Defence Minister Guido Crosetto chose unequivocal words. Speaking at the Defense Procurement Forum in Rome on October 20, he described the clashes in Milan and other Italian cities as the product of a hybrid war waged through TikTok, social media and YouTube, which the West is supposedly unable either to recognize or to counter.
He ruled out the idea that the young people taking to the streets were the so-called maranza – an Italian slang term for young people associated with urban street culture, often stereotyped as unruly or confrontational – or children of immigrants, speaking instead of a form of counter-education received outside the family and school, and of the risk that certain countries could use algorithms and behavioural data to shape the thinking of younger generations.
He did not name any state. Matteo Salvini responded shortly afterwards that there was no hidden hand behind the protests and that suggestions of Russian involvement were bizarre, while Stefania Craxi and Lia Quartapelle, from opposite political camps, both raised the possibility that foreign powers had amplified protests organized through social media.
The perennial question. It is a familiar scene. Whenever a protest movement descends into violence, from the gilets jaunes to the anti-vaccine movement, public debate immediately splits into two camps: those who see Moscow’s hand behind every smashed shop window and those who dismiss any suggestion of interference as conspiracy theory. Both are wrong, because they conflate three different things: the existence of hostile activity, its ability to amplify an existing phenomenon, and its causal role in producing violence.
- The first can often be documented, the second sometimes, and the third almost never. The minister’s argument, in its strongest form, concerns a genuine structural vulnerability: entire generations exposed to algorithmic ecosystems that platforms and hostile state actors are capable of exploiting.
- Moving from that vulnerability to attributing a specific incident, however, requires evidence of a different kind.
What the data tell us. France, where it all began, offers the most useful point of comparison. The October 17 mobilisation, which began with blockades of secondary schools and developed into protests against the rising cost of living, brought approximately 550,000 people into the streets and ended with nearly 2,400 arrests and around a thousand police officers injured.
- According to Visibrain data cited by Le Monde, the call to protest had generated approximately 460,000 messages and more than 132 million views on TikTok. Yet Viginum, the French agency responsible for countering foreign digital interference, had identified no significant foreign operations behind its spread.
- A government source acknowledged to 20 Minutes that some of the traffic originated abroad, although the conversation remained predominantly domestic, and that videos of the violence had been massively amplified by Russian, Iranian, Algerian, Turkish and Chinese state media.It is a familiar pattern: no demonstrated orchestration at the outset, but clear opportunistic amplification afterwards.
- In Italy, the most revealing phenomenon was not the clashes themselves, but what followed. From October 19, messaging groups used by students and parents in Milan, Pavia, Cremona, Ravenna and the Veneto region were flooded with false warnings about gang rapes, neo-fascist attacks against foreigners and fires at universities, accompanied by footage of past violence presented as current.
- None of the threats materialised, but at one school in Ravenna only a tenth of students turned up, while the centre of Cremona remained deserted for hours. This is the definition of a successful cognitive operation. Yet the only case in which those responsible were identified, in Cremona itself, led the Italian police’s special investigations unit, Digos, to report two local boys aged 14 and 15 to the judicial authorities. The same panic can originate with a teenager or a foreign intelligence service, and only a technical analysis of the networks involved can distinguish between the two.
The jihad of attention. There is also a third actor, which no one has mentioned. BBC Monitoring has documented how accounts associated with supporters of the Islamic State urged their “brothers” in France to exploit the chaos and make no distinction between civilians and military personnel, welcoming a “European spring” that explicitly included Italy, while other Islamist circles merely celebrated the decline of the West. There is no evidence of a jihadist role in the protests.
- Analyst Daniele Garofalo has pointed out that there is no evidence of any operational involvement by the Muslim Brotherhood or other groups. But Europol reports that, in 2025, 108 of the 347 people arrested for jihadist terrorism in the European Union were aged 18 or younger. The risk is not organized infiltration, but an already radicalized individual who sees disorder as an opportunity to act under cover. The symmetry with the radical right is striking: when Donald Trump attributes the French protests to Islam and immigration, he offers jihadist accounts the same clash-of-civilisations framework that they themselves promote. Each form of extremism finds confirmation of its own assumptions in the other.
