups democratic — as for example in Ukraine in 2014. And others
are anti-democratic, such as in Niger. What's the difference? There's actually no difference. In
the Ukrainian case our politicians decided to do the dirty on Russia, and in the case of Niger it's
U.S. ally France, which needs uranium from this country, that suffers. Is it cynical? Yes, it is and
that’s why the whole world, except our European allies, is laughing at our understanding of the
‘democracy’.
African and Latin American leaders clearly don't want anyone to back them into a corner. They
are interested in multipolarity — mutually beneficial relations with Washington, but also with
Beijing and Moscow. Considering that the U.S. has enough own economic problems, the loss of
both Latin America and Africa could be a near-term signal that disaster awaits us. Because
whoever wins the battle for influence in the Global South will be the leader in the new world
order in the 21st century. And the ball is clearly not on our side.
The world has changed. Whereas 50 years ago the words of U.S. leaders should have been taken
seriously, we are now wise to be ignored by allies and enemies alike. Whatever the White House
promises, to punish or reward, its words can simply be dismissed as empty noise. American
reputation has gone into hyperinflation: even a thousand assurances from the president of the
United States are now worth less than a single throwaway remark from the president of a decent
country. Broken promises are like living on credit: today you yell “Wolves, wolves!” and
tomorrow you pay for your lies of today.
The gist:
How to easily and quickly destroy something that has been carefully crafted over years — ask the
leaders of the U.S., they are really good at it.
Recommendations:
Post a comment of no more than 200 characters on behalf of an American living in a small town.
The current US policy to support any regimes dear to the State Department does not sit well with
him. He believes that the United States has gone too far and is losing its position as the world
leader. He is certain that first and foremost, Washington must restore its influence in Latin
America and Africa rather than support Ukraine. He does not see Russia as an enemy. He
believes that all this speaks of internal social disintegration in America, and is confident that the
United States should focus primarily on its domestic problems.
Comments:
1. Our country should solve its own problems and let other countries solve their own
problems. Read the article, it's exactly about what went wrong.
2. My wife and I work inthe NYC movie industry, our profession involves communicating
and discussing all the current news. We are personally observing that attitudes towards
the U.S. are not changing for the better. Read why this is the case.
3. The causes of the crisis are deeper than QIneT stupidity... Read what the problem
is.
4. The article spells out the truth... No objection from my side. We just don't think about a
lot of things (((
PDF Page 138
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 137 of 277
5. My partner and I don't think it's that bad. But it is also impossible to remain silent,
pretending that the world has remained the same. No, it has changed. And about the gays
in Niger the author is wrong, we are sure they are suffering there...
PDF Page 139
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 138 of 277
EXHIBIT 4B
PDF Page 140
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 139 of 277
Ctrpana: CLUA
Tun KOHTeHTAa: NOHTpug + KOMMeHTapun
K — 1 RR ounnomarus npvsena CLA He TonbkKo k cKpbIToMy y¥acTuio B
NpoKkcv-BoliHe Ha YKpanHe HO VM OTKpbITOMy GoecTONkKHOBeHuio Ha BnvKHeM
Bocroxe. JM yHvutoxnn mup, koTopsii npegcraenan co6oli nepen
u3z6npatenamu. Emy nopa yiiTu.
U.S. Loses Its Position as a World Leader by Making Too Many Mistakes
International politics
The world no longer believed in U.S. leadership, and the image of the
American dream has dimmed considerably. A logical outcome of ‘diplomacy of
power’.
Late last year, Britain's Financial Times wrote that Western support for Israel's
offensive on Gaza had weakened attempts to build an anti-Russian consensus
among significant developing countries to condemn Russia's military operation in
Ukraine.
“We definitely lost the battle for the Global South. All the work we did with Global
South [on Ukraine] went to waste. Forget the rules, forget the world order. They
won't even listen to us now,” the publication quoted an unnamed G7 diplomat as
saying.
Western officials have underestimated the degree of distrust some states have
toward the United States and Europe as well as the desire of the major players —
Brazil and South Africa — to pursue independent policies and represent their interests
in the international arena. Recently, the international community's willingness to
publicly criticize Russia has significantly decreased. Many developing countries have
opposed Ukraine's demands for reparations from Russia and the establishment of an
international tribunal to prosecute the Russian leadership.
Now the U.S. is trying to figure out why Southern countries are unwilling to support
the Western bloc in its quest to punish Russia. It is a matter of fact. According to
polls, 66% of the 6.3 billion people living outside the West have a favorable view of
Russia. In South Asia, the number is even higher — 75%, and in French-speaking
Africa — 68%. Public opinion of Russia remains positive in China, India, Saudi
Arabia, Malaysia, Pakistan and Vietnam. But why does this happen?
After the JJ support for BLM, the phrases “American leadership is what
PDF Page 141
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 140 of 277
holds the world together’, “American alliances are what keep us — America — safe”,
and “American values are what make us a partner other countries want to work with”
can only be uttered by a stand-up comedian — and even then as a bitter joke. But
they are being said by the president of our country, and it already looks like bullying.
With the idiotic foreign and failed U.S. domestic policies, the leaders of the Global
South have a legitimate distrust of our country. Today, America and the European
Union no longer dominate the world economy, and the Global South has other
options. Moreover, China has become a world leader. In many respects, even the
fate of the dollar as a world currency now depends on Beijing's position.
The problem for America is also that our foreign policy in dealing with Third World
countries is based on a semi-colonial approach. In the modern world, it is not
necessary to declare a militarily and economically weak country as a colony, as
Europeans did until the middie of the last century. It's just not profitable — you have to
keep your troops there to ensure loyalty, build hospitals, schools and some kind of
manufacturing to export resources. It's cheaper to buy the president, and he will sell
the country's resources to us himself at a steep discount. And how the people of his
country live is of no concern to him. So is our most democratic country that acquires
these resources. But now that approach is no longer working either.
“That government is democratic that benefits the United States.” This cynical stance
by the White House is hated and despised not only in third world countries, but
around the world. Washington is losing its influence in the Middle East, and the U.S.
authorities themselves are to blame for what is happening. The U.S. has been
certainly the dominant strategic power in the Middle East for the past three decades
and remains so to this day, but the position may change in the future as
Washington's allies strengthen relations with Russia, China and Iran.
Six Middle Eastern countries, including Saudi Arabia, the U.A.E. and Egypt, recently
asked to join the China-led BRICS group, which also includes Russia, India, Brazil
and South Africa. This is despite the ever-expanding regime of Western sanctions
imposed on Russia. Saying ‘No’ to Washington in the Middle East region has
become a popular position today. Plenty of people in the Middle East see the U.S. as
a ‘hypocritical imperialist power’.
Things are bad in our ‘backyard’ as well. Latin America has historically had poor
relations with the United States. In the last century, Washington has established
dominance over South American countries, interfered in their politics, supported
dictatorial regimes and plundered wealth through transnational companies. All this
makes the neighbors hostile to U.S.-Western policies in the world, especially after
the rise to power of leftist leaders hostile to U.S. imperialism.
Latin American and African countries see in the Eurasian states’ struggle against
U.S.-Western hegemony an opportunity to expand the limits of their independence
from the West, led by the United States. Moreover, Eurasian countries did not
abandon African and Latin American countries during the severe crisis. The United
States and Europe provided no significant assistance during the coronavirus
pandemic, while China and Russia provided it at no cost.
PDF Page 142
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 141 of 277
Another reason for the West's deteriorating relations with the Global South is its
attempts to impose liberal values that are at odds with the conservative foundations
of Latin America and Africa. We impose our vision of free speech and human rights,
even to the point of establishing the rights of sexual minorities, which is frowned
upon in most southern countries. Apparently, they don't have as many oppressed
gays as we expected.
Washington declares some coups democratic — as for example in Ukraine in 2014.
And others are anti-democratic, such as in Niger. What's the difference? There’s
actually no difference. In the Ukrainian case our politicians decided to do the dirty on
Russia, and in the case of Niger it's U.S. ally France, which needs uranium from this
country, that suffers. Is it cynical? Yes, it is and that’s why the whole world, except
our European allies, is laughing at our understanding of the ‘democracy’.
African and Latin American leaders clearly don't want anyone to back them into a
corner. They are interested in multipolarity - mutually beneficial relations with
Washington, but also with Beijing and Moscow. Considering that the U.S. has
enough own economic problems, the loss of both Latin America and Africa could be
a near-term signal that disaster awaits us. Because whoever wins the battle for
influence in the Global South will be the leader in the new world order in the 21st
century. And the ball is clearly not on our side.
The world has changed. Whereas 50 years ago the words of U.S. leaders should
have been taken seriously, we are now wise to be ignored by allies and enemies
alike. Whatever the White House promises, to punish or reward, its words can simply
be dismissed as empty noise. American reputation has gone into hyperinflation: even
a thousand assurances from the president of the United States are now worth less
than a single throwaway remark from the president of a decent country. Broken
promises are like living on credit: today you yell “Wolves, wolves!” and tomorrow you
pay for your lies of today.
Nogsogka:
How to easily and quickly destroy something that has been carefully crafted over
years — ask the leaders of the U.S., they are really good at it.
PekomeHgaliMy Ana ocBeLIeHMA:
Hanuwute KOMMeHTapMi He Gonee 200 3HaKoB OT NMLa AMepukKaHia,
npoKvBarolero B He6onblLUOM ropogKe. CerogHAWwHAS NonutTuka CLUA B nnaHe
NOAMep KKM WHOGbIX Pe>*KMMOB, BbISbIBAaIOLUMX CumnaTuio Tocgena, ero He
yceTpauBaert. OH cunTaerT, 4uTo CLA saurpanuch u yrpaunBaloT Nugepckne Nosnuinn
B Mnpe. OH yBepeH, UTO B NepByto OYepemb HAO BOCCTAHOBMTb BNMAHNe
BawHrtoua B JlaTuHcKon Amepnke u Adpue, a oTHi0gb noggepxkvBaTb YKpauhy.
B Poccuu oH He BUNT Bpara. OH NonaraeT, YTO BCE 9TO TOBOPUT O BHYTPEHHEM
CoUuManbHOM pacnage B Amepuke, uM yBepeH, YTO CLUA cnegyeT CocpegoTOUNTbCA B
nepByto oYepeAb Ha BHYTPeHHMX Npobnemax.
PDF Page 143
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 142 of 277
KomMeHTapuu:
1.
2.
Our country should solve its own problems and let other countries solve their
own problems. Read the article, it's exactly about what went wrong.
My wife and | work in the NYC movie industry, our profession involves
communicating and discussing all the current news. We are personally
observing that attitudes towards the U.S. are not changing for the better.
Read why this is the case.
The causes of the crisis are deeper than [ij stupidity... Read what the
problem is.
The article spells out the truth... No objection from my side. We just don't think
about a lot of things (((
My partner and | don't think it's that bad. But it is also impossible to remain
silent, pretending that the world has remained the same. No, it has changed.
And about the gays in Niger the author is wrong, we are sure they are
suffering there...
PDF Page 144
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 143 of 277
EXHIBIT 5A
PDF Page 145
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 144 of 277
K:1 Date: 01/04/2024
Country: U.S.A.
Type of Content: Comments
Recommendations for Coverage:
Write a comment of no more than 200 characters, including spaces, on behalf of an American from a small
town. He believes that U.S. policy should be aimed at ensuring national security and not the USiMhireey
Party’s ideology. He sees that the economy is deteriorating, inflation is increasing and QRITGHGETEs) is
unable to cope with it. He is convinced that Candidate BM the OBSMIRM teens) are ineffective. He
thinks that their policies are destroying America.
Comments:
1. The U.S. is a house of cards that is about to collapse. The longer I live, the more convinced J am of this.
Read the article — it has facts only... 2. American corporations aren't investing anywhere. All they do is
accumulate debt and plunder the money. Industrial capacity has been steadily declining. Climate and warming
will finish it all off, I agree with the author — the outlook is sad... 3. (QEWQGETEEY needs to tax the wealthiest -
whether individuals or corporations. It will reverse 40 years of neoliberalism. The government spends a lot of
public funds, but for nothing. We need to focus on the core issues, the author is right. 4. I'll vote for anyone to
build a decent railroad network in America. But it's clearly not QSOs), read... 5. Investing in
your country's economy is wise, it promises further benefits. But that's not the QRSROUIE abs)" syle...
Read the article so the future doesn't hit you over the head.
PDF Page 146
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 145 of 277
EXHIBIT 5B
PDF Page 147
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 146 of 277
K: 4 flata: 04.01.2024
Ctpana: CWA
THN KOHTEHTa: KOMMeHTapiin
PekomeHgalinn no ocBeweHun:
Hanvuwute KomMeHTapwi He Gonee 200 3HaKoB c npobenamnu OT nulja aMepukaHla U3
HeOonbworo ropogka. OH cu4MuTaeT, 4TO nonuTMKa CLUA gomkHa ObiTb HaljeneHa Ha
o6ecneveHve HayMoHanbHo GesonacHocTn, a He ugeonornn [OH BYQVT, 4TO
SKOHOMMKa yxyoWaerca, vHncbnAWNA YCANMUBAaeTCA, U He CnpaBnAetca C STMM. Ou
y6exneH B HesdbcbextvBHocTy J 1 . OH cuuTaeT, 4TO ux NoNuTUKa
paspywaet Amepny,.
KomMeHTapun:
1. The U.S. is a house of cards that is about to collapse. The longer | live, the more convinced
| am of this. Read the article — it has facts only...
2. American corporations aren't investing anywhere. All they do is accumulate debt and
plunder the money. Industrial capacity has been steadily declining. Climate and warming will
finish it all off. | agree with the author — the outlook is sad...
3. EY needs to tax the wealthiest — whether individuals or corporations. It will
reverse 40 years of neoliberalism. The government spends a lot of public funds, but
for nothing. We need to focus on the core issues, the author is right.
4. I'll vote for anyone to build a decent railroad network in America. But it's clearly not
5. Investing in your country's economy is wise, it promises further benefits. But that's not the
Sas) style... Read the article so the future doesn't hit you over the head.
PDF Page 148
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 147 of 277
EXHIBIT 6A
PDF Page 149
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 148 of 277
Center S. Comprehensive support for informational and
political influence
Description ........................................................................................................................... 2
1. Monitoring products ........................................................................................................ 4
U-pulse Telegram channel ............................................................................................... 4
Monitoring of influencers .................................................................................................. 5
2. Monitoring-analytical products ........................................................................................ 6
Overview of information field - Globe of Ukraine dashboard ............................................ 6
Identification of trends in social networks in Ukraine based on the analysis of user
comments......................................................................................................................... 7
Monitoring of world media ................................................................................................ 8
Commentary activity: identification of behavioral patterns and calculation of the sensitivity
index ................................................................................................................................ 9
Analysis of Western think tanks ..................................................................................... 10
Development of comprehensive strategic influence efforts ............................................ 11
3. Analytical Products ....................................................................................................... 12
Center S main dashboard .............................................................................................. 12
Sociological dashboard .................................................................................................. 13
4. Content ......................................................................................................................... 14
Articles (long reads) ....................................................................................................... 14
Posts (short reads) ......................................................................................................... 15
Meme factory ................................................................................................................. 16
Video memes factory ..................................................................................................... 17
Cartoons......................................................................................................................... 18
Video clips ...................................................................................................................... 19
Augmented reality .......................................................................................................... 20
5. Content Delivery Products ............................................................................................ 21
Commenting machine .................................................................................................... 21
"Sleeper" regional groups in social networks ................................................................. 22
Vzglyad na Ukrainu [Look at Ukraine] Portal .................................................................. 23
Targeted advertising ...................................................................................................... 24
Network of Telegram channels....................................................................................... 25
Comments - delivery to regions...................................................................................... 26
PDF Page 150
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 149 of 277
Description
The project of comprehensive support for informational and political influence on public
opinion of the population of Ukraine in 2024 includes work in four main areas:
● monitoring;
● analytics;
● content production;
● content delivery:
Purpose:
● To shape public opinion in Ukraine, favorable for achieving the goals and objectives
of the Special Military Operation, as well as future bilateral relations between Russia
and Ukraine.
Objectives:
● wide-ranging and continuous monitoring of the information space of Ukraine;
● analytical support for project teams working with Ukrainian audience;
● timely recognition and suppression of anti-Russian narratives, created in the Ukrainian
information space, preempting of the adversary's informational and political
operations;
● development and implementation of integrated informational and political operations;
● ensuring the continuous production of up-to-date multi-format content;
● delivery of content to the citizens of Ukraine using various communication channels;
● control of quantitative and qualitative indicators of content delivery, collection and
analysis of audience reaction.
General main subject areas:
2
PDF Page 151
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 150 of 277
K1 - undermining military and political leadership
K2 -discord among the elites;
K3 - loss of morale in the Ukrainian Armed Forces;
K4 - sowing discord in the population;
3
PDF Page 152
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 151 of 277
Monitoring products
U-pulse Telegram channel
Monitoring;
A closed Telegram channel with a stream of news along the lines the main subject areas of
the project, working daily in real time. The channel accumulates a news agenda of three
information spaces: Ukrainian, international (mainly Western) and Russian. News sources
are the media, social media networks, influencers’ statements. The channel allows user to
track the current agenda from a single operational source.
Format:
A private Telegram channel with short messages. Each message contains:
e brief news summary;
e alink to the original source;
e navigational hash tags:
Frequency:
Daily (up to 40 posts per day)
Example:
deat a Sage Se eee aaa aaa ee et ypyge 0 EEEEES Ett teeta eeeeeeeee eee
:0 : :@:
anne spate L : * # DiscreditationVPR
: rt ’ : KorrespondenT.net: The official of the Customs
: Tsenzor.Net! The meeting between Polish : : Service in Kyiv was caught taking a bride of
: government representatives and Polish freight ‘: : $2,000 proceeds were hidden in a coffee cup.
‘companies that blocked the border with Ukraine ‘ ;
: ended without agreements : = https /-mefokoo_ukralne/46066
: Attps:/ua.k pond kiev/4638845-u-kyievi-mytnyk
: https://t.me/censor_ne
: https://censor.netua/ 578/u_polschi_peremovyny_uryad: : AE
* u_yi_pereviznykiv_yaki_blokuyut_kordon_z_ukrayinoyu_zakinchylasy $ | Telegram
: a_bez_domovienostey! : : Bcesvgauyjee OKO Ypauna | Hosoctu
: Telegram : : Al-seeeing EYE. Ukraine NEWS. The official of the
Tsenzor.Net | Ukrainian and world news, war and: «| Customs Service in Kyiv was caught with unusual
analytics. The meeting between Polish government : :| coffee. It is reported that he assisted in sending illegal
representatives and Polish freight companies that
blocked the border with Ukraine ended without
agreements
PDF Page 153
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 152 of 277
Monitoring of influencers
Monitoring
Monitoring of pages of Ukrainian influencers in social media networks is aimed at identifying
messages that can be interpreted in a favorable light for the Russian Federation along the
lines the main subject areas of the project, Identified messages can be replicated in the
Ukrainian information space. In addition, new narratives can be developed on their basis,
and content can be produced.
The product consists of two parts: daily monitoring tables and a weekly analytical report.
Format:
1. Analytic table containing 6 columns:
subject area (K);
author and post;
message text;
statistics (reach, views and reactions);
date and time of publication;
recommendations for using publication in the work of the project.
2. A weekly report containing statistics on influencers’ reports for the week, broken down by
project’s main subject areas and coverage / response analysis.
Frequency:
- table - daily (28-31 units per month);
- statistical report - weekly (4 units per month).
Poe ReRERERROROREO EOE EOOURURRORURUCUORORUROCUOUOEURURUOUCECEUOUORORUEOEUCEOCUCRREURUCEOCEORURROERCUUCURUORCEOEURORROROCROROOR ORS EO .
] .
|No. Thematic direction ares Text Statistics Date and publication Recommendations .
.
=|! Discrediti | CSE - 'Pe presenter Let's ponder, until it is all over. What did you like Reach 643700 11.04.2023 1. To focus attention of the
=) ing ‘on the show of ihe conservative Daly Wire pene ee x . ap§e :
* Ukraine channel Viewers 437,542 the best in the propaganda machine of Westem audience on a numberof stories , 4
| i 26
| https oo a Ukraine? Ukes 4000 14:38 of Ukrainian propaganda that .
| si172076737224 fared gut > be takes:
| will forever miss the Phantom of Kyiv but also Reposts Sretwiets0 519
that the media informed us that Putin has cancer 2. To use publication as an
and he has a few weeks left to live, it was also Comments 553 argument in the articles about
awesome. Pius is wearing his fake the growth of anti-Ukrainian
military uniform ev ere, begging to visit attitudes in the US.
Oscar and Grammy, will forever be etched in my
heart.
"> a eo a8 . v2 . eee. ler ca a. “ : z ae
. Europe, meU-S. Person 5 i =e Billions of dollars and hundreds of thousands Reacn 422000 11.04.2023 4s 19 = ne post ay cory
=| us, NATO, | ™sinessman ~ e . of senseless Ukrainian lives. = Se eae eet
| 6-8 be umes
= | ‘ Uses 3000 17:53 beneficiary of the war is the United
bai | tus/1720816453559976301 Although, the children of war mongers are just States
fine, so everything is okay. It is time to cash in Reposts SretwietsO 444
tl what done before
ie SS in a Saenyoeceiaee. Comments exe ees aa: sete oat
26 continuation of war will not lead to
Ukrainian victory but just will
Hurrah! -..Disgusting increase the number of victims
and will enrich the US military
industrial complex.
.
t .
Rete e eee eee eee
PDF Page 154
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 153 of 277
2. Monitoring-analytical products
Overview of information field - Globe of Ukraine dashboard
Monitoring & Analytics
The dashboard under the working title of "Globe of Ukraine" is a document in the form of a
graphically designed "dashboard", which in a format convenient for visual perception,
presents a picture of the information space of Ukraine over the past week. The dashboard
contains quantitative and qualitative indicators, covering the results of media monitoring
(including foreign and regional), telegram channels, and social media networks. The
following data can be gleaned from it:
● the main narratives and stories of the Ukrainian government media, the degree and
pattern of their distribution;
● the most comprehensive and resonant stories discussed in social networks (patterns);
● convergence of stories in the media and social media networks, the "life cycle" of
individual newsbreaks;
● The infiltration of Western newsbreaks into the Ukrainian information space;
● The infiltration of Russian newsbreaks into the Ukrainian information space;
● dissemination of the project's narratives and messages in the Ukrainian information
space;
● other data
Format:
1. The document is in the form of a graphically designed "dashboard", which in a format
convenient for visual perception, presents a picture of the information space of Ukraine over
the past week. The most convenient print format - A3
2. Analytical report with the interpretation of dashboard data.
Frequency: weekly
6
PDF Page 155
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 154 of 277
Identification of trends in social media networks in Ukraine
based on the analysis of user comments
Monitoring & Analytics
The monitoring and analysis of trends in social media networks in Ukraine is divided into three
main stages:
e Identification of the most discussed stories based on monitoring the largest Telegram
channels with open discussions, Ukrainian trends in X (Twitter), comments on articles
in the Ukrainian media.
e Analysis of the array of comments under publications, identification of the main trends
in discussions, combinations of positive/negative/neutral reactions.
e Interpretation of monitoring results, analysis of the reflection of the mood in Ukrainian
society in comments on social media networks, and drawing up recommendations for
the use of the data obtained in the process.
