Language selection

Search

G7 Rapid Response Mechanism Annual Report 2024

Table of contents

Introduction

The G7 Rapid Response Mechanism (G7 RRM) was established by the G7 Leaders at the 2018 G7 Summit in Charlevoix as part of a commitment to promote a rules-based international order and counter foreign threats to democracies. The G7 RRM is comprised of representatives, known as Focal Points, from the G7 countries and the European Union. Australia, New Zealand, the Netherlands, Sweden and the North Atlantic Treaty Organization (NATO), have an observer status.Footnote 1 The G7 RRM Focal Points leverage their national structures to support whole-of-government engagement in the work of the G7 RRM. Canada provides ongoing strategic leadership in its capacity as the G7 RRM Secretariat.

The G7 RRM has produced annual reports since 2022 at the request of the G7 Foreign Ministers. These reports aim to shine light on foreign threats to our democracies and account for the activities of the G7 RRM in addressing them. The 2021 report focused on the threats posed by foreign information manipulation and interference (FIMI), while the 2022 and 2023 reports included a reflection on subnational interference (SNI) and transnational repression (TNR), demonstrating the expanding threat coverage of the G7 RRM. To reflect a more action-oriented approach in 2024, the current report highlights the G7 RRM activities aimed at countering foreign threats to democracies.

G7 RRM activities

In 2024, the G7 RRM made a strategic move towards concrete response actions in addition to well-established practices of multilateral information sharing. The year was marked by the first G7 RRM collective response statement and the development of the G7 RRM Collective Response Framework. The G7 RRM launched initiatives designed to protect electoral integrity against the backdrop of what was termed a "mega year of elections" and worked to respond to adversarial influence operations aimed at supplementing kinetic warfare. Throughout the year, the RRM focused on better understanding how generative artificial intelligence (AI) enables information threats.

G7 RRM priorities were operationalized through designated working groups focused on the following objectives: (1) enhancing the capacity of non-G7 RRM democracies to counter foreign threats, (2) improving analytics interoperability across the G7 RRM for detecting and assessing FIMI in support of coordinated responses, (3) increasing collective ability to respond to SNI, and (4) developing tools for countering TNR.

Strengthening the G7 RRM response capabilities

Through the , G7 Leaders reaffirmed their commitment to safeguarding democratic values and human rights, including from FIMI and TNR threats, and tasked the G7 RRM with developing a collective response framework to counter FIMI by the end of 2024. Under the leadership of the European External Action Service (EEAS), the framework was developed, negotiated and delivered on time. The framework gives the G7 RRM community collective response options to FIMI and facilitates their operationalization.

The G7 RRM was determined to operationalize the Framework through in-action testing. The Framework was applied in laying the groundwork for noting the Russian state media outlet RT (formerly Russia Today) and the Social Design Agency (SDA) in a first-of-its-kind collective . The statements released by the United States, the United Kingdom and Canada revealed Kremlin funding and direction of covert efforts by RT and SDA to subvert societies using global disinformation and influence campaigns.

Protecting election integrity

2024 was regarded as a "mega year of elections," with over 70 countries voting in elections across all government levels. Elections are an essential part of our democratic systems but can serve as lightning rods and testing grounds for malign actors as they attempt to influence electoral outcomes to align with their geopolitical interests and test new foreign interference methods. Secondary reporting, during the January 2024 presidential elections in Taiwan, identified that the People's Republic of China (PRC) employed a range of FIMI tactics aimed to sway Taiwanese voters towards the Beijing-preferred Kuomintang (KMT) party.Footnote 2 The PRC used AI-generated videos to amplify existing narratives and conspiracy theories by sharing and reposting them online through inauthentic accounts.Footnote 3 Russian FIMI operations were also active ahead of the June 2024 EU Parliamentary elections. Russia employed its long-standing Pravda network to convey large amounts of disinformation and pro-Russia propaganda narratives in a variety of European languages, taking advantage of the election period to erode EU support for Ukraine and question the impact of sanctions on Russia.Footnote 4

