► Southeast Europe (SEE) remains one of the most vulnerable soft targets for the Kremlin’s ongoing hybrid war against the European Union and the democratic West. The combination of state and media capture, simmering ethnic divisions both between and within countries, and the legacy of Russian cognitive bias all make the region a prime target for the Kremlin’s aggression following the invasion of Ukraine.
Russia’s brutal and ongoing war against Ukraine’s fledgling democracy has been a rude wakeup call for the European Union and Western democracies. The conflict has come as a stark reminder for Europe and the West that their tolerance of the Kremlin’s state capture bullying and sharp power hybrid war tactics across democratic Europe has lasted far too long. The Kremlin’s oligarchic networks have been granted free integration into the EU’s financial and industrial fabric, allowing Moscow to weaponize energy and financial flows into Europe.
In addition, the Kremlin’s media hydra has been allowed to leverage the vulnerabilities of the transition to social media to broadcast a wave of unchecked propaganda and disinformation to every corner of the continent, blanketing the European media environment with the pernicious white noise of pro-authoritarian, anti-European narratives. This ongoing campaign of hybrid warfare has been enabled by a network of strategic corruption, targeting political parties, media outlets, and state-owned enterprises across Europe.
After Russia’s invasion of Ukraine, however, the EU has been able to unify and provide a resolute joint response to the Kremlin’s aggression, securing unprecedented support for Ukraine and levying consecutive rounds of sanctions on the Russian war machine. This has been complemented by measures seeking to enhance Europe’s economic security and decouple its economy from Russian energy and financial networks.
Southeast Europe at a crossroads
► Illicit finance and disinformation are two of the most potent sharp power tools that the Kremlin has deployed to undermine democratic processes in Southeast Europe. The usage of these tools has also provided fertile ground for the corrosive influence of China and other authoritarian powers.
Southeast Europe remains the continent’s most vulnerable region to Russia’s hybrid threats. Moscow will likely continue to seek to destabilize SEE regardless of the outcome of the war in Ukraine. Parallel to its aggression against Ukraine, Russia has continued to employ economic influence, disinformation, and hybrid threats to undermine the national policies of NATO and EU members and candidate countries of strategic importance. Hungary and Bulgaria, members of both the EU and NATO, have weakened and undermined EU sanctions on Russia, threatening to use their veto power or carving out derogations. Serbia has thus far been the only European country to oppose sanctions on Russia. Belgrade seeks to maintain the status quo in its relationship with Moscow, and continues to allow Russian state-owned media to operate in the region. The Kremlin has constantly threatened Moldova diplomatically, militarily, and economically, pushing the country into a political crisis. The Republika Srpska region in Bosnia and Herzegovina has continued to sow division and threaten secession, seeking the Kremlin’s backing. Continuing fissures between countries in the region, such as the dispute between Serbia and Kosovo and between Bulgaria and North Macedonia, provide further opportunities for authoritarian meddling in the region by Russia and other actors.
The Kremlin Playbook networks, which utilize a broad array of tools to pursue state capture in Europe, particularly in the highly vulnerable and strategically important Balkans, remain alive and well. Both are inextricably linked to each another and to a merging of interests between Kremlin-aligned Russian oligarchs and their local counterparts, with the latter yielding considerable political influence in the still-unconsolidated Balkan democracies.
ILLICIT FINANCE AND FOREIGN MALIGN INFLUENCE
Over the past decade, authoritarian regimes have intensified their rejection of western democracies. Accordingly, they have boosted their tactical spending in campaigns aimed at manipulating public opinion and perceptions in the West. To this end, autocracies have weaponized diverse tools that include the development and exploitation of media and information, the abuse of wide-ranging cultural activities and educational programs, and the deployment of full-on disinformation and propaganda armies. These methods of authoritarian influence do not aim to attract or even persuade the citizens of democratic societies, but instead conspires to distract, divide, and manipulate them. The epitome of sharp power is the use of illicit financial flows stemming from the Kremlin to establish and cultivate relations with political parties, social groups, and high-ranking individuals, with the purpose of influencing key policy decisions.
