Special committee on the European Democracy Shield Ordinary meeting
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
EUDS European Parliament
Follow its sittingsJacob Tamm
In 2024, it was about how to expose it. And now we have this year's edition, how to deter it. So I think what is interesting about this sequencing as well is that it also, I would say, reflects a little bit the evolution of the team in the U. S. And how we have been tackling this issue.
Starting out first with a strong focus on situational awareness, getting a proper understanding of what the threat looks like, on to responses, and then on to more impactful responses. So I mean you could say that we have gone from being the nice guys to be a little bit more aggressive in terms of how we counter this threat, with focus on action and response. My colleague, Kiera, will take you through this year's report in more detail. We will also hand it out to the members and those interested. But I would say that the main takeaway of this report will come as no surprise to you, and that is that we are in a period of dangerous escalation.
FIMI attacks, we have looked at this sample that the Chair mentioned, over 500 incidents in 2025. And we see how FEMA attacks have reached a new level of complexity and global reach, with attacks increasing in frequency, intensity, and coordination. Let us just stop to look at the numbers for one second. Russia in 2025 invested roughly €2,000,000,000 to €3,000,000,000 in these types of activities. If we look at China, according to our sources, roughly 6 to 8,000,000,000 annually.
Of course, there are big numbers difficult in this field. There are big margins of uncertainty. But even with that margin of uncertainty, it is clear that we're being outspent by a significant margin. We also see, and the report demonstrates, how our adversaries have become much better at leveraging technology. And if you look at generative AI, we see how this has moved just from 2024 to 2025, to becoming something in the margins to becoming the norm of Fimi operations.
This is not to say that AI generated Fimi has the impact as sometimes ascribed to it in media, but it's certainly out there and it has become the norm. Threat actors are also deploying new ways of looking into AI. It's not only about using AI to create, you know, your deep fakes and so on, but they're also doing something that we refer to as LLM grooming, where they try to manipulate the very LLMs, the different chatbots and chat GPTs and what have you to make sure that or to manipulate the outcome in terms of the searches of that, so they better reflect Kremlin's talking points and propaganda. Third, we're also seeing how the EU is under attack from different fronts. This is no longer only about Russia and China, but the weaponization of information is really becoming a standard feature in today's geopolitics.
So what does this mean for the EU? What does it mean for the EES? Well, in this period of escalation, it is clear that the EU must also scale up its response. And the good news here is that we actually have the tools. We do not need to invent new ones, but we need to use the tools that we have in a better, more targeted, and more strategic way.
The Democracy Shield is certainly an opportunity in this sense. You know that the HR VP is fully committed to making a substantive contribution, bringing The U. Expertise and instruments to the table to raise the U. Internal defenses against FIMI and also to take forward the external dimension. But it's clear to us that we will not win this information war with a defensive posture alone.
So that is why the HRVP has called on member states to take a more forceful, offensive, proactive approach when it comes to countering FIMI, a sword, if you will, to complement the shield. So what we think is that the fight against Fimi cannot only be about resilience building and reactive measures like debunking and fact checking, but we need to get on the front foot and push back against the perpetrators that are behind these operations. So you will see that the title of the threat report is Dismantling the Fimi House of Cards. So this is a little bit about puncturing the myth of Russian invincibility. And we use this analogy of the Fimi house of cards because, like a house of cards, if you pull, I mean, it's a complex structure.
And if you pull the cards in the right places, the whole thing can come tumbling down. So I mean, the base is a little bit the organizational structure. It's the who, right? The middle is the digital infrastructure, how these operations are being deployed. And on the very top is the content and disinformation narratives.
So it's quite clear here that if we just keep responding to individual narratives, we will not move ahead in this game. It is about targeting the critical points of the Fimi system itself. So building on the work done in the previous reports, what we present here is a Fimi deterrence playbook. And that is a framework to make FIMI activity more costly and less feasible for the perpetrators. We have the tools, as I said.
What we are looking at here is a more effective use of sanctions, increase our cooperation with law enforcement, make a more robust enforcement of our digital regulations using proactive stratcom campaigns to penetrate the information space of our adversaries. And by that, creating a credible deterrence capacity that we believe will have a real impact in this fight. So thanks for that, and I will pass it on to Chiara for some of the main findings of these reports.
