“Mai vista una tecnologia così sofisticata per organizzare le proteste”, dice Lorenzo Alvisi, dottorando del Programma Nazionale in Cybersecurity presso Scuola Imt Alti Studi Lucca. È tra gli autori di un’analisi preliminare sul ruolo svolto dalle piattaforme digitali nell’organizzazione delle proteste esplose il 17 ottobre. Uno studio in attesa di pubblicazione, ma ilfattoquotidiano.it può già anticiparne i dettagli. Spicca un dato: “Cinque admin e un fondatore che controllano tutto”, dice l’esperto, illustrando un messaggio in chat. Appare in automatico, ogni volta che un utente porge domande sulla struttura di comando.

Il report traccia la mappa della galassia online marchiata “Italia in piazza”, tra i detonatori delle iniziative di protesta: un sito web e circa 40 gruppi, tra pagine TikTok e 19 chat Telegram. Instagram, secondo Alvisi, è solo la copertina e la costola meno importante. “Telegram ha compiti di coordinamento, ma il motore è TikTok”, dice il ricercatore. “È il social network della generazione Alfa, ragazzini delle superiori nati dopo il 2010”, aggiunge. Dunque minorenni intorno ai 16 anni. Mentre un piccolo nucleo di sei admin controlla la rete di 19 gruppi Telegram, sorti il 7 ottobre. Il motivo? La chat WhatsApp, battezzata Italia in piazza 17 ottobre all’inizio dello stesso mese, era frenata dal tetto per gli iscritti: massimo mille. Dunque, stando al report, l’8 ottobre chiude i battenti e trasloca su Telegram, senza vincoli al numero dei partecipanti. La chat nazionale copia il nome da WhatsApp: Italia in piazza, togliendo la data. Le 18 edizioni locali si distinguono adottando nomi di città e regioni.

“Sul gruppo nazionale, al 19 ottobre, si contavano 4.073 utenti”, dice Alvisi. In totale “saliamo a 9.010, ma la stragrande maggioranza degli utenti locali partecipa anche alla pagina nazionale”, prosegue il dottorando. Le 19 chat Telegram condividono lo stesso stemma: un megafono nero. E rimandano l’una all’altra: quando un utente chiede lumi sui vari gruppi, risponde un bot offrendo l’intera lista dei link. Quando si invocano informazioni sui capi, il bot firma un messaggio automatizzato con i nomi dei profili al comando delle chat: “Fondatore: Andrea, web developer. Vice-fondatore: Ludo, staff. Amministratore: Ily, staff. @Marco, staff. @nonbannato. @ssoqquadro, moderatrice”. Sei nomi inventati, nessun indizio sulle persone reali. Non sappiamo se il profilo Andrea sia il creatore delle 19 chat Telegram. “Ora il profilo è chiuso, ma nei messaggi appare come il fondatore”, dice Alvisi. Il nickname Andrea nasce contestualmente alla chat nazionale. Suo è il primo post, il 7 ottobre. Lui è il creatore dei topic, gli argomenti discussi dagli utenti. Il mare è l’immagine del suo emblema, “iltuoprefe2” come tag per essere trovato dagli altri utenti.

Alvisi delinea la struttura al comando della galassia Telegram: “Sei admin detengono il nucleo del potere, Andrea è tra gli amministratori di tutte le chat tranne due, dove non c’è lui è presente Marco”. Gli admin tengono le redini: escludono gli utenti con un ban, decidono chi accogliere, restringono o ampliano i poteri di centinaia di moderatori, mettono in evidenza i messaggi in chat orientando il dibattito. Poche persone, una struttura decentrata, per depistare l’identificazione. Se cade una delle 19 gambe Telegram, il corpo resta in piedi. Una pianeta in grado di calamitare infinite orbite delle proteste: “Se voglio organizzare una contestazione in una scuola, conviene spedire un link in quella rete, già ricca di migliaia di nodi”, dice Alvisi. L’esperto tira le somme della ricerca preliminare: “Mai prima d’ora le proteste avevano poggiato su un’infrastruttura tecnologica così complessa e coordinata”. Sito web con link a decine di gruppi, chat e comunità, bot automatici per gestire i collegamenti, sfuggendo a ogni radar, perché “nessuno aveva idea di cosa stava succedendo”. Sabato 24 ottobre si annunciano proteste nelle più importanti città d’Italia. Sarà il banco di prova, per capire se dalle chat si scende in piazza.

L'articolo “19 chat Telegram controllate da sei admin”: chi c’è dietro “Italia in piazza”, la galassia social che organizza le proteste proviene da Il Fatto Quotidiano.

Sergei Kiriyenko, first deputy chief of staff of the Russian Presidential Administration, set the goals for the Ukraine strand of the operation, launched in early 2023 under the codename "Uganda." Alexander Kharichev, now head of the Kremlin's Directorate for Monitoring and Analysis of Social Processes, oversaw it, according to hacked correspondence published by The Insider on 21 October.

Doppelgänger disguises Russian narratives as local news through cloned media sites, fake accounts, paid ads, and fabricated videos. The FBI named Kiriyenko among its orchestrators in 2024, and its contractor, the Social Design Agency (SDA), run by Ilya Gambashidze, is still expanding, now targeting AI chatbots. The new files go inside the Ukraine campaign and show the operation reporting even exposed fakes to the Kremlin as achievements.

