Securing Democracy Dispatch

News and Commentary

Russia casts a shadow over elections in Italy and Mexico: Anti-establishment and far-right parties, which were the big winners in Italy’s election yesterday, could throw “the eurozone’s third-largest economy into political gridlock.” The outcome is sure to make Moscow happy, regardless of any role it had in securing it — a question that analysts examined in the run-up to the election. According to DFR Lab, Russia does not have to try too hard to gain influence in Italy given “the nature of Russian influence in this case is very different due to strong — and mutual — economic and political relations between the countries.” However, analysis by Alto Data Analytics finds that “Russia’s state-controlled news agency Sputnik Italia was the most influential foreign media organization attacking immigration in Italy and among the top 2 percent of all news sources cited in the online debate,” implicating Russia in stirring the anti-immigrant debate ahead of the vote. According to the study, the “anti-immigrant camp posted 22 times on average during the period, while those in favor made fewer than six comments,” suggesting automated bots exaggerated support for the anti-immigrant movement. And The New York Times reports that Russia has been “building relationships with politicians, economic ties, especially for oil and gas, and cultural affinity through Russian associations.” Turning south, Andrew Weiss in The Atlantic writes that the “warning signs are everywhere” that Mexico may be Russia’s next target, but Mexican officials “have repeatedly denied that they see any signs of Russian interference.” According to Weiss, “unless countries like Mexico confront election-related vulnerabilities and the manipulation of voters through fake news and propaganda, the democratic process will be at risk.” (DFR Lab, Bloomberg, The New York Times, The Atlantic)

Russian information operations targeted the U.S. energy industry: According to a report  by the U.S. House Science, Space and Technology Committee, “A Russian-backed propaganda group used social media in an attempt to disrupt the U.S. energy industry and influence energy policy.” This activity by the Internet Research Agency (IRA) seemed designed to benefit Russia, the world’s largest oil producer, and use a hot political issue to inflame tensions in the United States. It is also an example of how Russian information operations target both the left and the right in their efforts to exploit divisions in the United States. Drawn from documents released last fall by Twitter and Facebook, the report shows how “starting in 2015, workers at the IRA posted photos and messages on Facebook, Instagram, and Twitter encouraging protests against pipeline construction in the U.S.,” with more than 9,000 posts and tweets from 4,334 Facebook, Twitter, and Instagram accounts tied to the IRA. According to Twitter, “more than 4 percent of tweets produced by the Russians dealt with energy and climate issues.” The social media posts sought to inflame debate around the “Dakota Access pipeline, government efforts to curb global warming and hydraulic fracturing.” One post by an IRA-created group called Native Americans United “shows what appears to be a young girl in a braid peering out over an unspoiled prairie,” with the taglines “No Pipelines. No Fracking. No Tar Sands.” These findings support BuzzFeed’s reporting from last fall, which revealed that “An Instagram account called @Native_Americans_United_ shared images related to Native American social and political issues — including the construction of the Dakota Access Pipeline, the flashpoint for activists from all over the country, but especially Native Americans.” (House Committee on Science, Space, and Technology, The Wall Street Journal, The Washington Post, BuzzFeed)

Leaked IRA documents provide further details of efforts to target the United States.: A leaked cache of IRA documents uncovered by the Daily Beast include the “names of Americans, activists in particular, whom the organization specifically targeted; American-based proxies used to access Reddit and the viral meme site 9Gag; and login information for troll farm accounts,” providing additional details about the breadth of the operation in the United States across the political spectrum. “The leaks show that IRA imposter accounts targeted activists for specific causes the Russians wanted promoted. On the target list: the daughter of one of Martin Luther King’s lieutenants,” as well as members of the Blacktivist cause. The documents show that while the IRA knew how to leverage social media, notes of interactions with actual Americans show they were much less adept at knowing “how users authentically interact with each other on it,” leading to suspicions among their targets. Peter Pomerantsev, writing in The American Interest, highlights how “in the Cold War, Soviet disinformation campaigns needed to cleverly, patiently infiltrate Western media with their agents, in order to craftily spread elaborate hoaxes. Now they just use Facebook,” which means that “we have to start thinking holistically about a media system which actively engenders disinformation, and where all campaigns smooth the pathways for each other. Disinformation won’t be curbed until the very model which produces it is altered.” (Daily Beast, The American Interest)