As the 2024 G7 President, Italy made the protection of free and fair elections from foreign interference a central focus of the G7 Agenda. The G7 Countries' unity in countering disinformation was reflected in the , in the  and in the , which included a commitment to strengthen joint action to prevent, detect and respond to FIMI. To counter information manipulation, the Italian Presidency streamlined concrete actions through the G7 RRM. The Task Force on Monitoring Elections was created to consolidate G7 RRM capabilities to monitor disinformation during election campaigns. This coordination platform allowed for the strengthening of information exchanges on FIMI narratives, as well as on FIMI actors and their tactics. The G7 RRM Election Monitoring Task Force was established as a pilot initiative focused on collective FIMI monitoring of the June 2024 European Parliament elections.

Notably in 2024, the Moldovan parliamentary elections were a target of Kremlin-sponsored interference schemes. Tactics included cyberattacks, espionage at diaspora polling stations and significant covert financial contributions to a candidate's campaign by pro-Russian oligarchs.Footnote 5 Several G7 RRM members (the U.S., Canada and the U.K.) released a exposing Russia's subversive activity and electoral interference targeting Moldova. By revealing the Kremlin's actions, the members affirmed their unity in standing against Russian attempts to undermine democratic processes and subvert Moldova's sovereignty.

Responding to influence operations supplementing kinetic warfare

State and non-state actors continued to use FIMI as a tool of hybrid warfare. In addition to kinetic warfare, the information space was exploited as a supplementary "battleground" for weakening opponents. A notable example is the Kremlin's use of Telegram. While Russia used the platform for its military recruitment, the Russian government conducted operations in parallel through networks of Telegram channels and bot farms to undermine mobilization in Ukraine.Footnote 6 The Kremlin also continued to conduct information operations painting Ukraine as an aggressor to undermine allied support. By promoting narratives that Ukraine's incursion into Russia's Kursk region put the Kursk Nuclear Power plant in imminent danger, the Kremlin attempted to provoke the withdrawal of clearance for Ukraine to strike into Russian territories with Western weaponry.Footnote 7

The Israel-Gaza war has been exploited by malign actors to support their own political agendas. Audiences in France and Germany were targeted by pro-Kremlin Facebook advertisements alleging that the weapons supplied to Ukraine by the West were used by Hamas, and promoting anti-American sentiments.Footnote 8 According to a Wilson Center report, the PRC also took advantage of the conflict by bolstering its relations with Islamic and Arab states to capitalize on their frustration with Washington and establish the PRC as a major player in the region.Footnote 9 Iran escalated its influence operations in support of Hamas and, subsequently, the Houthis. These operations continued to amplify pro-Hamas and Houthis messaging on social media platforms while targeting Israel through cyber-enabled influence operations.Footnote 10

G7 RRM members and observers shared information about such incidents and activities throughout the year. The G7 RRM also continued to provide support and expertise to a established by the G7 Global Partnership Against the Spread of Weapons and Materials of Mass Destruction (GP). Several G7 RRM partners (Canada, the European Union, NATO, Sweden and the U.S.) conducted a joint analysis of the key narratives and tactics, techniques and procedures (TTPs) used by Russia for engaging in chemical, biological, radiological and nuclear (CBRN) information manipulation.

Since Russia's full-scale invasion of Ukraine in 2022, several G7 RRM partners shared analysis related to the Kremlin's promotion of CBRN-related information manipulation across a variety of social media platforms with the goals of dehumanizing Ukraine and its supporters, further justifying Russian aggression, diverting attention from its own malign CBRN activities and discrediting global health projects around the world. According to the analysis, the PRC regularly amplified Russian CBRN narratives. The G7 RRM condemned such adversarial actions by endorsing the Countering WMD Disinformation initiative in a delivered by the Open Nuclear Network on behalf of the GP at the United Nations General Assembly First Committee.

Countering AI-enabled information threats

In 2024, the G7 RRM saw adversaries increasingly leveraging generative AI to supercharge their information threat efforts.Footnote 11 Generative AI was used to produce realistic content to persuade target audiences, profile individuals, tailor and translate content, and automate messages.

