At the end of November 2018 I drove into Lyon from the north, on my way to Les Menuires for the ski season, with everything I owned in the car. Protesters had shut every booth at the toll plaza on the A6 and left a couple of lanes open with the barriers up, so the traffic went through in a long, slow procession. There were flags, fireworks and flares, and riot police waiting in the background. I watched expensive cars being singled out and scratched, and as I went past, someone was trying to set one alight. I sat in the procession and added up what I would lose, and crawled through with everyone else. I was frightened. I also understood them. That is the part I have carried since. The Gilets Jaunes had started out over a rise in fuel tax, and they had picked a target you could stand in front of: the cars of people who would not notice the price. Weekend after weekend, at roundabouts across the south-east, they handed out leaflets, and you did not get through without taking one. They knew what they were angry at, and they knew where to stand. Eight years on, the name is back, and so is the fuel price. In early September a young man with no known political ties posted a TikTok video, angry about the cost of fuel, that proposed a date: Saturday, October 17. Other accounts dressed it up as the return of the Gilets Jaunes. Pupils had already been out for weeks over their schools, and by the day the unions had joined too. Several mobilisations met on one date. By late that night the prime minister, Sébastien Lecornu, put arrests at 1,200. In Lyon, rioters set fire to the tourist office on Place Bellecour. In Marseille, several dozen forced open the doors of the city hall and toppled a bust of Marianne. In Limoges, the prefect of Haute-Vienne said the town hall was largely lost to a fire he called deliberate. In Britain, in early September, hundreds of protesters clashed with police in Portsmouth after a dinghy landed. Two nights later masked protesters turned up outside a Portsmouth hotel looking for asylum seekers. They had found the Pakistan under-19 cricket team. So who moved the street? That is four questions: who started it, who made it big, who turned it violent, and who amplified it once it was under way. Hostile states are active in this space, and that is documented. This piece tests the first two: whether the public evidence shows hostile states as the principal driver of the mobilisation and its early spread. Here is what would prove me wrong. If published platform or government data showed state-linked networks driving most of the early reach of the calls to protest in France or Britain, I would be wrong, and I would say so. The other two questions, who turned it violent and what later amplification did, the public evidence does not yet settle. On the road In France the school strand came first. Pupils had been out for about three weeks over teacher shortages, crowded classes and crumbling buildings. The Interior Ministry blamed “ultra-left” groups for the attacks on police and public buildings. Marseille’s mayor condemned the vandals in blunt terms and described the damage as limited. That is the French street: students, unions, fuel-price anger, and a violent fringe the ministry blames and Marseille’s mayor condemns. Britain is a different crowd. Hope Not Hate counted at least 251 anti-migrant events across 77 places between June and December last year. It describes hardened far-right activists standing beside local people “taken in by the promise of safety”. UKIP, Patriotic Alternative and Britain First are among the organisations named. The organised core I can document in Britain is far-right and anti-migrant; in France the ministry blames the ultra-left. These are not mirror images. Handing out the leaflets The leaflet of 2018 is the feed of 2026. The mechanism is old: someone hands you a date and a reason. The distribution is new. A roundabout reaches the cars that pass it; a feed reaches millions, and nobody has to stand there. In France this autumn the leaflet was a TikTok video, and Le Monde traced it to its young author. Two French sites, citing Le Monde, report that Viginum, the French state’s watchdog on foreign digital interference, found only minimal, opportunistic foreign activity around it, of no significant reach. I have not seen that finding at source. Le Monde also found a dozen accounts, all created or renamed on September 9, that shared the call intensively, which it calls a typical practice of automated and coordinated accounts. Nobody has said by whom. A claim travels furthest when nobody has to answer for it. After Southport in 2024, the false name of the suspect was among the first posted by a website called Channel3 Now. The Bureau of Investigative Journalism found its Facebook page was run by administrators in Pakistan and the United States, and called the case for Russian involvement “weak at best”. A RUSI analyst, writing personally, judged the Kremlin the likeliest foreign actor but concluded that most of the content was home-produced and the Kremlin “lent a helpful megaphone”. Some of it is not state activity at all. When X began showing account locations last November, some UK-focused pro-Reform and far-right accounts turned out to be based in India, Switzerland and Spain. The data can be skewed, but those are people, not states. I see the same thing in the Facebook groups I use: accounts that behave like bots, posting the same lines at all hours. In those threads the origin is simply assumed: Russia, or Iran. It may be. I have no evidence either way, only a pattern I recognise, and nobody in those threads has any more than that. During the Brexit referendum, patterns like that were what first made me suspect some accounts were pushing lines from outside the country. Suspicion, not proof, then as now. Behaviour tells you that something is automated or coordinated. It does not tell you whose it is. The states I grant the premise in full, and the record is public. On October 7, France’s foreign ministry summoned Iran’s ambassador over what it called a disinformation campaign by the Iranian authorities about the school movement, and named official Iranian Foreign Ministry accounts as the source of false content. Viginum has documented 77 information operations by the Russian network known as Storm-1516 between August 2023 and March 2025, and the foreign ministry condemned them in May 2025. The premise does not carry the conclusion. A French disinformation researcher told one newsletter this week that he saw accounts matching the Storm-1516 pattern join in once the riots were under way. That is secondhand, and what he describes is amplification after the fact. The same newsletter relays a report from the French outlet La Lettre, of an official document attributing the signature of the Iranian regime to French-language accounts that circulated images of the clashes. I have not seen the document. The strongest claim the other way is a France Culture statement by the journalist Frédéric Martel, as relayed by the French tech site Cryptoast. Citing intelligence sources, he said influencers backed or amplified by Iran, Algeria and Russia helped mobilise rioters. I have not heard the broadcast, and the claim is unconfirmed. If it is borne out, it moves towards what would prove me wrong. I have found no public attribution of the violence to a foreign state by any French authority. In Britain, the Home Secretary’s statement to Parliament on October 12 set out Iranian proxies, arson in north London and threats to the Jewish community, which is a different category of activity. It said nothing about the anti-migrant protests, and I have found no attribution of them to Russia or Iran. None of that proves absence. A state does not have to create a grievance to exploit it, or organise a march to make it likelier to turn violent. No public attribution is not the same as no operation, and amplification after the start can still change what happen… Get full access to Stay in the Room at davidpreston.substack.com/subscribe