A fake newsroom, live during an election
In the weeks before Saxony-Anhalt's September 6, 2026 state election, a Russia-linked network calling itself Operation Matryoshka flooded X, TikTok and Bluesky with short videos dressed up as BBC and ARD broadcasts. Germany's domestic intelligence agency, the Bundesamt für Verfassungsschutz (BfV), documented three escalating waves between June and August 2026: fabricated news-style clips in June, content aimed at discrediting state and local politicians in July, and an August wave under the hashtag #TimeToDivideGermany pushing AI-generated material about splitting East and West Germany (verfassungsschutz.de). Reporting on the campaign found it consistently targeted candidates from the CDU, SPD, Greens and FDP while leaving the AfD — whose platform aligns with Kremlin positions on NATO, the EU and Ukraine — untouched (eunews.it). The AfD went on to win the election outright with 43.8% of the vote, its strongest state result yet (Wikipedia).
That sequencing — a documented foreign influence operation, an asymmetric target list, and a landslide for the one party the operation spared — is exactly the scenario the EU's Digital Services Act was supposed to make visible before votes were cast, through the systemic-risk transparency obligations it imposes on very large online platforms. It didn't.
What the DSA actually requires
Under DSA Articles 34 and 35, X, TikTok and other VLOPs must run annual risk assessments covering threats to "civic discourse and electoral processes" and report on mitigation measures to the European Board for Digital Services. The Board's first report under Article 35(2), published November 18, 2025, explicitly flagged foreign information manipulation and AI-generated synthetic content mimicking credible news sources as recurring systemic risks — precisely the Matryoshka playbook (officialblogofunio.com). Separately, the Commission has already found X non-compliant with DSA transparency duties: on December 5, 2025 it fined the platform €120 million for a deceptive paid-verification scheme, an unusable political-ad repository, and blocking independent researchers from the public data needed to study exactly this kind of coordinated campaign (digital-strategy.ec.europa.eu).
So the regime is not toothless, and platform critics have a real case. If X's verification badges can be bought without identity checks, and its ad repository is too broken to show who funded what, then the tools voters and researchers need to spot an operation like Matryoshka while it's running are degraded by design, not by accident. That is a legitimate transparency failure, and the fine was deserved.
The gap is speed, not intent
But the fine and the risk report both share the same structural limitation: they are backward-looking. The Board's report is an annual retrospective; the Commission's enforcement action addressed conduct that had already caused harm across previous election cycles. Neither mechanism produced a public signal during the Saxony-Anhalt campaign that could have told German voters, in real time, that a coordinated network was impersonating their national broadcasters. Analysis of platforms' own DSA-mandated disclosures has found the reports themselves are inconsistently detailed and hard to independently verify — Meta frames coordinated-inauthentic-behavior detection around content-neutral signals, TikTok's election-safeguard disclosures read as defensive documentation of past incidents rather than live-monitoring commitments, and none of the filings allow outside auditing of the underlying data (techpolicy.press). An annual filing schedule and a multi-year enforcement timeline cannot, by construction, intercept a disinformation network timed to a specific election date.
Why the fix isn't more discretionary takedown power
The temptation after an episode like this is to demand platforms exercise more judgment, faster, over what counts as "coordinated inauthentic" content during a campaign. That is the wrong lever. Handing VLOPs broader, speed-pressured discretion to remove political content in the days before a vote is a free-speech risk in its own right — it makes platforms the arbiters of contested factual claims about domestic politics, exactly the role the DSA's architects claimed they were avoiding. Content moderation errors compound under time pressure, and false positives against legitimate political speech are just as damaging to democratic discourse as the disinformation itself.
The more defensible fix is narrower: force platforms to disclose the infrastructure of manipulation — network structure, ad funding, account-creation patterns — not to adjudicate the truth of any given post.
That is also where the December fine actually points. A working, real-time-searchable ad repository and functioning researcher API access — the two things X was fined for lacking — would have let independent groups map the Matryoshka network's seeder and amplifier accounts as they were forming, rather than after the fact. The EU should extend the Article 35(2) reporting cycle with a standing, election-triggered rapid-disclosure channel: activated automatically 60 days before a scheduled national or state election, requiring VLOPs to publish network-level manipulation data on a rolling basis rather than annually. That preserves the DSA's core bargain — transparency obligations on platforms, not speech judgments imposed on citizens — while closing the timing gap that let Matryoshka run its full course before anyone with regulatory teeth could act.