The Stanford Internet Observatory has been investigating new facets to the manipulation of the local media environment in Libya: Russian actors who are known to have previously created and sponsored online news media fronts and associated Facebook pages, now appear to be expanding into similar activities in broadcast media. By surreptitiously financing a well-established well-known media brand, these actors are taking a Cold War-era strategy of supporting local media outlets and updating it for the digital age.

Over the past year Russia has become increasingly involved in the conflict in Libya. Some of this involvement is kinetic: Russian mercenary soldiers employed by firms linked to Yevgeny Prigozhin, a Russian businessman with close ties to Vladimir Putin, are fighting alongside Khalifa Haftar’s self-styled Libyan National Army (LNA) forces. Modern Russian weapons have been found on battlefields. Alongside the kinetic, the relationship includes media and information operations support for political candidates, and social media influence operations: Stanford Internet Observatory research previously found that Prigozhin-linked firms had created Facebook Pages bolstering not only Haftar but Saif al-Islam Gaddafi, one of Muammar Gaddafi’s surviving sons. Prigozhin may be trying to bring Gaddafi supporters to Haftar’s camp, or simply playing multiple sides of the local power game by bolstering two likely presidential contenders. While the motivation remains a matter of state strategy, it is clear that Russian actors are exerting influence via traditional as well as social media channels.

This involvement takes the form of both direct involvement in content creation as well as financial support for local creators, which presents a challenge for evaluating authenticity in the Libyan media ecosystem: when does foreign support for local media cross the line into facilitating inauthentic behavior?

In November the Dossier Center, a London-based investigative organization, shared an appendix from an internal Prigozhin-linked group document with the Stanford Internet Observatory team. The leaked document, dated March 20, 2019, describes three media interventions in Libya:

1. entering into a financial arrangement in which a Prigozhin-linked firm would own 50% of the former state-run TV station under Muammar Gaddafi (now supportive of Saif al-Islam Gaddafi); 
2. creating a physical pro-LNA newspaper, Voice of the People 
3. consulting on Alhadath, a Haftar-aligned TV station.

In this post, we discuss the social media and online presence of these television channels and the Voice of the People print newspaper. Key findings include:

• By secretly investing in a long-standing TV channel, Prigozhin is refining his ability to blur the lines of media authenticity. 
• The TV channel (and its related social media entities) have historically been pro-Gaddafi; in the months since investment, they additionally became supportive of Haftar. This backfired, with social media users mocking the obvious shift in tone and calling out what they perceived to be the channel’s foreign backers. 
• A real political party, the Civil Democratic Party, posts PDFs of the Prigozhin-funded newspaper on its Facebook Page, with the party’s logo on the paper’s header. The newspaper is vigorously anti-GNA and pro-Haftar.

Internal document from a Prigozhin-linked group. Source: The Dossier Center.

Aljamahiria TV station and Jana News Agency

The Aljamahiria TV channel was the former Libyan state-run broadcasting organization under Gaddafi. Anti-Gaddafi rebel forces removed it from the air in 2011. It appeared again in 2014, and is now on Nilesat, an Egyptian communications satellite.

The Dossier Center document describes “the company” (the name for the Prigozhin-linked group) providing technical, financial, and advisory support for a TV station, Aljamahiria TV since January 2019. The memo goes on to say that “the channel criticizes the activities of Khalifa Haftar [LNA], Khalid Al-Mishri [head of the Tripoli-based High Council of State] and Western countries” and supports Saif al-Islam Gaddafi, and notes that “50% of the channel (in a joint venture) belongs to the Russian side” (translated).

The memo highlights the transformative effects of the Prigozhin investment, saying that the TV channel used to be:

chaotic, regularly interrupted for 2-3 months. Currently, the channel broadcasts on a regular basis and is popular with supporters of Saif al-Islam Gaddafi. The channel’s monthly audience exceeds 6 million views in the Middle East and North Africa. Moreover, the company’s employees created a unified information service for the Jamahiria TV channel and the Jana news agency. In March 2019, the company’s specialists launched 6 new regular broadcasts and resumed work [...]

