Growth of Online Conspiracy Narratives in the Netherlands Presents Regulatory Challenges

Blog

Synopsis

High rates of internet connectivity and minimal online regulation in the Netherlands allow nearly any interested person to maintain a distributed, online network of conspiracy content. The online conspiracy landscape in the Netherlands is comprised of operators, infrastructure, and content used to broadcast misleading ideas to a wide virtual audience. Content, which can include misrepresented text and media, is centered around one or more conspiracy themes or ideas. Some conspiracy themes embedded in the Netherlands were first observed in the United States, while others are endemic. According to Europol, in the Netherlands, left-wing and right-wing aligned attacks comprised a greater number of attacks in 2020 than did Jihadist and ethno-nationalist/separatist attacks combined (1). Overtly banning conspiracy content is not an effective mitigation. Instead, efforts should focus on deprioritizing content that leads to violence and making certain sites less visible, rather than eliminating content altogether.

Methodology and Scope

EclecticIQ analysts performed discovery of online infrastructure and narratives specifically directed at the Netherlands public to identify how ideologies are directed and spread online, and to understand the risk created by increasing adherence to such narratives. The analysts used a combination of EclecticIQ’s Threat Intelligence Platform, automated tooling, and manual processes for this project. The scope encompassed public-facing infrastructure, with the exception of popular social media platforms. These platforms already experience a high degree of scrutiny and operate under different content policies without adequate transparency for this analysis. For this report, ‘online conspiracy infrastructure’ included English and Dutch language websites with top level domains *.com, *.eu and *.nl which describe events or convey ideas with the intent or effect of misleading the reader. EclecticIQ analysts followed the “Identifying Conspiracy Theories” guidance from the European Commission (2). For a complete list of the sites examined in this research, please review the appendices in this report.

Analysis

Lack of Internet Regulation in the Netherlands Creates Relatively Permissive Environment

The Netherlands takes an open approach to information dissemination online which generally aligns with the ideal of free speech common in most Western nation-states. Nonetheless, the relative immaturity of the internet as a communications platform means that the Netherlands, like many others, lacks both a formal internet takedown policy for different forms of illegal online content and the legal basis to implement stronger content filtering (3). The absence of formal channels and protocols makes content arbitration more difficult and almost certainly has the effect of enabling illegal and fringe content (4).

It is likely that the tolerant legal policies governing online behavior in the Netherlands have fostered an environment where it is easier to establish conspiracy-related infrastructure and, once established, more difficult to take down, compared to other countries. In 2019, the Internet Watch Foundation reported the largest percentage of child abuse images worldwide were hosted on Netherlands infrastructure (6). This suggests that the permissive online environment that allows conspiracy content to survive may also enable other types of illegal media.

Operators Easily and Rapidly Create Websites, and Distribution of Conspiracy Narratives Plays to Individual Interests

Online content is generated by website administrators or operators and does not require user participation to promulgate content, as QAnon did (7). After registering a website to broadcast conspiracy content, administrators use social media - especially Facebook - to advertise it (Appendix B1). This is how conspiracy-based websites begin attracting visitors and generating interest. According to data on registration of websites in the Netherlands that support conspiracy content, public-facing websites saw a significant uptick in 2016 and again in 2020 (Table A). Current events related to COVID-19 very likely drove the second wave of registrations and continue to generate the greatest volume of conspiracy content in the Netherlands.

Demand for online conspiracy content is propelled by a highly distributed model and an audience attuned to search out a particular conspiracy narrative. Outside of social media, conspiracy content in the Netherlands exists mostly on websites and online forums focused on a special interest topic, and on mobile chat applications. Operators of different sites or channels have various degrees of influence over their audience and help to further their particular conspiracy niche via that group.

Many Themes in the Netherlands’ Online Conspiracy Network are Familiar, but a Few are Highly Niche

Notable Netherlands-focused conspiracy themes most commonly include, but are not limited to:

Origins of COVID-19, ulterior lockdown motives, and vaccine skepticism
5G wireless bandwidth mind control and disease
Pedophile cabals
Global upheaval (e.g., The Great Reset)
Distrust of elites and government
Violence towards mainstream media
Conspiracy theories that closely echo central themes first observed in QAnon

A few conspiracy themes attempt to connect to unique aspects of the Netherlands, which allows them to further attract the interest of local user groups. For example, one conspiracy theory claims there is an underground network of tunnels and bases in the Netherlands (Appendix B2). Allegedly, the network was built as a strategic side project of land reclamation and is used for hiding government secrets.

