Operation “Stop News”: Russia-origin influence activity

This case study was originally published in OpenAI’s October 2024⁠(opens in a new window) report.

We banned a cluster of ChatGPT accounts that were generating content in English, French and Russian that was then posted by a number of websites and social media accounts across multiple platforms. This activity originated in Russia and appeared consistent with an operation run by a marketing company. We began our investigation after reviewing off-platform indicators in Meta’s 2024 second quarter threat report.

This operation used our models to generate short comments, long-form articles and images. The long-form articles in English and French were then posted on a cluster of websites that posed as news outlets in Africa and the UK. The short comments were posted by accounts on X. (Some may have also been posted on Facebook and Instagram before Meta’s takedown, but we would not be able to independently verify that activity.) Content in Russian served as promotional materials on a range of websites and Russian-language forums. Two of the websites used the brand “newstop”; we have dubbed this operation, “Stop News”.

This operation was unusually prolific in its use of imagery. Many of its web articles and tweets were accompanied by images generated using DALL·E. These images were often in cartoon style, and used bright color palettes or dramatic tones to attract attention. We have no indication that they were intended to falsely represent events which never happened, or to serve as deepfakes: rather, it seems more likely that their purpose may have been to catch the eye, making the articles or social media posts more engaging. Despite this use, their general level of engagement remained low, with few to no likes, comments, shares or views.

While the operation used modern AI techniques to create appealing images, many of its social media accounts featured profile pictures that appear to have been created using an older era of artificial intelligence: generative adversarial networks (GAN). These have been a feature of online influence operations since at least 2019. GAN images can be quickly and easily downloaded from the internet, and remain a staple of present-day influence operations: we described another operation using them in our May threat report. This illustrates once again the way in which operations mix different eras of technology, including social media accounts, websites, GAN faces and AI generation—also as we described in May.

One (so far) unique feature of this operation is that its UK-focused websites appear to have established “information partnerships” with public entities in the UK, including a school in Wales and a church in Yorkshire. These partnerships were published on the partners’ websites. It is unclear how these relationships were established, and what benefit the operators sought to obtain from them.

This operation generated comments and articles in English, French and Russian. In English, most comments and articles described news, sporting and cultural events in the UK. The website britishtalks[.]com appears to have focused exclusively on this sort of non-political content, while the website euronewstop[.]co[.]uk mingled it with criticism of Ukraine and the UK’s support for Ukraine. In French, many comments and articles focused on music and culture in Africa, particularly West Africa; some criticized Ukraine and France, and accused France of failing in its organization of the Olympic Games. (This has been a common theme of Russian influence operations since Russia was banned from Olympic competitions.)

In Russian, the content mainly consisted of short text comments promoting commercial services in north-western Russia, especially the St Petersburg region. Some of these comments appeared to be designed for use on websites; others were framed as responses to customer feedback on Russian-language forums.

This operation represented an unusual combination of efforts to build an audience, with differing results. On social media, its accounts did not gain significant traction: most of the accounts on X that we identified had double-digit follower counts, and Meta reported that its assets on Facebook and Instagram had a total following of 2,100. However, the UK-focused “news” brands appear to have established “information partnerships” with a number of local organizations, including a church in Yorkshire, a school in Wales, and an association of chambers of commerce in California. The local organizations in question published information about these partnerships, and typically described an arrangement whereby the website would provide publicity and information to the organization, and would, in turn, be able to engage with its members—for example, through joint publications or community outreach. It is unclear how these partnerships were set up, and whether the partners received sustained outreach from the websites.

Using the Breakout Scale to assess the impact of IO, which rates them on a scale of 1 (lowest) to 6 (highest), we would assess this operation as being in Category Three: it was marked by posting activity on multiple platforms, with some evidence that real people in different contexts (primarily the “information partners”) were engaging with it, but not the degree of virality that the Russian “troll” hoax achieved.

As part of our disruption of this network, we have shared indicators with the relevant authorities and distribution platforms.

• Euronewstop[.]co[.]uk
• Newstop[.]africa
• Britishtalks[.]com
• Britishattitudes[.]com