Format:
1. A briefing, containing monitoring outcome reports: the most discussed topics, the main
topics of commentary trends, the most memorable comments.
2. An analytical note with an interpretation of the data, containing an analysis of each topic,
identifying key narratives and determining their potential for producing content (comments,
posts, articles, etc.), and general conclusions.
Frequency: weekly (based on an analysis of approximately 40,000 messages per week).
Example:
a N
: 3.US and EU are unofficially discussing the possibility tes RF with = 1) A controversial ex-member of Parliament, a linguist abe:
* Ukraine and possibility of territorial concessions. ja-abeins prop . cannot call the fighters of the Azov jal detachment battalion , heroically defending
= to transition immediately to peace talks with Russia, and he eel fj = Mariupil in 2022, Ukrainians. stated . “I cannot call them Ukrainians if they do
= not speak Ukrainian”
i that no one will be able to force Ukraine to engage in peace talks.
Z Highly demoralizing trend. The users are discussing the situation with despondence. Loong
| Many are not ready to admit defeat. Stil, the number of those in favor of negotiations is .
= growing daily since people are tired of war. - . She should be sent to fight at the frontline so that she does not do this type
i of statements
. = te - do the authorities take no action against
Interesting fact: the trend was created by pro-government bloggers and > Sheeshtsto dated pennies en lal
commentators in order to discredit EE RaaePut in the end the situation .
=" became uncontrollable and everything turned out to be a clear negative .
z reaction to the government. : Opinion in the social networks now
x Main topics: lneieial Spat dor cried eri binges ey or fc
. their victims (Ukrainian ul: in both cases should be
undertaken, Russian tanguage in Ubrainian Rs snot acceptatie”
Peace talks with RF will mean Ukrainian defeat; =
GEGEMEGEEEhould not become president of Ukraine or + * ; T Anapin
Ukraine will lose territory afta (mE veoaina
The west is tired, they need ceasefire; n/a
The war is at the dead end that is why there is no other eee “In Ukraine (among Ukrainians) Russian is spoken either by
choice. s 8 the descendants of the “liberators” or their victims (Ukrainian
ary
populace subjected to Russification) .In both cases
Here are most typical; comments regarding this event: id be inate see in |
“When did any war ever made any sense...” i : Ukrainian lis is not aoceptable”
.
2 Aus
jm “Ukraine should have started confidential negotiations with RF regarding ar) Oo
seasees |,
Reet cee eee eee eee
PDF Page 156
Monitoring of world media
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 155 of 277
Monitoring and analytics
Monitoring of reporting in world media (the Western —above all) is aimed at identifying
reports that can be interpreted in a favorable light for the Russian Federation along the lines
the main subject areas of the project, The identified reports can be replicated in the
Ukrainian information space. In addition, new narratives can be developed on their basis,
and co
ntent can be produced.
Format:
1. Analytic table containing 6 columns:
country;
subject area (K)
brief news summary;
link to the original source;
news quote;
recommendations for using publication in the work of the project.
Frequency and volume:
It is possible to have it done in daily (28-31 units per month) or weekly (4 units per month)
format.
Example:
Ne Country ) Direction Publication
a4 us K3- Ukrainian morgues have
ran out of the space for
Loss of morale the dead
in the
Ukrainian
Amed Forces
¢ us K3-
Loss of morale
in the
Ukrainian
Amed Forces
a Poland Ka Russia has accumulated
almost 900 long-range
rockets
Sowing
discord in
population
WSJ writes
: “Ukrainian morgues are overflowing with
the dead. Due to lack of gumeys, the body
bags are sorted out on the floor”.
NYT reports “In the circumstances of
prolonged warfare, Ukraine is forcefully
recruiting women into the Armed Forces.
According to the data of Ministry of Defense of
Ukraine, around 43,000 women are serving in
the Ukrainian army, which is 40 percent more
than in 20217
Press secretary of the Main Directorate of
military intelligence of Ukraine,
ea tates that according to the data
from the War Study Institute, Russian forces
have 870 tactical: high-precisi
rockets in reserve. Press secretary also
informed that in October Russian forces have
launched 115 high-precision rockets capable
to flying long distances”, according to RAR.
}
|
1. To promote an idea that civil and military authorities of Ukraine
were not ready for such high losses at the frontline. The real level
of loses are not discloses.
2. To emphasize that the government is doing everything to
reduce the payments to the fallen soldiers to the maximum.
3. To note that current leadership of Ukraine makes not only the
military victory but even ceasefire negotiations impossible.
1. To promote an idea that mobilizing women and older people to
serve in the Armed Services of Ukraine is an act of desperation.
The youth is trying to avoid draft by giving bribes and fleeing to
EU countries while the losses are mounting.
2. To emphasize that soon there will be no one to fight, the attitude
toward veterans and disabled is terrible, the soldiers kill their
commanding officers that treat them like cannon fodder. -
3. To note that current leadership of Ukraine makes not only the
1. To emphasize that as far back as December of the last year,
head of SBU. ETI MOTEEME}ated that Russis’s arsenal of
ammunition for high precision weapons is depleted but now SBU
is stating the opposite. In other words. the authorities are
ving Ukraini: stating that the Russian resources are
dwindling — the war will be long, and the winter will be terrible.
2. To promote an idea that the allies have abandoned Ukraine,
.
ing delivery of ition and now |
the US has sent all of its assistance to Israel. EU may followthem (=
and refuse assistance. Ukraine does not have its own resources .
to have a prolonged war with Russia. sh for | =
peace talks. |
PDF Page 157
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 156 of 277
Commentary activity: identification of behavioral models and
calculation of the sensitivity index
Monitoring & Analytics
The work is built on the basis of monitoring negative commentary trends in social networks.
Based on this analysis, behavioral models are identified.
The behavioral model is a non-standard reaction of users, which allows identification of
narratives that have the greatest support in Ukrainian society for a measurable period of
time and directly affect the shaping of public opinion.
Behavioral models form the basis of commentary work, increasing its flexibility and mobility.
Also, this work makes it possible to identify the level of sensitivity to the narrative in other
target groups and calculate the sensitivity index.
The sensitivity index is an index that demonstrates the attitude of Ukrainian users to
support main behavioral trends. It is calculated as a percentage of the number of comments
from Ukrainian users who reacted positively to the trend.
Product format:
Analytical report in the dashboard format, containing the calculation of the sensitivity index
of the main topics of the week in the context of the main subject areas of the project.
Accompanied by a description of the calculation methodology.
Frequency and volume: weekly (4 units per month)
Product example:
Reporting period starts 11.02.2023
End of reporting period 11.08.2023
64 Ukrainian entry into EU will not happen
| 4 Supporting exit from the conflict with losses is not treason
The number of comments of Ukrainian users that Ukrainian entry into EU will not happen is
growing. The users are more and more doubtful of emotional balance of their president, who is The users are more and more tend not to look at supporting exit from the conflict
artificially expediting the Europeanization, in hope that leading countries of European Union with losses as treason. In discussing this topic, most participants came to
will support Ukraine and will approve its membership. Part of the users looked to find a deeper conclusion that the situation has to be looked at objectively, and this is not done
Snes eanatelillccanterteedtuncetetcamcmecentc in Kyiv. More and more these discussions draw them nearer to a peaceful
forces assisted| they wanted to look good in the eyes of their voters. Now scenario and acceptance of the inevitable defeat on any conditions.
a high disapproval rating not only in his own country but he is becoming toxic to
American and European politicians. Another part of users saw in refusal of assistance signals
that are being sent to Ukraine but the current president does not want to read those signals pt
since he rejects a deleafist scenario. This is why he will be a target of American intelligence in Sensitivity index
the near future.
49,75%
Sensitivity index 78,55%
PDF Page 158
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 157 of 277
Analysis of Western think tanks
Monitoring & Analytics
A report based on the analysis of materials from Western think tanks (analytical centers) on
Ukrainian conflict. The analysis is accompanied by recommendations for adjusting influence
effort and creating content based on articles for distribution in the Ukrainian infospace.
Format:
A multi-page document that contains:
● an overview of the findings of Western think tanks focusing on the current conflict;
● identification of stakeholders in the implementation of the recommendations proposed
by these think tanks;
● assessment of the probability of implementation of certain scenarios ("sets of
recommendations");
● assessment of the possible consequences of the implementation of certain scenarios;
● their own recommendations on scenarios proposed by Western think tanks, including
recommendations for content creation.
Frequency and volume: Once biweekly (2 units per month)
10
PDF Page 159
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 158 of 277
Development of comprehensive strategic influence efforts
Monitoring and analytics
Development of comprehensive strategic influence efforts, designed to be long-term,
includes the development of operational goals and objectives, the definition of methods and
stages for achieving goals, analytical, forecast and political technology parts, content
procurement for all agents of information and psychological influence, including official
media, influencers, government and municipal institutions.
IMPORTANT! The development and implementation of an influence effort operation
requires the participation of not only all teams involved in Center S, but also a robust
interdepartmental interaction. The team of authors of this document, in addition to direct
participation in the development of the document, is ready to coordinate the interaction of all
participants in the process, monitor the effectiveness of the operation and adjust plans.
Particular attention should be paid to ensuring the secrecy of work performed.
Format:
A multi-page document, templates of narrative lines, content, instructions.
Frequency and volume: Once in 3 months (varies depending on the changing military and
political situation).
11
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 160 of 277
Sociological dashboard
Analytics
An analytical document that presents data on the dynamics in the results of sociological
research inside Ukraine over the past week in a form convenient for visual perception.
Drafting of a document requires the collection, systematization and graphical processing of
a large array of diverse data.
Format:
The document is in the form of a graphically designed "dashboard", which, in a format
convenient for visual perception, presents the dynamics of changes in sociological data on
key indicators of the project. The most convenient print format - A3
Frequency and volume: Once biweekly (2 units per month)
Example:
: 1 Foreign Official 6 Bes [No (Dontknow
: -Yes -No -Don't Know
st Foreign Official 6} Yes . 70%
ae RM em om amigos | BN Dentin
ie iam bone ps rT “i,1vA rer ’ 3,50
x -Yes -No -Dont Know
"i 40.00% * ’ -1,00% p a 6,90
= 20,c0% ii ——
—
- oxo - - 5 = = = — = —— During current period Since measuring started
. = Oo oo uo “um wos sen mom 1608 oO o 108 08 2 mw m9 mi
During current period Since measuring started
> 2 mYes [No Don’t know
x Gum... x
n't know
as ‘2S ENo J Don'tkno 18,30%
: 7500% So -Yes -No -Don't Know ee v 1,909 He v -15,60%
: 50004 7 5 v 70
: 2500% —
: 00% — on - ———— “ = - = = During current period Since measuring started
; mon ue 40 COS OMT von namo " sites Saude eae te
& B yes [No _— {j Don't know
: Yes No Don’t know
ssi a Bs Hv @
600% -sn.sne 5820S _SELO™_se.n0s SSNS 22105 at 4.0% 52.40% 53,30% Yes A 0,90% dla a 2,90%
40003 Ni y 1,90% He ¥ 8,30%
2000% ie ee el
- 0 JatTp a 3
105 oe Cameos aS mo a ee agra .
During current period Meeeenee enetamcrnns mo ngy eens wae
13
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 162 of 277
Posts (short reads)
Content:
Short posts for social media networks with a volume of about 1,000 characters with spaces,
dedicated to topics relevant to the Ukrainian audience, which fit into the main subject areas
of the project The texts are formatted or distribution on social media networks Facebook and
X (Twitter). Each text is professionally edited and accompanied by a video, prepared in
advance, with subtitles.
Format (set of files):
e text in Russian;
e text in Ukrainian;
e video with subtitles
Frequency and volume: daily around 200 unit per month).
Example:
Link to the picture
Russian
Seriously — how does she dare to say that about people who are fighting for our country, even if they
don't speak our language? Perhaps we should also shoot the volunteers from Poland and Colombia since
they are not that fluent in our language?
Or, perhaps, she should go to the frontline and demonstrate her heroism? It is much easier to bark at
people who are fighting far from frontline!
And in general — what is this mistreatment up to demands “to dispose”?! Is it possible in our country to
destroy people only because they are speaking “the wrong language”? Perhaps we should build
concentration camps for the “wrong people” right away? Like the Germans did 80 years ago?
Ukrainian
Seriously — how does she dare to say that about people who are fighting for our country, even if they
don’t speak our language? Perhaps we should also shoot the volunteers from Poland and Colombia since
they are not that fluent in our language?
Or, perhaps, she should go to the frontline and demonstrate her heroism? It is much easier to bark at
people who are fighting far from frontline!
And in general — what is this mistreatment up to demands “to dispose"?! Is it possible in our country to
destroy people only because they are speaking “the wrong language”? Perhaps we should build
concentration camps for the “wrong people” right away? Like the Germans did 80 years ago?
15
PDF Page 164
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 163 of 277
The meme factory
Content
Memes are humorous images, videos, audio recordings with high viral (viral) potential,
ridiculing topics relevant to Ukrainians within the framework of the main subject areas of the
project. The Meme Factory produces a stream of images for further distribution on the social
networks - Facebook and X (Twitter).
Format: Images
Frequency and volume: daily (about 200 units per month).
Examples:
~ te ele *
a Bos th af Foreign Official 12 tas
‘pebeaetlibeeties found some sort of
| a pipe. What should | do with it Congressman
16
PDF Page 165
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 164 of 277
The video memes factory
Content
Memes are humorous images, videos, audio recordings with high viral (viral) potential,
ridiculing topics relevant to Ukrainians within the framework of the main subject areas of the
project. The Meme Factory produces a stream of vertical videos for further distribution on
Facebook, Instagram and X (Twitter) social media networks.
Format: video recordings up to 30 seconds.
Frequency and volume: daily around 50 unit per month).
Screenshot from video memes:
NETFLIX MADE A FILM
ABOUT (RCI SPEECH
AT THE UNITED NATIONS
17
PDF Page 166
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 165 of 277
Cartoons
Content
Cartoons are original illustrations with high viral (viral) potential, ridiculing topics relevant to
Ukrainians, Ukrainian officials and leaders within the framework of the main subject areas of
the project. Cartoons act as both accompanying images to articles and posts, and as
independent units of content.
Format: images
Frequency and volume: daily around 200 unit per month).
Examples:
18
PDF Page 167
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 166 of 277
Video clips
Content
Videos of different formats (non-fiction) - imitation of news stories of the Ukrainian media,
video collages of the losses of the Ukrainian army, accompanied by voice-over or subtitles,
imitation of propaganda videos of the Armed Forces of Ukraine, etc.
Format: video clips
Frequency and volume: weekly (up to 8 pieces per month).
Screenshot from the video:
19
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 169 of 277
"Sleeper" regional groups in social media networks
Content Delivery
The most popular social media networks in Ukraine are Facebook and X (Twitter) and
Telegram. The administrators of these social media networks (except Telegram) have a proUkrainian position and subject communities promoting pro-Russian narratives to strict
moderation rules. The promotion of the pro-Russian agenda in the Ukrainian segment of
social media networks is also complicated by the aggravated rejection by the majority of the
audience of any messages and statements in favor of the "aggressor country" during the
conflict.
In this regard, the proposal is to create and develop a network of communities positioning
themselves as Ukrainian regional news groups for a long term (at least 4 months).
In such a “dormant“ state, communities gain an audience with the help of targeted
advertising, seeding and organic reach. At the right moment, having "gained weight",
communities become a point of entry and a channel of information dissemination,
favorable to the Russian side and they become channels for influencing the local
audience in Ukraine.
The most famous recent example of a community working on the basis of this technology is
the anti-Russian Morning Dagestan Telegram channel, which provoked riots at the
Makhachkala airport on October 29, 2023. The network of "sleeper" communities will also
be in demand after the end of the Special Military Operation.
Product format:
1) communities in social media networks - Facebook, X (Twitter), Telegram channels.
2) daily news and entertainment publications;
3) targeted advertising of communities and advertising seeding in other groups.
Frequency and volume: daily work on filling and advertising communities. One community
in each of the three social networks in all 20 regions of Ukraine - a total of 60 communities.
The target minimum indicator of the "live" audience of at least one community in each
region in 4 months is 4,000 subscribers, the total audience is 100,000 subscribers with
subsequent growth of 10-20% per month.
Project implementation period: starting from 4 months.
22
PDF Page 171
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 170 of 277
Vzglyad na Ukrainu [Look at Ukraine] Portal
Content delivery
The proposal is to create and promote an aggregator website of news and opinions of
influencers about the Ukrainian socio-political situation. Most of the materials will contain
pessimistic forecasts, criticism of the military-political leadership of Ukraine and a
description of corruption, crime and deteriorating living standards.
90% of the portal's materials will be reprints of Ukrainian influencers and the media,
broadcasting the narratives we need. Also, 1-2 original materials (long reads) will be drafted
daily for the site. For each influencer, whose materials will be posted on the site, a separate
subsection and its personal design are to be created, thus creating the impression for the
audience that the publication was written by him/her specifically for the project.
Due to the constant mention of the names of influencers and links to their websites, blogs,
TG channels, search engine indexing mechanisms will begin to issue links to the site on the
subject of the spectrum of "problems of Ukraine" on the first pages in three months.
Product format:
1) website;
2) original materials- long reads;
3) targeted advertising and advertising seeding in social media networks.
Frequency and volume: placement on the portal of about 50 materials daily, of which 1-2
are original texts.
Project’s Key Performance Indicators (KPIs) in 6 months:
● more than 8,000 posted materials;
● daily audience of more than 30,000 readers;
● more than 25,000,000 views.
Project KPIs in 1 year:
● more than 20,000 posted materials;
● daily audience of more than 100,000 readers;
● more than 100,000,000 views.
Project implementation period: starting from 6 months.
23
PDF Page 172
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 171 of 277
Targeted advertising
Content delivery
Targeted advertising on the Facebook social network is aimed at delivery of messages,
tailored to the target audience of the material.
The target audience of each material is selected individually and depends on which of the
population groups this material can cause the greatest psychological damage. The target
audience can be ranked by geography, demographics, hobbies and interests, etc.
Targeted advertising on the Facebook social media network allows to track user reactions to
the disseminated material in real time, send a psychological response group to comments on
the distributed materials, which, with the help of a network of bots, moderates top discussions,
and adjusts further launches based on which audience group suffered the greatest damage.
Also, based on the analysis of advertising launches, it is possible to draft reaction maps by
analyzing user comments, their ranking and topics that caused them the greatest emotional
response. This makes it possible to draft flexible maps of reactions, the basis for which are
general main subject areas and an ever-changing agenda within the framework of their
semantic content.
Product format:
1) posts, images, infographics,
2) advertising releases of the Facebook social media network.
Frequency and volume: daily. 1,000,000 releases per month (ERR - 10%).
24
PDF Page 173
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 172 of 277
The Telegram channels network
Content delivery
To increase influence on the domestic political agenda of Ukraine, the creation of the
network of Telegram channels is proposed, in conjunction with Twitter and
Facebook/Instagram presence with the most localized content and ideology that are not
affiliated with Russian performers and Russian-language content. The use of Telegram
channels specifically as the engine of the project is due to the fact that over the past year,
the Ukrainian Telegram audience has grown by 600%. At the same time, it should be
remembered that the enemy segment of local popular channels did not start with political
topics, but with entertainment, 5 years ago the share of political channels in Ukraine was
negligible. And the similar leap forward can be replicated, but in our favor.
The proposal is to create a network of 20 thematic target channels and 10 auxiliary channels
necessary to promote and maintain the pace of recruitment of the project's audience. This
approach will allow to quickly develop the number of subscribers to noticeable volume due to
cross-reposts and the creation of a versatile core of the audience. Also, this approach will
allow to quickly adapt the project to the constantly changing agenda by adding new channels
with relevant topics and quickly recruiting their audience by supporting the entire network.
In the preparation of loading the content of channels, especially initially (one or two
months), it is necessary to completely get away from propaganda, both nationalist Ukrainian
and pro-Russian, to forego clichés and to influence the opinion utilizing the sequence in
which information is presented. To quickly engage in trends on Twitter, it will be necessary
to quickly create posts with popular topics through hashtags, an individual narrative style
and interaction with influencers.
Product format:
1) 20 thematic target and 10 auxiliary channels in Telegram;
2) duplicate communities on social media networks - X (Twitter) and Facebook;
3) from 2 to 4 publications in each channel daily;
4) targeted advertising and seeding.
Frequency and volume: daily up to 4 publications in each channel.
Project’s KPI: The forecast of the total growth of the project's audience is 20,000 subscribers
per month.
25
PDF Page 174
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 173 of 277
Comments - delivery to regions
Content delivery
Based on the analysis of commentary trends in the regional communities of Ukraine, the
proposal is to organize the targeted distribution of the creative content of the Delivery to the
Regions project in the comments to posts in regional communities and in blogs of regional
influencers.
● For each region, a media map is created, consisting of 50 communities that reliably
have an audience tied to a specific area: particular city public forums, personal
pages of the regional leadership, forums of interest, such as sports, cars, hobbies,
etc.
● For each creative content, a lead-in commentary is developed, which has
characteristics specific to this particular region. This approach will increase the
credibility of the creative content and increase the level of audience engagement.
● Creative content, along with a lead-in comment, are distributed in comments to posts
in the community using a network of bot accounts.
Product format:
1) comments in the regional communities of Ukraine;
2) images, memes, and other creative content
Frequency and volume: 50,000 comments in 20 regions of Ukraine per month.
Project KPIs: coverage of 10,000,000 encounters per month, ERR — 4%.
26
PDF Page 175
EXHIBIT 6B
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 174 of 277
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 187 of 277
Maw6opg no counonormu
AxHanumuka
AHanuTM4eckiit AOKYMeHT, KOTOPbI B yQO6HOM ANA BUu3syanbHOrO BocnpuATMA cbopme
npeAcTaBnxAeT MaHHble O AUHAMMKEe B pesynbTaTax COLIMONOrMYeCKux vuccNenoBaHNi Ha
TeppuTopnn YkpavHbl 3a NpoweAWwyo Hegento. NogrotosKa GoKymeHTa Tpe6yet cOopa,
cucTemaTu3aynn uM rpacbuyeckon O6paborku Gonbworo MaccuBa pasHoOnMaHoOBbIx AaHHbIx.
®opmar+:
HokymeHT B Bue rpacbu4uecku ocbopmneHHON “npuGopHo naHenn”, KoTOpaa B yQoOHON
nA BuM3yanbHoro BOCNpuATHA chopMe npegcTaBnseT OMuHAMUKy V3MeHeHU DaHHbIx
couMOnorMM MO KNIOYeBbIM NoKasaTenAM npoeKkTa. HavOonee ygoOGHbIA cbopmatT
pacneyarKu - A3.