Telegram channels posing as Ukrainian

An internal briefing on narratives says the project ran its Telegram channels on the principles of agent work and psychological operations, the Russian version of the investigation shows. Early on, the team decided to disguise all its outlets as Ukrainian and to run its campaigns without direct Russian propaganda. Every channel carried Ukrainian news to look unconnected to Russia. Dropping pro-Ukrainian themes, the briefing warned, would eventually expose the client and wreck the whole plan.

Explore further

Russia-linked bot networks kept their weekly rhythm after drone strikes on three Yandex data centers—disinformation monitor LetsData

Four goals and a can of stew

Kiriyenko set four goals: discredit Ukraine's military and political leadership, split its elites, demoralize its army, and disorganize its population. The SDA prepared the project's pitch and carried out the work.

Political strategist Alexander Asafov proposed fakes of his own: in May 2023, that soldiers were bribing commanders to avoid the front, and in January 2024, that Ukraine was pulling air defenses back to Kyiv to protect the authorities.

After an Il-76 military transport crashed in Belgorod Oblast on 24 January 2024, Moscow claimed it had been carrying Ukrainian prisoners of war. Kharichev's subordinate Yevgeny Kazakov, chairing a meeting in his place, proposed sending a fake to the widows of Ukrainian soldiers: "They died for an expensive Il-76—the Russians have few of those." The idea was dropped.

The same meeting produced another fake, and three days later the team launched it: that recruitment centers had sent widows a can of stewed meat with a little flag as compensation. The same producers also oversaw letters falsely attributed to Deputy Defense Minister Nataliia Kalmykova, the Russian version says.

Debunks filed as results

The SDA collected coverage of its work in a folder for the Kremlin. It filed the "Zelensky's yacht" story, which JD Vance, then a US senator and now US Vice President, echoed, together with its debunk. The report also included a TikTok campaign about former Defense Minister Oleksii Reznikov's family that the BBC had already exposed.

The Insider concludes that the team has had more failures than successes. The US sanctioned Gambashidze and the SDA in March 2024, and the UK followed in October.

In recent days, a Ukrainian drone strike hit Russia’s largest data center, owned by bank and technology company Sberbank. The strike came after Ukraine hit three data centers belonging to the tech giant Yandex, which is often referred to as “Russia’s Google.” After those attacks, Yandex’s traffic dropped 94%. Its users experienced heavy disruption to […]

The post Data centers in the line of fire of Ukraine war appeared first on Asia Times.

Ukraine’s Security Service (SBU) detained two men suspected of scouting targets for Russian strikes on Sloviansk and Dnipro, the agency reported on 14 October. Catching both early let it secure Ukrainian reserve command posts and the gas stations the alleged agents had been hunting, the agency added.

Sloviansk anchors the northern end of the Fortress Belt, the chain of fortified cities that has held Ukraine’s defense of Donetsk Oblast since 2014. Russia is pushing to seize them, and its aircraft bombed a residential area of Sloviansk on 11 October. Where Ukrainian convoys stop and troops gather is exactly what Russian handlers allegedly asked these suspects to supply.

A gas station worker suspected of filming convoys

The first suspect worked at a gas station complex in Sloviansk, Donetsk Oblast. Russian intelligence allegedly reached him through a former classmate who left for Russia after the full-scale invasion and now works for its special services, the SBU said. He then allegedly used his phone to secretly film Ukrainian army convoys at or near gas stations. He was allegedly supposed to send the photos and videos to Russia to help it prepare a targeted strike. He also allegedly drove his own car around other gas stations and bridges that the Defense Forces use for logistics.

Spotted through Telegram comments

The second suspect, a former Pokrovsk resident, moved to Dnipro in 2024 and settled in a dormitory. Russian intelligence noticed him through pro-Kremlin comments he posted in Telegram chats, investigators say. A female handler in Russia allegedly tasked him with guiding missile and drone attacks on places in the city where Ukrainian troops and equipment were concentrated. He allegedly scouted on foot or took public transport to reach outlying districts.

Explore further

Ukrainians think their own security service is calling—it’s Russia recruiting saboteurs

Officers seized computers and smartphones containing evidence of the men’s alleged work for Russia. Both are suspected of treason under martial law and of unauthorized dissemination of information on Ukrainian troop movements or deployment, under Articles 111(2) and 114-2(2) of the Criminal Code. They remain in custody without bail and face up to life imprisonment with confiscation of property. The SBU’s office for Donetsk and Luhansk oblasts ran the operation under the Donetsk Oblast Prosecutor’s Office.

On the night of March 20, 2024, unusually humid and mild in London, three people in their twenties pulled up at an industrial estate in the east of the city in a cherry-red Kia Picanto. They went inside, set fire to a warehouse, and filmed the blaze on a cellphone. The video of the flames consuming the premises ended up in the hands of another 20-year-old, Dylan Earl, who was reached via the Telegram messaging app by the Russian paramilitary organization Wagner, linked to the Kremlin, which had in turn recruited others to do the dirty work. One of the burned units contained humanitarian aid and Starlink satellite equipment destined for Ukraine. According to the British investigation, the three young men who lit the fuse did not know they were actually working for Russia.

Seguir leyendo