FIMI's older sibling: why Europe has to build, not just regulate
The autocratic offer has often become more attractive than ours.
On 1 June 2026, Alena Epifanova and I spoke at a closed-door gathering convened in Brussels to work towards a European internet freedom strategy.
Our session set out to name what we see as the older sibling of foreign information manipulations and interference (FIMI): the part of the information control machine that autocracies build at home before they export it.
What follows are our prepared remarks.
Everyone in this room is probably familiar with FIMI, foreign information manipulation and interference. Europe has a sharp framework for what foreign autocracies do to manipulate information inside our own societies. The fourth EEAS Threat Report documented 540 incidents last year, with Russia and China dominant. That work matters.
What we do not have, and what we want to talk about today, is a framework for the other half. What those same autocracies do to control information inside their own societies, and increasingly inside diaspora communities here. The half that has been my primary antagonist throughout my journalistic career. For the next fifteen minutes we will call it authoritarian information control. FIMI's older sibling. The part autocracies build at home before they export it.
Not a blackout: substitution, and then lock-in
If we hold the wrong picture, we will fund the wrong things.
In many policy rooms, people still picture autocracy in this space as a blackout. The internet goes dark. A dissident or a foreign broadcaster gets through with the truth. That is the picture thirty years of programmes, including Radio Free Europe, were built on. It is not what people inside these countries actually experience.
Iran has been the clearest stress test of the real model. The regime has cut large parts of international traffic while leaving more of the domestic stack running. From outside, Iran did not vanish. It stopped being reachable for the parts the regime did not want reachable. The message inside was simple. Switch to our stack and your life works, more or less.
Think of a small business owner in Tehran. Payments through an Iranian app keep working. The kids' school is on a domestic messenger the state can read. Telegram and WhatsApp are slow. A VPN is expensive and illegal. You can keep your life functioning if you switch.
The regime is not flipping a switch from on to off. It is substituting one information environment for another that the state can control and distort at will. The domestic pipe is right there. Cheaper, faster, more stable, and fully readable to the state.
In China, this substitution is essentially complete. A generation has grown up inside an environment it did not choose. Mainland users do not feel cut off. They feel served by a working autocratic system.
The fight is not distribution versus blackout. The fight is relevance versus substitution.
In Russia, the regime is building its version. A messaging service called Max has been pre-installed by law on every device sold since the first of September 2025. Telegram and WhatsApp are not banned. They are throttled, made slow and annoying enough that switching to Max becomes the rational choice.
Once you are on Max, the consequences stack. The state reads your messages, sees who you talk to, and can identify early signals of dissent before they become visible opposition. Critical voices become fragmented and powerless, while the regime grows stronger and can keep mobilising for the war it cannot afford to lose. The pipeline is simple: a state-controlled messenger, surveillance, silenced dissent, continued war.
Once substitution wins, getting people back out is enormously harder than keeping them connected in the first place.
The consequences scale outward.
Inside the affected society, the state acquires end-to-end visibility into ordinary life. The spaces where dissent forms become state-readable by default. A country can live this way for a long time.
For Europe's reach into that society, the room shrinks. The civil society interlocutors we used to talk to now communicate on state-readable apps. Government-to-government channels remain. Everything else gets harder, and is tracked.
For the diaspora here, it sits closer to home. Russians in Berlin, Chinese students in Paris, Iranians in Amsterdam use the apps from home because their families do. Germany's constitutional protection service names China, Russia and Iran as actors in transnational repression on German soil. Human Rights Watch and Amnesty have documented WeChat as a surveillance vector on European campuses.
This does not only affect diaspora communities. Earlier this month, the Dutch Data Protection Authority fined the Yango taxi app, a Russian Yandex spin-off, 100 million euros, in a joint investigation with Finland and Norway, for transferring user data from the three countries to Russia. Yandex Taxi operates in countries like Moldova, Armenia, Serbia and Kazakhstan, and across Africa, and sends user data to Russia, where security services can exploit it. Together with RKS Global, we are publishing a report on this in a few weeks.
The technology being refined in these systems gets cheaper every year. Once it is cheap and effective, it shows up in commercial platforms and AI systems European citizens use every day, regardless of where it was originally built. The lines between an autocratic deployment of these tools and a commercial one are often no longer visible. We risk importing autocracy without knowing it.
Autocrats already coordinate
Last month, RightsCon was supposed to open in Lusaka. RightsCon is the largest annual gathering of people who work on human rights in the digital space. 2,600 people on site, from 150 countries. The 2026 edition was due to start on 5 May at the Mulungushi Convention Centre, Zambia's premier event venue. It did not.
Six days before opening, the Zambian government postponed it. Access Now, who run RightsCon, had been told two days earlier that Chinese diplomats were pressuring Zambia's Ministry of Technology and Science, citing the participation of Taiwanese civil society. Zambia owes China around four to five billion dollars. The new conference complex at Mulungushi was built with a 30-million-dollar Chinese government grant pledged at the Forum on China-Africa Cooperation in 2018 and handed over in 2022. Amnesty called it a brazen act of transnational repression.
The conference built to respond to authoritarian information control was shut down by it. Meanwhile, the autocrats hold their own gatherings, and those run on time.