Russia and China have long used obfuscated corporate ownership structures and illicit financial flows to secure everything from new technologies and expertise to economic and political influence within countries of interest. Russia has established a pattern of malign economic impact in Europe through its cultivation of opaque networks of patronage across the region. It then deploys these networks to influence decision-making in key markets and institutions.
Illicit finance in Southeast Europe
► Illicit financial flows (IFFs) underpin state and media capture oligarchic networks across SEE. Amounting to 6% of the region’s GDP, IFFs are more pervasive in the Balkans than the global average, which stands at 3-5% of world GDP.
The size of IFFs is estimated at USD 1-1.5 trillion a year on a global level. While this figure totals to roughly 3-5% of world GDP, IFFs in the Balkans stand at around 6% of the region’s GDP based on estimates. IFFs in Southeast Europe are manifold and multi-directional. The common denominator of the SEE countries is their vulnerability to these illicit financial flows, exacerbated by institutional weakness and state capture.
IFFs promote rent-seeking and criminal behavior, reduce governments’ capacity to support development and inclusive growth, undermine the rule of law, erode the functioning of criminal justice systems, and jeopardize the business environment. Illicit financial flows drain public resources, reduce the scope and quality of public services, and thus damage the integrity of state institutions, along with public confidence in them. They also create powerful networks of influence, which serve local or external malign interests.
Defining Illicit Financial Flows
IFFs are unrecorded cross-border financial flows involving dirty money, i.e. funds that are illegally earned, transferred or utilized. In a broader sense, IFFs are funds that, through legal loopholes and other artificial arrangements, circumvent the spirit of the law, and include any cross-border flows that harm the economy, either directly (e.g., via lost tax revenue) or indirectly (e.g., by eroding institutions). A financial flow can be classified as illicit if either its origin (source), the method used for moving it (channel), or its eventual use is illegal. A single flow of money might go through multiple different channels, and each source tends to favor specific channels over others. Common sources of IFFs include:
- Corrupt proceeds (money stolen from the state or funds acquired through abuse of state power)
- Criminal proceeds (drug money, individual tax evasion, or tax fraud)
- Commercial proceeds (multinational tax or tariff evasion)
Illicit flows circulate in and out of the SEE region, enabled by an ecosystem of governance weaknesses, endemic corruption, crime, and corporate evasion. The region’s economies are less competitive than their EU peers, plagued by an abundance of undue political interference and state ownership, an underdeveloped private sector, and the frequent, obscured presence of intergovernmental agreements with authoritarian states.
SEE has traditionally served as the gateway route for drugs, migrants, and a variety of dual use and excise goods. The significant increase in infrastructure investments in recent years largely powered by China’s Belt and Road Initiative has added fuel to the fire, intensifying the existing flows of both legitimate and illicit commerce. IFFs are also eased by the region’s porous borders, the interdependent nature of its economies, and their large informal sectors.
Weaponization of Russian capital in Europe
An estimated USD 1 trillion of Russian capital has been invested across Europe since the collapse of the Soviet Union. A significant chunk of these funds has been used to capture key assets in strategic economic sectors such as energy, telecommunications, banking, construction, and logistics. On the eve of the invasion of Ukraine, Russian companies had firmly entrenched themselves in the European economy: In January 2022, Russia controlled EUR 277 billion in foreign direct investment stocks (inward FDI stocks) across the 27 EU member states – up by a third since the introduction of sanctions against Russia following the 2014 annexation of Crimea.
The true figures of Russian investment are likely much higher than the official central bank numbers indicate, as at least 50% of all Russian financial flows to Europe pass through offshore destinations such as Cyprus, the British Virgin Islands (BVI), Ireland, Luxembourg, and the Netherlands, where Russian funds are hidden behind nominal ownerships, trusts, and portfolio investments via third-party investment funds. Russian corporate assets within Europe reached almost EUR 600 billion at the end of 2021, and European banks still held EUR 83 billion in liabilities to Russian companies and individuals, with countries such as Austria, the Netherlands, Italy, and France most heavily exposed to the Russian market. Many of the transactions enabling the capturing of strategic assets in SEE passed through these European financial hubs.