Russia hacked the German foreign and defense ministries amid new reports on targeting of U.S. state election systems in 2016: “Russian cyber espionage group ‘Snake’ … smuggled in malware and then searched the federal government’s extensive server network for a way into the German foreign ministry” as well as the defense ministry, with reports finding they had been active since 2016. Originally thought to be the Russian hacking group Apt28, “attacks by Snake tend to be more sophisticated than those of APT28. They target usable information, unlike APT28, which tends to siphon off all available internal data.” Several German MPs have called the attack a “form of warfare.” However, according to a German official, “no significant data was transmitted.” And additional details emerged this week about Russian hackers’ efforts to penetrate U.S. election systems in 2016, with Newsweek reporting that “Russia managed to penetrate seven states by hacking voting websites, registration systems and databases during the 2016 presidential election cycle,” including in Alaska, Arizona, California, Florida, Illinois, Texas, and Wisconsin, although there is no indication that votes were affected. And a new Axios poll finds that “a majority of Americans have little to no faith that the Trump administration will stop foreign governments from interfering in the 2018 midterm elections,” which could be “a recipe for more than the usual distrust and fighting over the closest races.” (Financial Times, Deutsche Welle, Telegraph, The Washington Post, Newsweek, Axios)

Questions about Russian activity on Instagram as Facebook ends the Explore Feed: Jonathan Albright, researcher at Columbia University's Tow Center for Digital Journalism, finds that Facebook has not divulged how many Instagram users interacted with Russian accounts, which Albright estimates could be several million. When asked why it has not provided this information, a Facebook spokesperson said, “We have not been asked to provide that information.” And Facebook  has ended the trial that it launched last year in six countries, which “moved nearly all non-promoted posts from pages and publishers out of the main News Feed into a secondary feed, called the Explore Feed.” The change is in response to user comments and the fact that “some users and publishers found that the Explore Feed test ended up ‘amplifying the impact of fabricated and sensational stories,’” given that “official accounts and nongovernmental media sites were downgraded to the secondary feed unless they paid to promote their content in the main feed.” While “Facebook is reverting back to a singular feed, the company is still doubling down on its effort to prioritize ‘meaningful’ interactions over other types of posts.” An article in The Wall Street Journal accused Facebook of being “tone deaf” in its response to Russia’s use of its platform, noting “that the social media giant’s months-long obliviousness to deepening public concern about its social impact has worsened a backlash against it and other Silicon Valley giants,” while Clint Watts, senior fellow at GMF, states “they were in denial about the size of the problem and in denial about the effect it was having.” Meanwhile, the EU has introduced new regulations for Facebook, Google, and Twitter regarding removing terrorist and other illegal content from their websites within one hour of being flagged. “Internet activists expressed concern the voluntary measures announced Thursday pose a risk to free expression as firms — despite their protection from liability — would end up removing legal content in trying to comply with the guidelines.” (Wired, Gizmodo, The Wall Street Journal)

