The violence accompanying France’s October protests has revealed how foreign influence networks can exploit domestic grievances to undermine governments and European support for Ukraine. New evidence suggests Russian-linked operations were active before the riots, raising questions about whether information manipulation is moving beyond propaganda towards the mobilisation of political unrest.

France’s violent protests have exposed a vulnerability in European security that conventional policing cannot easily address: the ability of foreign information networks to exploit domestic political crises, amplify social divisions and transform legitimate grievances into instruments of geopolitical pressure.

President Emmanuel Macron has acknowledged foreign manipulation of information surrounding the disturbances of 17–18 October but insists there is no evidence that foreign actors organised the violence itself. His assessment reflects the evidence currently available, although new investigations indicate that Russian-linked networks were actively exploiting the protest movement weeks before the worst disorder began.

On 24 October, France deployed approximately 70,000 police officers and gendarmes to prevent further violence. Yet the security operation addresses only the physical consequences of a crisis whose online dimension extends across national borders.

Russia’s operations began before the riots

An investigation published on 22 October by Alliance4Europe provides evidence that Russian-linked information networks were exploiting French discontent well before the disturbances.

Researchers examined 547,471 posts and articles across nine languages. They identified 639 coordinated messages attributed with high confidence to Russia’s Doppelgänger operation, generating approximately 7.4 million views in the six weeks preceding 17 October.

The campaign used genuine concerns about living costs and public expenditure to promote a particular political argument: money allocated to Ukraine was being taken from European citizens.

This was not a random selection of grievances. France’s budget difficulties, public-service pressures and disagreements over defence expenditure provided material through which Moscow could seek to weaken support for Kyiv.

The researchers found that the operation targeted pro-European and pro-Ukraine politicians across the political spectrum. It praised selected proposals associated with Jean-Luc Mélenchon while also promoting nationalist narratives, illustrating a strategy driven less by ideological consistency than by opposition to existing European policies.

From manipulating opinion to encouraging mobilisation

An earlier investigation by EK Strategies, published on 8 October, identified an additional development.

Russian-linked channels were not merely commenting on existing demonstrations. They were circulating protest dates, identifying organisers and encouraging French audiences to follow the example of demonstrators in Germany.

On 28 September, the International Reporters network published an appeal urging French audiences to take to the streets. Other channels subsequently reproduced information about planned school blockades and demonstrations.

In one instance, a channel identified as Gavroche published rhetoric encouraging an attack on France’s Education Ministry.

Such activity goes beyond retrospective propaganda. It attempts to influence participation and behaviour while events are developing. Nevertheless, evidence that a network encouraged protests does not establish that it controlled the organisers or directed subsequent violence.

The original demonstrations arose from domestic grievances over schools, prices and government policy. The significance of the foreign activity lies in attempts to redirect and intensify an existing movement.

How France’s crisis was rewritten abroad

Once violence erupted, the information campaign acquired an international audience.

Alliance4Europe found that claims blaming migrants or Islam for the disturbances appeared in approximately one in 33 French-language posts, compared with nearly one in five English-language posts.

False allegations that immigrants had burned Limoges town hall circulated substantially more frequently in English than in French.

The same report identified 1,018 articles distributed through 28 websites associated with the Russian Pravda network. Their rapid republication across languages enabled a common narrative to reach audiences far beyond France.

The operation also presents a longer-term technological problem. Repeated publication of manipulated accounts can contaminate material subsequently retrieved or reproduced by artificial-intelligence systems, allowing false narratives to persist beyond the original campaign.

The political effects were visible when President Donald Trump and other foreign leaders portrayed France’s unrest principally through immigration and cultural conflict.

Speaking in Qatar on 21 October, Macron rejected these portrayals and criticised the circulation of fabricated AI-generated images. His remarks identified foreign manipulation after the riots but stopped short of alleging foreign responsibility for their organisation.

The Heritage Foundation and transatlantic networks

The transcript raises a more substantial allegation: that the American Heritage Foundation and Russia’s FSB have participated in a coordinated effort to destabilise France.

