Cyber Activists Confront Russian Information Operations

The elves operate anonymously and focus on fighting hybrid threats conducted primarily by the Kremlin and its proxies. Their work is voluntary, unpaid, and independent from states and governments. Their activities are strictly legal—they strongly denounce any form of criminal activity such as hacking or cyber espionage, and they mostly limit themselves to monitoring Russian disinformation and its perpetrators, such as the trolls. Most of the data they generate is shared with the public, either as media outputs produced by the elves or through articles by local media.

The elves across Europe have developed functioning international cooperation, mainly consisting of intelligence and information sharing. The Elves Academy is the best evidence of continuous and robust international cooperation. This project, established by the Lithuanian elves in 2018, has trained hundreds of elves over its three editions so far. The collaboration of the elves should be further cultivated and encouraged. Joined together under a common cause, the elves represent a group of several thousand experts on countering information operations—a force that plays and will play an undeniable role in the defense of democracies against Russian hybrid warfare.

The most important recommendation for how to support the elves is to initiate a dialogue with them to learn about their needs directly from them as the needs of the chapters differentiate significantly across Europe. Each chapter can be reached through its official channels—either social media, official email, or website—or in some cases through its official spokespersons who have stepped out of anonymity. Finally, the very least everyone can do for the elves is to acknowledge their activities, read their media outputs, show public appreciation of their work, and help them spread their message.


The activities of trolls—one of the key executors of Russian information operations—in the virtual realm of internet pose a severe security threat to Western democracies. The elves have real potential to successfully stand up to trolls. The conflict between them is part of an information war that is part of the broader hybrid war waged against the West by the Kremlin. Given the nature of cyberspace, Russian information operations are expected to grow in number, aggressivity, and sophistication. Furthermore, with Russian intelligence agencies already short of employees, the role of non-state actors such as trolls is expected to increase.

To prevent the rather dystopian picture of the future of trolling and other information operations due to the newest technologies from becoming reality Western stakeholders must look for innovative ways to counter information operations. This is especially the case since hiring an army of paid professionals, employing cyber criminals, or building armies of zombie or robotic networks is not an option for them. Cyber activism undoubtedly is, however.

Thanks to the growing role of information technologies and social networks in daily life, which allows activists to disseminate information and mobilize audiences on a previously unthinkable scale, cyber activism is on the rise. The elves present a specific type of cyber activism, operating anonymously in semiclosed communities in the CEE countries devoted to monitoring and countering Russian information and cyber operations. The movement started as a group of less than 20 enthusiasts in Lithuania in 2014 and slowly expanded, first to the other Baltic states and eventually 13 European countries overall, effectively creating a stable network of thousands of volunteers. 

The elves have managed to develop international cooperation among individual chapters across Europe, based on sharing information and best practices as well as occasional visits by representatives of each chapter. This cooperation is capped each year by the Elves Academy—an international congress at which about 100 volunteers learn under the leading elves new and valuable skills to protect and enhance their activities. 

The elves display a very good understanding of the global security environment and a great ability to adjust and face important new and emerging trends. Even though, given proximity to their countries, Russia will most likely be always the primary target of the elves, with China’s growing aggressive behavior and increasing information operations in CEE cyberspace, the elves are starting to expand their focus to include countering actions from Beijing. This might be highly relevant for Western stakeholders and could play an important role in the future of the elves. The elves are discussing with members of civil society in Taiwan the establishment of the first Asian chapter

When it comes to how to enhance the activities of the elves or to create conditions in which such movements are more likely to be founded and to blossom, perhaps the most important is that there is no one-size-fits all solution and that it is important to initiate the dialogue with the elves to learn about their needs directly from them. An equally crucial lesson is that the work of the elves is difficult, monotonous, time-consuming, and yet unpaid, and therefore that it is often difficult for the elves to keep their motivation. Thus, the least that can be done for the elves is to acknowledge their activities, read their media outputs, show public appreciation of their work, and help them spread their message.

Ultimately, the journey to a strong civic society that is resilient to information operations and other kinds of hybrid warfare by Russia or any other actor starts with every single citizen. We are the internet. We are social networks. We all need to assess online content critically, be careful with our personal data, respect “netiquette,” and avoid hateful and aggressive behavior under any circumstances. And, perhaps most importantly, we must think before we share. Our future is our own responsibility; let us not make it someone else’s video game.