August 24, 2026
On 2 September, Estonia will kick off its presidential election process, as the 101-member Riigikogu votes indirectly to select a successor to current President Alar Karis, with a wider Electoral College stepping in should parliament fail to reach a decision. The process largely insulates the public from direct participation yet, as our latest brief on the election finds, it does not insulate Estonia from disinformation.
GDI’s mission starts with rigorous, on-the-ground analysis of how disinformation actually behaves during moments of democratic significance and Estonia's presidential race offers a clear case study.
Estonian voters do not cast ballots directly for president. Candidates must first secure 68 votes in parliament; if none does after three rounds, the decision moves to an Electoral College. This structure limits the value of conventional voter-targeting disinformation. There is no mass electorate to persuade in the way a general election would require. But the process remains politically consequential, and the public conversation around it is already entangled with the cost of living, housing pressures, tension within Prime Minister Kristjen Michal's minority government, and the treatment of Estonia's large Russian-speaking minority.
Our monitoring identified two dominant domestic narrative threads. The first frames Chancellor of Justice Ülle Madise's candidacy, currently the frontrunner. Commentary describes the process as tantamount to dictatorship and, in some cases, slides into anti-immigrant and anti-EU rhetoric. The second casts Estonian authorities, including the president, as fearmongers manufacturing a Russian threat to justify defence spending. This draws on fringe domestic outlets such as Telegram EE, which describe the security environment as "theatre."
The most significant findings concern Foreign Information Manipulation and Interference (FIMI), a category the EEAS 2026 FIMI Threat Report tracks closely, and which names Estonia as one of several European countries experiencing escalatory Russian hybrid activity. As of this brief, no significant foreign information campaign has been identified specifically targeting the presidential election. Russian state outlets have given the candidate field little sustained coverage, and the indirect electoral mechanism reduces the appeal of conventional voter-targeting operations.
That absence should not reassure anyone. The FIMI risk here is structural rather than episodic. The infrastructure needed to run an influence operation is already active and embedded in Estonia's information environment. The more pressing exposure lies in exploiting the societal divisions surrounding the election, above all, the position of Estonia's Russian-speaking population.
A functioning distribution pipeline for disinformation is already in place. An August 2026 analysis by Propastop examined 1,799 articles the Estonia-facing branch of the Pravda Network published over three months. Rather than generating original material, the network republishes Russian state media, military bloggers and anonymous Telegram content, repackaging it as Estonian-branded, searchable webpages. This gives Kremlin-aligned narratives on Russia, Ukraine and NATO a ready-made channel into Estonia's Russian-language information space, independent of whatever the electoral news cycle is doing.
The "persecution of Russian speakers” narrative is intensifying. Coverage of Estonia's shift to [Estonian-language education](https://estonia.news-pravda.com/estonia/2026/08/03/45964.html\) including the dismissal of kindergarten staff lacking required proficiency now casts the reform as evidence of discrimination and, in more extreme variants, genocide or a final solution to the Russian question. Religion offers the same narrative as another vehicle: outlets including TASS and Rossiyskaya Gazeta have portrayed legal measures affecting the Estonian Orthodox Church's ties to the Moscow Patriarchate as state persecution of believers. A more overtly separatist variant has also surfaced: accounts across Telegram, VKontakte and TikTok are promoting a fictitious "Narva People's Republic complete with flags and insignia, echoing the branding Russian-backed separatist entities used in eastern Ukraine. Attribution remains unresolved and current reach stays small, but the symbolism is deliberate.
NATO's regional presence is being reframed as provocation.Pravda Network content has described NATO's Baltic Trust exercises as risking Baltic suicide while the InfoDefense Estonia Telegram channel presents alliance deployments as turning local populations into hostages of an arms race. Russian propaganda channels have also used Ukrainian drone activity in Baltic airspace to suggest the Baltic states are complicit in attacks on Russia.
Operational sophistication is increasing. On 6 August 2026, accounts on X circulated a fabricated report claiming a Ukrainian drone had been shot down near Ämari Air Base, destroying two Portuguese F-16s stationed in Estonia. The operation combined a cloned version of a legitimate defence-news website with an AI-manipulated video splicing real Estonian Defence Forces footage with generated imagery of burning aircraft, then distributed the story across multiple languages using accounts with pro-Russian, anti-Ukrainian framing. It is a template built to link Western military support for Ukraine directly to tangible costs and dangers for European citizens.
A “declining West” narrative ties it together. Russian media have folded falling birth rates, teacher shortages and defence recruitment into a broader story of Estonian and Western self-destruction, at times pairing this with claims that Western elites tolerate "Russophobia" only until it threatens financial interests, as in coverage of a Hungarian bank's acquisition of an Estonian lender with Russian business exposure.
Taken together, these findings describe an information environment where the operational capacity for a targeted FIMI campaign clearly exists, but where for now these actors are directing that capacity at Estonia's societal fault lines rather than at the mechanics of the presidential vote itself.
Disinformation of this kind does not sustain itself for free. Cloned news domains, AI-manipulated video, multilingual amplification networks and content farms that repackage state media into "local" outlets all require funding, and that funding routes, in part, through the same digital advertising infrastructure that finances the legitimate open web. Disinformation thrives when platforms' engagement-based algorithms operate without independent oversight, and voluntary commitments from platforms and advertisers have repeatedly proven insufficient to close that gap. Lasting change requires enforceable frameworks that embed transparency, independent oversight and clear consequences into the fabric of the digital advertising ecosystem, not case-by-case takedowns after the narrative has already spread.
Europe leads globally in regulating this type of FIMI, but transparency around monetised adversarial content remains scarce. Even where laws exist, like the EU's Digital Services Act package and Code of Conduct on Disinformation, Very Large Online Platforms (VLOPs) still fall short on transparency reporting requirements. This data void makes it hard for policymakers to tackle the profitability driving adversarial content, and hard for regulators to enforce existing rules. GDI's Online Harms Monetisation Dashboard (OHMD) is built to close that gap.
Notes:This brief draws on findings compiled ahead of Estonia's 2 September presidential election process. Source material referenced includes reporting from Propastop, the EEAS 2026 FIMI Threat Report, and monitored social media and Telegram activity. Some linked sources contain sensitive or offensive language reflecting the disinformation under analysis; this does not reflect the views of GDI
___
Photo by Nikola Johnny Mirkovic