There are documented connections between the Heritage Foundation and political institutions associated with Hungary’s former prime minister Viktor Orbán.

A 2026 investigation into Hungarian-funded international influence networks established that the Danube Institute had channelled substantial public funding towards foreign researchers and commentators. The institute also maintained a formal relationship with Heritage.

Heritage has acknowledged its cooperation with Hungarian conservative institutions but denied receiving funding or direction from foreign governments.

These relationships demonstrate the development of transatlantic political networks capable of circulating common ideas about sovereignty, migration and European integration.

They do not establish operational cooperation with Russian intelligence. Nor has credible evidence emerged connecting Heritage to the organisation or financing of France’s October riots. Ideological convergence, institutional cooperation and participation in a clandestine operation require separate evidential assessments.

The implications for European security

The European Union’s response has exposed a regulatory problem.

Under the EU’s Digital Services Act, major online platforms must address systemic risks arising from their services, including the amplification of illegal content and threats to public security.

On 23 October, the French government announced enhanced cooperation with digital platforms. More than 100 priority reports had been submitted ahead of the weekend demonstrations, approximately half resulting in account suspensions.

These measures targeted unlawful online activity, particularly incitement to violence and looting. They did not constitute findings that the suspended accounts belonged to foreign intelligence networks.

The European Commission has likewise refrained from activating emergency measures under the Digital Services Act without sufficient evidence connecting foreign manipulation to the violence.

The broader security concern is that foreign operations can exploit the interval between the emergence of social unrest and the establishment of reliable information about its causes.

Russia need not organise an entire protest movement to advance its strategic interests. By amplifying domestic grievances, promoting hostility towards support for Ukraine and circulating distorted accounts internationally, it can attempt to convert France’s internal political difficulties into pressure on European policy.

With France approaching its 2027 presidential election, these operations warrant continuing scrutiny. The central investigative question is no longer simply whether foreign networks spread false information after violence occurred, but whether their activities before and during demonstrations materially influenced mobilisation, radicalisation or political responses.

The evidence currently demonstrates organised manipulation and attempts at amplification. Establishing direct responsibility for violence would require a further evidential step, involving financial records, communications, operational instructions or connections with identifiable perpetrators.

France’s experience illustrates how contemporary information warfare can operate within a democratic society without necessarily directing events on the ground. Its immediate objective may be to alter the political interpretation of a crisis; its longer-term consequence may be to influence the policies adopted in response.

Italian authorities are examining whether foreign interference helped intensify violent protests across the country, as Defence Minister Guido Crosetto warns that social media is being used as an instrument of hybrid warfare. Prime Minister Giorgia Meloni has introduced emergency security measures and deployed additional troops to Milan, while further demonstrations are planned for Saturday, 24 October.

Italy is investigating the possibility that foreign actors, including Russian operatives, helped amplify the violent unrest that swept Milan and other Italian cities on 17–18 October. The inquiry introduces a national security dimension to demonstrations initially driven by rising living costs, dissatisfaction with public services and broader economic grievances.

According to information disclosed about the government’s intelligence inquiries, officials working under Prime Minister Giorgia Meloni have requested assessments of whether foreign provocateurs contributed to the disorder. No public evidence has established that Moscow organised the violence, and Meloni’s office has declined to comment on the reported intelligence discussions.

The developments follow EU Today’s earlier coverage of the Milan disturbances, which documented extensive looting, attacks on police and the detention of hundreds of young people, many of them minors. Since then, Rome has moved beyond emergency consultations, approving legislation that expands police powers and introduces tougher criminal penalties for violent demonstrations.

On Saturday, 24 October, Italian security forces are preparing for another wave of protests, with additional military personnel, drones and specialist police units deployed in several major cities. The immediate question is whether the government can prevent further disorder while establishing how much of the unrest was locally organised and whether foreign information operations influenced its development.

Crosetto warns of hybrid warfare through social media

Defence Minister Guido Crosetto introduced the hybrid warfare argument during a Defence Procurement Forum in Rome on Tuesday, 20 October. In remarks recorded by Italian public broadcaster Rai, he described the disturbances as the culmination of a form of conflict being conducted through TikTok, YouTube and other social media platforms.