Moscow and Tehran, the same script. On October 6, Iran summoned the French ambassador, accusing Paris of violent repression and double standards in light of the criticism Tehran had received over the Iranian protests in January.
- The following day, the Quai d’Orsay summoned the Iranian ambassador, denouncing a disinformation campaign conducted through the official accounts of Tehran’s Foreign Ministry.
- The pattern is familiar. During the Iranian protests in early 2026, the Institute for Strategic Dialogue documented how RT and Russian diplomacy amplified Tehran’s narrative of externally orchestrated unrest, through a chain extending from regime media to allied Islamist groups and ultimately to the Western far right.
- Today, the script has been reversed: Moscow’s and Tehran’s media portray France as a regime repressing its own young people. Precision is essential here: open sources document a convergence of narratives and mutual amplification, while operational coordination between the two apparatuses remains, as the CSIS observes, more frequently asserted than proven.
- But in terms of cognitive effects, the distinction matters little: two voices repeating the same narrative carry more weight than one.
When there really was a hidden hand. Recent history offers cases in which interference has been established beyond reasonable doubt. On May 21, 2016, in Houston, two opposing demonstrations, one against the “Islamisation of Texas” and the other in defence of Muslims, confronted each other outside an Islamic centre. Both had been organised through Facebook pages operated by the St Petersburg-based Internet Research Agency, which, according to the Mueller report, organised dozens of demonstrations across the United States. That same year, in Berlin, a false report that a 13-year-old Russian-German girl had been raped, amplified by Russian media and Foreign Minister Lavrov, brought the Russian-speaking community into the streets before police established that the alleged abduction had never occurred.
- France subsequently experienced the shift from digital interference to physical provocations. In October 2023, Stars of David painted on walls in Paris were amplified by 1,095 bots belonging to the Russian RRN network, whose first posts appeared 48 hours before the first authentic photograph. On October 31, 2025, a Paris court convicted four Bulgarians over the red hands painted on the Shoah Memorial, describing the foreign interference as beyond dispute. In 2025, Serbian police arrested eleven people in connection with pig heads placed outside Parisian mosques, who, according to Belgrade, had acted on instructions from a foreign intelligence service. It is the same logic seen in Houston: manufacturing incidents designed to pit communities against one another.
For large spontaneous movements, however, the evidence tells a different story. During the gilets jaunes protests, a network of approximately 600 Russia-linked accounts and state media seized upon the unrest, but researchers assessed their impact as limited, and no one demonstrated a role in the movement’s emergence.
- On vaccines, IRA trolls posted pro- and anti-vaccine messages in equal measure, with the sole aim of creating division. In 2021, Facebook dismantled the Fazze network, which operated from Russia and attempted to pay influencers to discredit the Pfizer and AstraZeneca vaccines. It was exposed because the influencers themselves reported it.
- And when the anti-vaccine movement turned violent, as in the 2021 attack on the headquarters of Italy’s CGIL trade union, those convicted were leaders of the neo-fascist Forza Nuova movement. The most serious case, the anti-immigrant riots that followed the Southport stabbing attack in 2024, originated with a false name identifying the alleged attacker as Muslim, circulated by a commercial website seeking traffic, without Westminster’s Home Affairs Committee identifying any state actor.[26] Over the past decade, foreign interference has acted as an accelerant, not a detonator, and the detonator has almost always been domestic.
What evidence to look for. What, then, would be needed to turn the minister’s warning into an attribution? Three elements, which the French experience has made recognizable.
- The first is temporal: a coordinated operation reveals itself when amplification precedes the event.
- The second is material: provocations entrusted to foreign operatives leave traces of travel, phones and payments.
- The third is infrastructural: known networks reuse domains, accounts and techniques. Until one of these elements emerges from a public technical assessment, hybrid warfare remains a plausible hypothesis and a legitimate warning, but not proof.
The bottom line: And premature attribution risks doing exactly what the adversary wants: fuelling distrust and polarization. The most serious vulnerability, as the past decade has shown us, is not the strength of those who attack us, but the willingness of our societies to do their work for them.
