On March 11, 2020 Twitter shared with the Stanford Internet Observatory accounts and tweets associated with five distinct takedowns. These include:

• Saudi Arabia, UAE, and Egypt: 5,350 accounts and 36,523,977 tweets. The removed accounts were linked both to a September 2019 takedown of accounts linked to DotDev, a digital marketing firm operating out of Egypt and the UAE, and a December 2019 takedown attributed to Smaat, a Saudi Arabian digital marketing firm. This takedown was a result of a tip the Stanford Internet Observatory shared with Twitter in December 2019. 
  • Facebook also shared with the Internet Observatory 55 Pages that are linked to this operation; these Pages were run out of Egypt. Facebook attributes these Pages to Maat, a social media marketing firm.
• Egypt (El Fagr newspaper): 2,541 accounts and 7,935,267 tweets. A takedown of accounts tied to the El Fagr newspaper, an Egyptian weekly tabloid. The removed accounts were linked to an October 2019 takedown of El Fagr’s activities by Facebook.
• Honduras: 3,104 accounts and 1,165,019 tweets. A takedown of accounts linked to a staffer of Honduran president Juan Orlando Hernández.  
• Serbia: 8,558 accounts and 43,067,074 tweets. A takedown of accounts linked to the Serbian Progressive Party (SNS), the party of current President of Serbia Aleksandar Vučić. These accounts engaged in inauthentic coordinated activity to promote SNS and Vučić, to attack their political opponents, and to amplify content from news outlets favorable to them.  
• Indonesia: 795 accounts and 2,700,296 tweets. 

In this post we summarize our analysis of the first four operations. We have also written in-depth whitepapers on the Saudi Arabia/UAE/Egypt, Honduras, Serbia, and Egypt and El Fagr operations, linked at the top of the page.

The Saudi Arabia, UAE, and Egypt operation

[FULL REPORT]

In December 2019 the Stanford Internet Observatory alerted Twitter to the hashtag #السراج_خائن_ليبيا (Sarraj the traitor of Libya), a reference to the Libyan Prime Minister’s signing of a maritime agreement with Turkey that angered many regional actors. The hashtag had a suspicious distribution pattern, and was shared alongside infographics linked to an earlier Twitter takedown attributed to digital marketers DotDev. Twitter’s subsequent investigation of this hashtag revealed not just a link between this new network and DotDev, but also a link to Smaat, a Saudi Arabian digital marketing firm that Twitter suspended in December 2019 (SIO’s report on Smaat is here); Twitter believes multiple social media management firms created the accounts in this network. In April 2020 they removed 5,350 accounts, which are the subject of this assessment. 

Image

On March 25 Facebook shared 55 Pages linked to this network.

Key takeaways from the Saudia Arabia/UAE/Egypt datasets:

• Tweets supportive of Khalifa Haftar - a Libyan strongman who heads the self-styled Libyan National Army - began in 2013. This suggests Saudi Arabia/UAE/Egypt disinformation operations on Twitter targeting Libya began earlier than previously known.
• Accounts claimed to be located in a variety of Middle East and North African countries, with many claiming Sudan. They discussed domestic politics with an anti-Turkey, anti-Qatar, and anti-Iran slant. These countries are geopolitical rivals of Saudi Arabia, the UAE, and Egypt. 
• Recent posts on the Facebook Pages leveraged the COVID-19 pandemic to push these narratives.
• Many of the accounts tweeted links from a set of domains that purport to be news sites for countries like Algeria and Iran; these sites were all created on the same day and publish content with a similar anti-Qatar, -Turkey, and -Iran slant.
• Prominent narratives included discrediting recent Libyan peace talks, criticizing the Syrian government, criticizing Iranian influence in Iraq, praising the Mauritanian government, and criticism of Huthi rebels in Yemen. (We discuss these in detail in our whitepaper) 
• There were several interesting behavioral tactics observed in this Twitter data set: 
  • Hashtag laundering: A geopolitically aligned news website and YouTube channel ran stories about the DotDev-initiated hashtag, with the intent of making it seem like Libyans were (for example) so hostile to Turkey that an anti-Turkey hashtag was trending in Libya. This coverage was grossly exaggerated; the hashtags did not go viral, and the accounts whose tweets they embedded in their articles were subsequently taken down by Twitter. 
  • Jingoistic personas: The accounts were exceedingly and passionately patriotic to the point of being comedic caricatures. Their profiles emphasized their pride in their purported country, saying things like (translated) “Emirati and Proud” or “Tunisia is my passion” or “I love you, Sudan.”