Open AI and other sources reported that Russia, the PRC and Iran used OpenAI models for their influence campaigns. Russian FIMI network attempted to use their models to create comments in European languages, translate articles from Russian into English and French, generate and correct English-language articles, and create short posts for social media.Footnote 12 Similarly, the PRC-linked Spamouflage also used OpenAI to generate comments in English criticizing Chinese dissidents and online commentators.Footnote 13 Generative AI was also used to create photorealistic avatars to promote PRC narratives during the Taiwan presidential elections.Footnote 14 Finally, a threat actor linked to Iran used generative AI models to produce pro-Iranian, anti-Israel and anti-U.S. content in English and French to target global audiences.Footnote 15

In 2024, the G7 RRM prioritized developing its collective capabilities to counter AI-enabled information threats. Under the Italian Presidency, the G7 RRM explored the potential disinformation risks and opportunities related to new and emerging technologies. These include the role of AI as a tool to develop and amplify the spread of disinformation and misinformation, especially in the context of elections.

The G7 RRM established a NATO-led working group on countering AI-enabled information threats. The group pooled G7 RRM resources to effectively detect and counter AI-enabled information threats and worked on identifying strategies and tactics to mitigate risks from AI. In collaboration with the Collective Response working group, the group conducted a joint tabletop exercise for G7 RRM members and observers, with participation from select industry representatives during the G7 RRM Focal Points meeting in Ottawa, Canada (December 2024). The presence of these industry representatives ensured the inclusion of their expertise and tools in discussions about AI-enabled information threats. The tabletop exercise explored G7 RRM collective response options to AI-enabled information threats, including identifying possible thresholds and developing recommendations for specific response actions.

Countering transnational repression

In 2024, transnational repression became a central issue for the G7 RRM community. Through the , the G7 Foreign Ministers affirmed their commitment to protecting democratic systems and open societies, including from TNR. In December 2024, the UK issued a condemning the latest round of arrest warrants by the Hong Kong Police targeting individuals in the UK for exercising their right to freedom of expression, whose continued safety remains a priority. Canada also issued a deploring the decision by Hong Kong authorities to issue international bounties and cancel the passports of democracy activists and former Hong Kong lawmakers, including Canadian nationals.

In 2024, malign actors continued to misuse digital technology to perpetrate TNR. Digital TNR, or DTNR, has become an important vector for malign activities. Human Rights Watch says Beijing limits the overseas Chinese diasporas to PRC state-approved apps, such as WeChat, for communication with their families.Footnote 16 These apps are then used for surveillance and harassment.Footnote 17 Russia has used online monitoring systems to identify dissidents.Footnote 18 Russian activists and civil society organizations in exile have reported facing various digital threats, including online harassment and espionage.Footnote 19

Through a dedicated working group, the G7 RRM continued developing the joint G7 statement declaring TNR an international threat. The group also worked on a counter-TNR toolkit for G7 RRM members, which is scheduled to be delivered in the coming year. In 2024, G7 RRM partners continued to call out specific acts of TNR to create a stronger deterrent for states that engage in such activities. A number of G7 RRM partners supported the . The statement outlined a collective understanding of TNR and the commitment of the partners to jointly counter TNR.

G7 RRM working groups

The operational work of the G7 RRM is executed through designated working groups, whose purpose is to advance key G7 RRM initiatives and provide opportunities to the G7 RRM members and observers to lead on their priorities. This section provides focused accounts of the objectives and activities of each working group in 2024.

Capacity Building

Led by the U.K. and the U.S., the Capacity Building working group met regularly throughout 2024. The group mapped activities across different regions by the G7 RRM partners, building a thorough understanding of the activities taking place in each country identified by the group. Once the initial mapping exercise was completed, it was decided that the working group would focus on one specific country in each region.