Chiara Pachendi
Thank you. Thank you to the chair and to the members of this committee for the invitation. So, yeah, Jacob already presented the deterrence playbook, which is the main element of this report, which defines the posture that we intend to take. When it comes to the main findings of this report, the analysis that we carried out in 2025, as already said, we analyzed 540 incidents. This reflects very much the mandate of the EIS when it comes to analyzing FIMI.
Such incidents were attributed 29% of the time to Russia, 6% to China, and then there is a huge part which is unattributed incidents, but incidents that have strong links to one of these threat actors. This underlies the importance of continuing to investigate Fimi in the gray area, because most of the operations that we are witnessing, that we are analyzing, are covert operations by design. It is not like an accident. We are not talking about organic activity here. We're talking about strategically planned activities where we can identify all the main features of coordination intent that make Fimi possible.
Many channels were involved. As you might know, of course, we base our monitoring on channels that are involved in Fimi, and that can be attributed to a certain degree to the two threat actors. Moving on, we have also tried to map the targeted countries and audiences in this report. We see that, of course, FIMI remains a global threat that impacts different regions. And, for example, in our monitoring perimeter, we see that Ukraine remains at the heart of Russian hybrid war efforts.
Moldova also appeared as one of the key priorities in the Fimi in 2025. And, also, following a similar pattern, we see the targeting of Armenia, but also new member states such as France, Germany, Poland, Belgium, Italy, Spain were attacked to different degrees. So, especially, we saw that major political and electoral events were targeted throughout the year. Next, please. We also, as already Jacob underlined, see the evolution of AI as something that is being used constantly in those incidents.
It's not something sporadic, but it's now the norm. And it's used to different degrees, of course. For example, we see that the use of synthetic audio and also images with forgeries. And, of course, it's really difficult to prove, but the LLM grooming phenomenon is also present. So as you can see here, we have 27% of the overall instance that we could identify as AI being involved.
Please, next slide. So, finally, I hope you can see it from the presentation. It's a bit dark. But we, as I said before, we mapped all these channels. And as we did last year, we tried to map the connections between them and how they interact with each other.
What are the main clusters? Of course, you know, we could spend hours talking about this graph here, but what you can see is a high degree of coordination where these nodes that are channels are connecting to other nodes through these edges, and this is because they interacted in the same incidents. So this is, for us, really, the proof that this activity is really not a casual activity, but it's a highly coordinated one. And here you can see a map in red, the channels, the assets attributed to Russia, then in blue, the one attributed to China, and then this big gray part, which is the unattributed one. And we see also them operating in different geographies, maybe the MENA region, Africa, but also the clusters you see here that are specifically targeting Moldova or Armenia, and then more international clusters interacting with each other.
So if you, my time is up now, and we would like to leave some time for questions. But maybe if you go to the last slide, for the first time, the US has decided to release some of these channels that are attributed to Russia and China. We have issued this interactive explorer that you can access just by scanning the QR code here. You can find it on u-verse with this info, the website of the AES, and you can explore directly some of the connections there. We will be feeding this instrument over time to be able to, you know, deliver this knowledge about Fimi that we have to the public.
Thank you very much.
And.
Vasile Dîncu
We have the session for answer and the chief for coordination. From PPA, we don't have, please, Madam Shardimose from S and D.
Christel Schaldemose
Thank you very much, chair, and also a big thanks to you for coming here to present your fourth report. And it is clear, I guess, for all of us that FEMA is not going to disappear. It's here, and it is increasing. And it is, as you said, more structured, more coordinated, and therefore, we also need to be more aware and have our system in place. And I think it's important for us.
First and foremost, in your report, I think that can be very well used for our purposes when we make our report here in the committee. It could be kind of a checklist. What you're saying, what you're suggesting, do we have that in our report as well? I, myself, I worked on the Digital Services Act negotiated that, and you also mentioned here that our digital rule book is good, but it doesn't really help us when it comes to go directly towards those who are behind the Fimi. And I think that's a very important thing.
We put obligations on the platforms, but we are not really doing direct things towards those who are making the Fimi. And I think that's a very important point that I think we have to consider and discuss how we can tackle that. So thank you very much for your report. One of the things that really makes me worried is also what you mentioned, the use of AI, the uptake of AI. It has become easy and cheap to use it, and it has become so good that it is difficult for ordinary people, also people like me, to see whether it's fake or not, and it will become even better and better.