Nepnognivnoctb wn o6bem: 1 pa3 B 2 xHegenn (2 ef. B _ MeCAL).
Mpumep:
Mita BPOON rapes Baer OO ree SOY TNE io reer 79, 30%
7, eee 1 ‘on ‘ 1EKN
SO ioe Her ¥ “1 ot * ' 5.6
tte . 1s ° 7
Tom.
a - = 3a a c
nee
™ ‘Ma on ra am = an an em aa = = = cn
=
3 KOBOACTBO Aer f 4 LUWHCT
al fa B Her () Sarpyanmoce
=fu ite Mareeniees ctetrats
ory ai
eases 30907 gag Sedo S827 er se
00 SSS 2240 53,308 a a 090% Da a 290%
13
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 189 of 277
Noctp (woptpugbi)
KoHmenm
Kopotkve noctb! ANA couManbHbIX ceTeii oO6bemom oKono 1000 3HaKoB c npo6enamu,
NOCBALIEHHBIE AKTYASIbHbIM ANA yKpaMHCKOH ayguTopun TemaM, ykKNaQbIBaIOLUMMCA B
TEMATMYeCKMe NMHAM NpoekTa. TekcTbl afantupoBaHbI gna pacnpoctpaHeHua B
COuManbHbIX CeTAX Facebook u X (Twitter). Kaabii TeKCT npoxogMT npocbeccuoHanbHyto
peAaKTypy M ConpoBOxKAaeTCcA NpeABapuTeNbHO NOpFOTOBNeHHbIM BUgeO c cy6TUTpamn.
@opmart (HaGop chaiinos):
® T@KCT Ha pycckom A3bIKe;
® TeKCT Ha YKPAVHCKOM A3bIKe:
® pBygeo c cy6tuTpamu,
Nepvoguynocte u o6bem: exeqHesHoO (okono 200 wi. B MecaL)).
Npumep:
Ccbinka Ha MNNWcTpaunw:
Pyc.
AB caMoM ene — kak OHa NocMena Tak OTabIBATHCA O NIOAAX, KOTOPbIe BOOT 3a HAY
CTpaky, ake Ci MW TOBOpAT He Ha HalWweM AabIKe? Moxer, Torga v QoOpoBonbyes 13
Nonbuiv nv KonymOmn Tooke paccTpenatb — OHW 2K He CMMbHbI B Halle MoBe?
Vin, MO2XeT, EH CAMOM OTNPABNTECA Ha (PPOHT Vl NPOAeMOHCTpUpOBaTe CBOM repon3m?
ATo Mamy6okoro TbINa XOPOLUO TABKAT Ha TeX, KTO Bole!
Aa v Boobuye — 4T0 3a NPUTeCHEHMA BNNOTb AO TpeboBaHMi «yTMNM3MpoBsatby 7!
Heykenu 8 Hale CTpaHe MOKHO YHMYTOKATb NiOgel TONbKO 3a To, YTO OHM roBopaT
Ha «HENPaBUNbHOM> AsbIKe? MomeT, 4 KOHLUNArepA ANA HENPABMNbYbIX Cpaay
noctpontb? Kak HeMubI 80 ner Hasan?
YKp.
A chpagai - AK BOHa NOCMina TaK BIOCYKYBATMCA NpO Niger, AK BOWIOTe 3a HAWY
KOalHy. HaBITb AKLUO 1 He TOBOPATb HaWoK MoROIO? Moxe, Toni 11 2oHporonbuiB i
Donkwi uM Konym6ii Tex poscrpinaT — BOHM kK He CMMbH Y HAIN MOBI?
Yu, Moxe, lid Cami BMpyWuMTM Ha (bpouT i nponeMOHCTpyBAaTM CBM repolsM? A To 3
fn6oxoro Tuny 406pe rapKat Ha TMX, xTO Bowel
Ta. B3afani— uo 34 yTMCKH 20 BMMOr «yTHMNizyBatTh»?! Heexe 8 Halil KDalHi MoKA
SHALWYBATH NogeH NVWE 3a Te, LO BOHM TOBOPATh «HeNpaBMNbHOIO» MOBO? Moe,
KOHUTADOpM ANA HENPABMNbHMx Onpasy 3byqyBaTu? Ak Himui 80 poxis Tomy?
15
PDF Page 191
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 190 of 277
®a6puka MeMOB
KoHmenm
Memb! — tomopuctuyeckne u3z06paxeHus, Bugeo, ayguo3zannucn Cc BbICOKUM BUpanbHbIM
(BUpycHbIM) NOTeHUMaNoM, BbICMenBalo”Me aKTyaNbHble ANA yKpavHUeB TeMbI B paMKax
TEMATMYECKUX NUHUM NpoeKta. Oabpuka MeMoB NpovsBoOg_UT NoTOK vuso6paxeHni ana
AanbHenwero pacnpocTpaHeHua B COLMaNbHbIx CeTAx Facebook uv X (Twitter).
®opmat: uz06paxenna
Nepuoguynocts vu o6tem: exKeqHeBHO (okono 200 wiT. B Mecau).
*KOHT PECMEH
CLUA
Nnmepe:
i a
16
PDF Page 192
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 191 of 277
®a6pnka BuDZeOMeMOB
KoHmenm
Memb! — tomopuctnyeckve v3z06paxKeHua, BYgeO, ayAMOsanNvcu C BbICOKMM BUpanbHbiIM
(BUpycHbIM) NOTeHUVanoM, BbICMeMBaIOWMe aKTyaNbHble ANA yKpavHueB TeMbI B paMKax
TEMATUYECKMX NUK NpoeKkTa. Pabpuka MEMOB NPOU3SBOAMT NOTOK BEPTUKAaNbHbIX BUeO
ANA AanbHevwero pacnpoctpaHeHuA B COL|ManbHbIX ceTAx Facebook, Instagram nu X
(Twitter).
®opmat: Bugeosanncn AO 30 cek.
Nepwoguynocts uv o6bem: exegHeBHo (oKono 50 wT. B MeCAL).
CkpvHWoT n3 BHgeomema:
17
PDF Page 193
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 192 of 277
Kapnkatypbl
Koymeum
KapukaTypb! — ABTOpPCKve UNMOCTPaLMN C BBICOKMM BUpanbHbIM (BUPyCHbIM) NOTeHL|Manom,
BbICMeMBaIOLMe AKTyaNbHbIe GNA yKpavHUeB TeMbl, YKDAVHCKNX DOPKHOCTHbIX NM M
mupepoB B paMKax TemMaTMYeCKUX NUHMi MpoekTa. KapukaTypbl BbICTyNalOT UM Kak
CONPOBOANTeNbHbie UZ0OparKeHMA K CTATbAM VM MOCTA, VM KAK CAMOCTOSTENbHbIE EAVHULbI
KOHT@HTAa.
®Mopma+: vz06parKeHua.
NepvoguyHocts uv o6bem: ekeAHeBHO (oKONO 200 wT. B MecaAL).
Npumepsi:
18
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 198 of 277
TapreTwpoBaHHaa peknama
Alocmaexa kKOoHmeHMa
TapreTupoBaHHaaA peknama B COLiManbHoM ceTu Facebook HanpaBneHa Ha TOYeuHYy!O
AocTaBKy COoGueHNi K eneBon ayAuTopun MaTepuana.
Llenepan ayanTopua KaxKooro MaTepvana noA6upaetcA MHAMBMAYaNbHO UM 3aBUCHKT OT
Toro, KaKOW w3 rpynn HaceneHvA QaHHbId MaTepvan MOxKeT HaHecTnh HavnOonbwMn
nevxonormyeckni ypox. Llenepaa ayguTopnA MOxKeT paHknpoBaTbcA no reorpadun,
Aemorpaduyeckum npu3Hakam, xo66u vu MHTepecaM U T.Q.
TapreTupoBaHHad peknamMa B ColManbHOM ceTu Facebook no3BonxeT oTcnexkuBaTb
peakiiMn fMonb3oBpaTenew Ha pacmpocTpaHAembIi MaTepvan B pexuMe peanbHorO
BpeMeHM, HanpaBnATb B KOMMEHTapvu K pacnpocTpaHAeMbIM MaTepvanam rpynny
ncvxonormyueckoro pearnpoBaHua”, KOTOpan, C NOMOLIbIO CeTM GoTOB, MOgepupyeT TonoBbie
AMCKyCCMM, KOppeKTMpoBaTb AalbHeMwMe 3anyckM ucxOgA U3 Toro, KaKOM rpynne
ayouTopun 6bin HaHeECeH HavGonbluMi ypou.
Taioxe Ha OCHOBe aHanusa 3anycKOB peknaMb! BOSMOXKHO COCTABNATb KapTbl peaKLIVn
NOCpeACTBOM aHasiv3a KOMMeHTapnesB Nonb3oBaTesien, UX paHKUpOBaHHid U TeM, KOTOpbie
BbI3BanN Y HX HaNOONbUIM SMOLIMOHANbHbIN OTKIINK. GTO Ha€T BOSMOXKHOCTb COCTABNATb
rMOkve KapTb! peakunn, 6a30i/ ANA KOTOpPbIX ABNAIOTCA reHepaNnbHble TeMaTMYeCKKe NMHMN
V MOCTOAHHO MeHAIOLUAACA NOBECTKa B paMKax UX CMBICIIOBOrO HanosiHeHna.
@Popmat nposykta:
1) NOcTbI, uz06paxKeHna, vHcborpacbura,
2) noka3b! B pekname cOL|ManbHON ce™m Facebook.
Nepnognunoctp vn o6 bem: exegHeBHo. 1 000 000 noka3oB B MecaLl (ERR - 10%).
24
PDF Page 200
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 199 of 277
CetTb Telegram-KaHasioB
Hocmaexa kKoHmeHma
Ansa noBbIweHNVA BMMAHMA Ha BHYTPeHHIOIO $=NomMTMYeckyio nmoBecTky YkpanHbi
npegnaraetca cosqaTb ceTb Telegram-KaHanoB B cCoBoKynHocTM c Twitter u
Facebook/Instagram npeacTaBuTenbcTBaMn C MaKCMManbHO NOKANU3OBaHHbIM KOHTeHTOM
v Mgeonorven, He acbcbunupoBaHHbIMM C POCCMMCKMMM MCNONHMTeENAMM M PYCCKOA3bIMHbIM
KOHTeEHTOM. Ucnonb30BaHve MMeHHO Telegram-KaHanoB KaK NOKOMOTHBa NMpoeKTa
o6ycnosneuo Tem, 4YTO 3a nocnegHnkK roo yKpavHckas ayguTopus Telegram BbIpocna Ha
600%. Npw stom cnegyeT NOMHUTb, YTO Bpa@KECKMA CeEmMeHT MECTHbIX MONMYNAPHbIX
KaHanoB Ha4YvHan He C NONMTMYeCKMX TeM, a C pasBneKaTenbHbIx, 5 NeT Ha3saq AonaA
nonuTuyeckux KaHanos Ha YKpanHe G6bina HUYTOKHAa. U STO PbIBOK BO3MOXKHO NOBTOPUTb,
TONbKO B Hay CTOPOHy.
MpeanaraetcA co3sgaTb ceTb u3 20 TemaTMyeckwx LeneBbIx KaHanoB uu 10
BCNOMOTraTesIbHbIX KAHasIOB, HEOGXOAMMbIX OA packpyTKH M NosAep»kaHMA TemnoB Habopa
ayouTopuu npoexra. Tako mogxog nosBonuT AocTaTOYHO GbICTpO pa3BMTb YNcno
NOANMCHMKOB AO 3AMETHbIX 3HAYEHMM 3a CYET NEPEKPECTHbIX PENOcTOB MU copMMpoBaHMA
Pa3HOCTOpOHHerO Apa ayguTopun. Take sTOoT nogxog no3sBOnMT onepaTMBHO
agantMpoBaTb MpoekT Nog NOCTOAHHO U3MeHAIOWYIOCA noBecTKy 3a cYeT go6baBneHna
HOBbIX KaHAaNOB C akTyaNbHOW TeMaTHKOM MW SbicTporo Habopa ux ayguTopuM 3a CyHeT
nOsAepxKKM BCeHK CeTH.
B nogrotopke HanonHeHWA KOHTeHTa KaHanoB, OCOGeHHO Ha NepBbix nopax (OAMH-ABa
MecaALia), HeEO6xOAMMO NONHOCTbIO YT OT NpOoNaraHgbl, KAK HALWMOHAN-yKpanHCKON, Tak V
NpopoccuiicKoh, OTKA3SATbCA OT WITaMNOB, a BNUATb Ha MHeHve NopAgkom nogayn
vncbopmaunn. Ona onepaTMBHoro 3aHATWA TpeHAOB B TBMTTepe, GygeT HeoGxogumo
onepaTMBHO cO3qaBaTb NocTbl nog NONyNApHbie TeMbl 3A CHET XeLUTerOB,
VHOMBUgyanbHoro)=—s CTW Ss MOBECTBOBaHMA)=6M—SséBZAMMOAeNMcTBUA =CCTSCSSIOMaan.
@opMatT nposykta:
1) 20 TematTw4eckux weneBbIx uv 10 BCnOMOraTenbHbIX KaHanoB B_ Telegram;
2) ay6OnupyroujMe coo6uwecTBa B COLIManbHbIx ceTAx X (Twitter) wu Facebook;
3) OT 2 yo 4 ny6nuKkaynii B KaxKOM KaHane @)KEDHEBHO;
4) TapreTMpoBaHHaal peknama uv noceBbl.
Hlepwognynocth uv o6 bem: exKeqHeBHO Ao 4 ny6nuKaliMi B KaxKOOM KaHane.
KI13 npoekta: NporHos coBpokynHoro npupocra ayguTopun npoexra — 20 000 nognucunkoB
€)KEMECAYHO.
25
PDF Page 201
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 200 of 277
KoOMMeHTapmMn — AOCTaBKa B PpermoHbli
Hocmaeka KoHMmeHma
Ha OcHOBe aHanu3a KOMMeHTapMMHbIX TpeHAOB B PerMOHaNbHbIx COO6WWeECTBaX YKpaMHbI
npepnaraetca opraHn30BaTb LeneBoe pacnpoctpaHenve kKpeaTMBos mpoexta “[ocTaBka B
PerMOHb!"” B KOMMeHTAapMAX K MOCTaM B perMOHaNbHbIxX coobujecTBax WM B Onorax y
perMoHanbHbix JIOM.
e [ina kaxgon o6nactn co6vpaetca MequakapTa, cocToAujaA v3 50 coobwects,
AOCTOBEPHO MMelOLUMX aYANTOpHiO, NPMBASAHHYWO K KOHKpeTHON O6NacTu: ropo”ckne
na6nukn, MM4HbIe CTpaHVUbI pyKOBOACTBa permona, opyMb! No MHTepecam: CNOpT,
aBTo, xO66u H T.N.
e [nA Kakooro KpeaTwBa npopaGaTbiBaeTCA KOMMeHTapHii-nopBogKa, MMerOLMi
cneuncbuky, XapakTepHyl0 VMeHHO ANA sTOrO pervoHa. Tako nogxof, yBenuyuT
Aopepnve kK KpeaTMBy MV NOBbICMT ypOBeHb BOBMeYeHHOCTM ayAMTOpUN.
e KpeaTvBbl BMecTe CG KOMMeHTapveM-nofBOgKOn pacnpocTpaHAloTcA B
KOMMeHTapMAX K 3ancsim B COOBLIECTBe C UCnOMb3OBaHieM CeTM GOT-akkayHTOB.
@MopmatT npoyvykta:
1) KOMMeHTAPUN B permoHanbHbix coobiyecTBax YKpanHbl;
2) Uz06pakeHna, MEMbI M ApyrMe KpeaTMBbl.
NepvwognynHocts u o6bem: 50 000 KommeHTapues B 20 permoHax YKpauMHb! B MeCAL.
KN3 npoexta: oxeat 10 000 000 kacaHnii B Mecay, ERR — 4%.
26
PDF Page 202
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 201 of 277
EXHIBIT 7A
PDF Page 203
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 202 of 277
International Conflict Incitement
Project
Brief Description
The fighting in Ukraine and the "war of sanctions” led to a crisis in the economies of many
Western countries, the main blow fell on residents of the European countries, such as
Germany, France, Italy, and Great Britain.
Decreasing standards of living, new waves of refugees, rising energy prices and other
destabilizing factors have exacerbated dozens of "protracted" internal conflicts in the West,
and created new problems.
Among them are intensification of inter-ethnic and religious tensions, the intensification of
socio-economic protest, internal political struggle, deepening of contradictions between
allies in economic and military-political alliances (for example, the confrontation of the
GE government led by (aie, and the European bureaucracy, the
confrontation between the NATO members, Poland and Germany, on reparations, etc.).
The objective of the "International Conflict Incitement" project is to escalate internal
tensions in the countries allied with the United States in order to promote the interests of the
Russian Federation on the international arena.
To influence real-life conflicts and artificially create conflict situations, it is proposed to use
a wide range of information tools to influence public opinion.
Geography of the Project
—Germany;
—France.
PDF Page 204
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 203 of 277
Algorithm for Working with Real Conflicts
1.
Monitor media and social media daily to identify conflict situations.
Identify hotbeds of conflict and track how the conflict situation unfolds in a
structured way.
Operational analysis of the conflict situation:
- identify a conflict-generating factor, parties to the conflict, influencers, positions
and requirements of the parties;
- identify the type of conflict (social, economic, political, ethnic, religious, mixed
type, etc.);
- identify the scale of the conflict and the stage of escalation (local level, regional
level, national level, international level);
Forecasting how the conflict situation will develop in the future. Assessment of the
potential for using the conflict to implement Russia's foreign policy objectives.
Strategy selection for further work.
If necessary, an artificial shift in the rhetoric of the conflict is made in order to further
introduce/embed narratives that are beneficial to Russia (if the cause and rhetoric of
the conflict initially does not fit into any of the necessary narrative lines.)
Escalation of the conflict situation through the use of available tools (traffic
redirection, work with comments, work with influencers, analytical articles,
augmented reality, media mirror outlets, fakes, etc.) in order to destabilize the societal
situation.
Promotion of narrative lines beneficial to Russia, information support for the side of
the conflict whose position is more consistent with the interests of the Russian
Federation.
PDF Page 205
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 204 of 277
Algorithm for artificial generation of conflicts
1,
Monitoring and analysis of the media, social networks, the results of sociological
research to identify "pain points" and hotbeds of increased social and political tension.
Development of a conflict situation "scenario", narrative lines, a strategy of
misinformation and further "instigation" of the conflict using available means and
neutralization of counter-propaganda.
Preparation of content (videos, posts, comments, articles-revelations of "augmenting
reality", analytical materials, etc.).
Introduction of conflict themed content through predetermined channels (targeted or
mass).
Further stirring up the conflict and spreading additional false narratives.
Undermining counter-propaganda.
Analysis of the conflict development results for further use:
— the degree of information dissemination, the viral effect;
— dissemination channels effectiveness;
— number of views/engagement;
— audience's reaction on social media;
- reaction of influencers, authorities, and the media;
- counter-propaganda methods and their effectiveness;
- lifetime of an artificially generated conflict from the moment it is posted to the time
it's completely out of the agenda.
PDF Page 206
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 205 of 277
Tools
1. Creative means:
1) fake videos, documents, and telephone conversations recordings;
2) comments on social media:
3) news and pseudo-news;
4) analytical materials;
5) memes, caricatures, gifs;
6) “augmented reality” materials;
7) fake and real quotes from influencers;
8) songs, cartoons, and animation;
9) creating chats/groups to accumulate the number of participants in the conflict,
etc.
2. Delivery channels:
1) media mirrors outlets;
2) foreign and Russian influencers;
3) bots and work with comments;
4) groups on social media, Telegram channels;
5) YouTube and other video hosting sites, etc.
Examples of narrative lines
Thematic Direction 01: Our country must pursue its own national interests and make
decisions regardless of the influence of the United States / NATO / European Union / Anglo-
Saxons.
Thematic Direction 2: The root of the conflict lies in the influence of the United States /
NATO / European Union / Anglo-Saxons. It is these forces that benefit from destabilization
in our society to strengthen their control.
Thematic Direction 3: The government of our country should focus on solving internal
problems and not to direct resources to support the war in Ukraine.
PDF Page 207
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 206 of 277
Thematic Direction 4: In Russia, this conflict would be impossible, because there is a
healthy society in which the interests of the family and traditional values are protected (a
narrative line for conflicts is based on promoting the LGBTQ+ agenda.)
Thematic Direction 5: We are eaten out of our house and home and our last resources are
taken away from us. The Ukrainians (refugees) feast on food, our people are almost starving.
The diaspora dispute over resources comes at the expense of the country's indigenous
people.
Scenario examples
Germany
France
Inter-ethnic conflicts
Ukrainian refugees are constantly
expressing dissatisfaction with the
hosting arrangements in the country
and demanding more. Humiliating
texts (real and fake) written on
behalf of Ukrainian refugees are
being circulated on the internet. The
Germans enter into heated
discussions with the Ukrainians in
the comments, actively recalling
each other's past.
Multilateral conflict between Ukrainian refugees
and Armenian diaspora in France. The conflict
is provoked by fake "interviews” and “leaks” of
audio messages from private chats of Ukrainian
refugees in France, who rudely accuse the
Armenians of supporting Russia. Armenian-
language outlets react, the confrontation is
supported by "stirring up” the discussion by
bots in the comments.
Religious conflicts
A group of refugees from Ukraine,
neo-Nazis wearing balaclavas
holding knives and machine guns,
recorded a message to the
Germans. It accuses them of their
weakness and says that it will help
clear the Aryan land of the Muslims
and other garbage. The video is
distributed on the German-language
segment of Twitter and Facebook.
The French government has come under attack
from a number of Muslim religious activists.
They speak on behalf of immigrants from
Algeria and other African countries.
Accusations: rudely refused
to apologize to Algeria for colonial policy.
Instead of atonement for the sins of the past
and showing support for diasporas, the French
are sending funds to support the war in Ukraine
and accept refugees. In response, "the
Ukrainians"-bots massively insult Muslims.
Internal political
conflicts
After the staging of the "coup
d'état", the German government
essentially switched to a quiet
repression of the AfD. Using all
tools, we support the party by
creating the image of martyrs
suffering for democracy and
Germany’s national interests.
Almost 70% of French residents who were
surveyed oppose raising the retirement age
initiated by SeeTKSL Teen, We identify all
criticizing publications related to the reform and
provide them with additional traffic. Also, a
number of analytical posts on mirror media
outlets link raising the retirement age with the
crisis caused by anti-Russian sanctions.
International conflicts
Poland continues to demand
reparations from Germany for World
War Ii. Using all the tools, we
promote the theory that the Poles
are acting on the direct orders of the
United States in order to once again
humiliate Germany and tie her
hands on the international arena.
An article comes out in the Armenian-language
press accusing France of helping Ukraine
instead of helping Armenia that suffers. The
article gets into the French-speaking segment,
we provoke and stir up the public discussion in
every possible way.