A March 24, 2020 post from the now-suspended facebook.com/GulfKnights1 criticizing Qatar in the context of COVID-19.
 

The Egypt operation

[FULL REPORT]

This takedown was attributed to actors linked to the El Fagr newspaper in Egypt. El Fagr has previously been associated with influence operations, possibly on behalf of the Egyptian government, on Facebook and Instagram, which took down a network related to their activity in October 2019. 

As with several past influence operations attributed to networks operating out of Egypt (and Saudi Arabia), the content consisted of a mix of auto-generated tweets from religious apps, commercial content, geopolitical news content, as well as subversive political astroturfing pushed by accounts that appear to be personas. The political astroturf identities were often made and deployed for a specific topic, created within a short time period and immediately deployed towards a particular topic with very little additional content. 

Key takeaways:

• The topics in this Egypt-attributed data set had high overlap with topics in past Egypt-attributed takedowns: negative content about regional rivals such as Qatar and Iran, positive tone towards the Egyptian government. 
• News properties were at the center of this network. Several appeared to be legitimate organizations, such as El Fagr itself, and other outlets based in UAE and Yemen. 
• Other handles that appeared to be news outlets were fabricated properties that had Twitter accounts with “news” in the name, but did not appear to be actual news outlets - there were no signs of original content. Additionally, a few used names that tried to create the perception that they were regional affiliates of legitimate news organizations (ie, @Foxnewseurope_f). 
• Fabricated personalities were created in batches, some serving as content creators, and others serving as content amplifiers. The creators would tweet “original” messages nearly simultaneously (3-6 accounts would put out the same text but not engage with each other), and then outer networks of “disseminators” would amplify them all. 
• There was significant amplification of El Fagr’s editor, @MustafaThabetM, with over a hundred thousand retweets - not only from the paper’s own twitter handle, but from a collection of persona accounts. The retweeted content often included sensational or highly political hashtags related to Qatar. 

An example of one of the many instances in which networks of accounts created in batches  were used to amplify El Fagr’s editor, Mostafa Thabet. 

The Honduras operation

[FULL REPORT]

This takedown of over 3,000 accounts was attributed to the administration of the Honduran President.  and is related to a July 25, 2019 Facebook takedown of 181 accounts and 1,488 Pages. Among the accounts pulled down were those of the Honduran government-owned television station Televisión Nacional de Honduras, several content creator accounts, accounts linked to several presidential initiatives, and some “like-for-likes” accounts likely in the follower-building stage. Much of the tweet behavior seems targeted at drowning out negative news about the Honduran president by promoting presidential initiatives and heavily retweeting the president and news outlets favorable to his administration. Interestingly, a subset of accounts in the dataset are related to self-identified artists, writers, feminists and intellectuals who largely posted tweets critical of the Honduran president Juan Orland Hernandez (‘JOH’).

Image

Image

Key Takeaways:

• The Honduras takedown consists of 3,104 accounts and 1,165,019 tweets. 553,211 tweets were original and 611,808 were retweets. Accounts dated as far back as 2008, but roughly two thirds were created in the last year. 
• The accounts created in the last year appear largely automated. Their activity overwhelmingly involved retweeting Honduran President @JuanOrlandoH. Approximately 37% of the tweets in the dataset mentioned @JuanOrlandoH.
• The largest removed account was that of Televisión Nacional de Honduras (TNH). The government-controlled TV station’s facebook page was also removed in July 2019. TNH has new social media presence on both platforms as of March 25, 2020.
• Some of the removed accounts are associated with known television and media personalities, one of whom, Chano Rivera, is also a political consultant and publicist.
• The frequency of hashtags including (in translation) #TheNewHonduras, #HondurasAdvances, #BetterLife, #HondurasActivates, #ISupportYouJOH, #LongLiveJOH and #HondurasIsProgressing shows widespread promotion of the president’s initiatives within the dataset. Minimal mention is made of some major news events, such as the criminal conviction of the president’s brother, Tony Hernandez, suggesting that the tweets sought to drown out negative press.
• A set of roughly a dozen accounts associated with self proclaimed writers, artists and feminists formed a distinct group in the dataset. These accounts were the only accounts heavily critical of the government. They also interacted less with the dominant media landscape and the president than other accounts in the dataset. There does appear to be evidence of coordinated activity across the cluster.