The memo then shows before and after images of the studio, illustrating that the Prigozhin investment helped modernize the studio.

Heading reads: "On-air studio: Before and after working with the company"

Aljamahiria and Jana News Agency have an extensive presence on social media platforms, sometimes with substantial followings and frequent posting schedules:

Aljamahiriya TV station and Jana News Agency social media presence.

Content on social media accounts associated with this TV station indicate that it shares Muammar Gaddafi nostalgia content (ie, “Muammar Gaddafi, I wish that you would come back.”) and content supportive of Saif al-Islam Gaddafi. For several months the additional posts on Aljamahiria’s Facebook Page were typically neutral news statements -- noting that there were clashes south of Tripoli, or posts about the weather.

In December 2019, however, the tone changed. Posts began to appear  that were critical of Turkish military support to the UN-recognized Tripoli-based Government of National Accord, and more supportive of the LNA. For example, a post on January 6, 2020 said قوات الشعب المسلح تحرر مدينة سرت (The forces of the armed population free the city of Sirte). The phrase “forces of the armed population” is a phrase originating from the Gaddafi regime to describe the official Libyan armed forces. Here the channel is using the term interchangeably to describe the LNA advancement on Sirte.

Posts on al-Jamahiriya became more anti-GNA over time. The anti-GNA slant measure comes from a dictionary of 37 words and phrases like “liberation” (as in “Haftar will liberate Tripoli”) and “Turkey” (as in “report reveals the number of Syrian mercenaries arriving from Turkey to Libya”) and “Qatar”/”terrorism”/”Muslim Brotherhood” (as in “Doha, funded by `Hamas and the Muslim Brotherhood’ to spread terrorism in Libya”).

Beginning in December 2019, social media users noticed this trend; they called it “حفترة قناة الخضراء” (Hafterization of the Green Channel). On December 19 one Facebook user commented in a group that Aljamahiria had shifted from referring to “Haftar’s militias” to “the Armed Forces,” language that aligns Gaddafi-era terms with Haftar’s LNA. One Page mocked Aljamahiria’s dramatic shift in tone, suggesting satirically that even the word “prayers” needs to be renamed “Haftar’s prayers.” In one comment thread a user said “the channel is now with Haftar,” and another responded saying “no, Haftar is now with the channel.”

Authentic Gadaffi supporters took to Facebook to express their displeasure at how now Hafterized Aljamahiria was misrepresenting them. One commenter even wrote a few poetic verses to describe his anger:

Yes, he really hafterised it
from Ghat to Sebha ..
and He ruined it ..
The green channel, he hafterized it.

Yes, rats hafterize yourselves.
The zero hour always equals zero if it's according to the local time of the Karama leader's watch.

A user posted Aljamahiria content using laughing emojis after noting that Aljamahiria encouraged people to fight with Haftar.

A Facebook user commenting on Aljamahiria’s shift from referencing “Haftar’s militias” to “the Armed Forces.”

Aljamahiria then backed off the pro-LNA language; in one post they called Haftar a war criminal. But social media users noticed this shift in tone as well. In February 2020 a pro-GNA Page posted an Aljamahiria video, saying that the channel was suddenly criticizing Haftar after having encouraging the youth to fight with him. In response to an Aljamahiria video that was critical of Haftar and posted in February 2020, one user wrote: “why did u turn on the army?” (translated). Two users posted 1,500 word tomes theorizing about the shifts in Aljamahiria’s tone, with one directing remarks toward what he perceived to be Aljamahiria’s foreign backers: he accused Jamahiriya of accepting money from foreign countries and said that Jamahiriya had become a channel of “propaganda and distorted ideas.” A Twitter user commented on the new tone shift as well. 