The cronyism which lies at the heart of Russia’s economy allows the Kremlin to weaponize Russian investment in Europe and elsewhere for political ends, thanks to informal networks of enablers. European oil and gas companies have locked national economies into a long-term dependence on Russia, buttressed by their longstanding business relations with their Russian counterparts. This trend provided additional pools of illicit profits to strengthen oligarchic corporate networks and political dependencies.
The unprecedented sanctions against Russia have spelled the end of the three-decade-long process of Russian economic and political penetration into Europe. The EU, U.S., and G7 have responded to Russia’s invasion of Ukraine by targeting the main financial pillars of the Russian economy. More than 4000 companies registered in the EU with ultimate beneficial ownership in Russia have been sanctioned. However, no Russian companies have been effectively sanctioned in SEE due to deeply entrenched dependencies and the dangerously low capacity of law enforcement to deal with matters of economic security.
Media Capture: Subjugating the Hearts and Minds
► Widespread disinformation is one of the most insidious symptoms of media capture in SEE. Serbia in particular has emerged as the primary launchpad for both illicit financial flows and pro-Kremlin disinformation in the Western Balkans. However, Bulgaria’s experience has demonstrated that even EU membership does not wipe these problems away if state and media capture practices persist.
Countries across the region, including EU member states Bulgaria and Croatia, lack sufficient institutional safeguards regarding the disclosure of ultimate beneficial owners and funding sources, as well as proper restrictions regarding ownership concentration. This dilemma is compounded by the rise of social media platforms which provide an open forum for the spread of disinformation and other types of propaganda while simultaneously eroding the funding base of traditional media.
Social surveys conducted throughout the region marked a noticeable decrease in public support for Russia with the beginning of the invasion. However, the editorial policies and agendas of key pro-Kremlin and sometimes even mainstream media outlets and political parties have endured. Political actors sympathetic to Moscow, such as the SNS and the SPS in Serbia, Revival and the BSP in Bulgaria, and the SNSD in Bosnia, have retained their parliamentary positions and decision-making power throughout a series of general elections in 2022-2023. Their success was aided by known pro-Kremlin outlets, which have similarly maintained and even increased their activity, contributing to a partial rebound of public sympathies toward Russia following the initial upset of the invasion.
Russia had already successfully capitalized on the lax regulatory environment in SEE to engage in media capture through opaque local networks of influence in the years prior to the invasion. These networks consist of Kremlin-aligned business tycoons, politicians, and other influence agents, who direct the editorial policies of major outlets and give credence to disinformation narratives. They have ensured that the mainstream information environment remains conducive to the Kremlin’s operations, which have only intensified after the launch of its invasion of Ukraine.
REGIONAL DYNAMICS
Bulgaria and Serbia continue to act as the main coordination hubs and launchpads of the Kremlin’s influence in information spaces across the region. Bulgarian politicians and reporters normalize pro-Kremlin disinformation domestically and in Euro-Atlantic institutions, while, Serbia helps extend the Kremlin’s disinformation operations throughout the Western Balkans via Serbian-language media outlets based both within Serbia and in Serbian enclaves such as Republika Srpska. Cross-country traffic metrics from mainstream news websites in the Western Balkans reflect an informational competition for Serbo-Croatian-speaking audiences between Serbian pro-Kremlin outlets and the relatively Euro-Atlantic-leaning Croatian outlets.
In over half (five out of eight) of the countries in SEE, at least one of the five most visited online outlets is an endemic proliferator of pro-Kremlin disinformation (namely, in Bosnia and Herzegovina, Bulgaria, Montenegro, North Macedonia and Serbia). Serbia stood out as the most pronounced case, with four out of five of its most visited news websites consistently publishing pro-Kremlin disinformation. The mainstream outlets in all eight countries were found to be referencing sources from Russian state-controlled media, with Bulgaria and Serbia accounting for over half of all identified references.
