Coordinated behaviour in the Latvian-facing TikTok space, first half of 2026

A structural analysis of audience overlap, posting synchronisation and narrative markers across roughly one hundred political, media and activist accounts — and how a cross-border segment operated from Belarus embeds into Latvia’s russophone information environment.

TL;DR

Our headline coordination score, after removing the mainstream-media “hub” effect, is 35.1 / 100 — a HIGH reading driven mainly by comment-audience overlap and posting timing rather than shared hashtags.

How the analysis was done

FactCheck.LT collected the public posting and commenting activity of about one hundred accounts active in the Latvian-facing TikTok space over a 180-day window in the first half of 2026: 101 accounts with usable data, 15,631 videos and 293,376 comments. Before any similarity was measured, we removed 83,815 low-signal comments (emoji-only and sub-two-character strings, 28.6% of the total), which otherwise inflate false overlap.

The sample itself was defined by a pre-set audience criterion: for most accounts, more than 50% of followers located in Latvia, based on Modash audience analytics. A small number of accounts, including three of the four Belarus-run ones, were added under a supplementary relevance criterion, as actors in the Latvian political space whose Latvian audience is large but not a majority (maksometr75: Belarus 27.8%, Latvia 26.8%; baltic.mind: Lithuania 28.2%, Latvia 20.2%, Belarus 13.6%; rsamul85: Belarus 34.7%, Latvia 31.1%). The roslikovs account passes the main criterion outright, with 62.0% of its followers in Latvia.

Coordination is not a single number. We measure four independent layers: shared commenters (audience overlap), shared hashtags, posting synchronisation (how often two accounts post within tight time windows), and network density. Because large mainstream-media accounts naturally share audience with everyone, a raw score overstates coordination. We therefore normalise against a baseline of 22 mainstream media accounts (both Latvian- and Russian-language), using a size-matched Jaccard threshold: a pair only counts as “excess” if its audience overlap exceeds what two accounts of that size would share by ordinary chance.

Crucially, every account was classified by identity — who runs it, and its confirmed party or organisational affiliation — before any coordination signal was examined, never the reverse. Cluster labels come from account bios, party registries and public reporting, not from who overlaps with whom. This discipline is what separates a measurement from a circular argument.

A final correction proved decisive. Several russophone parties (Suverēnā vara, the Latvian Russian Union and Jaunlatvieši) run a joint electoral list for the October 2026 Saeima elections, while Stabilitātei! and Saskaņa stand separately. Audience overlap inside a party or inside that coalition is expected and legal; it is not a finding. We therefore re-labelled every excess pair as within-party, within-coalition, cross-bloc or Belarus-linked, and reserved the word “finding” for the last two.

Finding 1 — A cross-border segment that embeds into the russophone audience

Four accounts in the set are attributed by FactCheck.LT to operation from Belarus. They do not sit at the edge of the Latvian conversation; they sit inside its russophone core.

For each of the four, we measured the share of its above-baseline audience partners that fall inside the confirmed russophone-political segment. The result is high across the board: roslikovs 0.67, maksometr75 0.64, rsamul85 0.59, baltic.mind 0.52. In plain terms, most of the “extra” audience these Belarus-run accounts share with anyone — over and above what their size predicts — is shared specifically with Latvia’s russophone politicians and opinion accounts.

Three of the four anchor on the same party. baltic.mind (2.80×), roslikovs (2.79×) and rsamul85 (2.79×) all show their strongest or near-strongest above-baseline overlap with the Stabilitātei! party account. This matters for a specific reason: Stabilitātei! is not part of the electoral coalition, so no lawful campaign alliance can account for the overlap. One of these accounts, roslikovs, presents itself as the party’s leader (a role held until Rosļikovs’s resignation in April 2026, after which Svetlana Čulkova became chair) — an account presenting as the leader of a sitting Latvian parliamentary party, operated from Belarus, is a finding in its own right, independent of any overlap. Audience analytics sharpen the picture further: 62% of this account’s followers are located in Latvia, while its videos are posted from Belarus — a Latvian-audience account operated from across the border.

The fourth account, rsamul85, embeds most broadly, reaching deep into named figures across all three russophone forces — igors.nikitin (3.96×), andrejspagors (3.21×), svetlana_culkova (3.13×) and jurijs.klepakovs (2.89×).

