The Masquerade Continues: Doppelgänger Interferes with Polish Elections

Saman Nazari, Alliance4Europe. 

Jakub Kubs, GLOBSEC. 

Wojciech Solak, Independent Researcher.

Aleksandra Wojtowicz, Independent Researcher.

Contributors: 

Lea Frühwirth, CeMAS.

Or Yacobi, Alliance4Europe. 

Pavla Tarozikova, Alliance4Europe

Executive Summary 

• The long-standing Russian Doppelganger operation has repeatedly been flagged since 2022, but is still active on X.
  
• In April 2025, Alliance4Europe and Debunk.org informed X that the influence operation was targeting the Polish elections.
  
• In April and May, the operation continued to be active on X, publishing at least 321 posts.
  
• The narrative analysis revealed a significant anti-EU sentiment alongside targeted criticism of Polish and European leaders like Donald Tusk and Ursula von der Leyen. Besides prevalent anti-EU rhetoric, the posts advocated peace emphasising social welfare over military expenditure and criticised the Polish government’s alleged failures in migration, healthcare, and economic policy.
• X has a legal obligation to geofence Doppelganger content from EU audiences, given the sanctions in place against the Social Design Agency, the organisation that runs the operation.
  
• Under the Digital Services Act Articles 34 and 35, X is also obligated to address threats to electoral integrity. 

Background 

Doppelganger is an active Russian influence operation that was first recorded in 2022. It is delivered for the benefit of the Kremlin by the Moscow-based organisation “Social Design Agency”, which is subject to sanctions by the European Union. Their activities have been tracked by open source intelligence (OSINT) researchers affiliated with the Counter Disinformation Network (CDN) since July 2024, leading to four previous reports and alerts. Alliance4Europe is continuously tracking its activity together with CeMAS (title) Lea Früwirth. 

In January 2025, Alliance4Europe published a report showing that Doppelganger had expanded its operations to BlueSky, mapping out the tactics and techniques employed by the operation on that platform. That report led to an exchange with BlueSky’s Trust and Safety department, which took action to ensure that Doppelganger would cease its operations on the platform.  

In April 2025, Alliance4Europe and Debunk.org published a report showing that the illegal Doppelganger influence operation had begun engaging with the Polish presidential elections on the social media platform X (previously known as Twitter) during the period between March 4 and April 4. Representatives of X acknowledged receipt of this report via email, and Polish media widely covered the research findings (E.g. examples 1, 2, 3, 4) 

In spite of this, the operation has remained active throughout the first round of the Polish presidential elections. Indeed, Doppelganger has not been seen changing its behavioural patterns since the original report on the operation was published in September 2024 by Alliance4Europe, CeMAS, and other members of the Counter Disinformation Network. Since then, the operation has interfered with the German elections, and now in the Polish elections. 

Operation Doppelganger, X and EU Law

Given that the operators behind the influence operation are subject to EU sanctions, X has a legally binding obligation to geofence their content from EU audiences, as outlined by Alliance4Europe’s December 2024 Doppelganger report. It is possible that X’s failure to geofence or remove flagged tweets might constitute a violation of the EU sanctions against the Social Design Agency. 

Furthermore, the Digital Services Act (DSA) stipulates in Articles 34 and 35 that Very Large Online Platforms (VLOPs), such as X, have a responsibility to mitigate systemic risks towards electoral processes. It can be argued that X has failed to meet this responsibility given this apparent omission. Given that a significantly smaller competitor platform, such as BlueSky, has proven able to take effective action against Operation Doppelanger, it stands to reason that X could plausibly do the same.

Doppelganger Activity in April–May 2025 

Between April 11 and May 21, 321 Polish-language tweets were traced to originate from the Doppelganger operation. Their relation to Doppelganger is inferred by their exhibition of the same behavioural patterns as those previously identified as characteristic of Doppelganger. They are made by inauthentic X accounts posting tweets that position them as Polish citizens, who have less than 10 followers. Despite the low following, the accounts get their content quote-tweeted by other inauthentic accounts onto authentic users’ posts hundreds of times. The tweets contain articles which align with or support Russian narratives. At times, articles which in fact do not necessarily support Kremlin talking points are reframed in the tweets to twist their meaning into a  Russian-aligned message.