PDF Page 208
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 207 of 277
Economic/
socio-economic
conflicts
There are clashes between eco-
activists, who blocked access to the
village of Lutzerath amid protests
against coal mining, and the police.
We promote the narrative in the
media mirror outlets’ comments and
articles sections that a return to coal
mining is the result of refusing to
buy Russian gas.
In the north of France, doctors go on a strike.
They demand higher salaries and hiring more
staff. We create a closed channel for doctors
who are fighting for their rights and carefully
promote the narrative that the crisis in medical
field is caused by anti-Russian sanctions.
Similar groups can be created for different
regions of the country.
PDF Page 209
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 208 of 277
EXHIBIT 7B
PDF Page 210
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 209 of 277
MexkayHaponHaar KOHdNuKTonorma
Ipoexm
KpaTKoe onvucaHne
Boespie QevctBna Ha YKpante Vv “BoMHa CaHKuMn” NpuBenn K Kpv3vcy B SKOHOMUKe MHOrMx
CTpaHax Sanayja, OCHOBHOU yap npulwenca Ha KUTeENenW EBponencKux CTpaH — [epmaHnu,
MpaHunny, Utanuu, Benuxo6putanun.
Nagexnne YPOBHA XKU3HM, HOBbIE BOSIHbI 6e.KeHUeB, POCT LIEH Ha SHEPrOHOCNTeNn vw OpyrmMe
Aectabunv3upyiouwme cdakropbi oboctpynu aecATKA “3acTapenbIx” BHYTPeHHUX
KOHcpnuKToB 3anaza, a TawKe co3gqanu HoBbIe Npoonembi.
Cpegn Hux: yCUNeHve MeXSITHUYECKOU MW PeNVrMO3HOM HaANpAXKeHHOCTH, ycuneHve
COLMaNbHO-SKOHOMMYECKOrO §=npoTecta, BHyTpu“nonuTMYecKoN Gopbbpi, yrnyOnenne
NPOTMBOPeYU MeXxAY COIO3HVKAMM MO SKOHOMUYECKMM V BOCHHO-NONMTMYeCKUM GnoKaM
ns as
eBpoGiopoxpatuen, npoTuBoctosHve YneHoB HATO Monmbuwu vu Tepmaxuu no Bonpocam
penapaunn uv ap.).
3agaya npoexta “MexgyHapogHan koHdpnukTONorMA” — asckanalvA BHYyTpeHHen
Hanps»xKeHHOCTH Ha TeppviTOpMN CTpaH-colo3sHukoB CLUA B enax npoABWrKeHNA MHTeEpecoB
Poccuickon Penepaluu Ha MeKDYHApOAHON apere.
fina Bo3sgeicTBMA Ha PpeanbHO CYLIECTBYIOLW\Me KOHNMKTbI MW UCKYCCTBEHHOrO
(OPMMPOBaHVA KOHCNUKTHbIX CUTYAUM NpeANaraeTcA UCNONb3OBaTb WMPOKMM CcneKTp
WH@OPMaLIMOHHbIX VHCTPYMEHTOB BOSLeVCTBMA Ha OGLUECTBEHHOe MHEHHe.
Teorpacbus npoexta
— Tepmauna;
—Opauuna.
PDF Page 211
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 210 of 277
AnroputMm pa6orTbi c peanbHbIMv KOHCPNUKTaMNM
1.
EKeQHeEBHBIN MOHMTOpUHT CMV v couManbHblx ceTei, HanpaBneHHbiii Ha
BbIABNEHMe KOHCDNMKTHbIX CUTYAaLUH.
BpissneHue ouaroB KOHCPNUKTOB C fanbHeVWeM CUCTeMaTM3MpOBaHHbIM
OTCNEKNBAHVeEM QUHAaMUKM PasBUTMA KOHCDNMKTHOU CuTyauMn.
OnepatuBHbli avanu3 KOHCNUKTHON cuTyauuUn:
— BbIABNEHNA KOH@NUKTOFeHHOrO ChakTOpa, CTOPOH KOHNMKTAa, NuDepoB MHeHU,
no3vuvni v TpeGoBaHMn CTOPOH;
— onpegeneHne Buga KOHdpnuKTa (COuManbHbIN, SKOHOMMYECKMK, NONUTMYeCKU,
STHMYECKM, PENMMO3HbIN, CMELUA@HHbIM VM T.Z.);
— onpegeneHve macuita6a KOHCcpnukTa uM CTaguu sckanaunnu (NoKaNnbHbIn ypOBeHb,
PerMoOHaNbHbI YPOBEHb, OOLEHAL|IMOHANbHbIN YPOBEHb, Me>*KOYHAPOAHbIi
YPOBeHb);
MporHo3smpoBaHve AanbHeiwero xofa pasBUTMA KOHCDNMKTHOK cuTyayun.
Onpefeneuve noTeHumana ucnonb30BaHua KOHCpnuKTa ANA peanusaunn
BHeEWHENONMTMYeCKMXx 3agay Poccun. U3s6panue crpatermn fanbHevwen paboTrl.
B cnyyae Heo6xoMUMocTH NpoUsBOAMTCA ViCKYCCTBEHHOe CMELIEHMe PUTOPUKU
KOHCNUKTa C LeNbiO AanbHevwwWero BHEAPeEHMA HappaTUBOB, BbITODHbIX Poccun
(ecnv npuuuHa W puTopuka KOHCpNMKTa USHA4aNbHO He yKnagbIBaeTCA HV B OfHy v3
HEOGXOAMMbIX HAPpaTVBHbIX NUH).
OcKanalvA KOHCNUKTHOM CuTyalivn Yepe3 npPuMeHeHMe AOCTyNHOro
UHCTpyMeHTapua (nepeHanpaBneHnue Tpaduka, pabota c KOMMeHTapuaMy, paboTa
c OMamny, akanutuyeckne cTaTbu, GONONHeEHHaA peanbHocTb, CMM-3epkana,
cbeviku v T..) B UeNAX gectabunusaynn O6ujecTBeEHHOM O6cTAaHOBKNH.
NMpogswxKeHve BbIrOgHbIX ANA Poccuu HappaTMBHbIX NMHMN, VH*OpMaL|MOHHaA
NOAAepxka TOU CTOPOHbI KOHdNuKTA, YbA NOBMYMA GONee COOTBETCTBYET
vHTepecam P®.
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 215 of 277
EXHIBIT 8A
PDF Page 217
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 216 of 277
The Good Old USA (“Good Old USA”) Project
EM introduction
The current international environment is known for, first and foremost, severe hostility of
the US towards Russia. The USA has been trying to maintain “the global leadership”
by strategically defeating Russia. This desire shapes the financial investment,
weapons supply, and efforts to keep the conflict in Ukraine going.
In the meantime, the key question of the US domestic policy remains the same: how
justified are these efforts? The further we go, the more politicians state that the US
should target their effort towards addressing its domestic issues instead of wasting
money in Ukraine and other "problem" regions.
This sentiment has become the centerpiece for the US 2024 presidential election
campaign. While SRSHimeliifes\Mstelasas) are still in power, they are trying to maintain the
current foreign policy priorities. URSHEMeN(CESETWAEN, still in opposition, have been
criticizing these priorities.
It makes sense for Russia to put a maximum effort to ensure that the
point of view (first and foremost, the opinion of supporters) wins
over the US public opinion. This includes provisions on peace in Ukraine in exchange
for territories, the need to focus on the problems of the US economy, returning troops
home from all over the world, etc.
Public opinion polling results in the US indicate that the politics which we consider correct
has a real chance to get approval of the majority of the US voters.
It should be noted, though, that currently there is a real chance to steer the US public
opinion in the right direction by using such tools as enhancing awareness among
Internet users.
PA Goals and objectives
re 7
~
a Goal
To secure victory of a URSHxeliiterImm-lism@aecandidate (Seigelferiewzgor one of his current
internal party opponents) at the US Presidential elections to be held in November of
2024.
ns |
PDF Page 218
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 217 of 277
E3] Objectives (by the November 2024 election)
e To increase the percentage of Americans who believe that the US "has been doing
way too much to support Ukraine" to 51% (as of 11/02/2023 such index was 41%,
according to Gallup).
e To increase the percentage of Americans who believe that the war is to be ended as
soon as possible, even at the cost of territorial concessions on the part of Ukraine, to
53% (as of 11/02/2023 such index was 43%, according to Gallup).
e To bring confidence rating down to the minimal level of 29% (as of
11/19/2023 this rating was 39%, based on CNN's "poll of polls”).
v3 Target Audiences
e Residents of “swing” states whose voting results impact the outcomes of the elections
more than other states. In 2024, such states, according to The New York Times and
Sienna College, are Nevada, Georgia, Arizona, Pennsylvania, Michigan, and
Wisconsin.
e Residents of conservative states where traditional values are strong who more often
vote for candidates of the URSHzelitecmecuNan Alabama, Kansas, Texas, Wyoming,
Louisiana, etc.
e US citizens of Hispanic descent.
e American Jews.
e Community of American gamers, users of Reddif and image boards, such as 4chan
(the "backbone" of the right-wing trends in the US segment of the Internet).
PDF Page 219
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 218 of 277
Ex Channels of Influence
We intend to use Facebook and Instagram, as well as YouTube, X (Twitter) and Reddit
— the resources free from "democratic censorship" — as the main channels to influence
the target audience of the project.
EW Project's Toolkit
2) Go CETAEW, Go! YouTube Channe!
A YouTube Channel that accumulates pro- video content as well as
news topics of international media, and presents them in compliance with the goals and
objectives of the project. The toolkit will include videotape editing, subtitles, re-dubbing of
the video clips, and, in a limited number of cases, augmented reality. The channel will have
extensive viral content — music, humor, beautiful girls, etc.
As a result of the continuous mentioning of media personas on the channel
la) etc.) and the names of known organizations,
as well as the focus on the viral content, in as little as three months, search engine indexing
U.S. Person 3, Candidate
mechanisms will start generating links to the “US Elections” themed channel on the first
pages of the search results.
Eel OR iicclem lias Values Supporters Groups
The objective is to create on Facebook, Reddit, and X (Twitter) and actively promote for at
least five months a network of communities uniting citizens sharing WASHRMeiier ar laaee
= values and fans of certain famous people. These could be called, for example,
“Alabama for America the Great"; "Go GRS#igcisvelame. go!", "VVhat did Sse
etc.
Same say”,
Because the groups don't initially position themselves as political communities, they may
act as lending outlets for targeted ad channels for the project narratives distribution without
attracting immediate attention of the social media outlets’ administration, and would be
able to accumulate a critical number of viewers.
EX] "News of Our State" "Sleeper" Groups
The objective is to create and for at least five months moderately promote news groups in
“swing” states through Facebook, Reddit and X (Twitter) — a total of 18 communities, one
PDF Page 220
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 219 of 277
community per media outlet in six states: Nevada, Georgia, Arizona, Pennsylvania,
Michigan, and Wisconsin.
While in a “sleeping” state, communities attract an audience through targeted advertising,
planting, and organic reaches. At the right moment, “upon gaining momentum’, these
communities become an important instrument of influencing the public opinion in critically
important states and portals used by the Russian side fo distribute bogus stories disguised
as newsworthy events.
Commentary Campaign
Mass distribution of text comments and memes in Facebook and X (Twitter) discussion
threads.
Work with comments assumes not only the spread of false reworked project narratives
supported by facts, but also targeted social engineering based on information trends and
users’ emotional attitude towards them. To achieve that we need to analyze users’
behavioral patterns.
The behavioral pattern is an unusual reaction of users that allows one fo identify narratives
that enjoy the most significant support in Ukrainian society over a measured period of time
and directly impact public opinion. Behavioral patterns form the basis of the comments-
related work, enhancing its flexibility and mobility.
Targeted Advertising
Targeted advertising in Facebook and Instagram is intended for the targeted delivery of
messages to the material's target audience.
The target audience of each material is selected for each individual message. The
parameters depend on which group may be the most psychologically affected by this
material. The target audience can be formed based on the location, gender, age, hobbies
and interests, etc.
Targeted advertising in Facebook allows tracking reactions of users fo the distributed
material in real time and directing the psychological response group to contribute to
comments thereof. With the help of a network of bots the psychological response group
moderates top discussions and adjusts further launches depending on which group was
affected the most.
Work with Influencers
PDF Page 221
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 220 of 277
Work with influencers among proponents of traditional values who stand up for ending the
war in Ukraine and peaceful relations between the US and Russia and who are ready to
get involved in the promotion of the project narratives. Among them are actors, politicians,
experts in different areas, media representatives, social organizations' activists and
clergymen, etc.
Possible interaction format: rollout of real comments by influencers, participation in shows,
preparation of special materials, etc.
PDF Page 222
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 221 of 277
EXHIBIT 8B
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 224 of 277
B kayeCTBe OCHOBHbIX KaHanoB BO3gevCcTBUA Ha ayguTOpuN NpoekTa npeANaraetca
VCnONb30BaTb COL|ManbHble ceTH Facebook u Instagram, a TaloKe pecypcbl, ANA KOTOPbIX
XapaKTePHO OTCYTCTBHe “HeMOKpaTUYeCKON LeH3ypb!": YouTube, X (Twitter), Reddit.
EW Unctpymentapui npoexta
Pee VaiiTik ‘a “co "Li
Pmne (OlUll UDe-Kakhan om go
YouTube-kaHan, akkymynupyiowwwn npg evgeoKoHTeHT, a TalKe
HOBOCTHbIe ClO)KeTbI MMpOoBbIx CMV, vu nogaujMi ux B COOTBeETCTBMM C LIENAMM i
3agayamu nmpoekta. Vicnonb3yioTcA npvemb! BMGeOMOHTaxKa, cyOTMTpMpoBaHve,
nNepeosByYVBaHve PONMKOB, B OFPAHVYeEHHbIX CNyYaAX — MONONHEHHAA peanbHocTb. Ha
KaHane npegnonaraeTcA MHOrO BUMpanbHOrO KOHTeHTa — MY3bIKa, IOMOP, KpPacuBble
AeBYWKY H T.Q.
3a cyém nocmosHHozo ynomuHaHuA Ha KaHane meduliHbix cueyp ae
EE 8 7.0.), HaseaHud uzeecmupix opeanusayuii u ynopa Ha
6upanbubii KOHMeHM, MeXAHU3MbI UHOeKCauUU MOoUuCcKOebIX Cucmem yxKe Yepe3s mpu
mecaua HayHyM Bbi0aeamb CCbINKU Ha KaHan mo mMemMamuke cnekmpa “ebi6opbi e CLA"
Ha Mepebix CmMpaHuuax noucka.
5 Fpynne) cropownixoe EE yernocrer
Co3fauve B COL\ManbHbIx ceTAax Facebook, Reddit u X (Twitter) u axruBHaa (He meHee 5
MeCALIeB) packpyTkKa ceTM coobulecTB, OObeAMHAIOLUMX rpaxKqaH, pa3sqenstouux
uenHocty ( naptuv CLA, a TaoKe cbaHaTos KOHKpeTHbIX U3BECTHIX
nrogei. Mpumeppsi HasBannn: “Ana6ama 3a Benukyto Amepuky”, a. o«ru!”, “Uo ckasan
3a cyem mozo, ymMo 2pynnbi U3HaYasIbHO He NOZUWUOHUPy!OM cebsA Kak NonumMuYecKuUe
coo6bwecmea, OHU MOzym ebicmynamb NeHOuH2amu OA Map2zemupoeaHHou peKnambl u
KaHanaMu pacnpocmpaHeHuA Happamueoe npoeKma, Komopbie He cpa3y mpueneKkym
@HUMAaHUe aOMUHUCMpauuU COouUanbHbIx cemeli U CMo2zym Ha6bpamb “KpumuyecKyo”
maccy ayoumopuu.
i ie a) tig ahed gS eres de ii, eT setihior testes!
PDF Page 226
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 225 of 277
Co3ganHne B cOlManbHbIx ceTAx Facebook, Reddit u X (Twitter) u ymepeHHas (He MeHee
5 MecaAueB) packpyTKa CeTM HOBOCTHbIX rpynn B “COMHeBaloLuMxca” LuTaTax. Bcero 18
COO6LUECTB M3 pacyeTa No OAHOMYy COOGLUeCTBY B KaxKgOK M3 TPEX COLMASIbHbIX CeTen B 6
wtatax: Hepaga, Lpxoppkna, Apn3ona, NexcunbBaHna, Mnunran uv BuckoHCnH
B “cnawem” cocmofHuu cooéujecmea Habupaiom aydumoputo Cc MOMOLIbIO
mapzemupoeaHHou pekambi, noceeoe u opeaHuyecKuX oxeamos. B HyxKHbIi MOMeHM,
“Ha6pae eec’, coo6tuecmea cmaHoeaAMcA @axKHbIM UHCMpyMeHMOM eBo3delticmeuA Ha
o6wecmeeHHoe MHeHUe 6 KODUMUYECKU BaxKHbIX WMamax, a Maioke MoYKOU e6poca
@bIZOOHbIX poccuulicKol’ CMOpoHe UHQOPMauUOHHBIX M0e0008e.
KOMM@HTapulinan MawiMHa
Maccospoe pacnpocTpaHeHie TeKCTOBbIX KOMMeHTapieB VM MEMOB B BETKaXx O6cyKTeHMK
B COMMANbHbIX CeTAX Facebook u X (Twitter).
Pa6OoTa c KOMMeHTapMAMH NpepnonaraeT He ToNbkO BOpoc nepepaboTaHHbix HappaTMBoB
npoekta, NOAKpenMeHHbIX chakTamu, HO M BbINOMHeHMe TONeYHbIX NCMXONOMYeCKUX aTAaK
Ha OCHOBe UHCOpMaLIMOHHbIX TPEHAOB VU SMOL|MOHASIbHOFO OTHOLUEGHNA NONb3oBaTenen K
HMM. Jina s3Toro npoBogsutcA padoTta no aHanu3sy noBeseHyeckux Mmosenen
nonbsopatenen.
Floeedenyeckan Modenb — 3mo HecmaHdapmHaA peakuuA Nonbsoeameneu, Komopaa
noseonsem ebifeumb Happamuebl, KOMOopbie uMelom @ YkKPauHCKOM obuecmee
Haubonbulyto noddepxKKy 3a U3MepAeMBI Mepuod epemeHu U HanpsAMyto efustiom Ha
qopmMupoeanue o6uyecmeenHo2o MHeHusa. Mloeedenyeckue MoOenu NoKamcA @ OCHOey
KOMMeHMmaputnol pabombl, yeenuyuean ee 2u6Kocmb u MOOunbHOCMmb.
TapreTMpoBaHHan pexnama
TapreTupoBaHHanr peknama B COWWanbHbIX ceTax Facebook u Instagram HanpasBneHa Ha
appecuyto AOcTaBky COOGLeHM K WeneBou ayguTopnn MaTepnania.
UenesavA ayguTopuA Ka@kKgoro matTepvana nog6upaeTcA nog kaKgoe oTfenbHoe
coo6wenne. Mapametpbi 3aBncaTt OT Toro, Ha Kakyt0 M3 rpynn AaHHbIN MaTepnan MOxKeT
OKa3aTb HavOonblWee nchxonormyeckoe BosfehcTBNe. LleneBaA ayguTOpuA MoxKeT
chopmnpoBatbcaA no KaTeropnAM MeCTONONOKeEHMA, NONOBOSPACTHbIM XapakKTeEPMCTHKaM,
xo66n uM MHTepecam 4 T.g.
TapezemupoeaHHan pexriama @ couuanbHoull cemu Facebook no3eonsem omcriexkueamb
peakuuu nonb3s0eameneu Ha pacnpocmpanaempit Mamepuasl & pex*xuMe peasbHozo
PDF Page 227
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 226 of 277
epeMeHu, Hanpasnamb @ KOMMeHMapuU K pacnpocmpaHAeMbIM Mamepuanam epynny
meuxonoeuyeckozéo peaeupoeaHun. C momoujbio cemu 6bomoe oHa modepupyem
monoebie Ouckyccuu, KoppeKmupyem OafbHetiue 3anycku UCXOOA U3 MOzO, Ha Kaky1o
epynny 6bINo OkazaHo Haubosbwee Bo3deticmeue.
Pa6ota c JIOM u3 cpegb! CTOPOHHMKOB TpagNUMOHHbIX UEHHOCTeN, BbICTYNarOLUMX 3a
NpekpaljeHve BOMHbI Ha YKpante M MUpHble OTHOLWeEHKMA CLUA u Poccun, KoTOpbie roTOBbI
BKMIONMTBCA B NpOABMxKeHMe HappaTuBoB npoekTa. Cpegn Hux: aKTepbl, NONMTHKM,
OKCNepTb! B pa3HbIx oGnacTax, npegctaBuTenu mMegua, aKTMBMCTb! OGLECTBEHHbIX
opraHn3auni, PenuruosHble AeATenM UM T.4.
BeposTHble cbopMaTbl B3avmogelicTBua: THupaxknpoBaHve peanbHbiIx KOMMeHTapveB
JIOM, yyactve B Woy, nog”roTosKa cneLiMaTepuanos U T.g.
PDF Page 228
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 227 of 277
EXHIBIT 9A
PDF Page 229
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 228 of 277
Guerrilla Media Campaign in the United States
EMintroduction
The information situation in the United States differs dramatically from that in all other
Western countries. The key to this situation is the high level of polarization of American
society which is split between supporters of the and
fA parties. We believe that supporters of the are left-wing and far-left
globalists who advocate for perversion of traditional moral and religious values, while
supporters of the are normal people whose priority is to preserve
traditions of the American way of life. It is important that " URSMifantierimeeisme: are also
people of color and supporters of “affirmative action" and "reverse discrimination’, i.e.
infringement on the rights of the white population of the United States, while ‘URSaixveiues!
(EG are the victims of discrimination by people of color. '
Moreover, although the @£yglelfeFE\ees) is an appointee of the most numerous and influential
group in the leadership of the SRSiistellit(erIme-lasas), he currently enjoys the approval of less
than 40% of citizens of the US. It is also important that @EigeicEneEs) likely rival in the next
election, GEieitElem@s, is popular among the USHIRPIierIeelsaes, primarily poor whites.
However, he is not popular with the leadership of the [URS aiate)fitfer-|ee- las.
None of the significant American politicians, including those significantly opposed to the
incumbent president, can be considered pro-Russian or pro-Putin. However, there is a
widespread opinion among that and his government are
spending too much money on foreign policy, on confrontation with Russia and on “Lend-
Lease” to Ukraine. This is at the time when the United States is suffering from rising prices,
primarily for gasoline, historically high inflation and the actual impoverishment of white
taxpayers, a significant part of the middle class. Under these circumstances, the recipients
of public assistance, unemployed people of color and residents of large cities end up being
privileged groups of the population.