Aggregated to the party level, the Belarus-run segment’s above-baseline audience overlap concentrates on Stabilitātei! (summed overlap 3,678), then Saskaņa (1,436) and the coalition (645) — visualised as the crimson edges in Figure 1.

Figure 1. Edge width ∝ audience overlap above a size-matched baseline. Within-party and within-coalition overlap excluded as expected.

Finding 2 — A pan-russophone audience pool across party lines

Once within-party and within-coalition overlap is set aside, 124 cross-bloc excess pairs remain (summed audience overlap ≈ 9,200). Most are small, but several are substantial and cannot be explained by any shared electoral list: Stabilitātei! ↔ Saskaņa (stabilitatei_st ↔ igors.nikitin, 5.05×, 185 shared commenters), Saskaņa ↔ coalition (igors.nikitin ↔ suverena.vara, 4.74×, 151), and Stabilitātei! ↔ coalition (rudibremanis ↔ vjaceslavs_stepanenko, 3.92×, 281).

At the bloc level the pattern is a triangle: Stabilitātei! ↔ coalition (4,877), Stabilitātei! ↔ Saskaņa (2,542) and Saskaņa ↔ coalition (1,748) — the grey edges in Figure 1. The three nominally separate russophone forces draw on a common, overlapping audience. We describe this as a shared audience pool (co-exposure), not coordination: it shows the same users move across these accounts, which is consistent with a single russophone-minority public, and does not by itself demonstrate that the parties act in concert.

Finding 3 — A domestic Latvian-language network: LPV

Distinct from the russophone story, and in Latvian rather than Russian, a cluster of accounts around “Latvija pirmajā vietā” (LPV), the party of Ainārs Šlesers, shows the tightest posting synchronisation in the entire dataset: andris.baumanis ↔ latvijapirmajavieta (400 synchronised windows), andris.baumanis ↔ normundsrozensteins (303) and latvijapirmajavieta ↔ normundsrozensteins (169), with individual pairs posting within 10–14 seconds of each other.

This is where a critical distinction applies. Coordinated is not the same as inauthentic. A legal party openly running a set of clearly LPV-branded accounts that cross-post its leader is aggressive but disclosed campaigning — lawful, and categorically different from a covert foreign operation. It becomes a manipulation finding only where accounts in the network present themselves as independent while concealing their LPV origin. FactCheck.LT is resolving this account by account via a disclosure check; the reader should treat the LPV network as a coordinated-but-open structure except where an undisclosed sub-network is specifically identified.

The media layer: substrate, not signal

A natural question is whether mainstream outlets behaved anomalously. They did not. When we sum each media account’s above-baseline overlap with the russophone-political segment, the overlap is carried almost entirely by Russian-language outlets — latvijaszinas (11,558), press.lv (10,726), rus.delfi (3,468), rus.tvnet.lv (2,823) and lsm4lv (2,715) — while Latvian-language outlets (Delfi, Apollo, LSM, TVNET) overlap with that segment an order of magnitude less (Figure 4, right).

The explanation is structural, not conspiratorial. Russian-speaking users read Russian-language news and follow russophone politicians, so these outlets are the shared substrate of the russophone bubble rather than participants in any coordination. This mirrors the language split we measure directly: median audience overlap is 2.56× higher within the Russian-language bubble than across the Russian–Latvian language line (Figure 4, left). The media did not coordinate; the media layer simply reflects the two-audience structure of the Latvian information space.

Figure 4. Left: two audience bubbles. Right: media accounts’ overlap with the russophone political segment; Russian-language outlets in dark.

Narrative signals (FIMI)

We scanned video text against a lexicon of foreign-information-manipulation (FIMI) narratives and recorded 311 markers. The dominant frames are Second-World-War “memory war” (91), economic doom around the euro (85) and pro-Russia “compatriots” appeals (49).

Two concrete, attributable signals stand out. First, the Belarus-legitimation frame is almost exclusive to the Belarus-run accounts (maksometr75 3, roslikovs 1, baltic.mind 1) — the narrative lives precisely where the cross-border operation lives. Second, the single most FIMI-active account in the entire set is maksometr75 — a Belarus-run account — with 25 markers, 18 of them WWII-memory-war framing (Figure 3). Narrative and coordination co-locate on the same nodes.