Libya Facts, a pro-Gaddafi Page, defended the Aljamahiria Page, showing screenshots of anti-Haftar posts on Aljamahiria to allay suspicions. Libya Facts also noted that the channel is based out of Egypt and the Egyptian government carefully monitors who receives foreign funding, implying that Aljamahiria could not possibly be tied to any foreign entity. 

Aljamahiria has a professional, polished Instagram account, created in October 2019, which shares original Muammar Gaddafi nostalgia memes and pro-Saif al Islam Gaddafi memes. 

Upper left: A post from facebook.com/libyanfacts.ly attempting to prove the neutrality of Aljamahiria TV. The image caption says “Jamahiriya attacked Haftar.” Upper right: A post on the Aljamahiria Facebook Page. The text says, in part, Muammar Gaddafi, I wish that you would come back. Lower left: An ad run by the Aljamahiria Facebook Page. It reads, “The official account of the Jamahiriya (green) channel.” The channel was called The Green Channel under Muammar Gaddafi. Lower right: A meme bolstering Saif al-Islam Gaddafi on the Aljamahiria Instagram account.

The Jana News Agency, which is explicitly part of the Aljamahiria network (its logo says Aljamahiria News Agency) and is mentioned in the leaked document, has a website, jana-ly.co, that was created in January 2017. Its original Facebook Page had 5 admins in Egypt, 1 admin in the UK, and 3 admins whose location are hidden. This pattern is similar to the administrator ownership pattern of Facebook Pages involved in Libyan influence operations that we identified in previous research, where Pages typically had 5 Egyptian Page admins and 1 other admin in a European country. Interestingly, jana-ly.co has an article from November 2, 2019, reposted from Russian state media outlet Sputnik, about the Prigozhin-linked Facebook takedown of influence operations targeting Libya. It claims that Facebook removed those Pages in anger over the success of the Russia-Africa Sochi summit. In February 2020 its Page came down, and days later it respawned as facebook.com/jana2.ly with 3 admins in Egypt. 

We also found a Facebook Page called الجبهة الشعبية لتحرير ليبيا (Popular Front for the Liberation of Libya) that lists as its “media platforms” facebook.com/aljamahiriytv and facebook.com/janaly.co Like the TV channel and Jana News, the Popular Front for the Liberation of Libya Page has pro-Gaddafi content. It has also run anti-Sarraj and anti-Turkish ads. The Popular Front Page also lists facebook.com/safalbonyan, facebook.com/libya24tv, and facebook.com/libyamandela as additional “media platforms”, which similarly have pro-Gaddafi posts. All of these Pages have a majority of administrators in Egypt.  

Consistent with the trends we observe on these social platforms, New York Time reporting suggests that Haftar is welcoming support from former Gaddafi supporters.

Voice of the People Newspaper

Another entity mentioned in the Dossier Center memo is the Voice of the People newspaper. The memo notes that “since January 2019, the Company’s specialists began publishing the Voice of the People newspaper. The newspaper is distributed in the territory controlled by the LNA. The general content of the newspaper is criticism of the new draft Constitution, the policies of Al-Misri and Sarraj, support for the activities of the LNA and the image of Khalifa Haftar. The circulation of the newspaper is 300,000 copies. At the moment, 2 circulations of the newspaper have been prepared and distributed.”

The creation of a print newspaper is noteworthy. New York Times reporting suggests Russian entities created a newspaper in Madagascar in 2018 as well, saying: “Russians published their own newspaper in the local language and hired students to write fawning articles about the president to help him win another term.”

We found the two issues of the newspaper here and here -- as of February 2020, there don’t appear to be more. The newspaper is vehemently against the new draft constitution, encouraging citizens to vote “no” on it. The Constitutional Drafting Assembly voted to allow military personnel to be eligible for president only if they renounce their military positions two years before elections, a policy that pro-Haftar groups were against given that he would likely run for the position in the future. The latest (fourth) draft of the constitution also says that presidential candidates must relinquish any foreign nationalities at least one year before elections; Haftar has American citizenship. The Civil Democratic Party appears to be close to Haftar, and supports his offensive on Tripoli.  Accounts on Twitter have said that the newspaper is being distributed for free; one posted a photo of it.