The Serbia operation

[FULL REPORT]

One of the takedowns announced on April 2, 2020 was a large cluster of Serbian accounts. These accounts were primarily engaged in cheerleading current Serbian President Aleksandar Vučić and his allies, in attacking the Serbian opposition, and in artificially boosting the popularity of Vučić-aligned tweets and content. Among other things, the accounts appear to have focused on supporting Vučić’s run for president in 2017 and tamping down public support for the opposition-led protests known as “1 of 5 Million,” which began in late 2018.

One of the most popular accounts in the Serbia-related takedown, @belilav11, replying to a tweet from the Serbian Progressive Party, the party of current Serbian president Aleksandar Vučić: “The government belongs to the people, not to the yellow tycoons [i.e., the opposition] and their mentors from the west. The people decide in the election who will be in power.” Accounts like this one tweeted in support of Vučić and his allies and attacked the Serbian opposition.

Key takeaways

• The network consisted of approximately 8,558 accounts. While many of these accounts existed earlier, most of the network’s activity came in 2018 and 2019. The accounts sent more than 43 million tweets altogether. 
• The accounts served as a coordinated pro-Vučić brigade on Twitter. They tweeted constantly in support of Vučić—over 2 million tweets were sent with the hashtags #Vucic and #vucic—and derided his rivals and the “1 in 5 Million” protests. 
• The accounts worked steadily to direct Twitter users to pro-Vučić news sources. Among their tweets were over 8.5 million links to sns.org.rs, informer.rs, alor.rs, and pink.rs, the official site of Vučić’s party and three Vučić-aligned news sites, respectively.
• The accounts relied on a few core tactics to boost visibility and achieve their aims: 
  • Dogpiling onto opposition-related content. Tweets by opposition politicians and publications were swarmed by the accounts, which replied with critical or derisive comments to give the content the appearance of unpopularity.
  • Taking over opposition-related hashtags. When protesters popularized the hashtags #1od5miliona and #PočeloJe, the accounts attacked the originators and attempted to co-opt the hashtags with pro-Vučić content.
  • Retweeting Vučić-aligned accounts to boost their popularity. The accounts retweeted @avucic 1.7 million times, @sns_srbija (the official account for Vučić’s party) over 4.5 million times, and @InformerNovine (an SNS-aligned newspaper) over 1.8 million times. Many accounts were engaged solely in retweeting @avucic.

While a precise connection between this network and SNS has not been established, there can be no doubt, given the content these accounts shared and the time period in which they were active, that this network was aligned with Vučić’s efforts to entrench himself and his party in power.  

The broad spectrum of takedowns in the April 2020 collection serves as a reminder that coordinated inauthentic behavior manifests globally, comes from a range of actor types, is reliant on broadcast media as well as the social media ecosystem, and that determined manipulators regenerate networks and update tactics with regularity.

4/2/2020, 11:30AM PST: THIS POST WAS UPDATED TO INCLUDE ADDITIONAL INFORMATION FROM FACEBOOK

Russia’s global strategy for reasserting itself as a geopolitical superpower has led to an increased presence in Africa, where it has broadened efforts to shape the continent’s politics and pursue new economic opportunities to allay the effects of sanctions. While the presence of Russian military instructors and paramilitary groups in Libya and the Central African Republic is well documented, there is emerging evidence that Russian-linked companies are now active in the information space as well. Yevgeny Prigozhin, the oligarch perhaps best known for running the Internet Research Agency, is central to this expansion.

In this post we identify a Facebook operation attributed to entities tied to Prigozhin — including, it appears, the Wagner Group (Частная военная компания Вагнера), a Russian organization that has served as a private military contractor in several African countries. The first allusion to a social media influence operation tied to Prigozhin stemmed from Daily Beast reporting and a document shared with us by the Dossier Center that suggested the existence of a cluster of Facebook Pages tied to the Wagner Group. We identified an initial cluster of Pages which targeted Libya, and shared the find with the Facebook Threat Intel team. Facebook subsequently provided us with data on two related networks that they had been investigating previously. These networks have been targeting the Central African Republic, the Democratic Republic of the Congo, Madagascar, Mozambique, and Sudan, and included “news” Pages and websites, and Pages purporting to belong to political parties as well as individual politicians. The part of the operation we analyzed included seven Instagram accounts and 73 Facebook Pages. In total 1.72 million accounts liked the Facebook Pages, though we note that some of these likes are possibly from the same account across multiple Pages. The Page managers were quite active; in October 2019 alone there were 8,900 posts. 