Number of articles referencing RT, Sputnik, TASS or RIA Novosti
in top five most visited news websites (2022)
Leading online pro-Kremlin outlets continue to blanket the Balkan digital landscape with a constant stream of disinformation and other types of propaganda. In some cases, the most prominent and consistent online amplifiers of explicit pro-Kremlin disinformation are also among the most visited news websites in the respective country, as is the case in Bosnia and Herzegovina (nezavisne.com), Bulgaria (blitz.bg), Montenegro (in4s.net and mondo.me), and Serbia (novosti.rs, kurir.rs, rts.rs and srbijadanas.com). These outlets are virtually synchronized with the Kremlin’s talking points, and act as its local mouthpieces without any known investment of resources or direct ownership from Moscow.
Facebook – an open forum for disinformation
Facebook remains the dominant social media platform in the region, with its popularity ranging from 98% of all web traffic to social media platforms in Albania and Bulgaria to 72% in Croatia at the lower end.
The platform continues to serve as a hotbed for the information operations of foreign authoritarian actors and their local proxies, and has proven to be a critical component for their outreach efforts. Pro-Kremlin parties throughout the region boast nearly 1 million combined followers, and published over 22,000 posts in 2022, receiving approximately 13 million interactions.
Follower counts of the Facebook pages of pro-Kremlin parties in 2022
Metrics of the Facebook pages of Russia’s embassies in the region in 2022 indicate that Moscow’s diplomatic missions expanded their outreach efforts the most in North Macedonia, followed by Montenegro and Bulgaria, albeit with varying success. The Kremlin’s official messaging holds by far the greatest sway in Bulgaria’s Facebook sphere, where the Russian embassy has a follower count of 65,000, twice as many as that of all the other six embassies’ pages combined. In 2022, the Russian Embassy in Bulgaria boasted a staggering 1.9 million interactions – nearly seven times the number of interactions received by the six other embassy pages combined.
Number of posts published and interactions received by Russian Embassy pages in 2022
What’s Next? Winning the War outside Ukraine
► Tackling the nexus of IFFs and media capture in the Balkans calls for continued democratization and rule of law reforms within the framework of an accelerated EU integration. Political leaders throughout the region should be called to account for their support, either open or indirect, of outside authoritarian influence and corrosive capital inflows.
The Kremlin has not only invaded Ukraine, but has also intensified its influence operations across Europe, which in many cases have successfully achieved some degree of state capture. Reversing this process must be the first order of business on the agenda in SEE, Brussels, and Washington. IFFs underpin state and media capture oligarchic networks across SEE. The Kremlin has consistently utilized the infrastructure of these networks to weaponize information and economic resources. Hence, decoupling the region’s economies from Russia has proven exceedingly difficult, even after the full-scale invasion of Ukraine.
Stemming the tide of IFFs and related media capture and disinformation requires both a whole-of-society and an international approach. This is a tall order for the limited capacity of SEE governments and civil society, and calls for stronger political engagement from the European Union and the United States. The EU must agree on a clear short-term timeline for the accession of the Western Balkans, as well as for Bulgaria and Romania’s membership in the Schengen Area of freedom, security and justice.
The U.S. needs to ramp up its re-engagement with the wider region of Southeast Europe and the Black Sea, encouraging more friend-shoring of its business, and strengthening its development cooperation in critical domains such as cybersecurity, media, and law-enforcement. Washington should follow up its Summit for Democracy initiative with a longer-term democratization, rule of law, and economic security support and capacity building across the region.
STEMMING THE TIDE OF ILLICIT FINANCE
► Stemming the tide of IFFs requires a new EU approach to economic security (e.g., accelerated rollout of the European Anti-Money Laundering Authority). There should be a continued strategic direction of constructive capital to SEE through EU funds and development aid to help the region decouple faster from corrosive oligarchic networks through improving sanctions enforcement and investment screening.
