Europe’s Protests and Their Exploitation Online

How Images Shape Mobilization

An account published by Corriere di Milano on October 19 describes calls to gather circulating on Instagram, TikTok, and Telegram, and reports that some people headed downtown after watching footage of the clashes. In this sequence, images appear to do more than document events. They become an invitation to participate. This offers a useful insight into how quickly the composition of a mobilization can change. [6]

The relative importance of each step remains to be established. The reporting does not isolate the effect of recommendation algorithms or show that they caused the violence. Public appeals, spontaneous sharing, and coordinated activity can overlap on the same platforms. Distinguishing them requires examining the origins of the content, the relationships among those distributing it, and the sequence in which it spread.

Telegram belongs in this assessment because of its role in group communication and organization. The existence of a channel or chat, including a closed one, does not establish clandestine activity. The dark web is a separate environment, and the sources reviewed provide no specific evidence of its involvement in the Italian clashes. Such a connection would become analytically relevant only if supported by verifiable traces.

When the Narrative Becomes an International Issue

France offers a concrete example of how the portrayal of a protest can become part of a diplomatic dispute. On October 7, before the violence of October 17 and 18, the French Foreign Ministry summoned the Iranian ambassador to protest what Paris described as a disinformation campaign concerning the high school protest movement. Its statement referred to content distributed through official Iranian Foreign Ministry accounts. [7]

The diplomatic action and the French allegation are documented. The statement, however, is not an independent forensic assessment of the content, and it does not establish that Iran organized the demonstrations or the subsequent violence. Nor does it provide grounds for attributing the Italian clashes to Iran. Its significance lies in revealing another level of confrontation, in which the portrayal of a domestic crisis becomes a matter of international contention.

An analysis published on October 8 by the European Digital Media Observatory adds another dimension. In coverage of the French protests of late September and early October, the observatory identified old or unrelated footage accompanied by narratives centered on ethnicity and religion. Material presented as a record of events was being used to give the demonstrations a meaning different from their original grievances. [8]

For an analyst, this shift warrants attention because it may indicate an attempt to discredit protesters, fuel hostility between social groups, or portray institutions as incapable of managing the crisis. Establishing which objective is actually being pursued requires examining each case. The effectiveness of an operation is also distinct from its visibility. Share counts alone do not reveal how much opinions or behavior have changed.

Synthetic Content and Attribution

Artificial intelligence creates additional opportunities for manipulation, but its use must be established through evidence. On September 30, TjekDet documented synthetic videos purporting to show anti-immigration demonstrations in European cities, including nonexistent events and misleading depictions of real protests. This is a relevant precedent for understanding the mechanism. It does not establish that the same technique was used in footage of the Italian clashes of October 17 and 18. [9]

Verification begins with the origin and date of the images and whether they match the locations they claim to show. It continues through comparison with independent accounts and reconstruction of their earliest circulation. A visual anomaly may warrant further investigation, but it is not enough to classify a video as artificial. Similarly, numerous accounts sharing the same material may be responding to a common event or copying one another without belonging to a single operation.

The case for coordination becomes stronger when verifiable links emerge among accounts, infrastructure, and distribution patterns. Attribution to a foreign actor requires an additional step, supported by converging evidence of control, possible financing, or other documented connections. A potential geopolitical benefit can guide an investigation, but it does not identify who carried out an operation.

Implications for Response Capacity

The public sources reviewed do not establish a cyber campaign linked to the Italian clashes. Any outage affecting an institutional website, or a claim of responsibility appearing at the same time, would require separate investigation. Establishing a coordinated hybrid operation would require evidence connecting the activities and explaining how they served a common objective. On the information currently available, that conclusion would be premature.

Operational preparation can nevertheless proceed while attribution remains uncertain. A public authority or service operator might simultaneously face a demonstration, false reports of closures, and an unrelated technical failure. That overlap alone could put decisions under pressure, particularly if reliable reports and misleading content reached the same offices while staff were already managing an emergency.

An exercise built around this scenario could test who verifies information before a closure is ordered, how a correction is authorized and communicated, and which channels remain available during an outage. Measuring verification times, decision handoffs, and the continuity of essential activities would give readiness a concrete operational meaning. It would also expose coordination weaknesses without assuming that every problem originates with the same adversary.

The focus should remain on documented behavior, misleading content, and operational dependencies. Participation in a protest, age, or personal background does not in itself indicate interference. Conflating these factors would weaken the analysis precisely where sound judgment matters most.

These developments bring us back to the question raised in my earlier commentary. A genuine crisis can create opportunities for exploitation even for actors who did not cause it. Determining whether that is happening requires following the circulation of content, reconstructing relationships among actors, and assessing the effects on public decisions. Doing this work in time to inform the response supports institutional resilience. It allows documented interference to be addressed while preventing suspicion itself from becoming another source of confusion.