Crosetto argued that young Italians were undergoing what he called a form of counter-education outside their families and schools, absorbing political attitudes and values increasingly hostile to democratic institutions. He criticised Western governments for failing to recognise the consequences of this process, although he did not publicly present intelligence establishing Russian responsibility for the riots.

His comments also exposed differences within the governing coalition. Deputy Prime Minister Matteo Salvini questioned suggestions of Russian involvement, arguing that the immediate priority was identifying violent groups and preventing their movement into Milan.

Russian information operations under scrutiny

European investigators have identified activity by established Russia-linked disinformation networks, including Operation Overload and Doppelgänger, which have circulated and amplified material concerning the unrest.

These operations have previously used manipulated content, misleading narratives and coordinated online distribution to influence European audiences. In the present case, investigations into the online amplification of the violence have identified foreign exploitation of the disturbances, rather than proof that foreign governments organised them.

The European Commission has consequently declined to initiate emergency intervention against social media platforms, citing insufficient evidence linking foreign manipulation directly to the organisation of the protests.

France has taken a similarly cautious position. President Emmanuel Macron acknowledged that foreign actors had manipulated information after the violence but said there was no established evidence that they caused the disturbances. French Foreign Minister Jean-Noël Barrot has separately identified hostile narratives originating from Russia, China and Iran.

For European security authorities, the principal investigative question concerns the relationship between genuine domestic grievances and externally coordinated information campaigns. Foreign networks can exploit political divisions without necessarily directing the organisations or individuals involved in street violence.

Meloni introduces tougher security legislation

Meanwhile, Meloni’s government has proceeded with a substantial legislative response. Following cabinet approval on 20 October, Decree-Law No. 190 of 22 October 2026 entered into force on 23 October.

The legislation introduces penalties of two to five years’ imprisonment and fines of €10,000 to €20,000 for specified forms of organised violence during public demonstrations. Those organising or encouraging qualifying violent groups, including through digital communications, face potential prison terms of four to twelve years. It also expands provisions concerning juvenile offenders and preventive policing. The decree must undergo parliamentary consideration within 60 days.

Separately, the Italian Defence Ministry confirmed the deployment of 500 additional soldiers to Milan under Operation Strade Sicure until 31 December. The soldiers will reinforce security around sensitive locations and support existing police operations without acquiring additional judicial policing powers.

New demonstrations test the government’s response

Security arrangements have been intensified ahead of demonstrations scheduled for Saturday, 24 October, in Milan, Rome, Turin, Bologna, Florence and other cities.

According to the latest security preparations, Rome is deploying approximately 1,500 officers, while Milan is preparing a combined police and military presence supported by aerial surveillance.

On Friday, Italian investigators conducted searches targeting approximately 100 people suspected of involvement in the previous weekend’s disturbances, including 51 minors. Authorities are also monitoring online calls for renewed protests, some organised by groups whose leadership and membership remain unclear.

The unrest presents Meloni with two parallel challenges: containing violence and determining whether hostile foreign networks have played a significant role in its escalation. Italy’s investigations may help establish whether the events represent primarily a domestic public-order crisis, the exploitation of existing tensions by foreign actors, or a combination of both.

For Brussels, the outcome could influence future enforcement of the EU’s Digital Services Act and its wider response to foreign information manipulation. For now, the evidence supports concern about Russian amplification of European unrest, but not a definitive conclusion that Moscow orchestrated the riots.

The EU General Court has upheld the European Commission’s decision to classify Stripchat as a very large online platform, establishing important limits on how technology companies can challenge the calculation of their European user numbers.

The European Union’s General Court has rejected a legal challenge to the European Commission’s classification of adult entertainment platform Stripchat under the Digital Services Act, strengthening Brussels’ authority to determine which online services must comply with the legislation’s most demanding obligations.

In its judgment delivered on 14th October, the Luxembourg-based court dismissed the action brought by Technius Ltd, the company operating Stripchat, against its designation as a very large online platform.

The dispute centred on how the Commission calculated the platform’s average monthly active users in the European Union, which determines whether additional regulatory obligations apply.