Europe needs a strategic decoupling of its economy from Russia’s. Priority should be given to breaking energy dependence and dismantling Russian oligarchic networks across the continent. In the more vulnerable economies of Southeastern Europe, Russia’s weaponization of trade must be opposed by pursuing a policy of strategic investment by the EU and the U.S. Two concurrent policies would produce a tangible result: exposing and targeting the loci of political corruption, and increasing the level of anti-money laundering enforcement against Russian financial flows in SEE.
- The first step is to assess the nature and scope of the threat, by identifying the government institutions and decision-making processes that have been affected by institutionalized political corruption (state capture).
- There is a critical need to increase the quantity and quality of data available on the nature and magnitude of IFFs, in order to comprehend their key drivers, channels and trends and initiate a stronger policy response.
- Concerted transatlantic action against illicit money and rogue assets in SEE through the effective enforcement of the sanctions against Russia following the invasion of Ukraine.
- Accelerating the integration of SEE into the rollout of the newly designed Anti-Money Laundering Authority. The Authority and its SEE counterparts should coordinate their actions closely with U.S. FinCEN and the financial intelligence institutions in each EU member.
- The heart of strategic decoupling is finding a solution to the European and SEE energy and climate security conundrum. This would mean ensuring the diversification of the supply of both fossil fuels – to prevent a breakdown of the European economy – and of key resources for the energy transition, which is already locking Europe into dangerous new dependencies.
- Invest in security: In the smaller, more susceptible SEE economies, Russia’s state corporatism and weaponization of trade must be opposed by a policy of strategic investment by the EU and the United States. European investment flows should seek to introduce fair market practices. Increasing Western corporate presence in these countries is the only way to ensure that Russian business practices do not warp economic policies for the benefit of the Kremlin.
As a matter of urgency, SEE countries must update their investment and national security strategies to include a robust FDI screening mechanism as a key defense against foreign malign influence and an additional safeguard for boosting quality foreign investment. The governments should integrate the private and civil society sectors in the development of this mechanism, and ensure adequate transparency of the process.
Rolling Back Media Capture
Countering disinformation in SEE would entail addressing all four components of media capture: (i) ownership, (ii) advertising, (iii) government, and (iv) cognitive capture. The EU and national governments across Europe successfully targeted direct channels of Russian media capture immediately after the invasion of Ukraine in February 2022. Similarly, advertising, government, and cognitive capture declined across Europe as support for Russia’s authoritarian model dissipated at the sight of the brutal scenes coming from Ukraine. However, the Kremlin’s grey media infrastructure remains largely in place, especially in SEE, and could resurge after the war.
Types of Media Capture
A first line of defense against disinformation entails establishing the digital forensics infrastructure necessary to detect and investigate disinformation campaigns, as well as the actors that drive them, in near real-time. Existing media monitoring and audience analysis tools should be deployed to measure the volume and reach of recurrent disinformation narratives across traditional and social media. These should be complemented by more sophisticated tools that analyze the digital makeup of news websites in bulk and automatically detect typical signs of abuse, such as domain repurposing, doppelgänger websites, false contact information, and lack of terms of use, among others.
Data acquired through the improved investigation and analysis of ongoing disinformation campaigns should be used to inform the development of preventative measures that limit the impact and demand for disinformation.
The Kremlin’s presence in the critical nodes of SEE’s media infrastructure can only be displaced by the creation of an equally distributed network of publicly funded and independently run media. Its scale should match the magnitude of Russia’s foothold, as its longterm goal is not simply to counteract disinformation with fact-checking, but to reinvigorate the civic nature of journalism and broadcasting as a crucial element of democratic culture. To this end, the model of U.S. government support for media freedom in CEE in the early 1990s should be revisited.
A democracy that delivers
The brutality of the war in Ukraine has prompted long-overdue action against the grey infrastructure which Putin has created across the continent over the last two decades. Before fatigue from this sanctions campaign sets in, though, urgent action is needed to achieve a thorough de-Putinization of Europe, and in particular SEE. A joint transatlantic push should aim to transform the current political will into concrete institutional mechanisms which would prevent the Kremlin and Beijing from ever being able to undermine European democratic order and economic integrity in SEE again.