And, therefore, we also have to be aware. Why what I fear, in terms of democracy, is that we end up in a situation where no one trusts anything they're reading online, because is it fake or not? We cannot see. And who is behind it? We need to, of course, educate people to be more critical.
But in the end, there is a risk that they don't trust anybody or anything they read. And, therefore, I do believe that the work against Fimi is so important. So thank you also for your work. The last thing I would like to say is that now I'm, I was going to ask you, are you in direct contact with the big platforms? On because they have a job.
They have a task. They are obliged to risk mitigate towards Vimee. But, are you helping them? Do you have any connections or contacts with them? I think that could be interesting to hear.
But thank you very much for your report.
Helmut Brandstätter
Thank you. Thank you very much, Chair. Sorry for my voice. A little bit difficult right now, but it's getting better. So I will be very short and following up on Chris.
As far as the US is concerned, is there an organization in the US that does the same work checking Fimi? Are you in contact with them? And what do you know about what they see in The US? And the other question is also about AI. I think it's 27% now.
Do you see or since when is there an increase? And how do you know that it's AI? That's a difficulty that sometimes you don't know if it's AI or not, because we discuss it quite often. The idea that the platforms have to sign it out. This is AI.
You think that this would be feasible? Thank you.
Tomáš Zdechovský
Thank you, chair. Your pronunciation is great. I think much better than my Romanian language. Also, I would like to thank you for this report and for the opportunity to talk. Sorry that I was a little bit late because I am also coordinator in the budgetary control committee, and we were discussing a very important issue linked with our reforms in EU.
And, I would like to say that this report, what we can have it here and we can discuss it, it's excellent. And give us exactly that argues what we needed, clear data, and full pictures of the threats. But, let me be very direct. The problem today, it's not a lack of knowledge. Problem today is any action in the European Union, and this is what we discussed in the US.
We know who is behind this operation. It's Russia, China, Iran, etc. We know how they work. We know what they target, and yet our response is still so slow and fragmented. Also, the gap between analysis and redirection is becoming a serious weakness for the European Union.
And I was also surprised by one thing. A 40-page report, the EU Democracy Shield is mentioned two times. So my question is, how do you see the EU Democracy Shield working in practice? And second question, more important is, how will it make sure that there is real coordination and data sharing with existing EU institutions and member states. Because if we don't move from analysis to action, even the best reports will not protect our democracy, and we saw it in Hungary.
It's a concrete example, and this is the thing that we need to discuss here today. And the democracy shield must not become more bureaucracy. It should be a platform that connects what we already have, share data in real time, and helps the EU and member states work together. And you see that Putin through the mobile of my colleagues never stops me again. No.
I'm joking. But, you look so serious after my speech. Also, I would like to make a very good atmosphere. Thank you very much for the answer.
Vasile Dîncu
Thank you. Very real question. We have KDI. If Katharina Mendes, you, or Mr. Sword.
No, thank you, please.
Jacob Tamm
Thank you so much for these comments and questions and word of support as well. It's important for us to hear it, I mean, for Chiara and the team that worked so hard on this report. It was a lot of sweat and tears that went into it. So thank you so much. I mean, I just want to say from the outset that we're completely on the same line that we need to move from admiring the problem to attacking the problem and resolving the problem.
And that is a little bit the point I tried to make as well, and where I see as well the community is evolving towards. So the EES work was very much focused on putting together a good understanding of what this threat was actually, what it was, defining it, conceptualizing it, and then providing the data to describe it. Now we are in a moment of response and action. So that's where our energy and investment is certainly at this point. I hear you as well, that you agree with the fact that we need to hold the perpetrators behind these operations to account.
And doing that also means that we need to have the tools to attribute these types of activities to specific entities, individuals, organizations that are pushing, well, this crap, if I may say so. And there, we have also developed a methodology within the ES on how we can attribute. And it's about, I mean, we had in the last threat report this analogy of an iceberg, where the visible was on top, what you could see was directly attributable to the Kremlin or Beijing. But then there was this massive hidden iceberg at the bottom, all those covert channels. So much of the work that we are doing now in the U.
