This is what makes this report useful beyond Estonia. It is not just a national security document for one Baltic state. It is also a window into how a smaller European country, with historical memory and practical experience, sees the wider threat environment.

The report repeatedly returns to one central idea that a country weakened from within is easier to break. In that sense, this is not simply a report about espionage or online lies. It is a report about the slow erosion of trust, cohesion, and decision-making capacity inside open societies.

For Forum readers, the most important section is the one dealing with what KAPO calls the defence of the constitutional order. This is where the report lays out its view of disinformation and influence operations.

The core point is straightforward. Sanctions have significantly constrained Russia’s hostile and propaganda activities, but they have not ended them. Instead, much of that activity has shifted more heavily to social media.

KAPO presents this as an adaptation rather than a retreat. The channels have changed because they are cheaper, faster, more flexible, and easier to launder through apparently organic local voices.

Why that matters is because the report does not define propaganda narrowly. It is not talking only about state television broadcasts or obvious troll accounts. It describes a broader effort to undermine cohesion in Estonian society, weaken relationships with allies, erode trust in government, and create new conflicts by amplifying existing divisions.

This is a familiar pattern across Europe. The target is not only what people think about one issue or another. The target is the social fabric that allows a democratic public to judge events together at all.

One very important observations in the report is that propaganda works best when it appears to come from local voices. KAPO says this directly. The goal is to persuade individuals to present hostile narratives as their own because those narratives become more effective once they are detached from their obvious source.

That is a crucial insight and it moves us beyond the old model of propaganda as something broadcast from Moscow outward. What matters now is narrative laundering.

The most effective hostile message is often not the one that arrives with a Kremlin stamp on it, but the one repeated by a local activist, a sympathetic commentator, an influencer, or a seemingly independent media personality who presents it as common sense.

That same logic also explains why social media now occupies such a central place in the report. KAPO describes it as the most cost-effective way to spread and amplify narratives. The report notes that although European sanctions have limited access to major Russian state channels, the continued circulation of hostile content on social platforms remains a serious concern.

This is where low-cost operations can achieve outsized effects. Even simple campaigns can become consequential if they trigger public panic, inflame social tensions, or attract mainstream media amplification.

The report specifically notes that for the adversary, having such campaigns picked up by mainstream media is considered a success because it increases both the credibility and the reach of the message.

This is one other reason the report feels more operational than many similar publications.

It does not treat disinformation as a floating layer of bad content detached from real-world action. It places influence operations inside a larger hostile ecosystem.

In the foreword alone, KAPO links propaganda to attempts to destabilise Estonia through Telegram campaigns, to social media recruitment of so-called one-off collaborators, and to broader intelligence activity targeting the country. That is a much more serious framework than the old habit of treating disinformation as little more than fake news or misleading posts.

In this report, influence is not just messaging. It is part of a system that can support recruitment, coercion, sabotage, and political interference.

Another very striking feature of the report is how clearly it recognises the role of artificial intelligence and algorithmic systems in this new environment. KAPO warns that artificial intelligence is now being used to translate and amplify propaganda narratives automatically.

More than that, it says the aim is to saturate the internet with Kremlin-aligned content so that chatbots and language models increasingly return responses consistent with those narratives.

That is one of the most important passages in the whole report. It points to a future in which the information struggle is not only about persuading human audiences directly, but also about shaping the background material from which machine systems generate answers.

This deserves a lot more attention because it reflects a shift in scale and ambition.

We are no longer talking only about bots posting slogans or coordinated accounts boosting hashtags. We are talking about efforts to contaminate the wider informational environment so thoroughly that manipulation becomes ambient.

In such a system, the issue is not just individual falsehoods. It is the gradual construction of a polluted knowledge space in which hostile narratives become normal, searchable, quotable, and machine-retrievable.

KAPO’s warning here should be read as an early signal of where influence operations are going next.

The Burceva case, as presented in the report, helps make this more concrete. KAPO describes how Svetlana Burceva worked for Baltnews, part of the Rossiya Segodnya media group, and published material aligned with Russian foreign and security policy goals.

According to the report, she received assignments and tonal guidance from editors connected to that sanctioned propaganda apparatus, while repeating a familiar set of Kremlin narratives about Estonia, the West, and Ukraine.

KAPO also describes her training in a master’s programme on “Information Conflicts and Hybrid Conflicts” in occupied Crimea, presented as a pipeline for training “information warriors.”

Whether one focuses on the propaganda output itself or on the surrounding infrastructure, the point is the same. Hostile narratives do not appear out of nowhere. They can be cultivated, directed, rewarded, and embedded in a wider state-linked ecosystem.

Another important lesson from the report is that influence does not always wear the clothes of media. KAPO’s discussion of the Russian Orthodox Church and its subordinate structures in Estonia is important for precisely that reason.

The report argues that religion has become an instrument of the Russian state and that church-linked structures can function as part of a broader influence architecture.

That does not mean every religious institution is reducible to state influence, but it does mean that democratic societies should stop assuming that influence operations arrive only through television studios, websites, or fake accounts. They can also travel through cultural, clerical, institutional, and community channels.

That wider framing is one of the report’s great strengths. Even outside the disinformation sections, KAPO keeps returning to the same larger pattern. The document covers counterintelligence, cybersecurity, protection of state secrets, extremism, international terrorism, illegal explosives, economic security, anti-corruption efforts, and the domestic implications of Russia’s war against Ukraine.

At first glance these may seem like separate fields.

But the report’s method is to show how they connect. Intelligence recruitment can overlap with online influence. Cyber intrusions can support strategic targeting. Social media can serve both propaganda and radicalisation. Economic vulnerability can create openings for hostile pressure.

What emerges is not a pile of isolated threats, but a single pressure environment.

There is also a practical message running through the report, and it is worth underlining. KAPO is not saying that democratic societies are helpless.

In fact, one of its clearest claims is that countermeasures have worked. Sanctions have constrained Russian activity. Preventive action has reduced room for hostile influence. Expulsions and enforcement have made Estonia a harder target.

The report’s argument is not one of doom. It is one of adaptation. Pressure works, but so does defence, provided societies understand the problem in systemic rather than fragmented terms.

So what can we learn from these 68 pages?

First, that disinformation is too small a word for the phenomenon being described. What KAPO is really mapping is a contest over internal stability.

Second, that hostile influence is most effective when it is laundered through local voices and local tensions rather than delivered in a blunt, foreign form.

Third, that AI and algorithmic systems are becoming part of the battlespace.

Fourth, that influence operations cannot be understood in isolation from intelligence work, cyber activity, recruitment, and sabotage.

And finally, that resilience still matters. Trust inside a society remains one of the strongest protective layers against hostile pressure.

That last point may be the most important one.

The real battleground in this report is trust. Trust in institutions. Trust in alliances. Trust in factual reality. Trust in the ability of democratic societies to recognise manipulation without collapsing into cynicism.

Estonia’s KAPO report is useful because it does not romanticise that struggle, but it does describe it clearly. And clarity, in a polluted information environment, is already part of defence.

And now, you know.

Source: Estonian Internal Security Service (KAPO), Annual Review 2025–2026,

https://kapo.ee/sites/default/files/content_page_attachments/annual-review-2025-2026.pdf