Collective of anti-disinformation ‘Elves’ offer a bulwark against Russian propaganda

Weeks after Russia launched its war in Ukraine in February, stories began circulating via Facebook and YouTube that President Vladimir Putin invaded only to destroy a secret U.S. and NATO-run lab making a deadly virus.

The messages portrayed Putin as the anti-Western hero saving Eastern Europe from an American ploy: “Washington’s unprecedented rage. Destroyed laboratories in Ukraine where the United States was developing advanced biological weapons against Russia. Reasons for launching Russian ‘Special Operations.’ What to believe? They didn’t admit it in Wuhan either!”

The biological weapons storyline that spread online and via email chain letters in Central and Eastern Europe is just one example of the propaganda coming out of Moscow to justify the war in Ukraine and turn public opinion against the West. While Meta, Twitter and Google say they are working hard to remove these kinds of fake stories from their platforms, it’s nearly impossible to find and dispute all the disinformation circulating online before thousands of people read, share, like or comment on the phony narratives.

This is where the Elves come in. 

A loosely organized collective of researchers, activists, technology experts and volunteers from across Central and Eastern Europe, the Elves are ordinary citizens who have banded together to fight Russian disinformation about the war. 

“The only cure is that you communicate the facts, but this [virus] narrative works really well because it scares people,” said Bleise, a 38-year-old Czech disinformation researcher working to debunk storylines such as the fake bio-lab posts. (Bleise asked CyberScoop not to use her real name due to security concerns).

Her goal along with other Elves is to flag articles or videos for social media platforms as well as to create and publicize an archive of disinformation from Russian troll groups so that researchers and disinformation watchdogs can better detect — and more quickly remove — posts in the future.

“Trolls are ugly; elves are bright creatures confronting them,” Hawk, the nom de guerre for a founding father of the movement, told CyberScoop. “To be an elf is quite fashionable and we have a lot of supporters,” Hawk said. “Because you’re fighting against evil.”

Today, there are several thousand Elves in chapters in Finland, Germany and 11 other countries across the former Eastern bloc, including Estonia, the Czech Republic, Ukraine and Poland. The community includes cybersecurity threat researchers, psychologists, lawyers, marketing experts and intelligence experts. 

The Elves also team up with tech companies offering data analytics and threat intelligence. One member of the Elves said he works for Trend Micro, the global cybersecurity company, and is able to use his expertise to help members mask their real identities.

Disinformation experts say the Elves are playing an increasingly important role in monitoring and debunking Russian disinformation. In fact, the Elves may be the most important and effective citizen-led response to disinformation in existence, said Kevin Sheives, an associate director at the International Forum for Democratic Studies at the National Endowment for Democracy and formerly a State Department official specializing in Chinese disinformation.

“They get more citizens involved in defending democratic values and the integrity of their own information space, but also help to amplify and augment the everyday work of civil society counter-disinformation responders,” Sheives said.

While the Elves have grown since the Ukraine war, the group has existed since 2014, shortly after the Russian invasion of Crimea. In the beginning, the Elves were just a group of three friends responding to Russian disinformation in the comments section of newspaper websites. “It was a pretty primitive way, but it’s where we started,” said Hawk. “Putin pushed us to stop discussions and start to do something,” he said.

To date, the Elves have cataloged and worked to disrupt thousands of Russian information operations, pioneering a model for squelching disinformation that experts said has informed the work of organizations such as the Atlantic Council’s Digital Forensic Research Lab and the State Department’s Global Engagement Center.

“They were fighting disinformation before it was cool,” said Gavin Wilde, a disinformation scholar at the Carnegie Endowment for International Peace and a former Russian and Baltics director at the National Security Council. “They established this bootstrap approach to understanding the disinformation landscape and formalized tradecraft that would come to be adopted more widely in the last several years.”

Eto Buziashvili, a Georgia-based disinformation researcher for the Atlantic Council’s Digital Forensic Research Lab, said “the Kremlin is quite aware of the Elves Army and that they have a huge network and of course they are worried because these people are located in many countries and they can detect the Kremlin operations early.”

Once a year, the Elves meet in Lithuania’s capital Vilnius at what is known as the Elves Academy, a conference where members are trained on the latest techniques and tactics for taking down their troll adversaries. It’s a place where members of the Elves such as Bleise can share their research and approach to hunting disinformation. 

A mother of two, Bleise spent years lecturing and writing about disinformation before becoming an Elf. The work is exhausting, she said. But the community of like-minded people working together with a common goal keeps her going. She said that while some people think the Elves are “crazy activists,” those in the know realize they are largely skilled professionals donating their time to the cause. 

She said she occasionally meets other Elves for coffee to “arrange some hackathon” and finds herself marveling at the fact that she is working with “some of the best brains in my country.”  

In the Czech Republic, which has a community of about 300 Elves, the group is highly organized and hierarchical because its leadership has military training. Specific teams within the community are dedicated to monitoring Telegram, Facebook and Twitter and others are tasked with infiltrating Facebook groups that traffic in Russian propaganda. 

Members are extremely security conscious, mostly remain anonymous even with each other and use a slogan inspired by the movie “Fight Club,” said Adéla Klečková, a disinformation scholar at the German Marshall Fund who published a policy paper on the Elves in January after spending months studying their operations. “The Elves never fail to say that ‘The first rule of the Elves is that the Elves do not exist.” 

Ultimately, said Klečková, the Elves just want to make a difference and use the tools at their disposal — the internet, their community and their intellects — to make a difference. “It is smart, educated people who simply care about values such as freedom of speech and democracy.”

This story was featured in CyberScoop Special Report: War in Ukraine

Explore report