Photo of the newspaper, Voice of the People. The Tweet says “Read the Voice of the People newspaper.”

The paper is branded with the logo of the Civil Democratic Party, and issues have been posted as PDFs on the Civil Democratic Party Facebook Page. The Party is made up of former members of Libya’s Transitional Council and former ambassadors. Its Facebook Page was created in September 2017, and has 3 admins in Libya. The CDP appears to have their own video recording capability, occasionally posting videos reminiscent of news broadcasts.

Cover page of the March 2019 issue of the Voice of the People newspaper.

The first issue of the newspaper, published in January 2019, included an article introducing the paper, written by the president of the party. The party leader expressed allegiances toward the LNA. The issue focused on criticizing the constitutional drafting project. Articles implied the new draft constitution was undemocratic and “succumbed to political Islam.” An opinion piece urged citizens to vote against the constitution.

A cartoon in the 2019 issue saying that the constitution project does not meet the demands of the people. The other cartoon criticized the constitution for preventing Haftar from competing in elections.

The first issue of the newspaper told Libyans not to be fooled, and to vote “no” on the draft constitution.

The second issue of the newspaper, published in March 2019, led with an article called “The Hidden Lebanese Government” (translated). The article alleged that the Government of National Accord -- the internationally-recognized Tripoli-based government -- is letting international actors like the UN and Lebanon take over the government. Another article on the cover page noted that the average Libyan is suffering, with queues at banks and corruption. The GNA should be replaced, it claimed, and the state should regain its monopoly on force and bring back the rule of law. A cartoon on the cover page shows the GNA Prime Minister bringing foreign allies a pie of Libya. Each foreign actor vies for a piece of Libya, and the Special Representative for the UN in Libya says there will be enough for everyone.

A cartoon of the UN serving a pie of Libya in the second issue of the Voice of the People newspaper.

Alhadath TV Station

The third aspect of this memo references the LNA-aligned TV channel: “In February 2019, the company’s specialists conducted an external audit of the activities of Alhadath TV channel (LNA channel), on the basis of which they prepared and presented their recommendations for the optimization of broadcasting to the [Haftar] team.” 

The Facebook Page associated with this TV channel has about 875,000 followers. It was created in 2016, and has seven Page administrators in Libya. The Page is generally pro-Haftar and often reposts statements from Haftar’s spokesman, Ahmed al Mismari. There is a Twitter account, @libyaalhadathtv, created in 2015, which has 89,100 followers. The only account that the Twitter account follows is @news9ly, which was created in July 2019 and shared LibyaAlhadathTV content. There is also a YouTube channel, created in 2016, which notes that the station (like Aljamahiria) is on Nilesat. Its associated website is libyaalhadath.net. The current nature of Prigozhin’s involvement in this TV channel is unclear, though we note that Facebook lists the Alhadath Page as a “Related Page” to the new Jana News Agency Page.

Pages discussed in this post, with a vertical line noting the start of January 2019. The internal document suggests some Prigozhin activities in Libya began in January.

Our prior research showed that Russian actors created Facebook Pages supportive of Saif Gaddafi and Haftar. This leaked document suggests that Russian actors are supporting these two figures in Libya’s traditional print and television media space as well. In our earlier research, we found that Russian actors had franchised out management of their Facebook Pages to content creators in Egypt. This made it harder for Libyans to detect the involvement of Russian actors. Similarly, here we see foreign actors inserting themselves into the legitimate Libyan media environment by way of financial support. While Libyans noticed the change in tone on the Pages, attributing that involvement to specific actors is a significant challenge. Going forward, the combination of franchising and virtually-undetectable financial support will make gauging the independence and authenticity of media outlets online and offline even more difficult for disinformation researchers. These tactics will also create difficult decisions for platforms about whether the behavior violates their terms of service. 