Current and former officials discuss Russian interference: Lt. Gen. Paul Nakasone, nominated to lead both NSA and U.S. Cyber Command, said Thursday that the “United States’ response to Russian election interference has not been sufficient enough to change Moscow’s behavior,” during his confirmation hearing before the Senate Armed Services Committee. Nakasone’s comments follow those by outgoing NSA head Adm. Michael S. Rogers, in which he stated that “they haven’t paid a price, at least, that has significantly changed their behavior,” and that “President Trump has given him no new authorities or capabilities to strike at Russian cyber-operations ahead of the midterms. Former CIA chief Michael Hayden spoke about the “’convergence’ of interests between Trump and Russia,” stating that “there is an eerie and uncomfortable echo between some of the things the president tweets, the different points of emphasis on Fox News, the thematic stories in the alt-right media, and Russian bots.” And Thomas Melia writes in The Atlantic cautions against performing moral equivalency tests between the U.S. and Russia, stating the need to differentiate between “programs to strengthen democratic processes in another country (without regard to specific electoral outcomes), versus efforts to manipulate another country’s election in order to sow chaos, undermine public confidence in the political system, and diminish a country’s social stability.” (The Hill, The Washington Post, Politico, The Atlantic)

Conditions enabling foreign interference: DFR Lab underscores the multidimensional aspect of influence operations as it analyzes Russia’s activities during the 2016 election, finding that “an operation which consistently makes one side look bad or unpopular, and makes the other side look good or popular, over a long period, is almost certain to have some impact on the vote tally. That impact may be marginal; but even a marginal change can, in a tight race, make a difference.” Russia’s hacking of the DNC and leaks of Podesta’s emails put the Clinton campaign at a “competitive disadvantage,” as the mainstream media reported on the leaks throughout the “critical final month.” DFR Lab finds that without the leaks “the DNC and the Clinton campaign would have been able to behave differently in the build-up to the election. That was not a decisive impact, but it was an impact in close election nonetheless.” According to Anne Applebaum, “The elimination of Russian influence from U.S. cyberspace would not prevent another Pizzagate” because “social media makes disinformation campaigns possible on a larger scale than ever before: Its algorithms encourage deep polarization, and its promise of anonymity opens the door to fraud.” (DFR Lab, The Washington Post)

Twitter calls for proposals to look at the “health” of the platform: In a statement, Twitter  says it is “committing to helping increase the collective health, openness, and civility of public conversation around the world, and to hold ourselves publicly accountable toward progress,” and has called on stakeholders to help the platform assess “the concept of measuring conversational health” and has outlined four indicators “shared attention, shared reality, variety of opinion, and receptivity.” In a statement, company CEO Jack Dorsey said “We aren’t proud of how people have taken advantage of our service, or our inability to address it fast enough … We’ve focused most of our efforts on removing content against our terms, instead of building a systemic framework to help encourage more healthy debate, conversations, and critical thinking. This is the approach we need now.” (Twitter, The Guardian)

Assessing U.S. efforts to combat state-sponsored disinformation abroad: The New York Times reported that “the State Department has yet to spend any of the $120 million it has been allocated since late 2016 to counter foreign efforts to meddle in elections or sow distrust in democracy.” According to The New York Times, “not one of the 23 analysts working in the department’s Global Engagement Center — which has been tasked with countering Moscow’s disinformation campaign — speaks Russian, and a department hiring freeze has hindered efforts to recruit the computer experts needed to track the Russian efforts.” After The New York Times, following a report on the issue by Politico in August, began asking about the delayed money, the State Department announced on Monday that the Pentagon had agreed to transfer $40 million for the effort, just a third of what was originally intended to help counter state-sponsored disinformation, which Steve Goldstein, the undersecretary of state for public diplomacy, said “is critical to ensuring that we continue an aggressive response to malign influence and disinformation and that we can leverage deeper partnerships with our allies, Silicon Valley, and other partners in this fight … It is not merely a defensive posture that we should take, we also need to be on the offensive.” The GEC’s “domestic mandate is limited,” however, so these efforts will not address Russian disinformation targeting the United States.  