S. Is to shed light on that bottom part of the iceberg and bring it out to the open. That can be done through different open source investigation type of techniques. It's about looking at the criteria. It's about seeing what's out there on the Internet, looking at the information that is hidden behind, and we're on the case.
Once we have clear evidence and a case built up, we can take action. We can do sanctions, for example. The issue here is that is a concern for us that the sanctions that we have today, they're not really effective when it comes to FIMI. I mean, most of the sanctions entities, individuals here in the European Union, the content that was being spread by those are being spread through local proxies. It's like, you know, pressing a water balloon.
You push on one side and go out on the other. So we need to have much stronger enforcement of the sanctions, and we need to have a plan on how to address circumventions of sanctions. So that is an important thing. On the questions on the platforms, yes, we are in contact. You know that the main platform that the EU has to engage with social media platforms is through the DSA and the code of conduct on this information.
You know all about that, so I don't need to say anything. But we are also in contact from our side, spreading, sharing some of the findings and evidence that we have as well, working together with our colleagues in DG Connect, but also in direct contact with the platforms. I mean, it's a mixed picture, as you may imagine. It's going so. And I think the picture is not getting any better.
So there, we need to make sure again that we have proper enforcement of our regulations here in Europe. Then on the U. So you know that one of our closest partners at the AES on this stuff of detecting and analyzing FIMI was the global engagement center under the State Department. And it was so close to cooperation that we had daily contact between our respective data teams. We had common standards and a shared way of encoding, so we could share information on these threats in real time.
Those were the good days, but that has changed. And the Global Engagement Center is no more. What there is in the U. S, and you were recently there. Interesting to hear your insights from that trip as well. But what there is, is of course a sort of civil society ecosystem that was built up in terms of detecting and analyzing and encountering FGM and disinformation.
And much of that has been unfunded. I mean, colleagues over there are having a very tough time. I'm sure you heard about it when you were over there. But there is still, you know, a lot of expertise and capacities in place that do this work that can be tapped into in this regard. On the democracy shield, how do we see that it's working in practice?
The Democracy Shield is a joint communication between the HRVP and the Commission, and we are fully committed to make this work. It's simply too important not to work. So it's there. It's being set up. I think the start is always bureaucratic when new things are being set up, but it's slowly coming into action.
The Center for Democratic Resilience was launched by Commissioner McGrath, as you know, in February, and we're now working with member states on a number of projects that would take the work forward more concretely. I mean, on your point in terms of making sure that it's clear that the focus should be on responses, but we also need to be able to bring these different sources of situational awareness of insight analysis across the system better together. And I think the Democracy Shield is all about that. I mean, the Center for Democratic Resilience, as you know, is supposed to be a little bit of a hub that ties a different sort of or that connects different dots in this sense, because it is true that the system that we have at the moment is still too fragmented. What we do have at the same time is the Rapid Alert system, which is an established mechanism for exchange on FIMI incidents with the member states.
There will be a meeting in Berlin only next week, where we continue to exchange good practices, build capacity on this topic. And I think perhaps on AI, Chiara, if you wanna come in?
Chiara Pachendi
Sure. Yeah. Just to cover the last question on AI, how do you know if it is AI? Well, it depends very much. So what we see about AI is the visible part, indeed.
So when it comes to the content, maybe text, images, videos, audio, and sometimes, of course, there are certain features that are quite easy to understand. Sometimes you can look, for example, at the metadata, etc. So sometimes it's more of a technical resurgence. Sometimes it's really very, very visible. And then, of course, you know, that there are also certain ways to see with open source tools or other types of tools if something is created with AI.
But, of course, we don't see the invisible part of that, which is, for example, using AI for automation, for development of certain ways of distributing content in our information space. Or for LLM Groom, like, we can, of course, try to imagine and theorize how it works, but sometimes it's not a 100% visible open source. And this is also why it's very much needed to have the cooperation of tech companies specialized in AI to tackle these kinds of issues. So, yeah, that would be it.
Vasile Dîncu
Yeah. Thank you. Thank you, Jakob and Chiara, for your explanation and for a fantastic meta for House of Cards. It's very explicit. And we the next session is in camera.
Please remain only person here who are authorized for this week two minutes post.
Ask anything about this video — I analyse its transcript to answer.