Under the Digital Services Act, platforms exceeding 45 million monthly active recipients in the EU are subject to enhanced supervision, including requirements concerning systemic risks, transparency, content moderation and independent auditing.

The judgment addresses a fundamental question for European digital regulation: whether companies can exclude particular categories of website visits when calculating the number of people using their services.

How Brussels challenged the platform’s figures

In February 2023, Technius reported that Stripchat had approximately 31.8 million average monthly active recipients in the EU, placing it below the threshold for very large online platforms.

The company relied on information provided by Similarweb, a commercial service measuring website traffic and user behaviour.

However, the Commission questioned the methodology used to reach that figure. Technius had discounted certain visits on the grounds that users entered the website but departed without engaging with its content.

Such visits are commonly described as bounced visits and frequently appear in commercial website analytics.

The Commission concluded that the company’s deductions had significantly underestimated its audience because the original Similarweb calculation of unique visitors already incorporated a filtering process excluding many bounced visits.

On that basis, Brussels calculated that Stripchat had more than 62 million monthly unique visitors in the EU, well above the statutory threshold.

The Commission consequently designated the platform as a very large online service on 20th December 2023. Technius challenged the decision, arguing that the figures were unreliable and that the absence of a prescribed calculation methodology undermined legal certainty.

The EU General Court rejected both arguments.

Court rejects challenge to calculation methodology

According to the court’s official explanation, the Commission had adequately explained its calculation and was entitled to rely on the data available when the designation decision was adopted.

The judges found that Technius had effectively applied deductions to figures from which relevant traffic had already been filtered, producing an artificially reduced estimate of active recipients.

The judgment also addressed a potentially significant complication.

After the Commission adopted its decision, Similarweb revised its methodology. Using the corrected method, Stripchat’s estimated monthly active audience for the relevant period was approximately 37.3 million.

That figure was below the threshold for classification as a very large online platform. Nevertheless, the court held that the subsequent correction did not invalidate the original designation.

The judges determined that the Commission’s decision had to be assessed according to the facts, applicable law and permissible evidence available when the decision was taken.

The ruling therefore does not establish that Stripchat currently exceeds 45 million monthly users. It confirms that the later recalculation was insufficient to annul the Commission’s December 2023 decision.

A significant precedent for digital regulation

The consequences extend beyond one adult entertainment website.

The Digital Services Act covers online intermediaries operating in the European market, including social networks, marketplaces, hosting services and other platforms.

Its obligations increase according to the size and nature of a company’s operations. Very large online platforms must assess systemic risks associated with their services, introduce appropriate mitigation measures and submit to independent audits.

The Commission is responsible for supervising their additional obligations and can impose substantial financial penalties for established infringements.

The distinction between the two categories can therefore have considerable financial and operational consequences.

Companies falling below the 45 million threshold remain subject to relevant DSA obligations but do not face the same additional requirements imposed on the largest platforms.

The General Court’s ruling confirms that companies cannot escape designation by applying an unreliable interpretation of website traffic data.

At the same time, the Commission’s published supervisory framework allows a designation to be revoked when a platform remains below the threshold for a full year.

European technology enforcement faces growing scrutiny

The judgment comes as the Commission faces multiple legal challenges to its enforcement of Europe’s digital legislation.

As EU Today previously reported, Washington has sought to intervene in proceedings concerning the Commission’s €120 million Digital Services Act fine against X, introducing an additional diplomatic dimension to European regulatory disputes.

The Commission is also pursuing separate investigations into whether major platforms comply with obligations concerning the protection of minors, advertising transparency and the management of illegal content.

In another case examined by EU Today, Brussels reached preliminary findings concerning TikTok’s default privacy settings for children, illustrating the practical consequences of the stricter duties imposed on very large online platforms.

The Stripchat judgment concerns designation rather than a finding that the company breached any substantive safety obligation. Its immediate consequence is to preserve the Commission’s original classification decision.

Technius may still appeal to the Court of Justice of the European Union on points of law within two months and ten days of notification of the judgment.

