A marketing technique goes to war

A marketing technique goes to war. A sanctioned Russian operation optimised its websites for machines rather than people. Five major AI models cited it. The techniques were borrowed wholesale from the marketing industry, and the proposed defence is that democracies borrow them too. The Foundation to Battle Injustice runs a website that does not much care whether you read it. On 98 per cent of its audited pages, according to research published in July by the British think tank Demos, the site carries a technical instruction allowing crawlers to extract unlimited amounts of text. Elsewhere in the operation, titles and descriptions extend beyond what ordinary search results display while remaining fully available to AI systems. The Foundation is a fake human rights organisation created by Yevgeny Prigozhin, the late Wagner Group financier, and it is sanctioned by the European Union and the US Treasury. It has been built for an audience of machines, at the deliberate expense of an audience of people. Researchers at Demos and CASM Technology put 3,000 prompts to five widely deployed models in April, drawn from fifty claims unique to the Foundation's own articles. In 16.6 per cent of responses the models engaged with the material in ways that served the operation, treating it as a legitimate side of a debate, repeating its claims without comment, or endorsing it outright as a human rights NGO. A further 30.9 per cent addressed the underlying topic while never mentioning that the source was a designated influence asset. The claims are not subtle. One holds that Ukraine has been processing the bodies of dead soldiers into meat products for domestic sale. A division of labour The operation is most instructive for how it was built. The 437 URLs the models cited belong to three domains performing three distinct jobs, each with a different technical signature. The Foundation's own site is the engineered origin point. A median article runs to 4,711 words and contains 71 sentences carrying quantitative claims and 19 attribution chains of the "according to" variety, with 60 per cent of paragraphs falling inside the word range models preferentially lift for citation. It publishes through a fast re-indexing protocol, so new material reaches search indices within minutes. A second domain, part of the Pravda network that published 3.6 million articles in 2024 alone, reports on the Foundation's claims as though covering someone else's story, and shows almost no optimisation at all. Its job is volume, multiplying the number of differently branded pages carrying the same assertion. A third restates the material in the register of a Western foreign policy journal, dense with the vocabulary of strategic studies. A model retrieving across all three does not see one actor asserting something. It sees a foundation publishing findings, a news outlet covering those findings, and a policy publication analysing them. The architecture manufactures the appearance of independent corroboration, which is precisely the signal these systems are trained to trust. None of this is novel tradecraft. As the first part of this series set out, it is the standard commercial playbook of placing content on third-party sites to borrow their authority, applied by a state instead of a brand. What the models did Behaviour varied enormously, which is the one genuinely encouraging finding. Grok comprehensively debunked the claims and named the source as a malign actor in 56 per cent of responses. Gemini managed 16.5 per cent, Claude 10.3 per cent and Mistral Small 1.2 per cent. Four of the five tested were the smaller, cheaper tiers that cost-sensitive deployments actually use, so the comparison is not quite like for like. The likely explanation is architectural. Each provider decides differently which documents to retrieve, how many, how to rerank them and how much weight to give source credibility. Grok draws on a live feed from X, Gemini routes through Google's infrastructure and its domain quality signals, and the others use their own arrangements. Treating models as one category obscures more than it reveals, and a system that performs well today may not after its retrieval stack changes. The channel nobody is selling Retrieval is the commercial vulnerability. It is not the only one, and the deeper evidence concerns training data. In May, Nature published a study by Hannah Waight and colleagues demonstrating across six studies that state control of the media already shapes model outputs. Chinese state-coordinated material appeared in an open training corpus at roughly forty times the rate of Chinese Wikipedia, rising to a quarter of documents mentioning political leaders or institutions. Additional pretraining of an open-weight model on 6,400 such documents made it markedly more favourable to the Chinese government, and the effect carried across languages. Auditing commercial systems, blinded human annotators judged the Chinese-language answer more favourable than the English one in 75.3 per cent of comparisons. Across 37 countries, models prompted in the local language produced more regime-favourable answers where press freedom was lower. Nobody had to purchase anything for that to happen. It followed from who controls the surrounding information environment. Retrieval poisoning can be mitigated by blacklisting a domain. There is no equivalent remedy once material is in the weights. How much of this is established The scale of the retrieval effect remains contested, and the sharpest challenge comes from four academics at Manchester and Bern who disputed the widely quoted claim that chatbots repeat Kremlin falsehoods a third of the time. Their objections were methodological. The prompts behind that figure were never released for replication, two-thirds were built to provoke falsehoods, and answers urging caution about unverified claims were counted as disinformation. Their own audit found false claims in 5 per cent of outputs, with dubious Russian sources surfacing mainly when a question fell into a data void that credible outlets had not covered. On that reading the vulnerability is information scarcity, the gaps close as reporting catches up, and overstating the threat hands Russian propagandists a flattering account of their own reach. That argument is not settled by the Demos study, though it is shifted. The evidence of intent there is technical rather than statistical. An operation that removes snippet limits for AI crawlers while allowing titles and descriptions to run beyond what ordinary search results display has made a decision about who it is talking to, and the decision is legible in the configuration. What follows The recommendations are where this becomes genuinely difficult. Demos proposes that model providers publish explicit policies on which optimisation practices they prohibit, that sanctioned assets be labelled whenever cited, and that Britain extend its planned media prominence regime to cover chatbots. It also notes that the Foundation, though sanctioned by Brussels and Washington, does not appear on the UK sanctions list, which makes labelling harder than it needs to be. The last recommendation is the one worth sitting with. Demos argues that the counter-disinformation community should adopt these techniques itself, so that accurate material is optimally visible inside AI systems. It calls this GEO for the public good. The reasoning is sound: the terrain will be contested by someone, and there is little to be gained by democracies withdrawing from it. The consequence is that the answer a citizen receives will increasingly reflect who invested in being retrieved, including when the investor is on the right side. The competition is already happening. The open question is who decides which truths are worth optimising, and whether anyone reading the answer will be able to tell that a decision was made. --- Disclosure: Anthropic's Claude was among the models tested in the Demos research described above, and Claude was used in the research and drafting of this piece. Sources: Demos and CASM Technology; Nature; NewsGuard; the Council of the European Union; Al Jazeera; The Times; Euronews.