Today the Stanford Internet Observatory published a white paper on GRU online influence operations from 2014 to 2019. The authors conducted this research at the request of the United States Senate Select Committee on Intelligence (SSCI) and began with a data set consisting of social media posts provided to the Committee by Facebook.  Facebook attributed the Pages and posts in this data set to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (Главное управление Генерального штаба Вооружённых сил Российской Федерации), known as the GU, or by its prior acronym GRU. It removed the content in or before 2018. The data provided by Facebook to SSCI consisted of 28 folders, each corresponding to at least one unique Facebook Page. These Pages were in turn tied to discrete GRU-attributed operations. Some of these Pages and operations were significant; others were so minor they scarcely had any data associated with them at all.

While some content related to these operations has been unearthed by investigative journalists, a substantial amount has not been seen by the public in the context of GRU attribution. The SIO white paper is intended to provide an overview of the GRU tactics used in these operations and to offer key takeaways about the distinct operational clusters observed in the data. Although the initial leads were provided by the Facebook data set, many of these Pages have ties to material that remains accessible on the broader internet, and we have attempted to aggregate and archive that broader expanse of data for public viewing and in service to further academic research.

Several key takeaways appear in the analysis:

• Traditional narrative laundering operations updated for the internet age. Narrative laundering – the technique of moving a certain narrative from its state-run origins to the wider media ecosystem through the use of aligned publications, “useful idiots,” and, perhaps, witting participants – is an "active-measures" tactic with a long history. In this white paper we show how narrative laundering has been updated for the social-media era. The GRU created think tanks and media outlets to serve as initial content drops, and fabricated personas — fake online identities — to serve as authors. A network of accounts additionally served as distributors, posting the content to platforms such as Twitter and Reddit. In this way, GRU-created content could make its way from a GRU media property to an ideologically aligned real independent media website to Facebook to Reddit — a process designed to reduce skepticism in the original unknown blog.

Image

The website for NBene Group, a GRU-attributed think tank. In one striking example of how this content can spread, an NBene Group piece about the annexation of Crimea was cited in an American military law journal article. 

• The emergence of a two-pronged approach: narrative and memetic propaganda by different entities belonging to a single state actor. The GRU aimed to achieve influence by feeding its narratives into the wider mass-media ecosystem with the help of think tanks, affiliated websites, and fake personas. This strategy is distinct from that of the Internet Research Agency, which invested primarily in a social-first memetic (i.e., meme-based) approach  to achieve influence, including ad purchases, direct engagement with users on social media, and content crafted specifically with virality in mind. Although the GRU conducted operations on Facebook, it either did not view maximizing social audience engagement as a priority or did not have the wherewithal to do so. To the contrary, it appears to have designed its operation to achieve influence in other ways. 

• A deeper understanding of hack-and-leak operations. GRU hack-and-leak operations are well known. This tactic — which has been described in detail in the Mueller Report — had a particularly remarkable impact on the 2016 U.S. Election, but the GRU conducted other hack-and-leak operations between 2014 and 2019 as well. One of the salient characteristics of this tactic is the need for a second party (such as Wikileaks, for example) to spread the results of a hack-and-leak operation, since it is not effective to leak hacked documents without having an audience. In this white paper we analyze the GRU’s methods for disseminating the results of its hack-and-leak operations. While its attempts to do so through its own social media accounts were generally ineffective, it did have success in generating media attention (including on RT), which led in turn to wider coverage of the results of these operations. Fancy Bear’s own Facebook posts about its hack-and-leak attack on the World Anti-Doping Agency (WADA), for example, received relatively little engagement, but write-ups in Wired and The Guardian ensured that its operations got wider attention. 

