Texas-based soldiers were training in Poland last year when leaders at U.S. Army Europe spotted some alarming social media posts.
A member of 1st Armored Division had allegedly killed a Polish soldier, stolen a car and was on the run. The posts referenced the soldier's unit, which actually was in the country at the time, and used his real photos.
"The first thing we think when we see it is, 'Yeah, right -- this is bull,'" said Col. Joe Scrocca, director of public affairs at Army Europe. "But then we start searching, and it's like, 'Oh wow. The soldier really is in that unit, and these pictures are not fake."
The unit was in the field, so it took time to track it down. Once they did, Scrocca said they confirmed their initial instinct: The posts were fake news. The soldier was with his unit doing what he was supposed to be doing, but the social media posts -- part fact, part fiction -- show how bad actors' efforts to sow discord about U.S. troops' presence in Europe and elsewhere are getting more sophisticated.
The fake story about the 1st Armored Division soldier followed several others like it in recent years.
In 2018, a story appearing to be from a top Lithuanian news site claimed that a U.S. Army armored vehicle hit a local boy riding his bike, killing him. Raimundas Karoblis, Lithuania's defense minister, told Reuters it was a textbook example of deceitful news meant to discredit a NATO exercise in the Baltics.
A year before that, a top NATO general said Russia was behind an email sent to the speaker of the Lithuanian parliament, claiming German troops operating in that country cornered a teenage orphan near their barracks and raped her.
Czech Army Gen. Petr Pavel, then NATO's top military officer, told Reuters that NATO troops and civilians in Europe should expect more fake news from Russia.
"It will get stronger," Pavel said. "... But we will be transparent, consistent."
Now, Russian disinformation efforts are a massive problem in the U.S. and other democracies. Fake news stories that originate in Russia -- often on highly divisive and partisan topics -- have made their way into Americans' social media feeds.
And it's not just fake news about political candidates, gun control, race relations or other hot-button items meant to divide Americans. Earlier this year, top military leaders warned that Russia and China were both spreading lies about the global coronavirus pandemic. Now, the U.S. is struggling to control widespread outbreaks of COVID-19, the sometimes-fatal illness caused by the new virus, after issues such as mask-wearing and whether to trust leading infectious disease experts have divided swaths of the country.
Those pushing fake news campaigns in Europe and elsewhere often have different goals when it comes to influencing the way people feel about U.S. forces and their NATO allies. Those efforts frequently center around vilifying the powerful, decades-old alliance that serves as a major counterbalance to Russia in Europe and elsewhere.
And rank-and-file troops, like that soldier with 1st Armored Division, are getting caught up in it.
U.S. military leaders are taking significant steps to prepare their forces for possible conflict with far more sophisticated enemies than those they faced off against in Iraq and Afghanistan.
The 2018 National Defense Strategy warned that troops face an "ever more lethal and disruptive battlefield" that will pose challenges across domains -- information warfare included.
Each of the services has created new positions or units to deal with renewed information warfare threats. The Navy has added shipboard information warfare commanders to aircraft carrier strike groups. A new information warfare-focused Air Force unit was activated earlier this year. The Army is in the process of standing up a new cyberwarfare battalion that will have a dozen teams capable of being dispatched to support operational forces.
The Marine Corps in 2017 established a three-star billet to oversee the service's information-warfare efforts -- a new deputy commandant of information position. Its efforts also include three new Marine expeditionary force information groups, known as MIGs, each of which has about 4,000 personnel organized to spot and respond to a host of threats.
"If you [wonder] how important a concern ... this disinformation, this information environment is, I think the creation of a MIG is a signal that the Marine Corps takes it very seriously," said Col. Brian Russell, commanding officer of II MEF's information group in North Carolina.
One of the top challenges troops face in combating disinformation campaigns is determining who exactly is behind the flood of false posts, he added.
"That is something we have to stay vigilant about and continue to work to really understand what the threat is and who the threat is," Russell said. "I think that's the challenge of the modern information environment. There's so much information out there, and so many people [with] malicious intent are trying to hide the fact that it's them contributing."
Scrocca, with Army Europe, agrees. While some misinformation comes from known sources, such as state-run Russian media, it can be a lot tougher to tell who's behind something like social media disinformation campaigns or the hacking of a news outlet.