Conspiracy Ideology in the Netherlands Shares Strong Similarities with QAnon Themes

The timing of infrastructure registrations and cross-pollination of conspiracy themes strongly support the idea that conspiracy groups in the Netherlands co-opted some conspiracy content originating in the United States. The two conspiracy themes observed in the Netherlands that exhibit the most similarities with U.S. narratives involve pedophile cabals and The Great Reset - a global change theme observed throughout the 2016 U.S. presidential election. The Netherlands group VizierOpLinks (Watch the Left) and its website follow closely the U.S. groups Turning Point USA and the Professor Watchlist (8).

Direct migration of ideology from the United States to the Netherlands is possible, in part, due to the low language barrier. The Netherlands’ second official language is English, which facilitates easy access to U.S. media (9). It is very likely that media attention provided to QAnon in a globalized environment created a conduit to introduce similar conspiracy themes in the Netherlands, where they caught on relatively easily. This is not to say there is no Dutch-language conspiracy content, rather that the spread between nations was likely faster than it would have been with a natural language barrier. (Read detailed analysis on the online evolution of QAnon.)

A Wide Variety of Threat Actors Participate in the Conspiracy Landscape, but Remain Focused on Single Narratives

While a particular conspiracy theme may make a geographic leap, most participants’ interest stays with one conspiracy narrative and does not bleed over onto other narratives. EclecticIQ analysts did not detect interconnectedness among multiple conspiracy groups or ideologies. The analysts detected very little public cross-talk and saw no evidence of groups moving between or blending ideologies. This finding indicates that individual conspiracy groups remain relatively siloed under a single ideology. Group leaders administering website content appear to act independently in promoting their favorite brand of conspiracy. They do not appear to copy from each other or exert large amounts of influence on each other.

Infrastructure Operators Share Minimal Content

Websites and forums do not reuse each other’s content. The content is not a collection of memes; rather it is more mature and caters to adult audiences. It is likely that more mature audiences favor websites, while less-mature audiences prefer to use social media (27). Several conspiracy-motivated groups demonstrate high enough levels of organization outside the internet to draw attendees to organized public events (Appendix A).

Conspiracy advertising does not spill over into the public domain of non-conspiracy-related infrastructure. Examples include a lack of conspiracy discourse leaking into public forums (Appendix B3). This is evidence that conspiracy ideology holds a relatively niche position among the Netherlands public.

A Significant Number of Conspiracy Websites Refer to Each Other

Although there is little evidence of content sharing, many individual sites containing conspiracy themes reference each other with links pointing to conspiracy content on other pages. These referrals enable users to discover additional materials and websites more readily. For example, the website name “telegramnl.eu” is found on over 1000 other websites. It is likely that the high degree of linking observed indicates that website administrators are aware of each other and thus have some knowledge of the greater network of conspiracy content.

Infrastructure Serving Conspiracy Content Remains Highly Distributed

Websites are hosted across a variety of providers and do not share administration. This separation and a lack of content sharing create a network model of highly distributed individual nodes (websites or operators), which in turn makes it more difficult to scope all behavior and participants. EclecticIQ analysts identified Nameserver ZXCS (.be, .eu, .nl) as hosting the largest portion of conspiracy and fringe content. It is a large provider that dates from 2013, with 17,432 total domains that are largely marked safe by antivirus vendors (Appendix B4).

Politically Left-leaning Groups Are Scarce on Public-facing Websites

Antifa-Netherlands-related content comprised the only notable left-leaning content and infrastructure in public internet spaces. It is possible that left-leaning groups have a greater presence on social media and mobile chat applications than on public-facing websites but examining social media to prove or disprove this hypothesis falls outside the scope of this paper.

Conspiracy Theory Participation Is Linked to at Least Four Types of Physical Attacks

EclecticIQ analysts observed reports of physical violence in the Netherlands that are very likely linked to online participation in conspiracies.

Individuals working in the media industry have been physically attacked in a variety of ways, including physical harassment and arson (10). The reported behavior closely aligns with conspiracy theories involving distrust of elites and mainstream narratives purportedly driven via elite-controlled media channels.
An epidemic of vigilante violence broke out in 2020, resulting in at least one murder of an innocent man (11). The behavior closely follows conspiracy themes of pedophile cabals.
An individual attempted a bombing attack on a COVID-19 vaccine center (12). The behavior reflects strong antivaccine themes expressed in online discussions.
5G towers were destroyed on multiple occasions (13). This activity aligns directly to conspiracy themes against 5G technology.