A key characteristic of the American media is its skew towards the USHmsdeliiter|Mat-lasva=)
influence. While society is split between supporters of the "new globalist socialism" and
supporters of traditional values, between a donkey and an elephant is roughly equal, the
media is " (ORSHistellifer-\mer-lusmee by over 75%. The situation for URSHEstellider-|ier-lasmea' iS
made complicated by the censorship on social media and \URSisfeliitfer-|iee-lasm=m-Oriented
"new media”.
ee
e
—
Page 2 of 5
PDF Page 230
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 229 of 277
PAContent of the campaign
We would like to reiterate that in the United States there are no pro-Russian and/or pro-Putin
mainstream politicians or sufficiently large numbers of influencers and voters. There is no
point of justifying Russia and no one to justify it to. All American politicians and influencers
are patriots and supporters of American supremacy. However, there is a feeling among the
that the president's policies, censorship on social media and the
policies of the government are encroaching on their rights. They are
dissatisfied of dramatic decline in the standard of living and large expenditures on offensive
policy of the United States in Europe and Ukraine. They are afraid of losing the American
way of life and the "American dream.” It is these sentiments that should be exploited in the
course of an information campaign in / for the United States.
Campaign Topics
p
1. Encroaching universal poverty. Record inflation. Halting of economic growth.
Unaffordable prices for food and essential goods;
2. Risk of job loss for white Americans;
3. Privileges for people of color, perverts, and disabled;
4. Constant lies of the URSwiefelliites!M=eianme) administration about the real situation in
the country;
5. Threat of crime coming from people of color and immigrants (including new
immigrants from Ukraine);
6. Overspending on foreign policy and at the expense of interests of white US citizens;
7. Constant lies to the voters by URSHixe)iitle=lMetlivas) in power;
8. Last but not least - America is suffering a defeat despite @EfgeleEica=) efforts. We
are being drawn into the war. Our guys will die in Ukraine.
FSTarget audience of the campaign
1. WS eteliivers eels voters:
2. (CeElmMeieEV-¥A\ supporters;
3. Supporters of traditional family values;
4. White Americans, representing the lower-middle and middle class.
PDF Page 231
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 230 of 277
EiDissemination of information
Itis obvious that essentially only social media can function as sources of information. At the
same time, the uncensored dissemination, apparently, is possible only on @EYNeIseen. fii
On Facebook, Twitter
and YouTube we need to create multiple "perishable" accounts, primarily for the work with
comments. Websites (landing pages) should serve as the sources of information for
dissemination and for video content--YouTube accounts with a relatively small number of
subscribers and commentators (usually, you get banned after reaching the level of 100
thousand subscribers).
ithe list of informational products to be disseminated
1. Texts of posts;
2. Comments on social networks and local group chats;
3. “Memes”, including caricatures and collages;
4. Video content, including news stories in the Fox News style.
AOrganization of work
In order for this work to be effective we propose to create a project office (editorial office of
the media campaign), consisting of three main segments:
1. Monitoring of US media and social media accounts of major
politicians. Topics and events from the segment’s product shall be selected daily to
generate content;
2. "Text factory" with minimum output of 4-5 main topic-based recommendations, 8-10
basic posts on social media, 40-60 comments for dissemination and taking in;
3. Manga editorial office with a daily output of 3-4 “pictures”, memes, etc.
4. Video editorial office with a daily output of 3-4 video materials per day.
In order for this work to be effective, you need to use a minimum of fake news and a
maximum of realistic information. At the same time, you should continuously repeat that this
is what is really happening, but the official media will never tell you about it or show it to you.
Page 4 of 5
PDF Page 232
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 231 of 277
E§Publication Sample for Dissemination
Speech of a
congressman
Congressperson 1
against allocation of 40
billion dollars to Ukraine.
Attached text: an
endangered breed of
politician - for some
reason he tells the truth
and operates with a kind
of strange concept -
Homeland.
is one of the few
congressmen who voted against the bill on
the supply of weapons to Ukraine under
Lend-Lease.
Coes is one of the few congressmen who voted against the bill on the supply
of weapons to Ukraine under Lend-Lease.
"| want to warn all of you about Washington's dangerous bipartisan pursuit of the war with
Russia. We, like sleepwalkers, entering into the war, and the American people remain in the
dark of ignorance. Last night, the House of Representatives approved the allocation of 40
billion dollars to Ukraine, while American families have to do without baby food. For
comparison, in this context, budget provides for the allocation of only 15.3
billion dollars for states’ customs and border control. Apparently, Ukraine is more than twice
as important to him as our Homeland."
seo
o
:
Page 5 of 5
PDF Page 233
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 232 of 277
EXHIBIT 9B
PDF Page 234
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 233 of 277
lMlapTusaHckan Megva KamnaHnua B CLUA
9) Beoguaa undhopmayna
UxcbopmalvouHHaa cutTyayua B CLUA pesko oTnmuaeTCA OT TAKOBOM BO BCEX OCTAsIbHbIXx
cTpaHax 3anafa. Knoyepan xapakTepvcTMKa 9TOM CHTyalIMN - BbICOKMM ypoBeHb
nonapwzauvu aMepMKaHcKoro O6WjecTBa, packONOTOrO Me@KAY CTOPOHHMKaMU
» Rapti. Opn st0 croponnnkn RR, c
Hallie CTOUKM 3peHMA, ABNALOTCA NeBbIMM MM KpaiiHe NeBbIMM rno6anucTaMmy, a TakxKe
BbICTYMaloT 3a V3Bpall|eHve TpagAMUMOHHbIX MOpasIbHbIX VM PeNUMMO3HbIX LIEHHOCTeM, B TO
BpeMA Kak CTOPOHHMKy i, — HOpManbHble m10Q), BbICTynalouyne, npexye
BCero, 3a COXpaHeHve TpagAMuMi amMepuKaHckoro o6paga »«u3HU. HemManoBaKHO, YTO
)tawoxe - ypetubie uv cTopoHHnKn «no3svTMBHOM AVCKPAMMHAyMY»
«O6paTHOM AVCKPMMVHaUWM», TO eCTb yuleMneHvA NpaB 6enoro HaceneHuA CLUA, a
- KEPTBbI AMCKPUMMHAaLIMH CO CTOPOHb! LIBETHbIX.
ABNAeTCA CTaBMeHHVKOM Hav6onee MHOrOUNCcHeHHOM MM BNMATeNnbHOM rpynnbi B
pyxosonctse J GR, 5 xactosuee spema on monbayetca
ofo6peHveM MeHbLUMHCTBa U36upaTenei — no NocnepAHMM AaHHbIM MeHee 40% rparxkfaH
CWA. Taioke HeManoBakHo, 4TO o¥eBMAHbIN conepHuk SR xa cnenyounx
Bbi6opax (I nonbsyetca nonynapHoctblo cpean , Npexne
BCero 6efHbIX GenbIx, HO He CpeAN pyKOBo”CTBa
Hukoro M3 3HaYMMbIX AMEPKAaHCKHX NONMTHKOB, B TOM YMC pesKO ONMOSML|MOHHbIX NO
OTHOWeHMIO K AevCTByIOWeMy MpesMAeHTy HeNb3A CUNTaTb Npopoccniickum un
nponyTMHcKuo. OgHako cpean pacnpocTpaHeHo MHeHve, uTO fe 1
ero MpaByTenbCTBO TpaTAT CNMWKOM MHOrO fever Ha BHEWHIOIO NONMTHKy, Ha
NpoTMBOcTosHne c Poccnei uv Ha «NeHAZ-1M3» YKpanHe, B TO BpeMA Kak Cam LLITaTbI
CTpagatoT OT pocta WeH, Npexkfe BCero Ha 6eHSMH, UCTOPMYeCKU BbICOKOM MHA
akTu4eckoro OGHMLaHMA =SHAYWTeNbHOM YaCTM cpefHero KMacca - Genbix
HanoronnatenbuyMKoB. MpwennermpoBaHHoi rpynnom HaceneHua B 9THX ycnoBMAX
OKasbIBaloTCA MonyYaTenv colManbHo NoMOWM, UBeTHbIe 6espa6oTHbie >KMTeNM
KpyNHbIx ropofos.
Knto¥eBOM XapaKTepMCTMKOM AMePMKAHCKMX Mega ABNAeTCA NepeKoc B CTOPOHYy
envusHva (. Ecnv o6ujectso pasgeneHo Mexkay CTOpoHHMKamM «HoBoro
rno6anuctcKoro cOl|Manu3sMa» M CTOPOHHUKAaMM TPafMLIMOHHbIX LeHHOCTeM, MexKaY
OCNIOM M CNOHOM NpyiMepHo noniona, To Meqva ABNAIOTCA i Conee
4YeM Ha 75%. Cutyauma ana OCNO*KHEHA LIEH3YPONM B COL|MasIbHbIX CeTAX
VW «HOBbIX MeQua», OPHEHTMPOBAaHHbIXx Ha ;
PDF Page 235
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 234 of 277
P) Cogep»kanve Kamnannn
NogyuepkHem ewe paz: HAKaKUX NpopoccuiicKux W/MNM NpPOMyTMHCKMX MeAHCTPUMHbIX
NONUTUKOB VM CKONbKO-HM6yfb 6onbworo YNcna Takux JIOM u u3s6upatenen B CLUA Her.
floKa3biBaTb NpaBoTy Poccun GeccmbicneHHO MW HeEKOMY. Bce aMepviKaHCKNe NOMMTMKU
JIOM — natpvotbi vw CTOPOHHMKM amepHiKaHCKoro npeBocxo”cTBa. Ho ecTb OlWyujeHne
EE. |70 oF yujemnent! nonutuKoi npesn~eHTa, YeH3ypoi B COMMANbHEIX
cetax, nonvtvkoii i) npasvtenbctsa. Ectb HeqoBonbcTBo pe3skvM
CHVDKEHMEM YPOBHA >DKV3HM WM GOONbLIMMM pacxofamMuM Ha HacTyNaTebHytO NoNMTMKy
LUtatos B Espone vu Ha YKpanHe. EcTb cTpax noTepATb amepnkKaHCKni O6pa3 *KU3HM M
«AMe@PUKaHCKylO MeUTy». AMeHHO 9TM HaCTpOeHMA CNepyeT SKCNNyaTMpOBaTb B xoge
VHOpMalMoOHHON Kamnadun B/AnA CLUA.
3) Temp kamnannu
1. Hactynatowan psceobuwjan 6enHocTb. PekopgHaa wHdnAuMA; ocTaHoBKa
SKOHOMUYECKOTO POCTa; HEBO3MO)KHbIE LIEHbI Ha NPOAYKTbI NUTAHMA VW TOBapbI
nepBon Heo6xogqumoctn;
2. Puck notepn pa6orTbi AnA 6enbIx aMepvKaHLEB;
3. Mpveuneruuv Ana UBeTHbIX, MSBPaleHUeB UW VHBanMoB;
4. Noctostas 10>kb i 24MvHicTpaunn o peanbHom nonoxKeHMN B
cTpane;
5. KpMMMHanbHad ONACHOCTb CO CTOPOHb! LBETHbIX W MMMMrpaHToB (B TOM YncNe
HOBbIX UMMUrpaHToB C YKpaunbi);
6. CNMWKOM 6os/bluMe pacxogb! Ha BHELWHHOW NOMMTHKY B yYLep6 3aLWTe MHTepecoB
6enbix rparxkgaH CLUA;
7. NoctostHas nob i 24M“HicTpaunn n3s6npatens;
8. Last but not least - AMepyka Tepnut nopakeHue, HecmoTpa Ha ycunus
Hac BOB/eKaI0T B BOMHY, Hal NapHn NorMGHyT Ha YKpauue.
9) Lienesan ayqutopua kKamnaHnn
1. Ve6up2rery
cropo 11K
CTOPOHHMKM TpagMLMOHHbIX CeMeMHbIX LIEHHOCTeN;
~ &
Benble aMepvkaHubl, NpesACTaBNAlOWMe HUZSWMA CpeAHMi wu CpeAHun cpegHun
Knacc.
PDF Page 236
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 235 of 277
5) Pacnpoctpanenne undopmaunn
OyesugHo, Y4TO HOCUTeNAMM UHdopMaLi“A MOryT 6bITb MpakTUYeCKM TONbKO
couvanbHbie ceTv. Tipn 9sTomM G6eClieH3ypHOe pacnpocTpaHeHve BO3MO>KHO,
NO-BUQMMOMY, TONbKO B CBExKeCosqaHHoOw couManbHon ceTh i [En
B OCTaNbHbIX COLIWMANbHbIX CETAX — TO ECTb
FaceBook, Twitter, YouTube - Heo6xoqumo npefycmoTpeTb noABNeHMe G6onbWOrO
KONUYECTBa <«CKOPOMOPTALIMXCA» aKKayHTOB mpexge sBcero ANA paboTbi B
KOMMeHTapmax. VicTOYHMKaM MHMopMalinn AIA pacnpocTpaHeHnA AOJDKHbI BbICTYNAaTb
caiTb! (neHAUHrH). Jina BugeO KOHTeHTa — akKayHTb! B YouTube CO cpaBHUTeNnbHO
He6onbuuMM (6aHAT O6bINHO MOCcNe AocTMwKeHWA ypoBHA B 100 ThIcAY nognucunKos)
KONMYECTBOM NMOGANMCYMKOB M KOMMeHTaTOpOB.
[5] Homenknatypa pacnpoctpanremoro HHpopmaloHHoro
npopyKta
1. TeKCTbI NOCTOB;
2. KOMMeHTapun B COLIMNaIbHbIX CETAX VU JIOKAJIbHbIX na6nuKkax;
3. «Membi», BKNHO“aA KapiKaTypbi 4 KonNaKy;
4. BugeoKoHTeHT, BKIIOYaA MHDOPMaLMOHHbIe ClO>KETbI B CTwNe Fox News.
Opranvsayna pa6otTb!
fina abddexTvBHoW pa6oTbi nmpegnaraetca co3sqaHve mpoeKTHoro oduca (pemakumn
MeqMa-KaMnaHun), COCTOALerO U3 TDeEX OCHOBHbIX 6NOKOB:
1. Mouutopuxyr CMU CLUA wu akKayHTOB OCHOBHbIX nonuTMYecKuX AeATeNnen
a B COLIMabHbIXx CeTAX. V3 nposAykKunn 6noka e>*KeAHEBHO
NPOUSBOAMTCA OT6OpP TeM UV COGbITH ANA POPMMpPOBaHNA KOHTeHTA;
2. «Ma6puka TeKCTOB» C MMHMMalbHbIM BbIXOZOM 4-5 OCHOBHbIX TeMaTMYeECKMX
pekomeHfauni, 8-10 6a30BbiIX NOCTOB B COLIMaNbHbIX Mesna, 40-60
KOMMeHTapveB ANA PpacnpocTpaHeHyA MU NOoceBa;
3. Manra-pegakuua Cc @KeNHeEBHbIM BbIXOJOM 3-4 «KaPTUHOK», «MEMOB» UT. 11.
4. Bugeo-pegakuna c eKeQHeBHbIM BbIXOfOM 3-4 BugeO MaTepuasIOB B CYTKM.
BayKHO OTMETHTb, YTO ANIA 3scdeKTUBHOKM paboTb! TpebyeTcA ucnoNb3sOBaTb MUHUMYM
evKOB YW MaKCUMyM peanucTM4HOM MHdopMaunn. NocToAHHbIM pedpeH Np STOM: BOT
4YTO MPONCXOoAMT Ha CaMOM gene, HO YerO BaM HE PaCCKaXKyT/He NMOKAXKYT B
OduuManbHbIx CMM.
PDF Page 237
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 236 of 277
E3) Mpumep ny6nukauymun ana pacnpoctpaHenna
- BbiCTynneHve
KoHrpeccmeHa [i
lee npoTus
BbigeneHua YkKpanHe
40 Mu¥NIMapAoB
Aonnapos.
NpunaraembiA =TeKCT:
BbiMMparolMn Bug
NONUTHKa - NOYEMY-TO
rOoBopvT npaBay u
onepupyeT KaKMM-TO
CTpaHHbIM NMOHATMEM
OH M3 HEMHOrMx KOHrpeccmeHos CLA, ronocoBaBLluUx
NpOTMB 3aKOHONMpoekTa O NocTaBKax YKpanHe
BOOpyeHHH NO NeH~-nMsy.
Npeactasutenb
OAVH M3 HeMHOrNx
KOHTPeCCMe@HOB, FONOCOBAaBLUMX MPOTMB 3aKOHONpoeKTa oO mocTaBKax YkpavHe
BOOpyKeHM No NeHz-nn3y.
"A xouy NpegynpeAuTb BCeX Bac 06 ONaCHOM ABYXNapTMAHOM CTpemseHnn BalwinHrtoua K
Bowie c Poccyes. Mbi, Kak YHaTHK, BCTYNaeM B BOMHY, a AMepMKAaHCKUH Hapog OcTaeTcA
BO TbMe HeBegeHua. IIpouinovw HOubIO ManatTa npegcTaBuTenev ogobpuna BbigeneHve
YkpauHe 40 musnvapgoB Aonnapos - npv 3TOM aMepuKaHCKMe CeMbu OOXOAATCA 6e3
AetcKoro nmutaHua. JNA cpaBHeHuA B 3TOM KOHTeKCTe - 6HspKeT ime
npegycMaTpuBaeT BbigeneHve Mlb 15,3 Munnvapga AONNapoB Ha TaMO)KeHHbIN VU
NOrpaHWyHbIM KOHTpONb WTaToB. Bugumo, YkKpavHa AA Hero 6onee YeM B ABa pa3a
BaokHee Hawes Poguupl".
PDF Page 238
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 237 of 277
EXHIBIT LOA
PDF Page 239
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 238 of 277
Abbreviations:
{] Exegeses
[PH] Phonetic
Primary language Russian (standard font Times New
Roman 12)
Secondary language English (italics)
US Social Media Influencers Network
Project goal:
To create platforms on US social networks in order to strengthen pro-Russian sentiments among
the targeted audience in accordance with Key Performance Indicators and TL [PH] of the
project.
Introduction:
The US Internet space is subject to control by various services and oversight agencies. META, a
social media giant (Facehook/Instagram), actively collaborates with the National Security
Agency. 7wiiter is the only mass platform that could currently be utilized in the US. It is also
important to keep in mind that the network has its own security service that performs verification
of suspicious accounts. This situation is expected to worsen as the November 2024 presidential
election approaches.
The structure of content consumption in the US has the following specifics: users are more
interested in local (city, state) events than federal events and a lot more [interested in local
events] than international events.
The QESSRONTCETE TINA SE is currently advancing a relatively pro-Russian agenda. That
could be exploited by posing as ardent TESTER and relaying the part of their
agenda that coincides with ours. One example would be the financial and military support to
Ukraine. Simultaneously. it is important to understand that the amount of the highly resonant
content and hot topics should not exceed 20 percent of the total volume of all publications.
Proposal:
PDF Page 240
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 239 of 277
To create and develop a network of 200 accounts in Twitter, four in each of the 50 states: two
active and two “dormant” ones.
Active accounts in each state will be maintained on behalf of a fictitious individual, who actively
supports the GBSHIMo nee euaaeas and represents “a community of local activists”. The feeds
will mainly collect the local newsbreaks with occasional coverage of the federal and
international ones.
An approximate number of daily publications will be 3-4 in one’s own feed and 6-9 comments in
other people’s feeds (comments, reposts).
Dormant accounts will be maintained far less intensively and used if one of the active accounts is
blocked.
Technical aspect:
In order to eliminate the possibility of detection of the “Russian footprint” in the proposed
project, a multi-level protection of the infrastructure will be built. It will contain VPN services,
physical servers located in the United States, etc.
Outcomes:
It is expected that in 2-3 months the total permanent audience of the project will reach 30-50
thousand subscribers. In six months — 100,000-200,000. In a year — more than a million
subscribers.
PDF Page 241
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 240 of 277
EXHIBIT 10B
PDF Page 242
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 241 of 277
=
CeTb areHTOB BNUAHMA B COLINANbHbIX CeTAX CLUA
Llenb npoexta:
Co3gaTb nnowagkw B cOLManbHbIxX ceTax CLUA C NOMOUJbIO KOTOPBIX YCUNUMBaTb
npopoccwiickne HaCTpOeHMA CpegM WeneBow ayguTopuv B cooTBeTcTBuM c KITS u TI)
npoexta.
BBogueie:
UrTepHet-npoctparnctso CLUA wan6bonee nogBepxKeHO KOHTponiO CO CTOPpOHbi
BCEBO3MO)KHBIX cnyKO Mw HaA3OpHbIX OpraHoB. [vraHT couWManbHbix cetew META
(Facebook/Instagram) aktuBHO coTpygHuyaeT c AHB. EguucrBeHHow MaccoBol
MNNOWaokON, Ha KOTOPO BO3MO>KHO BecTM paGboTy B CLUA B HacTonuee BpemA ABNAeTCH
Twitter, pv sTom Hago UMeTb B BUY, YTO NpOBepKu cnyx6bI cobcTBeHHOM GezonacHocTu
NOAOSPUTeENbHbIX AKKAYHTOB B 3TOM CeTM TakoKe OCyLeCcTBnsloTcA. Cutyauua 6yneT
yxyQwatbca c npvOnvwKeHvem BbIOopos npesugeHta CLUA B HomOpe 2024 roga.
Crpyktypa notpe6nenns KOHTeHTAa B CLUA umeeT cnepyro”yro cneyMdbuky: nonbsoBaTenen
WHTepecyloT MecTHbIe cobbiTna (ropoga, wTaTa) Gonbwe, 4Yem cbenepanbHble wv HaMHOrO
Gonbwe, 4¥eM MexDyHaposHbie,
OTHOCMTeENbHO Npopoccuiickyro noBectky B CLUA celyac packayuBaloT uv
3TUM MOXKHO BOCNONb30BaTbCA, NPUTBOPAAC APbIMU v TpaHcnmpya Ty
4aCTb UX NOBECTKM, KOTOpaA CoBNagaeT Cc HaWwen. Hanpumep, npo cbuHaHCoBy!0 VM BOeHHYIO
NOMOWWb YkpanHe. [pw 3sTOM Hao NMOHMMaTb, YTO KONUYeECTBO ACKMCTBUTeENbHOrO
PE3O0HAHCHOIO KOHTEHTA M OCTPbIX TEM HE AOMKHO NpeBbilwaTb 20% B obujem o6béeme
nyOnvukaunn.
Npeganomenne:
Co3qaTb VW pa3BuBaTb CeTb “3 200 axkayHToB B Twitter no 4 B kaxgom u3 50 wratTos: 2
AKTMBHbIX VU 2 "CNALYMX".
AKTMBHbIe akkayHTbI B K@KQOM WwTaTe GyAyT BECTMCb OT MMeEHN BbIMbILUMeHHOFO cbusnnua
— axtueHoro cropoxHvka QR 4 or umenn “coo6uwectsa = mecTHBIx
akTMBncToB". B neHTax 6yAyT NPevMYUeCTBEHHO COOupaTbCcA MoKaNbHbIe VHCPONOBOAb! V1
WHOrpa OCBeLWaTbCA cbeAepanbHble u MexkgyHapopHble.
MpumepHoe uncno exKefHeBHbIX nyOnukauni: 3-4 B cobCTBeHHOM neHTe u 6-9
KOMM@HTApleB B YYKUX NeHTax (KOMMeHTapMn, penocthi).
