This shift in perspective is the central contribution of the EU DisinfoLab report on building a common operational picture of FIMI.
Rather than treating disinformation as a collection of incidents or campaigns, it proposes analysing it as an ecosystem composed of reusable components.
The report calls these clusters Information Manipulation Sets, or IMSs. An IMS is not a state, not a single campaign, and not a narrative. It is the operational machinery that sits between those layers.
The importance of this distinction becomes clear once we look at how contemporary influence operations actually work. A single false article may be copied hundreds of times, reframed across platforms, translated into multiple languages, embedded in videos, or injected into comment sections.
Counting each instance as a separate event creates noise rather than insight.
What matters is whether those instances draw from the same infrastructure, rely on the same intermediaries, or follow the same operational logic. If they do, they are not independent at all. They are outputs of the same system.
From incidents to systems
Most public reporting on disinformation remains trapped at the tactical level. Screenshots circulate. Viral posts are archived. Headlines name and shame individual accounts.
This work has value, but it rarely changes the underlying dynamics. The report argues that the tactical layer should be treated as an entry point, not the endpoint. The operational layer is where patterns emerge.
At this level, analysts stop asking what was said and begin asking how it was made possible.
Which domains were registered? Which hosting providers were used? Which amplification networks pushed the content into visibility? Which intermediaries monetised it, promoted it, or disguised its origin?
When these questions are asked systematically, individual posts collapse into a much smaller number of operational clusters.
This is where the IMS framework becomes useful.
An IMS groups together recurring tools, tactics, infrastructure, and resources that plausibly originate from the same actor or ecosystem, even if definitive attribution remains out of reach. Crucially, one actor can operate multiple IMSs simultaneously.
This explains why operations that look different on the surface may still be connected, and why treating “Russia” or “the Kremlin” as a single monolithic actor obscures more than it reveals.
Who pays for it
Money rarely appears in screenshots, but no influence operation operates without it.
One of the report’s most important interventions is to reintroduce financing into the analysis. Russian FIMI operations, as documented in the case studies, are not sustained by volunteers or ideology alone. They are funded through a mixture of state resources, semi-official contracts, and private entrepreneurial arrangements.
The report describes a top-down but decentralised structure.
Strategic direction and funding originate with the Russian state, including government ministries and security services. Execution, however, is outsourced to a network of private or semi-official actors.
These actors operate as contractors of influence, competing for funding, adapting tactics, and sometimes repurposing infrastructure across different operations. This arrangement provides plausible deniability while increasing resilience. If one contractor is exposed or sanctioned, others can step in.
Understanding who pays matters because it clarifies incentives.
Contractors are not simply executing orders. They are maintaining businesses. They seek cost efficiency, scalability, and repeatable workflows. This is why infrastructure is reused, why cheap labour is recruited, and why automation and AI tools are integrated so quickly.
These economic pressures create vulnerabilities. Systems built for efficiency tend to rely on the same service providers, the same hosting solutions, and the same amplification shortcuts.
Who hosts it
Disinformation does not float freely through the internet. It is hosted, routed, cloaked, and promoted through concrete technical services, many of them located in Europe.
The report documents how sanctioned Russian entities continue to rely on EU-based infrastructure, from domain registration and hosting to advertising networks and large social media platforms.
This is one of the most uncomfortable findings in the document. EU sanctions formally prohibit providing economic resources to designated entities.
In practice, enforcement is fragmented and often passive. Hosting providers claim ignorance. Platforms claim lack of visibility. Proxies and shell entities obscure end users.
As a result, the operational backbone of influence campaigns remains intact even when the organisations behind them are publicly sanctioned.
From an IMS perspective, this is not a failure of intelligence but of execution. The infrastructure has been mapped repeatedly by researchers. The problem is that sanctions regimes focus on naming actors rather than disabling systems.
When enforcement stops at the level of reputational damage, operational continuity is preserved.
Where systems can be broken
The report’s most valuable contribution is not diagnostic but strategic.
By mapping IMSs as supply chains, it reveals where disruption is possible and where it is not. Removing individual posts rarely matters. Naming individual influencers often backfires.
Blocking entire platforms raises legal and political risks. But interrupting specific services within an operational chain can raise costs dramatically.
Certain choke points appear repeatedly.
Cloaking services that allow different content to be shown to moderators and users. Bulletproof hosting providers that tolerate abuse. Advertising and monetisation channels that reward engagement regardless of authenticity. Cross-platform amplification networks that recycle the same assets at scale.
These are not abstract vulnerabilities. They are concrete dependencies.
The report also highlights that not all countermeasures are equally effective.
Travel bans against operators who never intend to enter the EU have minimal impact. Asset freezes that are not enforced against intermediaries change little. Broadcasting bans can work, but only when paired with aggressive enforcement against alternative distribution paths.
The IMS framework helps distinguish symbolic measures from operational ones.
Why attribution still matters
One risk in shifting toward systems analysis is the temptation to abandon attribution altogether. The report explicitly warns against this.
Strategic attribution remains essential, but it should be built on operational evidence rather than inferred from narratives alone. IMSs provide a way to raise attribution thresholds by grounding them in infrastructure, financing, and repeated behaviour.
This matters not only for policy but for credibility.
Over-attribution weakens trust. Under-attribution creates paralysis. An operational approach allows analysts to say, with confidence, that certain systems behave consistently with known state-aligned ecosystems, even when individual actors remain unnamed.
It also allows platforms and regulators to act earlier, without waiting for absolute proof of state direction.
A different way of seeing the problem
Seen through this lens, disinformation stops looking like a battle of ideas and starts looking like a logistics problem.
Narratives matter, but they are interchangeable. Infrastructure matters more. The same system that spreads false stories about Ukraine today can be repurposed tomorrow for elections, public health, or social unrest.
This adaptability is a feature, not a bug.
The report implicitly challenges the media logic that rewards novelty. Rebranding the same IMS under new names may generate attention, but it fragments understanding. Operational continuity is the signal that should guide response.
Naming fewer systems more accurately is more useful than naming many incidents loudly.
Why this model matters now
The timing of this intervention is not accidental.
The proliferation of influence operations, combined with platform fragmentation and AI-assisted content production, has lowered the cost of manipulation. At the same time, institutional responses remain slow, siloed, and often reactive. Without a shared operational picture, each actor responds to a partial view of the threat.
The IMS framework is not a silver bullet. It requires sustained cooperation, technical expertise, and restraint in public communication. It also produces less immediately visible output than viral debunks. But it aligns analysis with how influence operations are actually conducted. That alignment is overdue.
If foreign information manipulation is treated as an endless stream of lies, it will always win on volume. If it is treated as an operational system with dependencies, costs, and failure points, it becomes a problem that can be managed, disrupted, and constrained.
The question, then, is no longer whether a story is false. It is which system produced it, how that system survives, and whether we are willing to act where it is actually vulnerable.
Sources
EU DisinfoLab
Building a Common Operational Picture of FIMI: Using IMS to strengthen technical attribution and disruption (2025).
— Core source introducing the Information Manipulation Set (IMS) framework, operational supply-chain analysis, and enforcement gaps in EU sanctions.
