Researchers have uncovered a network of likely Russia-based fake profiles promoting disinformation on online forums and social platforms as recently as last month. The accounts spread forged documents and false rumours, including about an anti-Brexit plot to murder Boris Johnson.
The Atlantic Council’s Digital Forensic Research Lab (DFRLab) started an investigation following Facebook’s removal of a small cluster of 16 suspected Russian fake accounts in early May 2019. After a closer analysis of the banned accounts, the researchers unearthed a much wider operation – across 30 social networks and blogging platforms, and nine languages – aimed at influencing online conversations about topics including Brexit, Northern Ireland, the European elections, immigration, UK-US relations, the turmoil in Venezuela and other foreign policy issues.
According to a DFRLab report on the investigation, the operation “was run by a persistent, sophisticated, and well-resourced organization, possibly an intelligence agency”, but its posts failed to catch on online, achieving only limited reach in all but one case. Unlike previous influence operation, the big social networks were a sideshow to a campaign conducted mostly on blogging sites, subreddits, and online forums.
“Most of the operations we’ve seen so far focused on Facebook and Twitter. This operation was almost entirely posted on other platforms, and barely used the main platforms,” says Ben Nimmo, a senior fellow for Information Defence at the DFRLab. “It also made heavy use of forged documents and outright falsehoods. Other operations have focused on half-truths, and biased or divisive content. The sheer volume of fakery in this operation was remarkable.”
Some of the false stories felt almost blatantly far-fetched. In one egregious instance in August 2018, fake accounts alleged that Spanish intelligence agencies had discovered a remainer plot to assassinate Brexit-backing Conservative politician – and probable next UK prime minister – Boris Johnson.
A Spanish-speaking Facebook account initiated the hoax on August 8, sharing a forged letter in which Spain’s foreign minister – whose name was misspelled in the signature – detailed the assassination plot. The rumour was later reposted on six subreddits and three Spanish-language forums, before being translated into English and repurposed for blogging platform Medium on August 13. The article, and a related meme juxtaposing the Spanish “letter”, an image of Johnson in the crosshairs and a photoshopped image of a dejected Johnson in a red jumper saying “Guess I’ll die”, was again shared on several online forums Facebook – but failed to spread online.
The Johnson assassination hoax followed a template typical of the entire operation. A false story would be planted by newly-created burner accounts sharing forged documents, and then amplified and expanded by accounts in multiple languages, in hopes that it would find its way to the mainstream media. Beside the Boris Johnson case, information operations targeting Northern Ireland followed a similar pattern. In August 2018, some accounts shared a screenshot of a false email exchange between the leader of the Democratic Unionist Party, Arlene Foster, and the EU chief Brexit negotiator, Michel Barnier, in which the two appeared to engage in a secret negotiation behind Theresa May’s back. Other Northern Ireland-focused disinformation bouts alleged that the IRA had helped Russia carry out the Salisbury poisoning, and that the (Catholic) Real IRA was recruiting “Islamic radicals” among its ranks.
A fraudulent letter also featured in the network’s attempts to influence the European Parliament elections in May 2019. On May 21, users on blogging platforms Medium, canalblog, andposted articles in French, German, and broken English claiming that “liberal forces” in the European Union had launched a “war against the right.” The articles were centred on a screenshot of a letter allegedly written by Italian-Swedish MEP Anna Maria Corazza Bildt. The forged letter – written in poor, non-native Swedish – called for “resolute and united” cooperation between European liberals and conservatives against the far right and praised the “well-organized work of the German media” against a far-right politician in that country.
Citing the letter, the blogs attacked a “desperate and oftentimes unlawful informational war […] being made against the forces that try to defend national interests of European countries.”
All three articles sourced the “letter” to a separate Medium post, dated May 16, and published by a user account called “Tom Welch.” The account posted only once and wrote in broken English, using language formulations common to Russian.
A scan of the three articles using the online tool BuzzSumo showed that none of them were shared online. That was despite the fact that one Twitter account linked to the operation posted it 16 times, tagging politicians from Germany’s far-right AfD party in order to elicit a reaction.
The operation’s overall failure to get traction, according to Nimmo, was mostly a result of its painstaking attempts to cover its tracks.
“The great irony is that this operation tried so hard to hide that it hid its own stories. Almost every post was made by a single-use account that was created that day, posted once, and then abandoned. That’s completely contrary to the way you work on social media, where the whole point is to develop a personality and a track record,” he says.
“On the down side, it means that taking down these accounts will have less impact on the operation, because the operators have effectively burned them already. But on the plus side, it means that most of their stories crashed before they even took off.”
One notable exception was a story targeting Germany, alleging that an Arabic-language forum had published a “guide for migrants” training immigrants to get away with crimes including “sexual molestation of German women.” The hoax caught the eye of German far-right news website Journalistenwatch, which picked up the story and boosted its diffusion online.
The DFRLab, like Facebook, is confident that the operation originated in Russia. Many of the topics around which the network spread disinformation – Ukraine, Armenia, opposition to NATO – are traditionally aligned with Moscow’s foreign policy goals; several language errors spotted in the shared posts, such as the omission of articles or the usage of non-standard idioms, suggest that they might have been poorly translated from Russian texts. The researchers also spotted parallels between the network’s modus operandi and that of “Operation Infektion” a disinformation campaign orchestrated by the KGB in the 1980s, which accused the US of creating the AIDS virus. “[Operation Infektion] planted the fake story in distant media before amplifying it through Soviet channels: it ultimately spread through genuine news media,” the report says.
According to the DFRLab, while it seems confirmed that the operation works out of Russia, it does not necessarily follow that it is backed by the Kremlin. “There is, of course, a significant difference between operating from Russia and having any association with the Russian state. There is insufficient open-source evidence to make a definitive attribution at this stage,” the report says.
“The sheer scale and ambition of the operation, however, mean that it is unlikely to have been attempted by a small or ad hoc group. [The operation has ] significant resources, not only in terms of manpower and time, but in terms of skills.”
At the time the report was released, the operation was still ongoing.