You see it at the World Internet Conference in Wuzhen, hosted by China since 2014, where cyber sovereignty is normalised as the alternative international doctrine to the open internet.
And in the UN, where Russia, China and Iran pushed for the December 2024 cybercrime convention. They did not get the authoritarian text they wanted, but they got the UN's first-ever cybercrime treaty, and they will try again in the 2027 protocol negotiations.
Iran got Chinese surveillance after the 2022 protests. Russia got Chinese dual-use electronics after invading Ukraine. China and Iran got Russia's foreign-agent legal template, now copied on every continent.
The learning cycle between these regimes is faster than the learning cycle between democracies trying to respond. AidData has documented how China leads on developing digital repression techniques, and Russia adopts them quickly. The speed is the part Europe most underestimates.
The visible products travel too. In September last year, InterSecLab published a report based on more than 100,000 leaked internal documents from a Chinese company founded by Fang Binxing, often described as the architect of China's Great Firewall. The report identifies five customer countries running that technology, including Kazakhstan, Ethiopia, Pakistan and Myanmar, with one not yet named. The Chinese model packaged and sold.
What Lusaka surfaces is that information control has become a foreign policy fixture, not just a domestic one. An asset to offer governments seeking population control, and a demand hard for them to say no to.
If you are the government of a middle-income country dealing with restive protests or an inconvenient opposition, China and increasingly Russia and Iran have a proposition. They will fund your fibre. They will build your data centres. They will renovate your convention centres. They will sell you the equipment to manage your information space, training included. They will not lecture you on conditionality.
Compare that to what Europe offers: often lectures on rights, compliance burdens, slow procurement. Europe's leverage shrinks not because Europe has become less attractive, but because the autocratic offer has become more so.
This is the half of the picture FIMI does not capture. FIMI is what these actors do to us directly. What we are describing is what they do at home, what they sell abroad, and the dissent they hunt across borders.
That is the reason to act now. The job is to raise the cost of digital repression at the source, give local communities the breathing space to organise and find the holes, and show the rest of the world that these models have holes.
Regulation is not enough. Europe has to build.
The question is no longer whether this is Europe's problem. The capacities we have described, refined in one country, sold to the next, absorbed into the products Europeans use, are moving faster than the policy cycles meant to respond to them. The question is what Europe can do before that gap widens further.
The European answer cannot be a copy of the American answer. Europe has its own competition with the United States on digital services, its own AI Act, DSA, GDPR, and its own, often more dignified, idea of what the internet should feel like to live inside.
Europe has also benefited immensely from work civic technologists and advocates have done globally with United States funding, and with the Open Technology Fund as a steward. Under the current U.S. government, much of this work is at risk of being stopped or diverted to bad-faith efforts that entrench Silicon Valley oligarchs.
Three distinct costs to Europe if it sits this out.
Exposure. The toolkit being built in Tehran, Moscow and Beijing does not stay there. It is marketed, copied, and absorbed into the platforms and AI systems European citizens use every day. Your FIMI response gets harder every year the autocratic side gets more efficient, especially if parts of Silicon Valley become complicit.
Sovereignty. European law has limited reach if the protocols, the platforms, the payment rails and the AI systems that mediate European public life are controlled outside Europe. Standards without adoption and investment in the underlying plumbing are hollow constructs.
Dignity. There is a posture in which Europe is permanently reactive, permanently catching up, permanently a market for somebody else's stack. That is not the Europe most of the people we work with inside Russia, Iran, China, Belarus and Kyrgyzstan are looking to.
This is not development aid. It is one of the most cost-effective forms of security and economic resilience spending available to a European government. The protocol work that keeps communication alive among civilians in Tehran is the same protocol work that could keep a Latvian municipal network up under attack.
Europe has been very good at regulating. But Europe cannot regulate its way out of this. The actors building the authoritarian information control machine, and the platforms and AI systems that carry it into European life, cannot be regulated away.
Authoritarian information control has become a foreign policy tool, and Europe cannot regulate its way out of having to tackle it.
The honest answer is that Europe has to build. Alternative protocols. Alternative tools. Investment in the underlying plumbing. There is no one quick-fix solution. What works is distributed across many efforts, in many countries, on different parts of the stack.
None of it works without the people on the other end. The people doing this work inside the countries we care about have a generation of expertise we do not. They know what works under pressure, what fails, how their compatriots actually behave when the substitute appears. Iranians have shown immense creativity in their use of Delta Chat to communicate freely. A tool, by the way, led from Europe.
What Europe could build
The internet is splitting into roughly four, all imbued with creativity and capital. An American robber-baron internet, built on data extraction. The Chinese one, the most complete authoritarian information environment ever built, now being exported. The Russian and Iranian model, converging on the Chinese. And billions of people who use whichever pieces of the first three reach them. There is no European internet in that list in terms of real adoption. Not yet. There could be. Many of the building blocks are already in place.
If you take away one thing from this: authoritarian information control has become a foreign policy tool, and Europe cannot regulate its way out of having to tackle it. Europe has to build its own vision, and it can only be built in community with the people inside those countries.
Alena Epifanova is a Research Fellow at the German Council on Foreign Relations (DGAP) in Berlin. Patrick Boehler runs Gazzetta, a civic media research lab focused on how journalism survives in distorted information environments.