The move comes as Josh Rogin writes in The Washington Post, "at this increasingly fraught moment for freedom around the world, the Trump administration wants to dismantle that infrastructure," including by slashing "the budget of the National Endowment for Democracy but also to disassemble its relationships with its core institutes." (The New York Times, Politico, Washington Examiner, Weekly Standard, The Washington Post)

Iran targets the BBC with disinformation: An Israeli cybersecurity company ClearSky published a report detailing a long running effort by Iran to impersonate and discredit BBC Persian going back to 2011. The report finds a handful of websites, including bbcpersian.net, which “is very close to that of the BCC, and some stories could, on the face of it, pass as real.” However, most stories are “anti-BBC articles or posts from other outlets that the BBC is accused of ignoring.” According to Forbes, Facebook and Telegram pages were set up to “spread” the disinformation, and the site frequently appears in Google and Yahoo searches. (Forbes)

Russian influence in the Baltics and Eastern Europe: Estonian regulators are investigating Danske Bank for money laundering going back to 2013. According to a whistleblower, “the anti-money laundering procedures at its Estonia branch had completely failed and that the bank may ‘have committed a criminal offense’ by aiding a company that had made several suspicious transactions and whose actual owners “included the Putin family and the FSB.” And a new study by Latvia’s Center for East European Policy Studies and CEPA assess the resilience of Latvia’s media spaces to Russian propaganda, finding that “events directly related to Russia are more noticeable in Russian-language portals,” and that “editors of Russian-language portals are generally more likely to interfere with the original headlines of republished articles;” and that “headlines in Latvian are more likely to stress causality … whereas Russian-language portals are more likely to highlight the negative consequences of Western policies for Western countries, particularly for Latvia.” The report’s authors call for strengthening local Russian-language news portals. Oskar Gorzynski finds in The Daily Beast that “far-right and outright fascist movements with links to Moscow are sowing discord among Ukraine and its European Union neighbors,” as a “Russian campaign bent on fomenting ethnic tensions within Ukraine, with the goal of destabilizing the country and antagonizing its NATO-affiliated neighbors, especially Poland and Hungary” may be gaining traction. (OCCRP, CEPA, The Daily Beast)

Hamilton 68 dashboard 

Hamilton 68 dashboard: The ongoing Syrian government offensive in East Ghouta was the primary focus last week of Russian-linked accounts monitored on Hamilton 68. #Ghouta, #EastGhouta, and #Syria were top hashtags throughout the week, and the #whitehelmets, a constant target of Kremlin propaganda, also regularly appeared on the dashboard. Additionally, the URLs shared by monitored accounts boasted of Syrian government advances, accused the United States of funding "terrorists," and presented an image of Russia as a humanitarian savior of the Syrian people. The effort to shift the Western narrative on Syria (or, at the very least, to confuse the narrative) is an example of the more tangible, propagandistic goals of Russian-linked disinformation campaigns. While Syria-related content is amplified during moments of international scrutiny, it should be noted that #Syria is the most-used hashtag by monitored accounts over the past six months — a sign that changing international public opinion on the war is a critical component of Russia's online influence operations.

Quote of the Week

“We’re taking steps, but we’re probably not doing enough … [Putin] … has clearly come to the conclusion that ‘there’s little price to pay here and therefore I can continue this activity.’ If we don’t change the dynamic here, this is going to continue.”

- Adm. Michael S. Rogers, director of the National Security Agency, February 27, 2018 

Worst of the Week

In a week that saw Russian-backed Syrian government forces target the rebel-held area of Ghouta with relentless air strikes, Russian media presented a different view of Russia's role in the conflict: humanitarian savior. Official Kremlin-media outlets RT and Sputnik touted Russia's call for a five-hour humanitarian "pause," while also blaming rebels for violations of the pause and for impeding civilians attempting to escape the violence through humanitarian corridors. Russia Feed took it a step further, championing Russia as the "true friend" to the Syrian people by declaring: "Russia goes all out with humanitarian aid effort in Syria's war-torn Homs province." Of course, little mention is made of the fact that the humanitarian crisis was caused, in part, by Russian assistance to Assad's forces, but those details likely would have made the hero a little less dashing. (RussiaFeed)