Wagner Group document shared by the Dossier Center. The document included an example post from a Page called ليبيا القذافي (Libya Gaddafi). The post was a photo of former president Muammar Gaddafi, overlaid on an outline of Libya. The document described the post as a “Patriotic post about the best time for the Motherland.” (High Resolution)

From our analysis of the social media activity, there are several key takeaways:

• The operation, conducted by Russia-linked organizations likely operating at least in part at the behest of a state actor, appears to have further relied on subcontractors who are native speakers and/or local to the region. This variety of nested obfuscation increases hurdles to attribution of disinformation campaigns. 

• In addition to well-known social media platforms such as Twitter and Facebook, the actors leveraged public WhatsApp and Telegram groups. Whether more private chat channels were also used is an area for further research. 

• The operation used social media engagement tactics designed to develop a close relationship with the audience, including Facebook Live videos, Google Forms for feedback, and a contest.

• The operation shared tactical similarities to Internet Research Agency activities; the operatives created several associated news sites (in one case staffed by reporters who appear to have spent time in Russia) as well as Facebook Pages that produced social-first content (memes, live videos). The attribution of such activity to non-IRA entities that nonetheless share an affiliation with Prigozhin leads to a significant unresolved question of what relationship, if any, exists between the IRA, Wagner, and Prigozhin’s other companies, and to what extent Russia is distributing its active-measures capabilities across a myriad of organizations to hinder detection and attribution.

The activity and strategies varied by country:

• Libya: Russian actors are supporting two potential future presidential candidates: the rebel General Khalifa Haftar and Muammar Gaddafi’s son, Saif al-Islam Gaddafi. The Facebook operation began in December 2018, and the Pages were run by administrators in Egypt. Prior reporting has indicated that the Wagner Group has at least 100 mercenaries fighting with Haftar’s militias.

• Sudan: Facebook activity began in mid-2018, and has persisted since the April coup against Omar al-Bashir, transition to the Transitional Military Council, and transition to the Sovereign Council of Sudan. Content has been slightly supportive of whatever government is in power, and occasionally critical of protesters. Several of the Pages relate to two news websites, khartoumstar.com and sudandaily.org, the latter of which often re-posted Sputnik articles. There were additionally Facebook Pages purporting to be the official Pages of several political parties, along with “news” Pages for the Transitional Military Council and the Sovereign Council of Sudan. The former had the url facebook.com/transitionalmilitarycouncil, and at first glance appeared to be its official Page. Prigozhin-linked companies are known to have mining agreements in Sudan and have trained local military forces.

A Sudan Daily article, reposted from Sputnik, saying that Russian mercenaries in Sudan have no connection to the Russian government. (Link to full image) 

• Central African Republic: A network of Facebook Pages was created to publicize and praise the wide range of activities undertaken by the Russian government in the CAR, from military support to cultural events. These Pages, most of which had administrators in Madagascar, seem to have been intended to appear organic and give CAR audiences the impression of widespread domestic support for the administration of President Touadéra and its Russian partners.

• Madagascar: Russian actors created several Pages in 2018, but only began posting in February 2019, just after the new president was inaugurated. The Pages bolstered the government. One Page was created for a specific parliamentary candidate. 

• Mozambique: The Facebook operation began in September 2019, a few weeks before the country’s presidential and parliamentary elections. The Pages posted content to support the incumbent president, and damage the reputation of the opposition – in at least one instance, with a fake news story. 

A post from Onda da Frelimo (Wave of Frelimo) describing the results of a poll purportedly conducted by the International Anticrisis Center, a Russian organization. The publication of such polls is illegal in Mozambique. Frelimo is the ruling party in Mozambique. (High resolution)

• Democratic Republic of the Congo: Three Facebook Pages, created in 2019 after a contentious election, published content and memes mocking and criticizing key Congolese political figures, including the president. These Pages were not clearly aligned with the Russian government’s public strategy. 

The potential connection between the Libya operation and the Wagner Group is based on the leaked document obtained from the Dossier Center, which we cannot independently verify. We attribute these collective operations to actors tied to Yevgeny Prigozhin. Facebook’s attribution supports our conclusion. This investigation demonstrates a fundamental challenge of attributing information operations: disentangling activity by domestic interested parties, foreign actors working on behalf of domestic parties and foreign actors working in support of their own geopolitical or commercial interests. Our initial analysis of this content suggests a complex mix of motivations and our understanding of the African political disinformation ecosystem continues to evolve. Our full analysis of the materials, including images and figures, is in the linked whitepaper.