In May, for example, ahead of another big exercise in Poland called Defender Europe, hackers cracked into real European news outlets' websites. They posted a fake interview in which Army Europe's new German chief of staff disparaged his Polish allies.
"We must be doing something right!" Army Europe tweeted about the interview, calling it #FakeNews. The command directed followers to the exercise's official webpage, adding that the comments in the fake interview were "totally fabricated by those who seek to tear apart our great Alliance."
The fake story is believed to have originated in Cyprus, Scrocca said, but it wasn't immediately clear whether there were ties to a specific government.
"That's much harder," he said. "We know who it benefits and who doesn't, but that's about as far as we go."
That matches what Emerson Brooking, a resident fellow at the Atlantic Council's Digital Forensic Research Lab, sees in his studies of disinformation campaigns targeting NATO allies. It would be easy to blame the Russian government for executing or directing the fake news efforts, since the campaigns often match the Kremlin's strategic goals, Brooking said, but the reality is much more complex.
"Within any of these Baltic nations, there are segments of the population who are quite disenchanted with NATO and the West, and who are in fact much more sympathetic toward Russia," he said. "... It may well be people ... who may wish that they were part of Russia who are independently spreading this sort of disinformation."
Troops won't only face misinformation in the Europe theater, military leaders and experts say. Spreading misinformation is cheap, fast and sometimes effective, making it an attractive option for adversaries worldwide.
In the Middle East, Scrocca said misinformation often comes in the form of false reports of civilian casualties. The best way to combat the efforts, he added, is by being proactive, transparent and truthful.
Army Europe not only has personnel dedicated to monitoring the information environment to quickly spot fake posts and alert NATO allies, it's also posting information ahead of time about upcoming exercises and other events to try to prevent any confusion about what U.S. troops are doing on the continent.
Putting out materials to illustrate the real narrative can help prevent the spread of misinformation, Brooking said.
"That information lets inhabitants of these countries understand the important work that NATO is doing," he said.
A member of Russell's command, who spoke to Military.com on the condition of anonymity, citing operational security concerns, said that was an important part of what II MIG did during Exercise Trident Juncture in Norway last year. They knew they'd be operating in an information-contested environment, he said, and fake news stories began hitting about the exercise.
"Both during and before the exercise, we actually saw several news stories and social media narratives claiming that the exercise was a facet of NATO and Western expansionism or aggression," he said.
Capt. Ronald Ellsworth Jr., a cyber officer who participated in that exercise, said they saw evidence of "several Russian trolls, activists and synthetic online users and extremist groups dedicate a lot of time to pushing an anti-Western, anti-NATO narrative in the form of blatant [propaganda]."
Members of II MIG worked with communication strategy and operations Marines, cyber defense units and NATO allies to combat that narrative, the Marines said.
At Army Europe, Scrocca said the challenges posed by fake news have bolstered partnership between U.S. troops and their NATO allies.
"That's one of the silver linings of this, is just the network and the tight coordination that goes on now, on a daily basis, between us and our allies and partners is amazing," he said.
Troops also have a role to play in keeping their information safe. Russell said they're encouraging Marines to apply some of the same tactics they used to spot improvised explosive devices in Iraq or Afghanistan to disinformation efforts.
"You kind of have to have a natural suspicion about what might appear to be normal things," he said. "... When the computer is acting a little bit slow, that might not just be a network issue -- you need to tell someone that the computer is acting up or working slow because that might be the first indication that you have a cyberattack going on."
Scrocca said they're also constantly reminding troops to keep their social media accounts on lockdown, using the example of the soldier whose unit and photos were riffed from his Facebook page to spread fake news that he was on the run after supposedly killing a Polish ally.
But Brooking offered a different take when it comes to social media, saying it could prove an important tool in helping get the word out about the real work U.S. troops are doing on different continents. There are ways to protect operational security while still offering people a transparent look about what troops in their country are doing, he said.
"The fact is that people engage much more with authentic content, so content that comes from young people who are part of these exercises sort of candidly sharing their experiences and thoughts," he said. "I've always seen that [as] really a valuable and underutilized asset. ... We do have to start thinking about these sorts of social media presences as a tool."