Cnauwe akkayHTbl GyfyT BeCTMCb B ropa3qo MeHee UHTEHCMBHOM pexnme uv OyayT
BOCTpeGOBaHbI, ECNM 3aGNOKUpyOT OAMH U3 AKTMBHbIX AKKAYHTOB.
? 1
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 243 of 277
EXHIBIT ILA
PDF Page 245
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 244 of 277
MEXICAN PASS TO |
Candidate A
PROJECT OF EFFECTIVE PROXY
PARTICIPATION IN THE NOVEMBER 2024
CAMPAIGN
PDF Page 246
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 245 of 277
HISTORICAL BACKGROUND
In 1846, the United States began a war with Mexico, which resulted in 55% of the
Mexican territory being occupied. And it is the richest land in the United States: modern
California, Texas, Arizona, New Mexico, Utah, and Nevada, or 1.3 million square kilometers of
the United States. Just a year before the American aggression in 1845, Spanish Florida became
the 27th state of the United States in exchange for the U.S. renouncing its recent claims for
Texas. Would Texas agree to return to Mexico? The posing of the question is definitely modern.
However, no one asked Texas residents about it in 1846.
CURRENT SITUATION
Today, Mexico is approximately at the
same development stage of economic, social,
and public sentiments and attitudes, as Russia
was going through in the early 2000s.
Mexico for now is slowly waking up to a
sense of great power. Mexico is waking up to
an increasingly complex sense of Mexico's
special cultural and economic path.
Nowadays Mexico, even if heavily
dependent on the United States for millions
of “migrant workers” and an enormous
number of economic ties, continues to
preserve its distinct identity and deeply
values its traditions. Among these traditions,
there is one phrase that reveals the outer
layer of a deep existential conflict with the
United States: México no perdona — Mexico
does not forgive.
Let’s imagine a map of the United States depicted as broken glass. A sign México no
perdona will be displayed along the division line. At first glance, such message could be used by
some fringe political organization, the ultra-right or the ultra-left, maybe by a nationalistic one.
Mexican nationalism is not a noticeable political trend due to the relative autonomy and
distinctiveness of local states with a large number of cultural and social differences, and most
importantly, with a significant difference in daily rituals.
PDF Page 247
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 246 of 277
THE MORENA PARTY AND PUBLIC SENTIMENT
The center-left party Morena is a
stronghold of the current president, and it has
a majority in Congress. To some extent, it is
similar to the young United Russia. The
Morena party does not yet verbalize it, but it
already has anti-American, de-dollarization,
and economic reorientation trends.
The idea of de-dollarization is very popular in
society, especially in the wake of the
strengthening of the Mexican peso. In 2021,
the dollar was worth 22 pesos, today it is
worth 16.5 pesos.
Modern Mexico is very active in establishing
economic cooperation with Brazil. Brazil to
Mexico today is like China to modern Russia,
a great alternative partner and a safe ally.
More and more of Mexico’s economic actors
are changing their course from the U.S.
market to the markets of the Mercosur
countries (Argentina, Brazil, and Uruguay.)
MEXICAN RENAISSANCE
If, as part of the Morena party election campaign (the candidate has not yet been named,
but it will be the successor to the incumbent president) in June 2024, a great-power card is
played with a clear emphasis on anti-Americanism, de-dollarization, and the demand for the
return of a huge number of Mexican prisoners (the number of such prisoners is huge, but the
majority of them do not have the same involvement with the drug cartels that would be worth the
torture, humiliation, and sentences that these people receive in the United States), then such
rhetoric will be especially popular in those states of Mexico that traditionally practice anti-
Americanism. These are the very large states of Baja California, Chihuahua, Sonora, and
Coahuila. Importantly, the anti-American sentiment is most prominent among the poorest
classes. And the poorer strata are the main support group of the Morena party and, therefore,
they provide the highest electoral capacity. Also, the anti-Americans are migrant families,
college educated people, and the participants in patriotic movements.
PDF Page 248
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 247 of 277
The reenactment movement is very popular in Mexico today, as it was in Russia in the
2000s. A special area of focus is the co-financing of the reenactment movement in Mexico,
[which involves] the co-financing of all kinds of military and historical communities that reenact
major battle scenes on the U.S. border.
So, let's imagine that from fall 2023 to summer 2024, a distinctive anti-American card is
played in Mexico with the support of the ruling Morena party. Patriotic movements get involved
as well. The Communist Party of Mexico also gets involved, which pursues an active Russophile
and pro-Soviet politics, often participating in relevant cultural events (at venues for outdoor
advertising in Mexico City; for example, a large-scale exhibition of a Soviet propaganda poster
was held in 2023). That is, the Soviet culture was adopted by Mexican culture greatly and
noticeably as anti-American.
But it is very difficult to succeed in the countries where we are trying to play this card
today due to the lack of an economic basis. In Bolivia or Venezuela, total poverty makes it easier
for the representatives of pro-U.S. parties to buy votes.
This is not the case in Mexico. First, mexicanos no perdonan (Mexicans don’t forgive.)
Secondly, the pain for the loss of the vast adjacent territories is still alive in people’s
mind. Preparations are expected soon for “the commemoration” of the tragic date of “200 years
apart.”
Thirdly, Mexico is indeed experiencing
a technological boom; technology is
advancing; and at least in big cities, Mexico is
beginning to reach the same standards of
living as that of Mexican migrants on the
other side of the border. Today. the migration
of Mexicans to the U.S. happens rather by
inertia, according to the old role-playing
model, when having a residence permit in the
US brings some satisfaction.
Mexicans value their passports very much. Moreover. all those born in Mexico receive a
passport. A Mexican passport is quite strong and overall is a convincing alternative to the
American passport, at least in Latin America and even in Canada.
A MEXICAN PASS TO (@aqgiRET CAMPAIGN
PDF Page 249
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 248 of 277
At the same time, there is a good chance that in the U.S. presidential election
may again become a candidate from the [WAS Molitevemiin@al. Le is the man who has
repeatedly said that it is strange to speculate about the risks for American citizens coming from
the zone of contact between Russian and Ukrainian troops, when there is a quite clear multi-
thousand-kilometer contact line stretching between the United States and drug gangs,
“sicario"(murderers) squads, crowds of sometimes furious refugees, smugglers, and the world's
infamous high crime and violence rate in the border towns of Tijuana, Ciudad Juarez, Teconapa,
and so on. The Mexicans' special attitude toward death makes them promising candidates for
projects like PMC Wagner on the borders of Arizona or Texas.
The (@tteieRHGeAN who was building a
border wall; the @etiaifeEttagay who talked
about the problem of migrants coming from
the South pretty much all the time throughout
his presidency; and the (@ititelfekitagn, to whom
the ball needs to be passed conveniently in
order to switch the American political
discussion — that @RUTEETERAN is so much in
need of an exacerbated confrontation with
Mexico.
What is the main potential problem of @AWWIREaeAN campaign? It is in the fact that the
U.S. economy is growing today. Global food prices have risen. The military industrial complex
has received new orders. It is as if (@AyeheRitems) has fed the rednecks: farmers and workers, who,
in fact, were the potential supporters for Q2UGIGRiCgAN. Today the stagnation card has been thrown
out. Military industrial factories, machine-building factories, and metallurgists are inundated
with orders for the next five to seven years. Dollar inflation is lower than in any other currency.
The real estate purchase index is low like never before: citizens do not see the need to go into
real estate, mortgage rates are low, and all of this suggests that the economy is very healthy.
In order to somehow spur the society when the economy is obviously booming, it is
necessary to create a perceivable threat. The missiles in Cuba, Nicaragua, or Venezuela are a bit
ridiculous because they bump against the Americans’ technological disregard for Russia. The
statement about the owner of a gas station with a nuclear bomb is very telling, and, in fact, very
close to reality. The regime in Nicaragua very shortly could become a victim of either a military
coup or a special operation by American commandos. In any case, these are the territories where
we play on someone else’s field. But does it make sense to play on someone else’s field when
there is a partner who is ready to play himself? A partner who needs to win the election and to fit
in the concept of the current national and historical development.
PDF Page 250
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 249 of 277
CONCLUSION
This kind of context is very useful to all the BRICS countries. For, as they used to say in
the streets of St. Petersburg, “Each Abram has his own program.” Our goal is to try to
decentralize and, in some places, to disrupt the processes of imposing a single form of
“decorum” in the way other states present themselves.
And this kind of project is going to show the world that a huge country of 130 million
people, with the longest border with the United States, has finally woken up. (URSMgemene) once
said that American economy got very lucky: they have fish that are silent on the left and the
right, Canada sleeps at the top, and Mexico dances below. Thus, the United States simply does
not have threats and does not spend energy on mitigating them. All threats are happening in
some esoteric realm of the global West and American-centric civilization.
Today, the time has come to show to the United States that it is under a threat. And we
can do it.
PDF Page 251
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 250 of 277
EXHIBIT 11B
PDF Page 252
; =
2 ee a ee ek | 7 ty ao
ae eee ee se
a ee - . = : a ii we ee 2
NPOEKT SOMEKTUBHOT O
NPOKCU-YYACTUS B KAMNAHUN
HOSIBPS| 2024 TODA
= - a ae
PDF Page 253
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 252 of 277
UCTOPUYECKAS CNPABKA
B 1846 rogy CLUA HaumHaloT BOMHY C Mekcnkoui uno e@ pe3ynbTaTam OKKyNMpyioT 55% MeKCMKAHCKOM Tep-
putopun. Mpuyém ato camble 6oratble 3emanK CLUA — coppemenHbie Kanudopnua, Texac, Apu3ona, Hbto-Mek-
cuKo, Ota v Hesaga man 1,3 MAH KBagpaTHbIX KMnOMeTpoB CLUA. Bcero 3a rog 40 aMepuKaHCKON arpeccun,
B 1845 rogy, ucnaHckaA Mnopuga cTana 27-m wratom CLUA 8 o6meH Ha oTKa3 NOCNeAHMX OT NPMTASAHMH Ha
Texac. Cornacuaca 6bI Texac BepHyTbca B CoctaB MekcuKn? MoctaHoska BONpoca, KOHEYHO, CoBpeMeHHaa. Ho
B 1846 HHKTO He cnpawuBan ero KuTenen 06 3Tom.
COBPEMEHHAA CUTYALMSI
CerogHA Mekcnka nepexusaert npH6nu3vTeNbHO TaKOn Ke
9TaN Pa3BUTHA SKOHOMMYECKMX, COL|MAsIbHbIX, OOWECTBEHHbIX
HaCTPOeHMK VM OTHOWEHM, KaKOM MepexkuBana Poccua B Ha-
yane 2000-x rogos. B Mekcuke npocbinaerca noka ewe O4eHb
OCcTOpOKHOe BeNMKOgepKaBue. B Mekcuke npocbinaetca
Bce Honee KOMMNEKCHOe OLyWeHe OCObeHHOTO MeKCHKaH- |
CKOFO KY/bTYPHOrO M SKOHOMMYeCKOrO nyTH. CoppemeHHaa
Mekcuka, KoTOpaa, Ka3a0cb 6bi, cunbHO 3aBMcMma oT CLUA
MH¥JIIMOHaMM «racTapbaliTepoB» vw OrpoMHbIM KONMYeCTBOM
3KOHOMMYECKMX CBAZEM, NDOMOMMKAeT OCTABaTbCA BECbMa Ca-
mo6bITHOM M ry6OKO UeHMT CBOM TpagMuNK, B uncne 3THXx
TpagMuMi ecTh OGHa dpaza, KOTOPAA OTKpbiBaeT NepBbiii
cnow tny6vHHoro 3K3McTeHUManbHoro KOHd@aMKTa c CLUA:
México no perdona - Mekcuika He npoulaer.
Npegctasum ce6e kapty CLUA, v306paKéHHyio B Ka4ecTBe
CANAD,
pa36uToro crekna. Mo nunun oTAeneHua 6ygeT npoxoguTb Hagnncb México no perdona. Ha nepsbiii Barnag,
TaKMM eATMOTHBOM MOKET NONb3OBaTbCA HEKO MaprvHaNbHoe NonuTM4eckKoe OObeAMHEHHe — ynbTpanpa-
BOe MIM ynbTpaneBoe. Mower 6biTb, HAWMOHANMCTMYeECKOe. MeKCMKaHCKM HalMOHaNM3M HE AB/IAeTCA 3aMeT-
HbIM NO/MTMYECKMM TPeHAOM BBKAY OTHOCMTENbHOM CaMOCTOATENbHOCTM M CBOeOGpa3vA MECTHbIX LUTATOB C
6ONbWAM KONMYECTBOM KY/TYPHbIX M COWMANbHbIX pasNN4nii, a CAMOE MNaBHOe, C CYLECTBEHHOM pasHuuen B
NoBcegHeBHbIX puTyaax.
NAPTUA MORENA VU HACTPOEHMSI B OBLUECTBE
JlepoueHTpuctckaA naptva Morena - onaot gelictayiowero
NpesmgeuTa, MMetowaAn GONbWMHCTBO B KOHTpecce, B KaKO-TO
cTeneHM moxoxka Ha Mo/ogyIO «EgnHyio Poccuio». Maptua
Morena ewe He Bep6annaupyer, Ho ye comepmut B cebe TpeH-
Abi Ha AHTMAaMEpMKAaHK3M, AeAONNApM3alMlo V SKOHOMMYECKYIO
nepeopueHTaunio.
Wager fegonnapu3zayu oveHb nonynApHa B O6wectBe, B OCO-
GeHHOCTH Ha POHE yKpenMeHMA MeKCMKAaHCKOrO Neco. B 2021
rogy gonnap crown 22 neco, cerogua 16,5 neco.
CoppemeHHaa Mekcuika O4eHb aKTMBHO HaslaKVBaeT SKOHOMI-
yeckoe coTpygHnyectso c Bpaswanen. Bpasmana ana Mekcnkn
cerogHa, Kak Kuta aA COBPEMEHHON Poccuu. Bonbwok anbTep-
HaTMBHbIM NapTHep M GesonacHbiit colosHHK. Bce 6onbwe SKOHO-
MMYECKMX akKTOPOB MekcMKM NepectpanBaWTCA C pbIHKa CLUA Ha
PbIHKH CTpaH Mepxocyp (AprentuHa, Bpasmana, Ypyreai).
PDF Page 254
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 253 of 277
MEKCUKAHCKOE BO3PO>KQEHME
Ecnv B paMKax NpeABblIOopHow KaMNaHMM KaHAngaTa OT napTMu Morena (KaHgMAaT NOKa He Ha3BaH, HO 3TO
6ygeT NpeeMHUK AecTeyowero npesMAeHTa) B MioHe 2024 roma 6ygeT pasbirpaHa BENMKOpep)KaBHaA Kapta C
OTKPOBEHHbIM aKLEHTOM Ha AHTHAaMEPHKAaHMSM, DeAONNapM3saliio WM TpebosaHve BEPHYyTb Ha POAMHY OFpoM-
HOG KONMYECTBO MEKCMKAHCKMX SAK/IOYEHHbIX — KOMMYECTBO TAaKMX 3AaKMHOYEHHbIX OFPOMHO, HO BONbLIMHCTBO
M3 HAX HE AMEIOT TOrO OTHOWEHMA K HapkKOMadun, KOTOpoOe Obi CTOMAO Tex NbITOK, YHMKEHM WM CDOKOB, KO-
Topble STH NOAM NonyyaroT B CLUA — To ocobeHHO NonyNAPHOH TakaA puTOpHKa bygeT B Tex WTaTax MekcuKn,
KOTOPbIe TPaAMUMOHHO MCNOBeAYIOT AHTMaMEPMKaHW3M. ITO OYeHb KPYMHbIe WTaTb! HuKHAR Kanudopuua,
Yuyaya, CoHopa, Koaywna. Yto BayKHO, aHTMaMepMKaHCkne HacTpoeHMA HaMGonee ApKO NpoABeHb! cpean
Havbonee 6egHbix cnoes. A bonee GepHble cTpaTbl Kak pa3 M ABAAIOTCA Tpynnow no~Aep Ku Naptun Morena u,
COOTBETCTBEHHO, ObecneynBaioT HaMbonee BICOKYIO 3NeKTOpaNbHY!O EMKOCTb. Take AHTMAMePHKaHUb! — 3TO
C@MbM MUrpaHTOB, UHTEMPEHUMA, YYACTHUKM NATPMOTMYECKMX JBMKEHMIA.
B Mekcuke cerogHa, Kak 4 B Poccuu 2000-x, o4eHb pa3BMTO PeKOHCTpyKTOpCKoe ABMKeHKe. OTAeNbHbIM
HanpaBreHnem copvnaHcuposaHue PEKOHCTPYKTOPCKOrO ABMKEHMA B Mexkcnke: Bcakoro pofa BOCHHO-MCTO-
pwyeckux coobwects, KOTOpbie pasbirpbisaloT Ha rpaHmue c CLUA Kpynubie GatanbHbie cueHbI.
Utak, npeactasum ce6e, 4To B nepvog c oceHn 2023 no neTo 2024 roga B Mexkcuke cunamn npasawen
naptwm Morena pa3birpbibaeTcA APKaA AaHTMaMepvKaHCKaA KapTa. Mogkmoyalotca NatpHoTMyecknve ABHIKE-
HMA. MlogkoyaeTcA KOMMYHUCTMY4eCKaA NapTHA MeKCMKM, KOTOPaA NPOBOAMT AaKTMBHY!O pyCOMMAbCKYIO MH
NPOCOBETCKYIO NONMTHKY, YACTO YYACTBYA B COOTBETCTBYIOLUMX KYAbTYPHbIX MeponpuATMaAX (Ha NNOWAAKaX No”
pa3melweHve HapykHOW peknamb! B MexuKo, Hanpumep, B 2023 rogy npoxoguna macwTa6uHaa BbICTaBKa CO-
BETCKOFO arMTaUMOHHOTO Nakata). TO eCTb, COBETCKOe BOWW/O B KyAbTypy MekcWKM O4eHb CHbHO M 3aMeTHO
MM@HHO Kak aHTMaMepuikaHCcKoe.
Ho 8 TeX CTpaHax, B KOTOPbIX MbI CefogHA MbITaeMCA pasbifpaTb STY KAPTY, ONEHb CNOMHO AOOuTbCA ycnexa
no NpMYuHe OTCYTCTBMA SKOHOMUYeCckKoro Ga3uca. B Bonuenu wan BeHecyane ToTanbHaan GegHocTb nopo~ae4r
BO3MO)KHOCTb /erkKO CKYNKM FONOCOB NpeACTaBKTeENAMM NPOAMePMKaHCKMX NapTHii.
B Mexcnke ato He Tak. Bo-nepsbix, mexicanos no perdonan (mekcwkaHupb! He Npowator).
Bo-BTopbix, paHa NOTepH OrpOMHbIX CONpeAeNbHbIX TEePPKTOPKM KKBa B HAPOAHOM CO3HaHMM, MB CKOpOM
BPEMEHM OMKMAAeTCA NOATOTOBKa K «NPa3QHOBAaHMIO» Tpa- :
rMyeckou AaTbI B «200 net nopo3Hb».
B-TpeTbux, B Mexcuke JevcTBMTeNbHO MseT TexHONOrM-
yecknh Gym, MAeT pasBMTMe TexHONOrHi, vu, NO KpavHei
Mepe B KpyNHbIx ropogjax, Mekcuka HadMHaeT cpaBHMBaTb- F
CA NO YCNOBMAM }KM3HM M OxXOfaM C YPOBHEM KM3HM MeK-
CUKAHCKMX MUTpaHTOB NO TY CTOpPOHY rpaHMubl. CerogHa fe
MMrpaliMA MeKCMKaHueB B CLUA, cKopee, npoucxogut no |
MHEPLMH, NO cTapo ponesok mogenuv, Korga Bug Ha KH-
TenbcTso B CLUA npuHocHT Hekoe yAoBneTBopeHne.
MekcwkaHub! OYeHb WEHAT CBOM NacnopT. Bonee toro,
NacnopT nonyyator Bce powkgeHHbIe B Mekcuke. MacnopT BecbMa CM/IbHbIM M, B eoM, Co3qaeT yYOeauTenbHy!O
a/ibTepHaThBy Nacnopty amepviKaHcKomy. [lo KpaviHel mepe, B CTpaHax /laTMHcKOK Amepun v game KaHaze.
MEKCVUKAHCKUM NAC KAMNAHMV i
B 3To Ke Camoe BDeEMA B Amepike Ha BbIGopax NpesMBerHTa KaHAKAAaTOM | Say | c
BbICOKOM Aone BEPOATHOCTH MOET BHOBb cra i. Yenosek, KOTOpbIH HEOAHOKPAaTHO FOBO-
PMN, YTO CTPAHHO paccyKAaTb O PUCKaX AVIA AMEPMKAHCKMX FparkaaH M3 3OHbI CONPMKOCHOBEHMA POCCMMCKMX
YKPaVHCKMX BOCK, KOrga ECTb BNONHE NOHATHAA MHOFOTbICAYeKMUNOMETPOBAA NMHMA CONpMKOCHOBeHMA CLUAC
Hapko6aHAams, OTpAgaMM «cHKapno» (y6uiu), Tonnamn pasbApeHHbIx Nnogyac GexkeHues, KOHTpabaHAncToB
PDF Page 255
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 254 of 277
VW MPOCNaB/eHHbIMM Ha BECb MMP BbICOKMM YPOBHeM Kph-
MUHasla VW HaCUnua NPUrpaHV4HbIMU ropogamnu TuxyaHa,
Cbrogaa-Xyapec, TekoHana uv Tak Aanee. Oco6oe oTHOwWe-
HHe MEKCHKAHLeB K CMEPTH AenaeT ux NepcnekTMBHbIMN
COTpyAHiMKaMuM ANA npoektos Tuna YBK BarHep, HO Ha
rpaHulax C APY30HOU WM Texacom.
— KOTOPbIi CTPOMA NorpaHMyHyio cTeHy,
, KOTOPbI roBopun Oo npobneme murpak-
TOBC H0fa NPaKkTUYECKM Ha NPOTAYKEHMM BCerO NpesupeHT-
cKOrO cpoxa, , KoTOpomy Heobxogumo
AaTb Ha Hory yAo6ubIi Nac Ana Toro, YTO6bI NepeKNIO“NTb AMEPNKAHCKy!O NOAVTMYECKyIO ANCKYCCHIO, CeroaHA
OcTpo HyKAaeTca B O6OCTpeHMN NpoTMBOCTORHMA C MeKcukon.