For European regulators, the decision provides judicial support for using established commercial analytics when assessing the reach of online platforms, provided that the methodology is adequately explained and the underlying evidence is reliable.

For technology companies, it confirms that the legal assessment of user numbers extends beyond the figures they choose to report to Brussels. The Commission can scrutinise those calculations and reject methods that fail to provide a reliable estimate of an online service’s European audience.

In December 2023, a Belarusian KGB representative entered an online seminar organised by the Belarusian Free University and told participants that everything was under the service’s control.  

The following month, the online university, run from exile, was designated an “extremist entity”.

It was a warning that being in exile in a safe country does not necessarily put independent voices beyond the reach of authoritarian states. 

For people forced into exile, reaching the EU should mean being able to continue their work without fear. Yet repression follows them into the digital spaces where they organise, report, and communicate. “We can never be sure who is behind a switched-off camera in our online meetings,” one interviewee told us.  

ARTICLE 19 Europe’s new report, 404: Safety not found?, draws on interviews with exiled targeted journalists, human rights defenders working in Belarusian and Russian language environments, as well as digital security experts who try to protect them. Respondents identified Belarusian and Russian state-linked actors as major sources of threats, while stressing how difficult it is to attribute individual incidents. 

The research documents phishing attacks that expose private communications and trusted contacts, including people inside repressive states. It also shows how platform moderation is manipulated through coordinated malicious complaints.

“Extremist” and “foreign agent” designations deter audiences from sharing or subscribing to independent media. A publication may lose sensitive records built up over years, or remain online yet lose contact with the people it exists to inform. 

The harm extends beyond the person whose accounts are compromised. Stolen information may be used to pressure colleagues and relatives, while fear and mistrust drive self-censorship and withdrawal from public work.

For dispersed organisations with few offline ways to reach audiences, losing access to a platform can threaten their ability to function. 

To an external observer, those attacks might seem like a scattering of isolated incidents. They are not. Digital transnational repression is a coordinated, evolving strategy – and treating it as anything less than a systemic risk will leave the response permanently one step behind the threat.

It’s a reality that the international community, including the European Union, must confront. 

Turning commitments into protection

EU governments should recognise transnational repression for what it is: an attack on the conditions that allow independent journalism and civil society to function.

Offering physical refuge is not enough if people in exile cannot safely investigate abuses, organise or reach their audiences.  

On 23 September, more than 130 UN human rights experts called for action against transnational repression. Mariana Katzarova, the UN special rapporteur on Russia, has called for a binding UN convention. 

But the EU does not need to wait.  

The Digital Services Act already gives the European Commission a basis for action. It requires designated very large online platforms to assess systemic risks to fundamental rights arising from their services in the EU and to take effective, proportionate measures in response.

The practical test is straightforward: does a platform’s design or operation enable transnational repression? Does that amount to a systemic risk under Article 34? Has the platform adequately mitigated it under Article 35? 

Repeated abuse of reporting systems should trigger scrutiny of how those systems operate.

Platforms should provide meaningful human review, clear and accessible appeals and timely support for users facing coordinated attacks, and scrutinise government requests based on politically motivated designations.

Where the commission finds breaches, it should enforce compliance. Any measures against repression must protect freedom of expression, privacy and secure communication, including encryption. 

While attribution remains difficult, victims should not have to establish the entire chain of state responsibility before receiving support.

Investigators must pursue perpetrators and enablers, while regulators assess whether platforms have addressed recurring risks.

These are distinct responsibilities; difficulty in fulfilling one cannot justify neglecting the other. 

The EU should also establish a permanent European coordination mechanism linking national authorities, cybersecurity responders, and civil society.

It should set out clear arrangements for cross-border referrals, early warnings and support.

People reporting attacks need practical assistance, legal advice, and psychological support. Authorities must work with affected communities and build trust without treating language or nationality as grounds for suspicion. 

The test for the EU is simple: can people who have reached European soil feel safe to continue documenting abuses, speaking publicly and seeking justice without having to constantly fear the governments they fled?

If the EU’s commitment to freedom of expression is real, it must be measured by the protection it delivers.