The 321 tweets were quote-tweeted over 271,000 times onto other users’ content. Considering these inauthentic interactions, which also translates into over 271,000 inauthentic views, it seems like the content gained around 1,229,000 views. The operation also gained 3879 likes. It is unknown how many of these are authentic or inauthentic.  

Electoral Silence Violation

Poland has a two-day electoral silence period, as defined by the Polish Election Code, and violations can carry fines.

At least four of the Doppelganger tweets in our dataset mentioned a political candidate and were published on May 17, 2025, one day before the first round of elections, which is during the electoral silence period.

As per the Digital Services Act Articles 34 and 35, the social media companies are obliged to implement measures against and address illegal content on their platforms. In this case,  it would seem plausible that X has not lived up to this responsibility, both in regard to the electoral silence and the violation of sanctions, as the operation operated during the silence period. 

Articles Amplified

Doppelganger’s modus operandi includes resharing articles and presenting them with posts and captions that align with Kremlin narratives. The following outlets were amplified by the tweets contained in this report’s data set:

Amplified Media

Russicisms, Grammar Issues and Repetitive Phrasing 

The posts of the dataset contain several phrases repeated across ostensibly unrelated accounts. This includes phrases such as “nie możemy pozwolić”, which translated to “we cannot allow…” Given that authentic posters tend to naturally vary their language, express themselves in personally distinct ways and adapt phrases to individual context, verbatim repetitions of complex political statements such as the example above across 16 accounts from several different listed countries of origin is statistically improbable. 

Another repeat feature of the data set is the recurring nicknaming of Nawrocki as “Nawo”, which is not a common nickname for Nawrocki in Polish discourse. The repeated usage of this might be theorised as a shared autocorrect feature, or some type of difficulty to spell the Polish surname.

Additionally, out of a random sample of 50 posts, 26 posts were found to include Russicisms, poorly-translated phrases or assorted grammatical and linguistic errors. The frequency of this occurrence (52%) within the limited random sample serves as an additional indication that the posts found in the data set were authored by non-native speakers of the Polish language.

Examples of incorrectly written Polish includes: 

• “Nie możemy być już uciszką w rękach UE!
• “Niemcy eksportują do nas swoje problemy, a my mamy tość skrupów, aby przyjąć je z otwartymi ramionami?”
• “Musimy myśleć o naszej przyszłości i nie pozwolić, aby decyzje podejmowane w Brukseli nasz badlywały.”

Some accounts used words that either don’t exist in the Polish language, or which indicate some level of linguistic influence from Russian, both in vocabulary and in syntax. For example:  

• The word “kompromity”  seems to be used as a Polish version of the Russian term “компромат”, which refers to compromising materials, but the noun does not exist in proper Polish.
• Tweets use “ES” instead of “EU”, which is reminiscent of the Russian abbreviation EC (from “Европейский союз”), 
• The phrase “wciągnąć w konflikty nie na naszej płycie” is a literal translation of a Russian expression, “не на нашей площадке”, which translates to “not on our playing field”, and which reads as inauthentic Polish. 
• Similarly, “dziesięcioinkomowiec” is a malformed plural based on Russian grammar (десятиинкомовцев).
• The sentence “We can no longer be uciszka in the hands of the EU!” uses a fabricated word – uciszka – which mimics Russian-sounding diminutives like игрушка (toy). 
• The claim that “Germans export their problems to us, and we have enough skrupy to accept them with open arms?” contains skrupy, a word that does not exist in polish, but which might derive from a mistranslation of “scruples” or “burdens.” 
• The phrase “nasz badlywały” appears to be an unsuccessful formulation pretending to be Polish and taken from the English phrase “treat us badly”, which is not a natural polish statement.

Image 1: Tweet using “dziesięcioinkomowiec”

Narrative Analysis

The dataset includes 321 X posts, covering the period from 11 April 2025 to 21 May 2025. 