Conspiracy Content in the United States May Continue to Influence Netherlands Citizens

A significant amount of attention to conspiracy theories can be attributed to the rise of QAnon in the United States. Media coverage of QAnon brought many conspiracy-themed discussions to public platforms. It is very likely that some of the conspiracy content currently circulating within the Netherlands population was directly co-opted from the QAnon culture in the United States due to language sharing. Similarities in themes and website content that closely followed U.S. politics during the 2016 and 2020 elections provide the strongest evidence for a link. Despite having some similarity to U.S. content, the architecture of conspiracy content in the Netherlands is highly distributed, with no single group or individual driving large amounts of content or unifying themes.

Agencies in the Netherlands Are Taking Proactive Steps to Prevent Conspiracy-Inspired Violence

The Dutch Police deter violence stemming from conspiracy themes by monitoring the possible transition from the virtual space to the physical world and arresting those making physical threats to individuals (14). At the individual level this deterrence is likely to be effective in preventing violent crime influenced by conspiracy ideology; however, it does not stem the spread of online conspiracy content. One possible point of conflict about this approach is that more widespread police measures could eventually curtail the long-held tradition of self-expression (15).

Some banks in the Netherlands refuse funding to groups that back conspiracy theories.
Five financial agencies have started to refuse to open accounts for groups associated with conspiracy content (16). This defunding will likely have a significant impact on groups’ ability to organize and recruit from larger audiences and participate in large public events. However, broader use of this strategy, or an official defunding policy, may become a slippery slope that turns financial institutions into arbiters of personal opinion or belief.

Outlook

Balance the Right to Self-Expression with Education, Technology, and Policing for Criminal Acts

Officially banning conspiracy content is not likely an effective policy for countering its spread. For example, when Twitter removed the Netherlands-based group VizierOpLinks on April 10, 2021 (17), the group experienced its highest surge in membership to date. Rather, the most effective policy for ensuring safety while permitting self-expression is to strongly police the line that separates online discussion from threat of physical violence and bring violent offenders to justice. The deterrence effect of these law enforcement actions is more likely to keep online activities from becoming violent in the physical world.

As mentioned above, banning online content altogether is probably not going to be effective in stemming the growth of conspiracy content, nor does it align with free speech rights. However, it may be possible to preserve the right to free speech while tweaking online ranking systems to deprioritize dangerous or false content and make it harder to find. Such de-prioritization is already well established within some online platforms (20). In addition, continued education about the dangers of false and misleading information, and practical advice to help recognize such content online, will be key to ensuring both physical and online security.

References:

Table A: Domains hosting conspiracy content observed in this investigation.

dutch-mapping-table-a

Appendix A: Groups capable of organizing public demonstrations:

Vizier op Links
Launched an intimidation campaign against perceived Leftist opponents’ private addresses. https://www.tellerreport.com/news/2021-05-27-om-is-investigating-radical-right-wing-platform-vizier-op-links.SylR8a92Fd.html
VirusWaarheid
Filed suit in the Hague against the State regarding COVID-19 vaccination policy https://www.bbc.com/news/world-europe-56084466
Netherlands branch of Qanon
Present at various anti-lockdown and anti-coronavirus events https://www.bloomberg.com/news/articles/2020-11-03/dutch-fall-for-covid-conspiracies-in-warning-to-europe-s-leaders
Antifa-linked groups
Present at anti-lockdown protests in the Netherlands https://www.garda.com/crisis24/news-alerts/427341/netherlands-anti-fascist-protest-in-amsterdam-jan-10

Appendix B: Screenshots from related websites and searches

Telegramnl[.]eu advertised via multiple Facebook pages
Bitchute featuring a conspiracy of underground bases
Lack of trolling and conspiracy discourse on normal public forums such as expat[.]com
Nameserver ZXCS[.]nl hosting many legitimate sites.

About EclecticIQ Threat Research

EclecticIQ is a global provider of threat intelligence, hunting and response technology and services. Headquartered in Amsterdam, the EclecticIQ Threat Research team is made up of experts from Europe and the U.S. with decades of experience in cyber security and intelligence in industry and government. EclecticIQ’s Threat Research team strives to apply the analytic rigor principles of U.S. Intelligence Community Directive 203 to its analysis.