Collective Response

Under the leadership of the EEAS, the Collective Response working group developed and negotiated the G7 RRM Collective Response Framework. The Framework sets out the principles to guide action, including the roles and responsibilities of participants. It outlines the available policy and other tools that G7 RRM members and observers can leverage, as well as providing guidance on evaluating responses to improve future efforts. The Framework is a landmark G7 RRM document that provides the G7 RRM with a shared understanding of collective response options. The working group committed to keep operationalizing and testing the framework in the coming year.

Countering AI-enabled Information Threats

Established in 2024 under NATO leadership, the working group focused on enhancing the capabilities of the G7 RRM to mitigate risks from AI-enabled information threats. The deliverables included a mapping of assets and gaps across the G7 RRM through a survey and expert briefings. The working group conducted a joint tabletop exercise with the Collective Response working group for G7 RRM members and observer and selected industry representatives to test our collective response to AI-enabled information threats. The group's action plan was informed by consultations with members and observers, as well as by existing resources and capacity.

Open-Source Analytics

Led by the US, the Open-Source Analytics working group continued to meet regularly to increase analyst capacity to collectively detect and assess FIMI. In 2024, the working group members conducted virtual and in-person exchanges on interoperability and streamlining data-sharing processes and refined best practices through joint monitoring efforts. The working group also committed to a set of objectives for the community to work towards in the coming year. The working group will continue to develop joint protocols for information sharing and response, create opportunities for analytic collaboration, share state-of-the-art tools and methodologies, and evaluate the effectiveness of these practices.

Subnational Interference

Led by Germany, the SNI working group shared approaches, information and best practice on SNI through discussions with civil society and academics on best practices, challenges and benefits on working in the subnational space. Working with civil society organizations and specialists, the SNI working group started developing a document that provides basic information and recommendations on SNI to city networks and national governments for their work with subnational entities.

Transnational Repression

Under the leadership of the U.S., the Transnational Repression working group convened regularly throughout 2024. The group continued developing the joint G7 statement on TNR as a national threat and mapping the counter-TNR tools available to the G7 RRM members. The group effectively shared information on their respective governments' existing policies and frameworks addressing TNR and determined possible options for collective G7 RRM response.

Member and observer updates

Canada

In 2024, the Government of Canada continued to focus on countering foreign interference with policies and responsive actions. The took place throughout 2024, with the objective of examining interference by foreign actors in the 43rd and 44th general elections at the national and electoral district levels. The inquiry assessed the capacity of federal departments to detect and counter foreign interference targeting Canada's democratic processes. Following public hearings with Canadian government and opposition officials, civil society organizations, diaspora community representatives and journalists, the Foreign Interference Commission published its Initial Report. Acknowledging that Canada is increasingly targeted by foreign interference, the federal government introduced , which would update relevant laws to equip the government to disrupt this threat to national security.

European Union

In 2024, the EEAS continued to detect, analyze and address FIMI. The EEAS published its , sharing insights from 750 investigated FIMI incidents. The report also introduced a Response Framework. Later in the year, EEAS presented an OSINT toolkit to detect and analyze identity-based FIMI. Via their flagship awareness raising campaign EUvsDisinfo, the EEAS kept analyzing and exposing Russia's FIMI efforts, reaching more than 38 million people in 2024. The EUvsDisinfo public database of pro-Kremlin disinformation cases passed the 18,000 marker, making it the biggest of its kind in the world.  Notably, the EU established a new sanctions framework to raise the cost of Russia's hybrid activities, including FIMI, across the world. It was used in December, when the EU imposed sanctions on 16 individuals and three entities responsible for Russia's destabilising actions abroad. Globally, the EEAS continued building resilience in partner countries, especially in the Eastern Partnership, the Western Balkans, the Middle East and North Africa, and Sub-Saharan Africa, working with governments and civil society actors, who play a central role in tackling FIMI. In addition to combatting Russian FIMI, the EEAS also continued its work on countering PRC FIMI.