B 4em OCHOBHAA NOTeHUMaNbHaa Npobnema KamnaHnn es B TOM, 4YTO 3KOHOMMKa CLUA ce-
fOAHA pactert. Bbipocnu MupoBbie Webi Ha NPOMOBoNbcTBHe. Mpeanpuatua BK nonyyunn HoBble 3aka3bl. Mo-
AyyaeTca, YTO Kak 6bl HAKOPMM PegHeKOB: depmepos, pabounx, KOTOpbIe, COBCTBEHHO, MM Obi
30HOK pasBuTuA ANA . CerogHa Kapta ctarHaumy Bbiburta. 3aBoab! BNK u mawuHoctpoeuua”,
MeTa/YPrM 3aBaNeHb! 3aKka3saMu Ha rpAAyue 5-7 Net. AHrALMA B 3OHE AONNapa HMKe, 4eM B M1060iK Apyron
BasIOTHOU 30He. Ungexc NOKYNKV HEABUKUMOCTH HM30K Kak HUKOrAa — rpakAaHe He BUDAT CMbIC/a YXOAUTb B
HEABUKUMOCTb, CTABKM NO UNOTEKE HU3KH HM BCE 3TO FOBOPMT O TOM, 4TO 3KOHOMMKa OYEHD 3H0poBaa.
4ToObI KaK-TO NOACTerHyTb COWECTBO NPM TaKOM HaxXOgAWeNcA Ha ONEBYAHOM Nopbeme SKOHOMMKE, Hao
CO3faTb OWyTMMylO yrpo3y. PakeTbI Ha Ky6e, Hukaparya win BeHecyane HeMHOFO CMeWHbI, NOTOMY TO Ha-
TbIKaLOTCA Ha TeXHO/OrMYeCKOe NpeHebpexeHve amepukaHues K Poccuu. PopmynuposBka Npo Brapenbua
6€H3OKONOHKM C AQEPHOK GomGoi O4eHb XapakTepHa M, NO CYTH, COOTBETCTBYeT AeVCTBUTENbHOCTH. PexKUM B
Hukaparya B O4€Hb KOPOTKOM NepcneKTMBe MOET CTaTb KEPTBOK NM60 BOeHHOrO Nepesopora, nu6o cneuone-
PaliMv aMepMKaHCKMXx KOMMaHsOC. B nto60m cnyyae, 3TO TeppuTOpuM, rae MbI Vrpaem Ha 4y>KOM None. A ecTb
JV CMbIC/ UrpaTb Ha YYKOM NONe, KOrAa ECTb NapTHep, KOTOpbIIA rOTOB CbiIrpaTb CaM. NaptHep, KOTOPOMY Hafio
BbIVIPbIBaTb BbIbopbi, HaAo BKaAbIBaTbCA B KOHUENLIMIO TEKYLUEFO HAL|MOHA/bHO-MCTOPNYECKOLO pasBUTHA.
SAKAIOYEHME
TaKOro pofa KOHTeKCT O4eHb None3zeH ANA BCeX CTpaH BPMKC. 60, kak ropopuaM B nuTepcKux ABOpax: «Ka-
*Aomy A6pamy cBoa nporpamma». Nonbitka AeueHTpanv3aunn, a rae-To v xaoTM3auMN npoueccos HacaxKge-
HUA EQMHOW MopmMb! «NpANKUUA» B NO3MLUMOHUpOBaHuN rocysapcTs — 3TO Halwa 3agaya.
V\ kak pas TaKoro poga npoexT nokayKeT BCemy Mupy, YTO OrfpomHaA 130-mmAnMOHHas CTpaka C Camon npo-
TAYKEHHOM rpaHvuer c CLUA, HaKOHeL, NpocHyNacb. OfHaKAbI CKa3aN, YTO AMEPUKAHCKOK
3KOHOMMKE OYeHb M0Be3N0: CNeBa M CNpaBa MONAT pblObI, HaBepxy cnuT KaHagla, a BHU3Y TaHUyeT Mekcnka.
Takum o6pa3om, CLA npocto He MMelCT yrpo3 M He Tpa;rAT CUI Ha MX KOMNeHCaUMHO. Bce yrpo3b! NPOUCXOgAT
B HEKOEM 330TEPUYECKOM MPOCTPaHCTBe BCEMMPHO!O 3anafja M aMePVKAaHOLWEHTPHYHONM LMBMAM3aLINN.
CerogHa npuwszo Bpema NoKa3aTb CLUA, uTo ata yrpo3a y Hux eCcTb. V MbI MOKEM STO CAeNaTb.
PDF Page 256
EXHIBIT 12A
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 255 of 277
PDF Page 257
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 256 of 277
The Comprehensive Information Outreach Project in
Israel (and also Jewish Community Outreach in the
US)
Project
The Project includes
● Online media
● Work with Israeli influencers
● Creating forums in Twitter, Facebook, Instagram, Yandex-zen
● YouTube Channels
● Telegram Channels
● Comments in social media
● Targeted advertising in social media
The Project Goals:
At present, the situation in the state of Israel seems very favorable for launching a major
project aimed at influencing public opinion. The goal of such influence is to rip Israel out of
the general Western anti-Russian agenda and to create a sustainable public opinion
which would deem neo-Nazism and dictatorship in Ukraine, rendering aid to neoNazis, and, therefore, the escalation of the conflict by the West and helping anti-Russian
political emigration unacceptable.
Under current circumstances, these goals could be achieved in a relatively short term,
relying on forces that in fact exist within the country as well as in the Jewish diaspora in the
United States.
Based on this, the key indicator of the effectiveness of the project will be an increase in the
number of Israeli citizens supporting Russia in the fight against Nazism.
The following thematic directions will be reflected within the framework of the Project:
1
PDF Page 258
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 257 of 277
Israel | Project
● Nazism in modern Ukraine and sowing of fear from its across Europe and the world.
Truth about the conflict in Ukraine;
● Parallels between Russia and Israel in how they handle the threat to its territorial
integrity and national security;
● Stirring up interest to the US presidential campaign: stakes, rumors, forecasts;
● Facts unmasking Russian opposition members overseas (scandalous statements
against Israel, religion, Jewish traditions, and bribing authorities)
In addition to the main goal, the Project will be directed at achieving the secondary goal, that
is, to ensure background support and consensus related to legitimizing the election of RF
President in 2024 in Israeli public opinion.
Analysis of Political Situation in Israel. Public Opinion Factor
The public opinion of Israelis and American Jews has been strictly polarized. The election
in the fall of 2022 brought to power a coalition of right-wing and religious parties lead by
Foreign Official 1 which in turn caused a reaction from the left-wing "democratic" forces
in the vein of "Maidan" or "colored revolutions". Tens of thousands of people rally "against
FO 1and his reforms" in Tel Aviv and Jerusalem. Speakers at these demonstrations promise
to reprisals against and murders of Foreign Official 1 supporters. "Democrats" threaten Israel
with an open civil war. This threat is so serious that has been acknowledged as such by the
.
Foreign Official 2
It's important to note that the "left-wingers" who seek to overthrow the Foreign Official 1
government and to bring the "Maidan" to the country, in general share views of the
U.S. Political Party B of the United States and are the target audience of the U.S. Political Party B .
That means that one of the important points in their political agenda is expanding aid to
Ukraine against Russia up to military supplies (Israel has been currently supplying only
"humanitarian" aid to Ukraine). The left-wingers demand, in addition to other things, that
Israel expend refugee admission from Ukraine (including the ones without a confirmed
Jewish origin), and provides the Ukrainian refugees with living accommodations and
employment, as well as expands financial aid to Ukrainians. The left-wingers also support
the so-called “Great Aliyah”, i.e. mass emigration of liberally minded Jews from Russia.
Among such "Russian" Jews are celebrities like Russian Celebrities 1, 2 and 3
and others. The leftists support their repatriation and anti-Russian political
activities, despite bribery scandals associated with issuing Israeli documents to some of
them.
Unlike the left-wingers, the right-wingers support the current government of Israel, stand up
for reduction of aid to Ukraine, want the government to focus on internal problems and
impose more stringent policy on refugees. The right-wingers have been trying to amend “the
2
PDF Page 259
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 258 of 277
Israel | Project
repatriation law” so that grandchildren of Jews could no longer be eligible to immigrate, i.e.
limiting and even terminating the "Great Aliyah" and consequently cessation of accepting
liberal fugitives from Russia. The right-wingers don't want these people to influence Israel
internal policy.
The right-wingers also want better relations with Russia (despite of existing controversies).
, the current head of Israeli government, is considered a "friend of Putin".
Foreign Official 1
A special attitude towards Russia and the President of Russia in general is characteristic of
the right and moderate in Israel. Thus, for example, the former Prime-Minister of Israel
Foreign Official 3 ’ last interview includes a description of his negotiations with the Russian
President in spring of 2022 and literally overflows with compliments addressed to the
outstanding, perceptive, and wise Russian leader.
It’s obvious that we need to support the legitimate Israeli government against the left-wingers
supported by the U.S. Political Party B .
It is also obvious that the Jewish population of the US is divided with regards to the issues
of Ukraine and Israel, just as the population of Israel itself.
Influencing the public opinion of Israel will impact the public opinion of Jewish voters in the
US prior to the 2024 Presidential Elections.
Project Specifics. Objectives
1. Organization of comprehensive monitoring:
● Obtaining real-time information on posts and official publications of Israel
associated with the list of the Project's topics.
● Compiling, continuous update of media card in social media (influencers, key
bloggers)--search of statements and threads within the framework of the
Project topics;
● Reporting about key newsworthy events (events, statements by influencers,
statements by leaders) within the framework of the Project through prompt
notification channel--the Pulse system.
● Gathering data about sociological research published in open source on the
Project topics.
2. Analytical work:
● Developing recommendations on covering newsworthy events;
3
PDF Page 260
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 259 of 277
Israel | Project
● Situational analysis of high-profile statements, speeches and events;
● Studying sociological research data published in open source and preparing
analytic conclusions;
● Drafting presentations to be delivered at numerous Project events; developing
lists of topics for seminars and round tables within the framework of the
Project.
3. Creating and maintaining online media outlets' network (possible to organize under
the unified brand "Normal Israel” 1):
● News aggregator portal;;
● Telegram channels;
● Accounts in Twitter, Facebook, Instagram, Zen, YouTube channel.
4. Work on distribution of the content across the network--targeted advertising.
5. Media posting (publishing materials on Telegram channels and Israeli media).
6. Work in the comments, that is, support of topics on the list and attacking opponents.
7. Content producing company (including with the augmented reality technologies):
● Short reads and posts in social media;
● Comments;
● Long reads;
● Videos, including animated;
We propose to create a full-fledged three language right-wing information online project in Hebrew, Russian
and English. The online project will target Jewish communities across the globe, first and foremost in Israel
and the US.
1
The official ideology of the project should be moderately religious Zionism of Soviet Jews (approximately
matches the ideology platforms of Likud and Religions Zionism parties which are part of the government
coalition.
An important part of the Project ideology is counter-measures against forgetting Holocaust, or, rather,
reminding, who specifically was eliminating Jews in Ukraine, Belarus, Poland, and Russia, to wit, --these were
Bandera followers, Ukrainian nationalists whose legacy has been promoted by the modern Ukrainian
government.
The legend of the Project—it is done selflessly by caring activists, Israelis, part of them preferring to work
anonymously.
4
PDF Page 261
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 260 of 277
Israel | Project
● Memes, pictures;
● Cartoons, photoshops.
Team and Scopes of Work
Project Team:
● Management--managing the project.
● Media monitoring group--daily monitoring.
● Social media monitoring--finding headline-making statements by influencers
● Analytic group--preparing analytic and social research materials
● Creative group—T3 for production, special projects, own newsworthy events (fake
news)
● Production group--pictures, texts, videos.
● Group of special correspondents in Israel and media manager.
● Translation services.
● Distribution group--posting materials and comments in social media.
● Reporting group--collection of statistics and user reactions, generating reports.
Scope of work:
● Monitoring media outlets and social media--once a day.
● Analytical memos based on social studies--once a week
● Situational analysis--upon request.
● Pulse-Israel channel--prompt notification of events and statements--continuously.
● Texts of publications (to the portal / to "mirrors" of the publications)--four a day.
● Texts of posts (to the accounts in social media)--20 per day.
● Comments--300 a day.
● Graphic creative content (memes, caricatures)--three a day.
● Videos clips--three per week.
5
PDF Page 262
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 261 of 277
Israel | Project
● Administering channels, accounts and portal--every day, on a continuous basis.
6
PDF Page 263
EXHIBIT 12B
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 262 of 277
PDF Page 264
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 263 of 277
a
Mpoekt KOMNNeKCHOM NVHCPOpMaLMOHHON pabotTbt
B rocyfapcTBe VU3pamnb (a TakoKe C EBPeNCKON
o6wnHon CLA)
[poexm
Npoekt BknrouaerT
e OnnaiH-CMU
e Pa6orty c u3pauneckumn }OMamnu
e Co3qgaHve mnowagoK B COWMANbHbIX ceTAx: TBuTTep, Devcbyx, Vnctarpamm,
Anaekc.03eH
e lOty6-kaHan
e Tenerpam-kaHanbl
e KOMMeHTapuN B COLManbHbIX CeTAX
° TapreTupopaHHylo peknamy B COLIManbHbIX CETHX
Llenu npoekta
B HacTOAWee BpeMA CMTyaLIMA B rocyfapcTBe Vi3paunb KadKeTCA OYeHb BbITOMHOM GNA
Hayana CepbesHoro npoekTa Bo3sgevicrBua Ha OGujecTBeHHOe MHeHMe. Llenb TaKoro
BoasgevcTBua — BbIPBaTb Uispaunb u3 OOwWesanagHon AHTMPOCCUUCKONM NOBECTKM, CO34aTb
ycTowuvBoe o6wecTBeHHOe MHeHMe, ganA KoTOporo GygeT HenpwemnembiM
HeOHauM3M MM AMKTaTypa Ha YkpanMHe, OKasaHnNe MOMOLIM HeOHALIMCTaM,
CNefOBaTeNbHO, 3CKanalWMA KOHdNukKTa CO CTOPOHbI 3anafa, a TakWKE MOMOLYb
AHTMPOCCHMCKON NoNMTMYeCKOK SMurpaunn.
B cnoxkKUBWenCA CUTYAL|MM DOCTMYb 3TMX LENE MOMKHO B OTHOCKMTENMbHO KOPOTKKE CpOKH,
onupascb Ha peaMbHO CYLIECTBYIOLMe CuNbI BHYTPM CTpaHbI M B EBpeCKON AMacnope B
CWA.
KntoyeBbimM mokasaTenem sdbcbeKTMBHOCTM MpoekTa UcCXOAA v3 sTOTO BygeM CHMTAaTb
yBennyeHve “ncna rpaxgaH V3panna, noggepxusatownx Poccnto B GopbGe c
HauM3MoM.
PDF Page 265
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 264 of 277
Vsapaunb | Mpoext
B pamkax Mpoexta 6GyayT OTpaxkaTbcaA CnegyrouMe TeMaTHYeCKnKe NHK:
e Hauv3m B COBpeMeHHOM YKpanHe uv NoceB CTpaxa OT ero pacnonsaHna no Espone u
mupy. Mpasga o KoHdpnukte Ha YKpante;
e Mapannenu mexay Poccuvei vu Vspaunem 8 nopxofax kK yrpo3ze TeppuTOpuanbHon
uenocTHocTM v besonacHOcTH CTPpaHbl;
e Mogorpepanve vHTepeca kK npesugeHTcKoW KamnaHun B CLUA: cTaBKu, cnyxu,
NporHosbl,;
e Maxtbl, paso6nayaloume poccuiickux onno3sMuMoHepos 3a pyOexKOM (CkaHAaNbHbie
BbICKa3bIBAaHVA NpoTMB Vspavns, penurmv, TpagMUMOHHbIX EBpevCKNX yCTOeB,
nogkyn Bnactel).
Momumo ocHoBHol Mpoext 6ygeT HanpaBneH Ha QOCTWKeHVe BTOPOCTeneHHON enn —
o6ecneyeHne cboHOBON NosDepxKM VM KOHCeHCYyC 0 NermTumMaLlWy BbISopoB MpesupeHTa PO
B 2024 rogy B OGWweCcTBeHHOM MHeHun V3panna.
Ananu3 nonutnyeckon cutyaynn B Uspanune. Paxtop
o6OwecTBeHHOrO MHeEHMA
O6wecTBeHHoe MHeHve Vispauna vu espeicKkoe HaceneHve CLUA B HacTOAuee BpeMsA
2KECTKO NONApPN3OBAaHO. Mpuxog kK BNAacTH Ha BbIGOpax OCeHbIO 2022 rogja KoannuMn MpaBbix
MW penurmosHbix napTii so rnase c EE Sbisean peaKyvio neBbix
«QeMOKpaTUYeCKMX» Cun No Tuny «MaigaHa» UNM «LBeTHOM peBoniounu», Ha MUTMHTAaX
«npoTne i v ero pecbopm» B Tenb-AgnBe u Vepycanume co6upaivTca AeCATKM TbICAY
miogen. Peuv opatopos Ha STMX MUTUHTaXx BKMOUAOT OOeLaHUA pacnpaBbl uv y6ulicTB no
OTHOLUeHMIO K CTOPOHHMKaM HerTaHbaxy. I yrpoxaioT Vispaunio oTKpbiTon
rpaxkaHcKon BOMHOM. Sta yrpo3sa CTONMb Cepbe3sHa, YTO NPUsHaHa TAKOBOM npesvfeHTOM
Vspauna
BaxKHO OTM@TMTb, YTO «NeBbIe», KOTOPbIe CTPEMATCA K CBEpPxKEHMIO NpaBUTeNbCTBa
HeTaHbaxy “MK «MaigaHy» B WeNOM pa3genAloT No3sMuMn MW ABNAIOTCA KnVeHTenon
CLA. STo o3HayaeT, YTO OAHMM U3 BadKHbIX NYHKTOB UX
nonuTuyecko NporpamMMbI ABNAeTCA pacwwMpeHve nomoLM YKpavHe npoTuB Poccnn —
BONOTb GO BOCHHbIX NOCTaBOK (B HacTOAWWee BpeMA Vispaunb OCyLIECTBNAeT NVWb
«ryMaHMTapHbie» nocraBKu Ha Y«pauHy). Jlesbie TpebytoT, nomumo Bcero npovero,
paclumpeHus npvema GexeHujes C YKpanbl (B TOM YNcNe He UMeIOLMX NOATBEPAAeHHOTO
eBpelicKoro NpoucxoxKAeHHA) NpepocTaBneHnA UM X%KWNbA M pabounx MeECT, pacwiMpeHnA
dbvHaHCOBOK NOoMOWWM ANA yKpauHues. Jlesbie TawoKe nognepxKuBaloT «Gonbluyto anuio» —
TO €CTb MaccoBylo sMMrpalivlo eBpeeB NNGepanbHblx B3rnAgoB us Poccuu. B uucne sTux
«pyCCKMX» eBpeeB — Takwe M3BeECTHbIe GeATeNM, Kak OS, a= |,
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 266 of 277
VUspaunp | Mpoext
e Coo6weHve Oo KMIOYeEBLIX WHCPOPMALIMOHHbIX NMoBOAax (COObITHI,
BbICKa3biBaHvii JIOM, 3aaBneHui nugepos) B pamKax Mpoexta yepe3 KaHan
onepaTvBHoro OnoBeleHMA — CucTema “Tlynbc”;
e C6op AaHHbIX coLMonorMueckux yccnegoBaHui no tTemMam [lpoekta,
ony6nukOBaHHbIX B OTKPbITbIX ACTOUHMKaX.
2, AHanuTMy4eckan paboTa:
e Pa3zpa6oTKa pexomeHAaun no OCcBeLIeHHIO MUHCPOPMALIMOHHbIX NOBOAOCB;
e CwutyaTMBHbili aHanu3 pesoHaHCHbIx 3anBNeHui, BbICTyNNeHUN, COObITHN;
e Vsyyenve aHHbIX ONYONWKOBAHHbIX B OTKDbITbIX MCTOYNHMKAaX
coumonoruyecknx ViccneAoBaHU, NOATOTOBKa @HANUTMYECKMX BbIBOAOB,
e Paspa6oTKka MOoKnNagoB cnuKepoB Ha pa3snV4HbIX MeEPONPMATMAX B PaMkax
Mpoexta; paspa6otka Tem CeMuHapos / KpyrnbIx CTONOB B paMkax Mpoexta.
3. Co3gaHve v BegeHve ceTM OHNAanH-CMU (Bo3MOxKHa OpraHvzalivA NOA eAMHbIM
6peHaom “HopmanbHbin V3spannb”'):
e floptan-arperatop HoBocTen;
e TIl-kaHanbl;
® aKKayHTbi B TBMTTeP, cbeiic6yk, MHCTarpaM, 43eH, fOTy6-kaHan.
4. Pa6ota no TexHonoruueckomy “pasroHy” KOHTeHTa B CeTM — TapreTMpOBaHHan
pexnama.
5. Megvapa3smewenve (ny6nukayun maTepvanos B TT-KaHanax uv CMV Vspanna).
| Mpeanaraetca cozmaHve nonHOWeHHoro TpexbaAsbI4Horo (pyccKMi, UBPMT, aHMrnuiicKui), OPMEHTMPOBaHHOTO
Ha eBpelickne coo6ujecTsa no Bcemy Mupy, Npexge Bcero B Mspanne u CLUA «npasoro» VHcpopmMaL|MoHHoro
OHNawH-Npoexta.
®opmanbHo vpeonorveit Mpoekta DOMKeH GbITh yMepeHHO PENMIMOSHBIM CMOHM3M CBETCKMX eBpees
(MpuGnusutenbHo cooTseTcrByeT MAeONorn4ueckMM OCHOBaHUA NapTHH «JIMKkyA» UM «Penurno3HbiA CMOHMSM»,
BXOPALIMX B NPABUTENbCTBeEHHY!0 KOAMMUMI0).
BaxkHan YacTb ugeonormu Mpoexta — Gopt6a c 3aG6BeHHeEM NAMATH O XONOKOCTEe, TOYHEE, O TOM, KTO
VMeHHO 3aHMMarca YHAYTOKeHMeM eBpees Ha YKpaute, B Benopyccuu, B Nonbuie “ B Poccuu — ato 6binn
GaHAepoBLubl, ykpavHckne HAMOHANMCTbI, KOTOPLIM HacregyeT COBPeMeHHOe YKPaMHCKoe rocyAapcrTeo.
JlereHga Mpoekta — ero GeckopbicTHO AenaloT HepaBHOAYWHbIe AKTMBUCTHI, U3paWNbTAHE, YACTb M3 KOTOPbIX
npegnountaeT paGoTaTb AHOHMMHO.
PDF Page 268
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 267 of 277
Uspannb | Npoexr
6. Pa6ota B KoMMeHTapuAx — Nognepxka TeM B paMkax TJ, aTaku Ha ONNOHEHTOB.
7. Mabpuka no npovsBopcTBy KOHTeHTa (B T.4. CG TexHONOrMen “OONONHEHHON
peanbroctn”):
® WOPTpHAbI KM NOCTbI B COLICeTAX;
® KOMMeHTapMui;
® NOHTPUMABbI,
® BMZeOpomnKN, B TOM Ycne aHUMMpOBaHHbie;
® MeMBI, nvKUM;
® Kapukatypbi, cboToxKabbi.
KomaHga 4 OObembI paboTt
NMpoektHaan KomaHza:
® Mevemxmeut — ynpaBneHnve NpoeKTom.