Some of the most noteworthy operations we analyze in this white paper include:

• Inside Syria Media Center (ISMC), a media entity that was created as part of the Russian government’s multifarious influence operation in support of Syrian President Bashar al-Assad. Although ISMC claimed to be “[c]ollecting information about the Syrian conflict from ground-level sources,” its actual function was to boost Assad and discredit Western forces and allies, including the White Helmets. Our analysis of the ISMC Facebook Page shows exceptionally low engagement — across 5,367 posts the average engagement was 0.1 Likes per post — but ISMC articles achieved wider attention when its numerous author personas (there were six) reposted them on other sites. We counted 142 unique domains that reposted ISMC articles. This process happened quickly; a single article could be reposted on many alternative media sites within days of initial publication on the ISMC website. We observe that, while both Internet Research Agency (IRA) and GRU operations covered Syria, the IRA only rarely linked to the ISMC website.

Image

The Quora profile for Sophie Mangal, one of the personas that authored and distributed ISMC content.

• APT-28, also known as Fancy Bear, is a cyber-espionage group identified by the Special Counsel Investigation as GRU Units 26165 and 74455. This entity has conducted cyber attacks in connection with a number of Russian strategic objectives, including, most famously, the DNC hack of 2016. The Facebook data set provided to SSCI included multiple Pages related to hacking operations, including DCLeaks and Fancy Bears Hack Team, a sports-related Page.  This activity included a hack-and-leak attack on WADA, almost certainly in retaliation for WADA’s recommendation that the International Olympic Committee ban the Russian team from the 2016 Olympics in Rio de Janeiro. The documents leaked (and, according to WADA, altered) by Fancy Bears purported to show that athletes from EU countries and the US were cheating by receiving spurious therapeutic use exemptions. Our analysis of these Pages looks at their sparse engagement on social platforms and the stark contrast to the substantial coverage in mainstream press. It also notes the boosting of such operations by Russian state-linked Twitter accounts, RT, and Sputnik. 

• CyberBerkut, Committee of Soldiers’ Mothers of Ukraine, and “For an Exit from Ukraine,” a network of Pages targeting Ukraine, which has been subject to an aggressive disinformation campaign by the Russian government since the Euromaidan revolution in 2014. Our investigation of these Pages highlights the degree to which apparently conflicting messages can be harnessed together in support of a single overarching objective. (This also suggests a parallel with the tactics of the IRA, which frequently boosted groups on opposite sides of contentious issues.) Among the multiple, diverging operational vectors we analyzed were attempts to sow disinformation intended to delegitimize the government in Kyiv; to leverage a Ukrainian civil-society group to undermine public confidence in the army; and to convince Ukrainians that their  country was “without a future” and that they were better off emigrating to Poland. While the Pages we analyzed worked with disparate themes, their content was consistently aimed at undermining the government in Kyiv and aggravating tensions between Eastern and Western Ukraine. 

Considered as a whole, the data provided by Facebook — along with the larger online network of websites and accounts that these Pages are connected to — reveal a large, multifaceted operation set up with the aim of artificially boosting narratives favorable to the Russian state and disparaging Russia’s rivals. Over a period when Russia was engaged in a wide range of geopolitical and cultural conflicts, including Ukraine, MH17, Syria, the Skripal Affair, the Olympics ban, and NATO expansion, the GRU turned to active measures to try to make the narrative playing field more favorable. These active measures included social-media tactics that were repetitively deployed but seldom successful when executed by the GRU. When the tactics were successful, it was typically because they exploited mainstream media outlets; leveraged purportedly independent alternative media that acts, at best, as an uncritical recipient of contributed pieces; and used fake authors and fake grassroots amplifiers to articulate and distribute the state’s point of view. Given that many of these tactics are analogs of those used in Cold-War influence operations, it seems certain that they will continue to be refined and updated for the internet era, and are likely to be used to greater effect. 

