How Did Foreign Actors Exploit the Recent Riots in the UK?

In the aftermath of the terrible attack on a girls’ dance school in Southport that killed three children, there has been a wave of unrest across the UK of a level that has not been seen since the 2011 London riots. A significant factor fuelling this has been the misinformation and disinformation regarding the identity of the attacker. Many were ready to believe that the attacker was a Syrian refugee who had entered the country illegally. By the time the attacker was publicly identified as a Cardiff-born UK citizen of Rwandan descent, the message had already taken hold, and protests and violence soon followed. 

As the protests and riots continued, the government warned that foreign actors were seeking to exploit the chaos and inflame and cement divisions in society through the further dissemination of misinformation and disinformation. This is hardly a surprise; subversion through the exploitation of free-flowing information is the weapon of choice short of war for malign actors seeking to undermine and dominate the international system. 

It is important not to dismiss the riots as being solely the result of state-backed interference; this would be an oversimplification. They demonstrate a confluence of multiple issues including genuine grievances around migration, the evolution of the far right, and the problematic model of social media platforms. However, we must understand who inflamed these tensions and how to effectively counter future subversion campaigns that are almost certain to occur. This is not an easy task; the substantially low bar for conducting subversion and information manipulation campaigns makes attribution increasingly difficult. Contributing to this difficulty is that, due to privacy concerns, the geolocation of profiles is now increasingly hidden beyond what users themselves are willing to share, unless social media companies disclose it. Nevertheless, an analysis of discourse around the riots and an understanding of how different threat actors operate demonstrates how the Kremlin was likely the most prevalent threat actor in this case.

The Kremlin remains at the forefront of manipulation and influence campaigns internationally, largely due to its view that it is currently in an existential struggle against the West and the historical importance it ascribes to ‘information-psychological operations’. While there have been notable increases in efforts by the Chinese Communist Party (CCP) and the Iranian regime, as well as a multitude of non-state actors including extremists and influencers-for-hire, their tactics are substantially different. The CCP tends to operate through official capacities and centralised control, with a preference for infiltrating media structures rather than mass disinformation campaigns. Iran tends to focus on issues that align with its ideological stance – especially ‘anti-imperialism’ and ‘anti-Zionism’ (often a veil it uses for antisemitism). And non-state actors operate on a smaller scale. All are learning from the Kremlin but are not yet on a par with it in the disinformation realm.

The Kremlin has also demonstrated the greatest awareness of the environment it acts in and how to obscure and legitimise its narratives by outsourcing and franchising its campaigns to witting and unwitting proxies. Outside the Western environment this has included pan-Africanists, but within the West it has concentrated on the far left and especially the far right. For example, Stephen Yaxley-Lennon (aka Tommy Robinson) has previously given interviews at Russian press conferences criticising ‘censorship’ in the EU and espoused the need to ‘preserve our Christian values, culture and identity’ – a common grievance that the Kremlin exploits in its propaganda. To be clear, there is no evidence that Yaxley-Lennon is a Kremlin agent; but he is a useful polarising figure with a substantial following for the Kremlin to latch onto. Similarly, Channel3Now, believed to be one of the original posters of the lie that the Southport attacker was a Syrian migrant, has been theorised as a Kremlin backed outlet. The site – which purports to be a US news site focused on crime – originated as a Russian YouTube channel. Sceptics have pointed to the fact it has not published Russian content in 11 years and its managers are reportedly based in Pakistan, while the owners have insisted they purchased the YouTube site and have taken the article down – creating confusion as to whether the site was indeed manufactured by the Kremlin. Considering the use of multiple mirror sites and pages like Channel3 Now, Channel3 NOW News, Channel3 News and Channel3 NOW, and that the pages focus on sensationalising US crime (often with racial overtones) before opportunistically pivoting to the UK – as well as the heavy presence of ads on its pages – it is clear this is an inauthentic site, but one more likely motivated by money than a Kremlin connection. Regardless of its management, though, the Kremlin was swift to amplify the lie.

This brings us to the main thing we need to understand about the Kremlin’s exploitation of the riots and its wider subversion campaigns: it was parasitic rather than proactive.

While the Kremlin does continue to produce content, it increasingly focuses on amplifying existing inflammatory content from genuine users rather than producing its own. Usually this takes the form of deploying bots to repeatedly repost, like and engage with genuine inflammatory posts, accompanied by provocative commentary to con social media algorithms into assessing that a point of view is more popular than it is. Consequently, the content is more likely to be boosted and appear on others’ feeds, including those who fundamentally oppose it, thereby causing angry engagement. Reviewing typical provocative terms associated with the protests and riots (#twotierkier, #twotierpolicing, ‘UK has fallen’ and so on) demonstrates telltale signs of Kremlin interference. Some profiles reposting the content were established in 2022 – the year of the Kremlin’s invasion of Ukraine – or in the run-up to the UK elections, both periods when there was a spike in Kremlin-sponsored interference, and some appear to have shifted from attacking the UK’s support for Ukraine to lambasting the Labour government and the alleged double standards of UK police by reposting content from figures like Yaxley-Lennon, Elon Musk and provocative anonymous accounts on X and Telegram at a rate that would require a person to go without sleep. Most of the content was produced domestically; the Kremlin simply lent a helpful megaphone.

Ultimately, building resilience to subversion campaigns like these requires tackling root grievances that the Kremlin and others can exploit: socioeconomic deprivation, migration and the structures of social media that amplify divisive content. But these are long-term goals. In the meantime, there are several short- and medium-term actions for building resilience and countering subversion.

Firstly, we must prioritise speed and transparency in comms around immigration and refute core narratives such as so-called ‘two-tier policing’. This will require consistent messaging around the subject as well as identifying and tracking the key amplifiers and ‘super-spreaders’ so that malign amplification can be interdicted directly. Furthermore, we must increase our understanding of the evolution of the extreme right, protests and subversion campaigns in general and reflect this in our responses. It is far more common to have clustered groups and key influencers rather than top-down structures; therefore, we need smaller and more agile communications groups who are given set messaging guidelines in response to subversion campaigns, but more freedom in how they respond to them.

Secondly, we need to pursue new methods of attribution, thereby allowing us to differentiate domestic content and foreign amplification. This can be achieved by gaining a deeper understanding of adversaries’ approach to subversion operations, which can be used to identify their methodological fingerprints. This information should then be publicised and undermined consistently and amplified during crisis periods in formats likely to gain attention and be absorbed by a population increasingly inundated with information – specifically, harnessing short-form video and ‘infotainment’, which has been successfully utilised in counter-extremism and prior counter-propaganda campaigns from the Second World War. 

Lastly, we must raise costs for the Kremlin and other actors conducting subversion campaigns by going on the offensive. This does not mean copying their tactics. We should avoid using disinformation for three reasons. Firstly, we are substantially poorer at it than the Kremlin, which has far more experience in information manipulation and a greater willingness to plumb the depths. Secondly, it creates conditions that ultimately undermine us and benefit the Kremlin by encouraging the belief that we are the same as them and that there is no such thing as truth. Lastly, we do not need to. As I have touched on in other articles, we should base our counter-narratives in truth and attempt to separate regimes from their populations by targeting and publicising their corruption, incompetence and self-preservation – all of which have been persistent weak spots of authoritarian regimes.

The riots may have died down, but the manipulation and subversion are almost certain to continue, and the narratives that facilitated the disorder are more likely to take hold. Consequently, there is a realistic possibility of the next set of riots being even more destructive. We need to plan and act now, or the violence and subversion of the past few weeks will become the norm.

The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.