Hacking. Disinformation. Surveillance. CYBER is Motherboard's podcast and reporting on the dark underbelly of the internet.
Twitter,
Facebook, and Instagram have taken down a series of accounts that
appeared to be running a Russian-language, pro-U.S. influence operation,
according to researchers
from the Stanford Internet Observatory (SIO) and Graphika, a private
research company. The campaign lasted for almost five years, according
to the researchers.
The tactics used closely mirror
those that the Russian government deployed in the United States during
the 2016 election; this time, however, the memes, petitions, fake news,
AI-altered profile photos, propaganda, and hashtags deployed were
pro-U.S., anti-Russia, and seemingly designed to undermine Russia,
China, Iran, and other authoritarian countries, according to the study.
The
news highlights an obvious fact but one that rarely receives
substantial analysis: that U.S. leaning social media influence campaigns
are, ultimately, very similar to those run by adversarial countries.
“These
findings unveil what we believe are the first major covert pro-America
and Western operations identified and suspended by Twitter and Meta,”
Renée DiResta, research manager at the Stanford Internet Observatory
told Motherboard in an email. The report also shows that U.S.-based tech
giants are willing to take action on propaganda even when it seems to
align with the broader interests of the U.S. government.
According
to the researchers, the “joint investigation found an interconnected
web of accounts on Twitter, Facebook, Instagram, and five other social
media platforms that used deceptive tactics to promote pro-Western
narratives in the Middle East and Central Asia.”
A screenshot from the report. Image: Stanford Internet Observatory and Graphika.
The
accounts seemed to promote the views, values, and goals of the United
States while attacking the interests of Russia, China, Iran, and other
countries. “The content included messages that criticized the Russian
government for the death of civilians and its ‘imperial ambitions’ after
its invasion of Ukraine,” the report said.
Some
of the accounts linked to the influence campaigns were posting as early
as 2012, but the bulk of the influence campaigns seem to have run from
the summer of 2019 until 2022. The Twitter dataset covered 299,566
tweets by 146 accounts and the Meta dataset included 39 Facebook
profiles, 16 pages, two groups, and 26 Instagram accounts. After taking
down the relevant accounts, Meta and Twitter provided a set of the
activity to both sets of researchers, according to the report.
In
the campaign focused on influencing Russia and other countries in
Central-Asia, the operators posed as fake media personalities linked to
fake news accounts. The accounts would copy and paste the same news
stories and posts across several accounts and ask users for engagement
by asking them to comment on what they’d just read. In some cases, the
articles and information posted wasn't "fake news," per se, but,
according to the researchers, it was often posted in a coordinated way
that is banned by the social media platforms.
A screenshot from the report. Image: Stanford Internet Observatory and Graphika.
According
to the researchers, the fake news stories were often copy and pasted
from legitimate outlets like Meduza.io and the BBC Russia Service. The
posters would make minor changes to the stories in an attempt to pass
them off as original, but the translations were often poor. “In one
case, the outlet posted a Russian-language article about Russian
disinformation in China that was almost certainly translated from the
English-language version of a Ukrainian article published nine days
earlier,” the report said.
Fake
journalists and fake influencers required pictures. According to the
research, the influence campaign cast a wide net and pulled pictures
from dating sites. Sometimes these pictures were altered to tweak the
appearance of the user. The most striking example is a photo of Puerto
Rican actor Valeria Menendez whose altered face was used in the Central
Asian campaign.
Some of the memes
attempted to appeal to Central Asian migrants in Russia. “Several
posts covered the pressured, sometimes forced enrollment of Central
Asian migrants into the Russian army in exchange for promises of Russian
citizenship,” the report said. “This narrative overlapped with posts
about the high casualty rate for ethnic minorities fighting for Russia
in Ukraine.
The influence
campaigns focused largely on Russia, including posts that criticized
Russia’s use of propaganda to spread anti-Western sentiment. The posts
often “depicted Russia as a nefarious actor working to undermine
independent democracies,” the report said. “In January 2022, for
example, the accounts covered mass protests that followed a sudden
increase in fuel prices in Kazakhstan, but mainly through the lens of
debunking Russian allegations of ‘foreign interference.’”
A screenshot from the report. Image: Stanford Internet Observatory and Graphika.
The
accounts were mostly focused on Russia, but did attempt to spread
influence in China, Iran, and Afghanistan as well. A few accounts used a
similar mix of fake news, copy pasted posts, bad memes, and AI
generated faces to needle China about the Uyghur genocide. Posts
targeting Iran often focused on Hezbollah and humanitarian issues like
women’s rights. “One Instagram post said that by supporting Hamas and
Hezbollah, the late Qasem Soleimani had brought poverty and misery to
Iran,” the report said.
Multiple
Facebook and Instagram posts compared the opportunities available to
Iranian women with those in the west. “Posts also noted that little has
changed for women in Iran over time. Many posts highlighted domestic
protests against hijab dress requirements,” the report said.
None
of these campaigns fared well. The researchers found that the
inauthentic accounts did not garner all that much engagement. Most of
the posts and tweets the researchers reviewed received a “handful” of
likes or retweets, and only 19 percent of the covert accounts identified
had over 1,000 followers, the report said.
A screenshot from the report. Image: Stanford Internet Observatory and Graphika.
“In
this specific case, what’s most striking is the low quality of posts
and engagement. We found many copy-paste and spam-like posts that got
little or no traction. This demonstrates the limitations of inauthentic
posts and engagement on social media for building influence,” DiResta
added.
“More broadly, state influence activities stem from strategic objectives. Many scholars have contributed research documenting the vast breadth of state-linked operations run directly by
government entities, as well as by mercenaries and contractors
worldwide. Governments appear to believe that they serve a purpose;
while this manifestation of influence operation activity is a modern
update for the social media age, front media and personas have a long
and storied history,” she added.
Meta
and Twitter have not published their own detailed findings on the
operation. In its report, the Stanford Internet Observatory said that
Meta said the “country of origin” was the U.S., while Twitter said the
activity’s “presumptive countries of origin” were the U.S. and Great
Britain.
A Twitter spokesperson
told Motherboard that “presumptive country of origin is determined
through an analysis of the most frequently seen technical indicators of
geolocation.”
Facebook
reiterated to Motherboard its stance that this campaign originated in
the U.S. The company added this is the first foreign-focused, pro-U.S.
network it has taken action on. Facebook has taken down other U.S-based
networks, such as one the company linked to Rally Forge, a U.S. marketing firm that was working with Turning Point USA and Inclusive Conservation Group.
Facebook
said it provided data on the campaign to researchers so they can also
study its activity across YouTube. YouTube did not immediately respond
to a request for comment.
Update: This piece has been updated to include a response from Twitter.
Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
79