France

With the European Parliament elections and early parliamentary elections in France, followed by the Paris Olympic and Paralympic Games, 2024 offered unprecedented opportunities for malicious actors to target French interests in the information space. To protect these events from foreign interference, VIGINUM and the French Ministry of Europe and Foreign Affairs (MFA) worked closely to detect and targeting France. VIGINUM continued to monitor the online activity of Russian FIMI networks, including Portal Kombat, Matryoshka and Doppelganger, concurrently witnessing an increasing number of informational maneuvers involving Azerbaijani actors targeting France and its overseas territories. VIGINUM shared these findings through .  Official MFA statements were released to condemn those covert attempts. France contributed to the . France also supported projects for the benefit of the civil society, the media ecosystem and the private sector (including s for specific target audiences), as well as for the production of and .

Germany

Germany continued its whole-of-society approach to countering hybrid threats at all political levels, aiming at strengthening societal resilience and reinforcing capacities for analysis and government response. The Federal Government reacted to the high level of foreign information manipulation campaigns by establishing a new interagency unit, the , operational since June 2024. The Office is tasked with analyzing FIMI using OSINT analysis. The inter-ministerial task force against disinformation and hybrid threats led by the Federal Ministry of the Interior and Community coordinates the governmental work on hybrid threats and disinformation and links the activities of the Central Office with other government units. Germany also continued its efforts of countering foreign threats on the subnational level and shared best practices in this field with international partners. Furthermore, measures to counter transnational repression came into focus.

Japan

Japan's Ministry of Foreign Affairs (MOFA) held an online workshop on countering disinformation in late 2023. Throughout 2024, the MOFA exchanged lessons learned with participating Southeast Asian countries for their awareness of the evolving foreign threats and their efforts on countering disinformation. Furthermore, the MOFA advanced efforts to share information and experiences in addressing disinformation and misinformation, particularly on how it impacts foreign affairs and security with Southeast Asian countries. With a view to ensuring the integrity of the information space, the MOFA is advancing efforts towards steadily strengthening capabilities to make coordinated response to foreign information manipulation and promoting cooperation with other countries and regions that share the same values. At the Japan-NATO Conference on Strategic Communications in February 2025—held in the context of one of the flagship projects between IP4 and NATO, announced at the NATO Summit in July 2024, which included "countering disinformation"—Japan primarily exchanged views on the information environment in the Indo-Pacific region with NATO.

Italy

In 2024, Italy saw an increase in disinformation campaigns, especially by Kremlin-linked actors, and in light of the G7 Presidency and the European elections. The narratives aimed to justify the Russian aggression of Ukraine, portray NATO and the EU as oppressive entities undermining national sovereignty, and spread doubts about the legitimacy of electoral processes. Specifically, a social media campaign characterized by the hashtag #iononvoto (I do not vote) re-emerged and reached a peak due to the simultaneous use of the hashtag #votaPutin (vote for Putin). The record amount of disinformation on Telegram was recorded following the attack on Crocus Hall in Moscow. Malign actors exploited "typosquatting" of Italian newspaper domains, with articles criticizing the government. In response, and in line with its 2022-2026 National Cybersecurity Strategy, Italy strengthened cooperation across public entities countering FIMI. Within the 2024 tender for information services, Italian Public Administrations favored both the dissemination by Italian news agencies of news bulletins in different languages, and the agreements between Italian and foreign news agencies to counter disinformation through the dissemination of verified information. Italy worked to increase public awareness and resilience. For example, in the run-up to the European elections, the Italian Foreign Ministry ran a #FreeFromDisinformation social media campaign to raise awareness of the risks associated with disinformation.

United Kingdom

The UK has worked to understand and tackle FIMI threats, and contest malign narratives. In 2024, as tasked and funded by the Russian state, sanctioning several of its leadership. The SDA was attempting to deliver interference operations designed to undermine democracy and weaken international support for Ukraine.鈥�, and on behalf of the Kremlin. To support Ukraine, the UK delivers factual strategic communications campaigns and supports the Ukraine Communications Group. The UK has made clear that misusing cyber capabilities for foreign interference in democratic systems is unacceptable and that we will take action against this threat. In March 2024, the UK and allies identified a Chinese state-affiliated organisation and individuals responsible for malicious cyber campaigns targeting democratic institutions and parliamentarians, sanctioning a front company and members of APT31. The UK's Defending Democracy Taskforce is conducting a review on TNR in the UK to develop our understanding, provide recommendations on a strengthened response and produce public guidance.