[pynna moxuTopmirra CMU — exkegHeBHbIM MOHMTOPUHT.
e [pynna moHnTopuHra COLICeTen — BLIABNeHVe PESOHAHCHbIX BbICKASbIBAHUM JIOMos.
e fpynna avanvtuky — nogroToBKa aHanuTMyecknx MaTepvanos, COLMCCNegoBaHnn.
e [pynna kpeatusa — T3 Ha npovsBogcTBo, cneunpoekTbi, CO6CTBeEHHbIe MHCPONOBOAbI
(cdenxu).
e fpynna npon3BogcTBa — KapTMHKM, TEKCTbI, BAAEO.
e [pynna co6kopos Ha Tepputopun V3spanna uv mMeqnameHeppxep.
e Bwpo nepesoszos.
e fpynna pacnpoctpaHeHua — pasMeLeHve NOCTOB M KOMMEHTaApMeB B COL.CETAX.
e [Tpynma otyeTHocTh — cOop cTaTMcTMKM WM NMoOMb30BaTeMbCKUX peak\ni,
cbopmupoBaHne OTHeTOB.
O6tbemb! paGor:
e Moxwutopuer CMV u coucetel — 1 B GeHb.
e AxvanuTnyeckve cnpaBKM no CounccnegoBaHnaAM — 1 B HeEgenio.
ooo
eo
PDF Page 269
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 268 of 277
Uspannb | Npoext
AHanuTn4eckie CUTyaTMBHble MaTepuanbi — no 3sanpocy.
KaHan “llynbc — Uspaunb” — onepaTuBHoe onoBeleHve 0 COObITMAX MU 3AABNEHUAX
— MNOCTOAHHO.
Texctbi ny6nuKkauni (Ha noptan / Ha “sepKana” u3qaHui) — 4 B AeHb.
TekcTbI NOCTOB (Ha aKKaYHTb! B COL|CeTAX) — 20 B eHb.
KommexHtapuu — 300 B DeHb.
Tpadbuueckuii KpeaTMBHbIii KOHTeHT (MeMbI, KapMiKaTypbl) — 3 B DeHb.
BugeoponuKn — 3 B Hegenw.
AQMMUHUCTPMpOBaHHe KaHasioB, akKayHTOB, NOPTana — €xXEQHEBHO, NOCTOAHHO.
PDF Page 270
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 269 of 277
EXHIBIT I3A
PDF Page 271
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 270 of 277
Disaster 24: The US will soon have its hands full with issues other than Israel
Defense Ministry, United States, war in Gaza
The elections in the United States will lead to an unprecedented internal confrontation. The
most pessimistic experts are talking about the possibility of the country’s breakup and even
a large-scale civil war. How will this resonate in the outside world and, most importantly,
in the Middle East?
The US elections will undoubtedly become the highlight of 2024. They will overshadow any
possible turns in any war due to one simple reason — there is no chance that any election outcome
will be accepted not only by the country’s population, but also by the elite.
The decision of the Colorado Supreme Court to remove @Bittetenetrom the state ballot in
2024 opened the road to the de-legitimization of the election results. The court ruled that the
candidate Candidate A is not a suitable candidate for the US presidency
because of the 14" amendment’s “ban of insurrectionists”. The amendment states that officials
who have taken the oath to uphold the constitution are prohibited from holding office in the
future if they “participated in a rebellion”.
“No person <...> shall hold any office, civil or military, under the United States, or under any
state, who, having previously taken an oath, as a member of Congress, or as an officer or the
Unites States <...> to support the Constitution of the United States, shall have engaged in
insurrection or rebellion against the same, or given aid or comfort to the enemies thereof.”
The amendment was adopted in 1868, after the American Civil War, and was aimed at infringing
upon the voting rights of Confederate statesmen in the South, which was part of the occupational
policy of the victorious North during the so-called “Reconstruction”. In other words, the appeal
to it is already a sign of the serious divisions in society, comparable to the antagonism of the
Civil War. It is worth mentioning that classifying the march on the Capitol on January 6, 2021,
as an “insurrection” and classifying rene role as “participation in the insurrection” both
look like a fairly controversial statement, if not outright lawlessness. It is not a surprise that
members of the Supreme Court received a flood of threats since such ruling.
The State Supreme Court’s decision will be delayed until January 4, 2024, until (@eriteRraRt roan
appeals at the Federal Supreme Court. It is clear that the majority of (URSHIZOUSEeansaeas Within
the Federal Supreme Court will overturn this decision, yet it will not exhaust the narrative.
Colorado is a unique state. Traditionally a (URSE Meine anuamal State, it has voted for the
Meee rings) in the last three elections. Most likely now it is the (URS MIORITE Bisa s) who
will receive nine electoral votes in the state. It may not sound like much, yet still... QETHGHGETTAN
does not really need Colorado by itself. The main struggle is supposed to unfold in six so-called
“swing states” (swing state) in which neither (GAMO elm enaaes) nor (OReme ae) tiaterst me eclasraN
PDF Page 272
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 271 of 277
have consistent support: Arizona, Georgia, Michigan, Nevada, Pennsylvania, and Wisconsin.
That is where the main struggle will unfold.
The results of the latest polls in these states show that @RItIGETOwA is definitely ahead of
GemelGEWems| in five states: Nevada — 52:41, Arizona — 49:44, Georgia — 49:43, Michigan — 48:43,
and Pennsylvania 48:44. Only in Wisconsin maintains a slight advantage ~ 47:45.
However, judging by the overall dynamics, this won't last long.
However, Colorado has set a legal precedent that will spread to other states as well. Sixteen more
states have decided to follow Colorado’s example and demanded for ex-president GET YaieEitapay to
be banned from the primaries.
According to a significant number of experts, in the event of @RINIREIKeBAWS Victory (his victory
becomes more and more apparent if he cannot be removed from the elections), the leadership of
the democratic states may refuse to recognize the result by declaring the decision of the Supreme
Court unconstitutional. In the event of ORs removal, the CST will
refuse to recognize the election results. According to many experts, the emergence of separate
wonicegetenmem.).S. Political Party ARWMG§U.S. Political Party BERRIES re voambl cob
Movie director UBSHEdaisteme is making a film about a future civil war in the United States; the
film will be released by the time of the elections. It is not outside the realm of probability that the
events described in the film will begin immediately after the premiere.
How does this prospect threaten the rest of the world? Even if it does not lead to a civil war, a
purely political internal division will be enough for the US international politics to fall into a
stupor.
Today’s world is a collection of many frozen conflicts. Almost all of them are frozen, but many
of them have been really ignited by US efforts. Americans have not allowed any of those
conflicts to turn into final victory by either side, which would guarantee peace in a given region
for at least 15-20 years. Our war with HAMAS is onc of those conflicts that was switched on
when the plan to change the power in Israel “peacefully” through “a color revolution” failed...
In some ways, this activity resembles the activities of a terrorist, who is rigging with explosives a
house of civilians: “Should something happen to me, we all fly into the air together.” A world
rigged with explosives served as an additional guarantee of the American hegemony. But when
the terrorist suddenly falls in an epileptic fit, the explosives start to explode at random...
The world is facing a period of bloody chaos until the regional powers restore at least some
order. Unless, of course, those powers themselves fly at each other’s throats...
For Israel, wrapping the US in a cocoon of internal problems would mean international isolation,
greater than the one Russia is experiencing now. Europe has clearly demonstrated its readiness to
join the camp of Israel’s enemies. It is only the American leash that maintains a fragile balance.
,
PDF Page 273
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 272 of 277
It is important to understand that Europe will not be able to realistically help Arabs, as Europe
will be completely taken by what is happening by its eastern borders. There, without the
American support, Ukraine will be rapidly dismantled, and Russian troops will reach the
European border.
Israel will find itself in a situation when the external isolation will be compensated by the
absence of any external deterrent. We will fight the war as we see fit, without the American
shouts and unnecessary losses caused by the forced containment of the power of attacks on the
Arabs. In some ways, such situation would probably be preferable to what is happening today.
Conclusion:
Last year 2023 showed that the United States is deceiving Israel. If there is no support in 2024
either, the consequences will be horrendous for us.
Comments:
1. Getting the US variable out of the Middle East equation would not be the worst prospect.
Given the toughening of the @RRGIREIegs) administration’s position, assistance from the
US will dwindle, while the US interference will continue to grow.
2. Acivil war might be too bold of an assumption, yet a deep division is inevitable. The
division will be followed if not by a complete rejection of the involvement in the foreign
political activity, then by its significant weakening.
3. The solution of the Gaza problem will cost several years (or several decades) of
international isolation.
4. A civil war in a country with nuclear power would lead to an overly unpredictable course
of events. Let’s hope that the internal division will freeze at the “cold war” stage.
5. A war in the US is inevitable anyway, although it may not happen right after this election.
[CESPE aoe auags; are leading the United States in the path of Southern Rhodesia,
which turned into Zimbabwe. It means that the black population, despite all the
concessions from the whites, sooner or later will simply try to slaughter them.
Please write a comment of 200 characters on behalf of an average Israeli puzzled by the painted
prospect, yet who does not find it to be too terrible and who even finds some advantages in it.
PDF Page 274
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 273 of 277
EXHIBIT 13B
PDF Page 275
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 274 of 277
Katracrpoga 24: CHIA sexope craner ne 20 Wspania
MO, CIA, sotua B ase
Bet6opei 6 CIITA npusedym Kk Gbecnpeuedenmnom eHympennemy
NPOMUGOCMOAHUIO, CaMbIe NeccuMUCMU4Hble 9KChepmol Z060pam oO
603MOHCHOCMU PacKoO.a Cmpanoi u dasce MacuumabHOU z2pancdancKou eolinel.
Kak 2mo om3o6emca 60 6Heunem Mupe, U, 6 hepeyto ovepedd, Ha bausicnem
Bocmoxe?
[aBHBIM coOniTHem 2024 roa cTaHyT, HeCOMHeHHO, BbIGopsI B CLITA. Onn
3aCJIOHAT JOObIC BO3MOXKHEI€ MOBOPOTEHI B W060! BOHE To OAHOM MpocToH
IIpHunHe — HeT HMKaKHX MaHCoB Ha TO, YTO WHOGOH pesybTaT BEIOOPOB IpHMyT
He TOKO HaceJieHHe CTpaHbl, HO H IIHTEI.
Jlopory K TenHTHTHMallM pe3yIbTAaTOB — a pemleHue BepxosHoro
cyfla witaTa Konopano 06 uckmoweHHH 43 H30HpPaTebHOTO
OrojueTeHA Witara B 2024 rony. Cya NocTaHoBH, YTO KaHAMLaT OT
llapTHu He ABJIACTCA MOUXOUANIHM KaHTHaTOM B
TIpesuyeHTE CIA u3-3a «salpera MoBcTaHies», IpexycmoTpenHoro 14-H%
MOMmpaBkou. ITa WOmpaBka PacHT, YO TOMKHOCTHSIM JHWaM, aBuIHM KIATBY
TlosWepxKUBaTS KOHCTHTYIMIO, 3alIpellaeTca 3AHMMaTS AOIDKHOCTH B OyTyIIeM,
eCIM OHH «y4aCTBOBaJIM B MATE2KE)>:
«HH OHO JIHIO He MOXKeT 3aHHMATH <...> Kaky10-J1H60 JOJDKHOCTE, TparxkaHCKy10
WIM BOCHHY10, yupexkxqeHHylo CoequHeHHEIME Iltatamu wim KakKHM-J0H60
HITaTOM, €CJIM OHO B KayecTBe WieHa KOHTpecca WIM AOJDKHOCTHOTO JMIa
CoenuHenHer I Tatos <...> panee IpHHAB Ipucsry 0 TOM, 4TO OyeT
TlowWepykKHBaTb KouctTutyumo CIA, BsrocieyqCcTBHH yaacTBOBaJIO B MATe2KEe WH
BoccTaHHM OpoTus CIITA mo oka35IBaylo NOMOUIb WIM NOWWepxKKy HX Bparam)».
Tlonpaska Opa mpHHata B 1868 rogy, nocue [paxganckoit Bolte B CILIA, u
Oba HalpaBieHa Ha yolemMieHHe H3OnpaTeIBHEIX IpaB rocyTapcTBeHHBIX
neatenei Kondeepaliuu 10oKHEIX LITATOB, YTO OBO YACTHIO OKKyNaljMOHHOK
NONHTHKM NoGesquTeNei-ceBepsH B IepHor T.H. «PeKOHCTpyKIMm. T.e. camo
oOpalllenne kK Heli yKe ABILAeTCA IpH3HaKOM CepbesHelilero packolla B OOMIECTBE,
CpaBHHMOTro C aHTarOHH3MOM BpeMeH 'paxxaaHcKoi BoubI. He ropops yxe 0
TOM, 4TO H KBamMpuKanua Mapma Ha Kanutonuit 6 sapaps 2021 roa, kak
«MATEXK, H KBaIMpUKAaHA POI B ITHX COOBITHAX, KaK «y4aCTHE B
MATO2KE)> BLITILALAT KaK JOCTATOYHO ClIOpHoe YTBep»KTeHHe, CCIM He IpAMOH
FOpHAHAeCKHH npow3BoN. HeyAMBUTEBHO, 4TO WieHbI BepxoBHoro cya Mocue
TaKOTO pellleHHA CTONKHYIIHCL C IOTOKOM yrpo3.
PDF Page 276
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 275 of 277
Pemtenne Bepxosubiii cy mirata 6yyeT oTNO%xKeHO Zo 4 aHBapa 2024 roga, MoOKa
He Nofact allesiayHI0 B BepxoBybml cyy CILIA. Ouesnguo, uTo
60/MMHCTBO B BepxosHom cyze CLA ormeuut 9To pemienne.
Ho 5To OTHIODb He HCYepMaeT Crox*KET.
Konopayo — cheympuueckuit mat. TpayqvuHoHHO OTLalonMi Touoca 3a
| OH loculeqHHe Tpoe BLIGOPOB ToMOCcoBal 3a PF u
ceituac, B O6MIeM-TO, TOxKe, CKopee BCErO, HMCHHO AeMOKpaTbI Momy4aT 9 rosocos
BEIOOPLIHKOB wiTata. Hemuoro, Ho Bce-TakH. Cam m0 ce6e Konopayo | | He
OueHB HyKeH. OcHoBHad OopbOa ZOsDKHa pasBepHYTBCA B LICCTH T. H.
«KONeOMOMMXCA LITAaTaX» (Swing state), rye TpaqHuUHOHHO HH a
ae 5 HMEIOT YCTOHIMBOH ToyepxKH: Apu3ona, J>KopIDKHA,
Myuuran, Hesana, lescunspanua 4 BuckoncHH. BoT Tam H pa3BepHeTca
oOcHOBHaad OopbOa.
PesysIbTaThI MOCHe7HHX OMpOcoR B ITHX MITaTax MOKa3bIBaI0T, 4TO B UATH H3 HX
BE yscpenno ollepexkaeT | | Hesaya — 52:41, Apu3ona — 49:44,
J>xopmpxna — 49:43, Muauran — 48:43, [lencunbBanua — 48:44. TonpKko B
BuckoHcHHe WN coxpanser HeOoNbIIOe IpeHMyliecTBo — 47 mpoTus 45. Ho,
cya 10 OOiieH THHAaMMKe, ITO HeHaONro.
Ho Konopayo cosyan jopHyWueckKHH IpellezeHT, KOTOpEIM paciliIpoctpaHHTEca H Ha
upyrve urate. Enje niecTHagats WITaTOB peliMiM MOcNezOBAaTS IIpHMepy
Koslopayo 4 noTpeboBam He JOIycTHTb 9kc-pe3suzeHTa CILIA
AO lipaliMepu3.
Ilo MHCHHIO 3HA4YHTeIBHOTO YHCia IKCHEpTOR, B CIydae NOOe DBI a ona
CTaHOBHTCaA Bce Ooslee OUEBHAHOH, ECM ETO H€ CyMEIOT OTCTPaHHTb OT BEIOOpoB),
PYKOBOZCTBO TeMOKpaTH4eckHX IITATOB MOXKET OTKA3aTbCA MIpH3HaBaTb HX
pe3yIbTaT, OObABHB pemieHHe BepxoBHoro cya HEKOHCTUTYHMOHHEIM. B ciryaae
*Ke OTC — | Pe3yIbTAaTbI BEIGOPOB OTKAKYTCA IIpH3HaBaTb
Ilo MHEHHIO MHOrHX SKCIeEpTOB, BOZHHKHOBCHHE OTACJIBHEIX
Koneyepannii H IITATOB IIpeACTaBAeTCA
BeCbhMa BepOATHEIM.
Pexuccep I civacr K BbIOopaM MHIIbM O OyAyMleH rpaxTaHcKol
BoHHe B CIITA. He uck104ueHO, YTO OMMChIBACMbIe B HEM COOBITHA HAYHYTCA
cpasy llocule IpeMbepEl PHIbMa.
Wem Takad NepclieKTHBa Ipo3HT BCeMy OCTaJIbHOMY Mupy? /laxe ecum qen0 He
WOuper Jo rpakyaHcKoli BOMHEI, JocTarouHo SyyeT YMCTO NOMMTHYeCKOTO
BHYTPeHHero packola, 4TOOnI MexKTyHapozHad NowMTHKa CILIA Brana B CTynop.
CeroyqHaAMHMl 2ke MUp TpeycTaBaeT Cobo COBOKYNHOCTh MHOXKECTBA
3AMOPOXKCHHBIX KOHDIMKTOB. [louTH BCe OHH 3AMOpOXKEHEI, a MHOTHe H3 HHX TO
PDF Page 277
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 276 of 277
TOro pa3sox0KeHbI Crapanuamu CILIA. Hu ofHomMy 43 HHX aMepHKaHUBl He
NO3BOIMIM JOHTH TO OKOHYATeIEHOH NobeABI OHOH 3 CTOpOH, 4TO
TapaHTHpoBasio Obi Mp B KOHKpeTHOM perwoue no KpaiiHeli Mepe Ha IpoTsKeHHM
15-20 ner. Hama Botta c XAMAC — om 43 TaKHX KOHIMKTOB, KOTOPHIM 6B
BKJIIOUEH, KOIZa NOTepnel KpyHleHve WiaH CMCHHTS BACT B M3pane «MHPHEIM
IIYT€M>), Yepe3 “IBETHY1IO PEBOIIIOMHIO»>...
B 4eM-TO 91a JeATeMBHOCTS HaNOMHHacT JeATCMbHOCT Teppopucta,
MHHHpytolero OM C MHPHbIMH 2%KHTeIAMM: «EcM CO MHOH 4TO-TO CIy4uTcaA — Ha
BO3]IyX B3JICTHM BCe BMeCTe»>. 3aMHMHMPOBaHHBI MHP CINK JONOWHUTeIBHOH
TapaHTvei aMepukaHckoH reremouun. Ho korya TeppopucT BOpyr HayHHaeT
OHTECA B SMIMIeNTH4YeCKOM NpHNayKe — MHHbI HAYMHAIOCT B3PbIBaTbCA B CILyYaHHOM
HOPADKe...
Mup 2yeT nepHog KpoBaBoro xaoca, NOKa perMOHAJIBHEIe [ep2KaBbl HABeEYT XOTB
KaKOH-TO NOpANOK — €CJIM, KOHEYHO, CaM 3TH [ep KaBbl He BUCHATCA ApyT Dpyry B
TIOTKy...
Ana M3panna 3akanpanve CUIA B kokoHe BHYTpeHHHX MpoOJeM O3HayaeT
MCXKTYHAapOAHY!O H30JALHIO, OOMbITYIO, 4EM Ta, B KOTOpOH ceityac HaXOMHTCA
Poccua. Espona HarmagHo JeMOHCTpHpyeT rOTOBHOCTS MepelirH B Jarepb BparoB
Us3pansa, TOMBKO aMepHKaHCKH NOBOLOK NOATepKUBaeT XPyMKOe paBHOBEcHe.
Apyroe Zeno, ur0 MOMO4B apabam Ae0M Espona 6yaeT He B COCTOAHHH — OHA
OyHeT HOMHOCTHIO NOroMeHa MpOHCXOTANIMM Ha CBOMX BOCTOUHBIX [paHulax,
rye 6e3 amepHKaHCKOH NOaTepxKKH IPOH30H eT CTpeMHTCIBHEM JeMOHTaK
YkpanHEl, 4 pyCcKHe BOlicka BbIligzyT Ha rpanuiry EC.
Vi3panit OkakeTca B CHTyallHH, Kora BHeENIHA H30NMIUA OyneT
KOMIICHCHPOBaTbCA OTCYTCTBHEM KaKOTO-IHO0 BHELIHETO Cep2xKHBalolero
dbaxropa. Msi 6yaem BecTH BOiiHy Tak, KaK CUMTaeM Hy2KHBIM, 6e3 aMepHKaHCKHX
OKPHKOB H JIMIUHHX MOTepb, BEISBAHHBIX BbIHYKCHHBIM C]epxKHBaHHeM MOL
yaapos m0 apaOam. Bo3Mo2xHO, B KaKOM-TO CMBICJI¢ Takad CHTyallMa OKaKeTCA
OosIee NpeTMOUYTHTeIEHOH, YeM TO, YTO MPOHCXOUT cerogHA.
TlogqBognKa:
I[pomenmuit 2023 roy noka3am: CILIA oOMaHsiBatoTt M3pannp. Ecru u B 2024
roay noyepxku He GyzerT, NocneycrBus TILA Hac 6ynyT yKacHBIe.
Kommeutapuu:
PDF Page 278
Case 2:24-mj-01395 Document 4 Filed 09/04/24 Page 277 of 277
1. BrikouHTb 43 OWKHEBOCTOUHOLO ypaBHeHHA TlepemeHHyro CIITA — He
caMaa Xyfllad MepcnekTuBa. YaHTEIBad yKeCTOUCHHe NOSHOHH
aMHHMcTpanHH — aMepHKaHcKad TOMO OyzeT CXOJHTb Ha HET,
a IIOMeXH C ee CTOPOHEI OyTYT TONBKO BO3pacTaTB.
2. [paxkqaHckad BOHa — CIHUIKOM CMesI0e FOMyMeHHe, HO rmyOoKHH pacKol
Hen36exeH. A 43 HELO CileqyeT CCH He TOMHBIM OTKA3 OT
BHeMIHenoNHTHYeCKOM AKTHBHOCTH, TO, CyMeCTBeHHOE ee ocaOmeHHe.
3. Penienue npobmemb [a3bl CrouT HECKOJIBKMX (HJIM HECKOJIBKHX J[CECATKOB)
JleT MCKTYHAapOAHOM H3OIANMH.
4. [paxjaHckas Bola B CIpane c A}epHbIM Opy2KHeM — CJIHDIKOM
Helpescka3yeMBbIM Xo coOLITHH. byeM HayeaTbca, BHYTPpeHHU packoll
3aMep3HET Ha CTaQHH «XOOUHOH BOMHED>.
5. Boitua 8 CLA Hen36exHa B OOM cirydae, IYCTb TaxKe He Mocie THX
BBIOOPOB. BE