An automatic classification of the posts was carried out using AI, with the help of which it was indicated that out of 321 tweets, the following content breakdown emerges:

• 131 attacked the EU 
• 28 attacked Donald Tusk 
• 10 attacked Ukraine 
• 9 personally attacked Volodymyr Zelensky
• 8 attacked Germany 
• 7 personally attacked Ursula von der Leyen

The posts tapped into a number of topics, such as: 

• Anti-Europeanism and Sovereignty: the EU is described as a coloniser that de facto rules over Poland. The EU is presented as an entity responsible for the alleged economic crisis and worsening of the citizens’ welfare in Poland. This narrative also frames polish political figures such as Donald Tusk and Rafał Trzaskowski as subservient to foreign forces. 

• The Peace Narrative: Narratives hold that government prioritisation of military spending over social services harms ordinary citizens. The narrative portrays the government as keen on escalating war involvement, while asserting that prioritising peace should be the main goal to safeguard citizens’ welfare and security.

• Polish Government Failures: This discourse frames the Polish government as responsible for a number of claimed failures, including mishandled migration, ineffective healthcare, and spiralling national debt. Other failures listed include unsubstantiated accounts of Poland being a ‘dumping ground’ for old buses and solar panels from Germany, promoting Polish coal mining, and framing Russia (and to a lesser extent, China) as economic powers that must not be ignored or isolated. 

Candidate-specific Narratives 

290 posts refrained from expressing support for any specific individual, but 15 posts instead opted to express support for candidate Karol Nawrocki, presenting him as someone opposing the EU, and as someone caring about the people of Poland. Two tweets were specifically critical of Polish presidential candidate Rafał Trzaskowski (PO – EPP).

Nawrocki Discourse

The dataset includes 15 posts mentioning Nawrocki, all expressing positive sentiment.

Strong Nationalist and Anti-EU Framing: Pro-Nawrocki posts consistently depict him as a champion of Polish sovereignty, an opposing force to  EU influence and the policies of Brussels. Nawrocki is presented in comparison to other Polish politicians, especially his main opponent in the presidential race, Rafał Trzaskowski.

Image 2: “@tammyjonesdea” (May 21, 2025): “Nawrocki stands against surrendering to Brussels’ dictates. Polish industry must not be sacrificed on the altar of political correctness!”

Focus on Rationality: In the posts, Nawrocki is presented as a pragmatic and rational politician in the times when other Polish public figures are framed as emotionally volatile. In contrast, he is positioned as a person who will rely solely on his cold judgment. 

Image 3: “@dorothymperfec” (May 21, 2025): “Amidst the energy crisis Nawrocki offers a pragmatic approach that considers our safety and prosperity”

Focus on Energy Independence and the Coal Industry: Four posts emphasise Nawrocki’s advocacy for coal and energy security, positioning him as a defender of Poland’s economic sovereignty and mining jobs.

Image 4: “@natalie_besuffi” (May 21, 2025): “The EU wants to force us to abandon coal, but what about our jobs and the development of mining regions? Nawrocki has the answers.”

Electoral Timing: Four of the 15 posts were published on May 17, 2025, one day before the first round of elections, indicating a strategic effort to boost Nawrocki’s campaign. Nine additional posts appeared on May 21, 2025, reflecting sustained support during the second round.

Image 5: “@bryan_flynpi” (May 21, 2025): “Poland’s elections are a chance to voice our discontent with EU interference. Nawrocki is our voice in this fight.”

Trzaskowski Discourse

The dataset contains two posts explicitly mentioning Trzaskowski (with his name misspelt). Both portray him negatively: one links him to his political faction, holding him accountable for the actions of said collective, which the tweets frame negatively. The other criticises him for allegedly prioritising Brussels’ interests over Polish sovereignty.

The accounts spreading anti-Trzaskowski content were created in April 2025, hinting at the intent behind the accounts being to indeed propagate against the candidate in question.

Actions Taken and Next Steps

On May 28th, all posts analysed were flagged to X, which then deleted the accounts responsible for the tweets. However, considering that the last post in our dataset was posted on May 21st, and given that the life-span and sharing cycle of this type of content  tends to last for just one or two days, it is likely that the messages had managed to reach users before the takedown. 

X should use the behavioural mapping of Doppelganger we have provided them to block the influence operations from being able to operate on their platform. This approach worked for addressing the same influence operation on Bluesky, and should also work for X. 

If we can automatically track their activity using X’s own API, so can X.