Image

The linked white paper and its conclusions are in part based on the analysis of social-media content that was provided to the authors by the Senate Select Committee on Intelligence under the auspices of the Committee’s Technical Advisory Group, whose Members serve to provide substantive technical and expert advice on topics of importance to ongoing Committee activity and oversight. The findings, interpretations, and conclusions presented herein are those of the authors, and do not necessarily represent the views of the Senate Select Committee on Intelligence or its Membership.

Russia’s global strategy for reasserting itself as a geopolitical superpower has led to an increased presence in Africa, where it has broadened efforts to shape the continent’s politics and pursue new economic opportunities to allay the effects of sanctions. While the presence of Russian military instructors and paramilitary groups in Libya and the Central African Republic is well documented, there is emerging evidence that Russian-linked companies are now active in the information space as well. Yevgeny Prigozhin, the oligarch perhaps best known for running the Internet Research Agency, is central to this expansion.

In this post we identify a Facebook operation attributed to entities tied to Prigozhin — including, it appears, the Wagner Group (Частная военная компания Вагнера), a Russian organization that has served as a private military contractor in several African countries. The first allusion to a social media influence operation tied to Prigozhin stemmed from Daily Beast reporting and a document shared with us by the Dossier Center that suggested the existence of a cluster of Facebook Pages tied to the Wagner Group. We identified an initial cluster of Pages which targeted Libya, and shared the find with the Facebook Threat Intel team. Facebook subsequently provided us with data on two related networks that they had been investigating previously. These networks have been targeting the Central African Republic, the Democratic Republic of the Congo, Madagascar, Mozambique, and Sudan, and included “news” Pages and websites, and Pages purporting to belong to political parties as well as individual politicians. The part of the operation we analyzed included seven Instagram accounts and 73 Facebook Pages. In total 1.72 million accounts liked the Facebook Pages, though we note that some of these likes are possibly from the same account across multiple Pages. The Page managers were quite active; in October 2019 alone there were 8,900 posts. 

Wagner Group document shared by the Dossier Center. The document included an example post from a Page called ليبيا القذافي (Libya Gaddafi). The post was a photo of former president Muammar Gaddafi, overlaid on an outline of Libya. The document described the post as a “Patriotic post about the best time for the Motherland.” (High Resolution)

From our analysis of the social media activity, there are several key takeaways:

• The operation, conducted by Russia-linked organizations likely operating at least in part at the behest of a state actor, appears to have further relied on subcontractors who are native speakers and/or local to the region. This variety of nested obfuscation increases hurdles to attribution of disinformation campaigns. 

• In addition to well-known social media platforms such as Twitter and Facebook, the actors leveraged public WhatsApp and Telegram groups. Whether more private chat channels were also used is an area for further research. 

• The operation used social media engagement tactics designed to develop a close relationship with the audience, including Facebook Live videos, Google Forms for feedback, and a contest.

• The operation shared tactical similarities to Internet Research Agency activities; the operatives created several associated news sites (in one case staffed by reporters who appear to have spent time in Russia) as well as Facebook Pages that produced social-first content (memes, live videos). The attribution of such activity to non-IRA entities that nonetheless share an affiliation with Prigozhin leads to a significant unresolved question of what relationship, if any, exists between the IRA, Wagner, and Prigozhin’s other companies, and to what extent Russia is distributing its active-measures capabilities across a myriad of organizations to hinder detection and attribution.

The activity and strategies varied by country:

• Libya: Russian actors are supporting two potential future presidential candidates: the rebel General Khalifa Haftar and Muammar Gaddafi’s son, Saif al-Islam Gaddafi. The Facebook operation began in December 2018, and the Pages were run by administrators in Egypt. Prior reporting has indicated that the Wagner Group has at least 100 mercenaries fighting with Haftar’s militias.

