Thread by @benimmo

BREAKING: UK gov't "almost certain that Russian actors sought to interfere in the 2019 General Election through the online amplification of illicitly acquired and leaked Government documents."

These were the trade leaks from op Secondary Infektion.
graphika.com/reports/UK-tra…

"Sensitive Government documents relating to the UK-US Free Trade Agreement were illicitly acquired before the 2019 General Election and disseminated online via the social media platform Reddit."

UK statement here.

parliament.uk/business/publi…

For those coming to this from a standing start, this story broke when UK-US trade documents leaked a couple of weeks before the general election.

theguardian.com/society/2019/n…

A number of investigative journalists, notably @Direthoughts, found that the documents had been posted on Reddit and some fringe German-language forums a month before.

scramnews.com/austrian-news-…

The @Graphika_NYC team realised that the online dissemination was a match with Russian operation Secondary Infektion: same sites, same use of burner accounts, same sorts of language error.

H/t @jc_stubbs for all his work on this.

reuters.com/article/us-bri…

Reddit dug into the activity on their platform, and they concluded the accounts that did the leaking were "indeed tied" to Secondary Infektion.

reddit.com/r/redditsecuri…

Now we have the UK government "almost certain" of the attribution to "Russian actors".

Criminal investigation ongoing, and gov't "reserves the right to respond with appropriate measures".

Still open questions: which Russian actors, and how were the docs obtained?

Secondary Infektion itself was a long-running and well-resourced influence operation that almost invariably used forgeries: the trade leaks were an exception.

It was also the most cross-platform op I know. Over 300 platforms.

Deep dive here.

secondaryinfektion.org

Some of the forged claims were outlandish (and clumsy). Here's an SI letter claiming that the US government was tapping the phones of the UK Royal Family.

"I have an honor to inform you..."

Interesting side note on the trade leaks: when the story broke in the UK, the focus was on the NHS, but the original online posts didn't mention that. They focused on portraying the US as bullying the UK.

Oh, and chlorinated chicken.

beforeitsnews.com/eu/2019/10/off…

Important point: detection and attribution are team sports. @Facebook found the initial traces of Secondary Infektion. @Graphika_NYC, @DFRLab, @Reddit, @Twitter, @Quora, @Medium, @Google all built out the picture.

Now the UK government adds a layer.

Each piece counts.