Assessing cost-effectiveness: responses to the Doppelganger operation

This EU DisinfoLab analysis assesses the cost-effectiveness of responses to the Russian Doppelganger influence operation, which clones legitimate media outlets and spreads cloned links and ads across X, Facebook and Telegram. It evaluates actions by media, civil society, platforms, and authorities between May 2022 and April 2024 across five dimensions: situational awareness, impact on threat-actor capability, triggering of new responses, attribution, and deterrence.

The report finds situational awareness high among analysts and journalists but slower among public institutions, and that takedowns and sanctions — including EU sanctions on seven individuals and five entities in July 2023, US sanctions in March 2024, and four successful domain transfers via UDRP procedures — disrupted but did not eliminate the operation, as its operators continued adapting tactics with apparently ample resources.

It concludes that deterrence has not been achieved, with the operation persisting into its second year, and calls for improved researcher data access, a broader definition of vetted researchers under the DSA, and greater engagement with domain registries as key intermediaries.