• Sudan: Facebook activity began in mid-2018, and has persisted since the April coup against Omar al-Bashir, transition to the Transitional Military Council, and transition to the Sovereign Council of Sudan. Content has been slightly supportive of whatever government is in power, and occasionally critical of protesters. Several of the Pages relate to two news websites, khartoumstar.com and sudandaily.org, the latter of which often re-posted Sputnik articles. There were additionally Facebook Pages purporting to be the official Pages of several political parties, along with “news” Pages for the Transitional Military Council and the Sovereign Council of Sudan. The former had the url facebook.com/transitionalmilitarycouncil, and at first glance appeared to be its official Page. Prigozhin-linked companies are known to have mining agreements in Sudan and have trained local military forces.

A Sudan Daily article, reposted from Sputnik, saying that Russian mercenaries in Sudan have no connection to the Russian government. (Link to full image) 

• Central African Republic: A network of Facebook Pages was created to publicize and praise the wide range of activities undertaken by the Russian government in the CAR, from military support to cultural events. These Pages, most of which had administrators in Madagascar, seem to have been intended to appear organic and give CAR audiences the impression of widespread domestic support for the administration of President Touadéra and its Russian partners.

• Madagascar: Russian actors created several Pages in 2018, but only began posting in February 2019, just after the new president was inaugurated. The Pages bolstered the government. One Page was created for a specific parliamentary candidate. 

• Mozambique: The Facebook operation began in September 2019, a few weeks before the country’s presidential and parliamentary elections. The Pages posted content to support the incumbent president, and damage the reputation of the opposition – in at least one instance, with a fake news story. 

A post from Onda da Frelimo (Wave of Frelimo) describing the results of a poll purportedly conducted by the International Anticrisis Center, a Russian organization. The publication of such polls is illegal in Mozambique. Frelimo is the ruling party in Mozambique. (High resolution)

• Democratic Republic of the Congo: Three Facebook Pages, created in 2019 after a contentious election, published content and memes mocking and criticizing key Congolese political figures, including the president. These Pages were not clearly aligned with the Russian government’s public strategy. 

The potential connection between the Libya operation and the Wagner Group is based on the leaked document obtained from the Dossier Center, which we cannot independently verify. We attribute these collective operations to actors tied to Yevgeny Prigozhin. Facebook’s attribution supports our conclusion. This investigation demonstrates a fundamental challenge of attributing information operations: disentangling activity by domestic interested parties, foreign actors working on behalf of domestic parties and foreign actors working in support of their own geopolitical or commercial interests. Our initial analysis of this content suggests a complex mix of motivations and our understanding of the African political disinformation ecosystem continues to evolve. Our full analysis of the materials, including images and figures, is in the linked whitepaper.

The House Permanent Select Committee on Intelligence held a public hearing on Thursday, March 28, 2019, as part of its investigation into Russian influence during and after the 2016 election campaign.

The hearing, "Putin’s Playbook: The Kremlin’s Use of Oligarchs, Money and Intelligence in 2016 and Beyond” included testimony by Michael McFaul, former U.S. Ambassador to Russia and Director of the Freeman Spogli Institute at Stanford University.

Download Complete Testimony (PDF 263 KB)

EXCERPT

To contain and thwart the malicious effects of “Putinism,” the United States government and the American people must first understand the nature of the threat. This testimony focuses onthe nexus of political and economic power within Russia under Putin’s leadership, and how these domestic practices can be used abroad to advance Putin’s foreign policy agenda. Moreover, it is important to underscore that crony capitalism, property rights provided by the state, bribery, and corruption constitute only a few of many different mechanisms used by Putin in his domestic authority and foreign policy abroad.

This testimony proceeds in three parts. Section I describes the evolution of Putin’s system of government at home, focusing in particular on the relationship between the state and big business. Section II illustrates how Putin seeks to export his ideas and practices abroad. Section III focuses on Putin’s specific foreign policy objective of lifting sanctions on Russian individuals and companies.

Watch the C-SPAN recording of the testimony. 

Media Contact: Ari Chasnoff, Assistant Director for Communications, 650-725-2371, chasnoff@stanford.edu