Today, as the DisinfoPortal reaches its first anniversary, conversations around disinformation have evolved significantly from this time last year. Currently, many of those conversations revolve around whether local disinformation campaigns are of domestic or foreign origin. And far too frequently, observers and investigators focus their approaches to the problem on identifying only the source spreading the disinformation and not the origin of the story’s content. Unfortunately, such approaches miss a crucial aspect of disinformation campaigns and conversely advance the aims of foreign aggressors who use disinformation as a weapon.

Two recent articles have highlighted a change of tactics in the Kremlin’s approach to spreading disinformation. Reporting about the Ukrainian presidential election that took place in April, the New York Times wrote: “Unlike the 2016 interference in the United States, which centered on fake Facebook pages created by Russians in faraway St. Petersburg, the operation in Ukraine this year had a clever twist. It tried to circumvent Facebook’s new safeguards by paying Ukrainian citizens to give a Russian agent access to their personal pages.”

Meanwhile, just days before the polls closed across Europe in the EU’s recent parliamentary elections, Der Spiegel reported: “The BND, Germany’s foreign intelligence agency, and the Office for the Protection of the Constitution, the country’s domestic intelligence apparatus, are currently detecting a change in the Kremlin’s strategy. Rather than relying solely on its own media and channels for campaigning and aiming to steer the agenda, it is now focusing much more on individuals, a small group of parliamentarians were recently told in a classified meeting.”

These two cases suggest an important evolution in the Kremlin’s disinformation strategy: namely, attempting to hide its tracks by using local individuals as proxies to spread disinformation.

Numerous articles in recent months have highlighted a similar pattern, in which non-Kremlin actors disseminate disinformation originating in the Kremlin. Fresh research on disinformation surrounding the MH17 crash shows how some Dutch influencers repeated the exact same falsehoods that had been created and multiplied by the Kremlin-controlled information ecosystem. Meanwhile, Serbian outlets frequently republish articles by the Kremlin-linked RT and Sputnik, “turning [Serbian media] into a disinformation hub,” said Serbian expert Jelena Milić to Polygraph.

In the case of Serbia, there are no media investigations or secret services proving Moscow’s intentional pursuit of this strategy. However, the overall trend constitutes an undeniable success for the Kremlin’s disinformation campaign. Repetition of Moscow’s preferred disinformation narratives by other actors boosts both their exposure and their legitimacy. Such a cycle in effect launders the source of the disinformation and obscures its foreign origins.

This change of tactics is not new. A news organization operating in the Baltics, with websites posing as domestic Lithuanian, Latvian, and Estonian sources, consistently received instructions from Moscow about what and when to publish. Recently, another “independent and alternative” quasi-media outlet apparently based in the United States, Southfront, has also been proven to have direct links to Russia.

This unwitting dissemination of Kremlin disinformation goes beyond seemingly independent websites. Real people sometimes unknowingly contribute to its proliferation, as happened when segments of the US population helped advance the goals of the Kremlin’s troll factory during the lead-up to the 2016 US presidential election.

Politicians and leaders at the highest levels of government can also wittingly or unwittingly endorse disinformation from Moscow. In Italy, Beppe Grillo’s influential network of sites spread the Kremlin’s disinformation. Candidate Donald Trump in 2015 repeated the Kremlin’s typical disinformation narratives about the MH17 tragedy. There are dozens of similar cases.

Notably, this mechanism of “information laundering” has been in the Kremlin’s toolkit ever since the Soviet KGB days. Books by Ion Mihai Pacepa, Vladimir Bukovsky, and Kevin McCauley document the process whereby front organizations, willing agents and fellow travelers, or unwitting useful idiots help spread the Kremlin’s disinformation and advance Moscow’s interests. The cases above demonstrate that the current Russian regime has learned from its predecessor and employs largely the same approach.

This context raises another question: should disinformation be classified as “domestic” or “foreign” solely on the basis of the source that spreads it?

Two recent studies about the European parliamentary elections, one by the Oxford Internet Institute and another by the Institute for Strategic Dialogue, highlight the role of domestic sources in spreading disinformation. However, without deeper analysis of the precise content of these disinformation messages, it is premature to simply conclude that such messages are purely of domestic origin and unrelated to Moscow. If a domestic source spreads a typical lie originating in the Kremlin-controlled media ecosystem about MH17 being shot down by Ukraine, the United States being an occupying power in Europe, or the EU promoting sexual perversion, does that message suddenly stop being the Kremlin’s disinformation?

This is why tracing the origins of particular narratives and stories is so essential: to determine whether they emerged organically in a domestic context or intentionally planted by a foreign adversary. Currently, there exists a multilingual database of the Kremlin’s disinformation stories (currently with over 5,500 cases) where it is possible to check whether particular narratives have a history in the pro-Kremlin disinformation ecosystem.

However, even that strategy is vulnerable to deception. History shows that in bigger disinformation operations, like the infamous Operation Infektion, the Kremlin tried to hide its fingerprints even more diligently. Sometimes, a disinformation campaign organized by the Kremlin is uncovered as such only decades later. Had the criteria delineating “domestic” sources been applied in this case, the disinformation message “the CIA created AIDS” would have to be classified as disinformation of Indian origin as opposed to what it was in reality: a KGB operation.

It is possible to analyze the specific interests furthered by individual disinformation messages. The cases about MH17 or the EU’s sexual perversion above clearly help advance the Kremlin’s goal of further weakening and dividing the West. Narratives such as these also help the Kremlin’s local allies in Europe, namely anti-European movements, achieve their objectives of mobilizing and radicalizing their audiences. In this case, the “domestic vs. foreign” disinformation label would be a false dichotomy; a particular disinformation story can aid both domestic and foreign actors.

Focusing solely on whether the source spreading a piece of disinformation is domestic or Kremlin-controlled does not communicate much about whether the message’s content relates to Moscow. Instead, it is essential to trace the origin of disinformation stories to determine whether they were planted in our information systems by foreign actors or emerged organically. Characterizing the Kremlin’s disinformation repeated by domestic sources as solely a domestic problem is a dream come true for Vladimir Putin. Such an approach exonerates Moscow of accountability, whitewashes the Kremlin’s actions, and diverts attention from the true aggressor. Given the Kremlin’s track record and the unparalleled achievements of its disinformation strategy, it would be unwise to underestimate Moscow’s capabilities.