BREAKING: coordinated takedown across Facebook, Twitter and Instagram.
-Operation based in Ghana;
-Targeted the African-American community;
-Still in audience-building stage;
-No systematic reference to 2020 election;
-Linked to associates of the Russian IRA troll farm.
-Operation based in Ghana;
-Targeted the African-American community;
-Still in audience-building stage;
-No systematic reference to 2020 election;
-Linked to associates of the Russian IRA troll farm.
Huge kudos to @DarrenLinvill, @plwarre and the team at @CNN for their investigations, including reporting on the ground in Ghana.
H/t @GianlucaMezzo @katie_polglase @clarissaward @TimListerCNN @sebshukla
edition.cnn.com/2020/03/12/wor…
H/t @GianlucaMezzo @katie_polglase @clarissaward @TimListerCNN @sebshukla
edition.cnn.com/2020/03/12/wor…
Per @Facebook, "Although the people behind this activity attempted to conceal their purpose & coordination, our investigation found links to EBLA, an NGO in Ghana, and individuals associated w past activity by the Russian Internet Research Agency (IRA)."
about.fb.com/news/2020/03/r…
about.fb.com/news/2020/03/r…
And here's @TwitterSafety.
Discord, racial tensions, civil rights... Ring any bells fro earlier IRA operations?
Discord, racial tensions, civil rights... Ring any bells fro earlier IRA operations?
But more of the content was positive and affirming than negative. This was an operation trying to build an audience, especially in African-American communities. It was looking for virality through the feelgood factor, not hate.
With the IRA in 2016, the hate came later.
With the IRA in 2016, the hate came later.
The core of this operation was an apparent NGO called EBLA, "Eliminating Barriers to the Liberation of Africa".
CNN reported that the EBLA manager worked under a false name, and his staff had no idea of their actual role.
We call this operation "Double Deceit".
CNN reported that the EBLA manager worked under a false name, and his staff had no idea of their actual role.
We call this operation "Double Deceit".
EBLA said it was a "cyber activism" NGO. Many of its posts did deal with human rights. They were mainly focused on the U.S., "where POC are mostly subjected to all forms of Brutality."
The EBLA website was odd. For one thing, it was mostly in Latin (Lorem ipsum).
For another, it apparently raised four times more than Ghana's annual GDP.
For another, it apparently raised four times more than Ghana's annual GDP.
Around EBLA, Facebook and Twitter exposed a network of over 250 accounts across platforms. They were based in Ghana, pretty overtly (including manager locations), but they timed their posts for the U.S. market.
If you're a fan of @ushadrons, you'll recognise a lot of the content. IRA accounts like "Black Matters" used variants on the same memes in 2016.
Could be no more than parallel evolution, but it's worth a look.
(Old IRA post on the right.)
Could be no more than parallel evolution, but it's worth a look.
(Old IRA post on the right.)
It looks like the Ghanaian operators were working off a common stock of memes, too. Repeatedly, the same images showed up on different assets, sometimes weeks apart.
One of the big things about this takedown: it confirms that Russian influence operations are still targeting American divisions, especially race and police violence.
This operation was still building its audience, but the focus was clear.
This operation was still building its audience, but the focus was clear.
Second thing, which bears repeating: the operation was NOT posting systematically about the 2020 election.
We know the IRA has form in election interference, but at this stage, this operation looked like it was building its audience, including with lots of positive posts.
We know the IRA has form in election interference, but at this stage, this operation looked like it was building its audience, including with lots of positive posts.
How did it go viral? It picked posts that already were, and repeated them. Screenshots of tweets or FB posts, shipped across to Instagram, and vice versa.
In some ways, the operation tried hard to hide. They copied American posts and lifted memes, and even changed their account names when exposure seemed near.
Using real people to do the posting must have seemed like a smart way to get past the detectors, too.
Using real people to do the posting must have seemed like a smart way to get past the detectors, too.
But the thing is, running an operation on the ground leaves a footprint on the ground.
And not telling the staff that they're meant to be covert trolls leaves a pretty significant vulnerability.
And not telling the staff that they're meant to be covert trolls leaves a pretty significant vulnerability.
Interesting to see the difference in impact across platforms. The Facebook assets had about 13,000 followers; Twitter, over 65,000; Instagram, about 235,000.
But this was a cross-platform operation, as so many are these days. Focus on one too much, you might miss the others.
But this was a cross-platform operation, as so many are these days. Focus on one too much, you might miss the others.
And we'll need to keep watching for others. This is at least the sixth IRA takedown we've seen. The more they try to hide, the more they bury their own posts, but they haven't given up.
This was the last effort, in October.
graphika.com/reports/copypa…
This was the last effort, in October.
graphika.com/reports/copypa…
But the thing is, the 2016 IRA got away with crazily obvious things, like registering its accounts to Russian numbers, because nobody was watching.
Now operational researchers are.
Going to be an interesting year.
Now operational researchers are.
Going to be an interesting year.