By cluster, FIMI markers concentrate in the russophone opinion-amplifier accounts (6.7 per account), the LPV network (6.9) and the russophone-minority politicians (5.4). Mainstream media register 4.3 per account, but this figure must not be read as media pushing FIMI: the lexicon cannot distinguish reporting on a narrative from propagating it, and a newsroom quoting a politician’s claim scores the same as the politician making it. Media FIMI counts are a reporting artefact, not a signal.

Figure 3. Left: narrative markers across the corpus. Right: two signature narratives, Belarus-run accounts vs the rest.

What is not a finding

The two largest raw overlap ratios in the entire dataset are not evidence of coordination, and saying so is essential to the integrity of the analysis. saskanascentrs ↔ andrejsklementjev (12.3×) is two accounts of the same party (Saskaņa); latvijaskrievusavieniba ↔ lubova_svecova (10.7×) is two members of the same electoral coalition (LKS and Suverēnā vara). Co-partisans and coalition partners naturally share audience — that is expected, lawful, and excluded from every coordination claim above (Figure 2). Of the excess pairs inside the russophone segment, 52 are within-party or within-coalition (expected) and are set aside; the findings rest on the 226 Belarus-linked and cross-bloc pairs.

Figure 2. Top excess pairs after the party/coalition correction: the two highest raw ratios are expected co-partisan and intra-coalition overlap.

How to read this, and its limits

Co-exposure is not coordination. Audience overlap shows that the same users appear under two accounts; it does not, on its own, prove the account operators act together. We reserve “coordination” language for the layers that go beyond overlap — tight posting synchronisation and, in the LPV case, near-simultaneous publishing.

Coordinated is not inauthentic. Open party networks (LPV) and a shared minority public (the russophone pool) are lawful phenomena. The manipulation concern narrows to two things: the segment operated from abroad (the Belarus accounts) and any undisclosed astroturf sub-network — not coordination as such.

Attribution has boundaries. Party labels are drawn from public sources and account bios; the “operated from Belarus” attribution rests on video-level posting-region data (Exolyt analytics built on TikTok platform data): these accounts’ videos were posted from Belarus systematically throughout the observation window. This attributes the place of posting, not the operator’s identity or citizenship. A handful of russophone opinion accounts remain without a confirmed party and are excluded from the party-level cross-bloc counts rather than guessed at. The language detector under-counts Russian on music-only or near-textless accounts, and those were held out of the language split.

Conclusions

Taken together, the three structures describe a layered rather than monolithic influence environment.

First, the cross-border segment is small but placed, not peripheral. Four accounts operated from Belarus achieve what scale alone cannot: between half and two-thirds of their above-baseline audience sits inside Latvia’s russophone political segment, and their strongest anchoring converges on a parliamentary party that stands outside any electoral coalition. The significance is not reach — none of these accounts is large — but position. A foreign-operated presence has attached itself to the audience of a domestic political force, and carries with it the one narrative frame (Belarus legitimation) that exists almost nowhere else in the corpus. For monitoring purposes, this is the segment where narrative injection into Latvian domestic politics would be cheapest to execute and hardest to notice.

Second, the russophone audience pool is a structural vulnerability, not a manipulation. The cross-bloc overlap among Stabilitātei!, Saskaņa and the coalition shows a single audience circulating across nominally competing forces, sustained by a Russian-language media substrate that behaves normally. Nothing in this is illegitimate. But a unified pool means a narrative seeded at any point of it — including by the cross-border segment — travels the whole pool without needing any inter-party cooperation. The vulnerability is topological: it exists whether or not anyone exploits it, and our data show at least one foreign-operated actor positioned to do so.

Third, coordination itself is becoming an unreliable signal. The two highest raw coordination ratios in the dataset turned out to be lawful co-partisan behaviour; the tightest synchronisation belongs to a domestic party network that may be entirely legitimate campaigning. Without identity-first classification and the party/coalition correction, this analysis would have “found” coordination precisely where it is expected and legal, and buried the genuine anomaly — the Belarus-run segment — in the noise. The methodological conclusion generalises: in electoral periods, coordination detection that does not model parties and coalitions will systematically misfire.

What follows from this. The monitoring priority for the second half of 2026 — an election half-year — is not the loud, open networks but the quiet attachment points: the four Belarus-operated accounts and any new accounts that begin to reproduce their embedding pattern; the disclosure status of the LPV network’s undisclosed candidates; and the Belarus-legitimation frame as an early-warning tracer, precisely because it is rare, attributable and currently confined to the cross-border segment. Any spread of that frame into domestic accounts would indicate the pool is being used as designed.