Australia

On 14 December 2024, the Australian Government launched the "Countering Foreign Interference in Australia – Working together towards a more secure Australia" publication. The publication describes the foreign interference threats facing our communities, democratic institutions, higher education and research sectors, industry, and media and communications. It outlines who is most at risk, what our government is doing to address foreign interference, and how individuals and organizations can protect themselves. It also details a range of measures the Australian Government has implemented to respond to foreign interference, including an investment of $71.6 million over four years from 2024 to bolster our countering foreign interference efforts. In 2024, Australia joined with international partners in calling out and exposing state-sponsored disinformation and malicious activity. Through ongoing international engagement and active multilateral participation, Australia remains committed to countering FIMI and hybrid threats.

New Zealand

In September 2024, New Zealand released its second threat environment report, featuring an additional eight case studies to help New Zealanders better understand the tactics used and the goals a foreign government might be trying to achieve. This is in addition to ongoing awareness raising and education efforts for exposed sectors. In late 2024, the New Zealand Government introduced legislation to strengthen the criminal law to better address foreign interference and espionage activity. This legislation will help deter harmful activity and better equip agencies to hold people to account, including through the creation of a new "foreign interference" offence. At time of writing the Bill remains before Parliament and public feedback is being considered as part of the Select Committee process. New Zealand is also particularly concerned about the effects of foreign interference on its ethnic communities, which are often the most directly affected by these threats. To address this, the Ministry for Ethnic Communities is leading a four-year program to better engage and support these communities. New Zealand has also worked to build civil society's understanding of and resilience to the harms of disinformation.

Sweden

In 2024, the Swedish government supported actors through development aid to counter FIMI in elections, including free and independent media. This year, the received a renewed commission to support Ukraine with education, training and advice regarding FIMI. The Agency also assisted Moldova in its work on developing its own concept for countering FIMI. It continued to engage in raising awareness of FIMI on gaming platforms. In addition, the was commissioned to initiate a two-year national campaign to strengthen media literacy and a resilient society with a particular focus on the use of AI in the information sector. The campaign plans to use active and wide-reaching national media literacy network to develop digital training tools and conduct outreach into broader society.

North Atlantic Treaty Organization

In October 2024, Allied Defence Ministers endorsed . This approach identifies growing hybrid threats and challenges from state and non-state actors targeting the Alliance and recognizes that information threats are a national security issue. The approach consolidates existing efforts by NATO and Allies to counter information threats and further strengthens the Alliance by establishing a well-connected and interoperable approach to understand, prevent, contain, and mitigate, as well as recover from information threats. NATO increased its alert and sharing mechanisms and enhanced its joint responses, in strategic communications. Cooperation between NATO and partners on countering information threats will continue to be strengthened. As part of NATO's new approach, the NATO Rapid Response Group was set up ahead of the . It is a collective response mechanism that consists of NATO and Allied counter information threat experts to flag, detect and respond to information threats.

The Netherlands

In 2024, the new government in the Netherlands presented its program. FIMI was among the important concerns to be addressed. The government plans to support the quality of public debate, which requires societal resilience and action against FIMI. The development and implementation of the government-wide strategy to counter FIMI, first presented in 2022, also continues apace. The latest update on the strategy identified three new lines of action: (1) establishing measures aimed at actors spreading disinformation, (2) improving media literacy and citizens' resilience against disinformation, and (3) increasing our understanding of disinformation and how to counter it. Attention will also be paid to the potential threat arising out of the use of generative AI for producing and spreading disinformation, and its potential use in countering it. Prior to the elections for the European Parliament, the Ministry of Interior issued a general warning to X under the to proactively flag the possibility of disinformation aimed at the election.

Date modified: