How a cross-border discrediting campaign was dismantled and stopped

The campaign did not begin with a high-profile publication. At first, isolated mentions appeared on obscure platforms - the kind that under normal circumstances no one would notice. Within a few days, the same claims began to reappear elsewhere, now citing the first mentions as a source.

By that point, documents had been added to the claims. On the surface, they looked like working materials: correct format, recognisable structure, details that an uninitiated reader would take as a sign of authenticity. It was the documents that gave the campaign a credibility that statements alone did not provide.

The client approached us at a stage when the situation had stopped looking like coincidence but had not yet become a public event. His question was formulated precisely: not "who is doing this" but "which of the materials being circulated is genuine, and how is this organised".

We set out the limitations at the outset. Identifying who commissioned the campaign is not within the scope of a private check. We can verify the integrity of the circulated materials, reconstruct the chronology of their appearance, and describe the structure of distribution. Naming the organiser and characterising their actions is a matter for the court alone.

A separate question the client raised directly was resolved as well: whether a symmetrical response was possible. The answer was no, and it was not discussed further. A counter-campaign turns the affected party into a participant and strips them of their one advantage - the ability to speak through documents rather than assertions.

The anonymity of sources creates the impression that there is nothing to examine. In practice this is not so: a campaign retains observable properties unrelated to identities. Below is what can be described, and what cannot.

We do not describe the methodology here. A public description of how document integrity is verified is useful, above all, to someone who next time wants to prepare materials more carefully. Below are the principles and the nature of the conclusions, not the procedure.

First principle: what is verified is the integrity of the carrier, not the truthfulness of the content. The question is not "is what is written true" but "does this document correspond to what it claims to be". The second question cannot be resolved by technical means, and we do not promise that it can.

Second principle: what matters is a discrepancy, not an individual characteristic. No single feature means anything on its own. What matters is a persistent inconsistency between what a document claims to be and what follows from the totality of its technical characteristics, recurring across several materials.

Third principle: the result is divided into three parts, not two. Materials whose integrity raises no questions. Materials with persistent signs of alteration. And materials on which no confident conclusion can be drawn - these are always the minority, but they are stated directly, not dissolved into a convenient formulation.

It was the conclusion regarding the second group that changed the client's subsequent decisions. Before it, the discussion concerned a public response addressing the substance of the accusations; after it, it became clear that the subject of the conversation had to be not a substantive debate but the origin of the materials themselves.

What this conclusion does not mean. It does not establish who made the alterations, and it does not prove intent. Signs of alteration are a technical fact; their legal qualification, including any conclusion of forgery, falls within the competence of a court, not ours.

The campaign affected not only the client's professional role. This changes the nature of the work: where the immediate circle is concerned, the priority is not evidentiary completeness but safety and minimal interference.

We adhere to a strict rule here. No information about family members, their whereabouts, routines or circumstances was collected beyond what was necessary for the risk assessment, and none was included either in the public version of the material or in the report beyond the necessary extent. This text says nothing about them, and that is a deliberate decision, not an omission.

The assessment came down to three questions. What information about the immediate circle is already publicly available, and through what channels it got there. What of this can be reduced or closed off without abrupt action. And what signs would indicate that the situation had ceased to be a matter of information alone.

The last point was addressed separately and in writing. If signs of a direct threat to life or health appear, the matter immediately ceases to be private: the proper addressee is the police and the authorized bodies of the relevant country. A private company does not hold their powers, does not replace them, and must not attempt to.

The professional part of the assessment was structured differently. Here it was important to understand which circles the campaign had actually reached and what decisions might be made on that basis before a documented rebuttal appeared. This time frame determined the priorities of all the rest of the work.

The response format followed from the result: since the key conclusion was technical, the conversation had to be conducted on legal ground, not in public debate.

The materials were provided to the client's legal counsel in a form suitable for procedural use: recorded primary materials, a conclusion on indicators of alteration with confidence levels separated out, a described chronology and distribution structure, and a list of what could not be established.

Further action - approaches to platforms, demands and any procedural steps - was handled by legal counsel. We did not take part in this and did not act on the client's behalf: this division of roles is not a formality but a condition for the check to retain its value.

Public communication was kept to a minimum and built on one principle: not to restate the allegations. Refuting them point by point inevitably reproduces what it refutes and widens the circle of those aware of it. Substantive engagement with anonymous materials almost always works in favor of their author.

We separately record what we do not assert. We did not establish, and do not assert, that the campaign was organized by a specific person, organization or party. We do not assert that distribution stopped as a result of the measures taken: according to the client's observations, no new publications appeared after the legal approaches, but the causal link here is not proven and may have other explanations. This is the client's account, not a finding of the check.

First. Regular monitoring of the information background. Campaigns almost never start loudly: time usually passes between the first inconspicuous mentions and a noticeable stage, and that time is a resource. Detecting the start earlier means recording materials before they begin to disappear and be edited.

Second. A predefined procedure. Who receives the signal, what is recorded immediately, who is authorized to decide on a public response, at what point legal counsel becomes involved. In a crisis, the procedure is executed, not invented.

Third. Information discipline around working materials. Altered documents are most often based on genuine working files rather than invention: altering an existing document is easier and more convincing than creating one from scratch. Narrowing access to working materials is the most underrated preventive measure.

Fourth. Dividing roles in advance. A person who has become the target of a campaign should not simultaneously be its analyst and its voice of response. Combining these roles worsens both the assessment and the communication.

Fifth, and this is a limitation. None of these measures guarantees that a campaign will not recur. They reduce response time, preserve evidence and reduce harm - but they do not remove the possibility itself.

And last. Eighteen days and the described procedure are the circumstances of this example, not a standard. A different situation may require substantially more time, and an honest result of a check is often a conclusion that there are no indicators of alteration of the materials.

Signs of a task to be resolved through forensics and legal documentation, not a public response. This is not a diagnosis and not a promise of a result.