Securing Democracy Dispatch

Russian charged with information warfare against the United States tied to IRA’s Prigozhin: On October 19, the Department of Justice (DOJ) announced charges against Elena Khusyaynova, a Russian national, for “Conspiracy to defraud the United States.” Khusyaynova allegedly worked since 2014 as the chief accountant for Project Lakhta, an ongoing operation funded by Internet Research Agency (IRA) financier Yevgeny Prigozhin to wage “information warfare against the United States of America.” According to the indictment, Project Lakhta seeks to “sow division and discord in the U.S. political system, including by creating social and political polarization, undermining faith in democratic institutions, and influencing U.S. elections, including the upcoming 2018 midterm election.” Members of the project allegedly created inauthentic personas impersonating Americans, organized and funded protests and rallies, solicited support from U.S. citizens to spread narratives, and purchased social media advertisements. Members of the conspiracy wrote narratives from multiple political perspectives and attacked politicians in both parties, including Sens. John McCain (R-AZ) and Mitch McConnell (R-KY), as well as President Barack Obama. They also shared content intended to inflame tensions surrounding a variety of issues and events, including gun control, LGBT rights, the NFL national anthem debate, and the Las Vegas shooting. Details of the indictment exposed how Project members seized on existing headlines from deeply partisan sources to incite polarization. According to the DOJ, Project members were issued detailed guidance on how and when to target U.S. audiences, and what narratives to employ in order to illicit strong emotional responses. The Project even maintained an entire department dedicated to Search Engine Optimization to ensure that Kremlin narratives topped search results. (Department of Justice, Axios, New York Times, ASD, Lawfare)

Twitter exposes details of foreign information operations as more authoritarians adopt the Kremlin’s tactics: Twitter released over 10 million tweets associated with information operations run by the Russian IRA and Iran. The release included tweets from 2009 until 2018; inauthentic accounts originating in Russia and potentially Iran; and GIFs, pictures, and videos shared by the foreign actors. ASD Director Laura Rosenberger praised the release as a “welcome move,” saying, “Exposure of these operations and transparency around platform actions are critical for combatting information operations.” The data confirmed what was already known about how foreign information operations seize on hot button issues and inflame divisions on both sides of issues. ASD analysis of the new data also found that the inauthentic accounts’ profile descriptions used keywords like “mom,” “husband,” and “retired” to humanize themselves and appear more relatable, while they used labels like “veteran,” “military,” and “patriot” to boost their credibility. As described by researcher Kate Starbird, the new data highlights the way inauthentic accounts “worked to infiltrate politically active communities” and “shape the conversations” within those groups. Twitter pledged to release “similar datasets in a timely fashion” in the future if more operations are discovered. Just one day after the release, NBC reported that Twitter suspended a separate network of inauthentic accounts pushing pro-Saudi narratives in the aftermath of the disappearance of journalist Jamal Kashoggi. These new revelations, along with recent exposures of Iranian social media information operations, illustrate that the tactics first made famous by the Kremlin “are being adopted by authoritarian actors around the world.” (Twitter, DFRLab, NBC)

Authoritarian regimes manipulate social media to stoke violence and silence internal dissent: The New York Times reported on October 15 that for half a decade members of the Myanmar military used fake pages and accounts on the platform to incite what a United Nations panel has termed “ethnic cleansing” and “genocide” against the country’s Muslim Rohingya minority. Facebook removed the official accounts of 20 individuals and organizations in August “for committing or enabling ‘serious human rights abuses in the country’,” but the extent of the unofficial activities of this network, which used fake accounts and names, went undetected until now. According to The New York Times, the “actions by Myanmar’s military on Facebook are among the first examples of an authoritarian government’s using the social network against its own people.” A separate New York Times assessment revealed that in Saudi Arabia, the alleged murder of Saudi journalist Jamal Khashoggi has exposed details of a broad online intimidation effort allegedly ordered by Prince Mohammed bin Salman to silence critics of his regime inside Saudi Arabia and abroad. According to reporters Katie Benner, Mark Mazzetti, Ben Hubbard and Mike Isaac, Saudi Arabia has become an “illustration of how authoritarian governments can manipulate social media to silence or drown out critical voices while spreading their own version of reality.” (The New York Times)

Experts warn that “deep fake” technology represents a major threat to democratic institutions: The Council on Foreign Relations released a report on the emergent threat posed by advances in “deep fake” technology, which will allow malicious actors to create realistic renditions of public figures in order to propagate false information that can spread quickly to large audiences. Deep fakes can be used to exacerbate existing divisions in a society, manipulate elections, and incite violence, among other things. The report warns that deep fakes are a serious concern for the security of democratic institutions and the global order, and require a coordinated response from the public and private sector to combat. In a New York Times op-ed, Jennifer Finney Boylan argued that as deep fake technology continues to evolve, it will lead to increasingly frequent events such as the doctored photo of Parkland High School shooting survivor Emma Gonzalez tearing apart a copy of the U.S. Constitution, which went viral on Twitter in February. In a Washington Post op-ed, Senator Ben Sasse (R-NE) commented that America’s adversaries will use deep fake technology to exploit political divisions, and warned Americans to be aware of the threat this new technology poses to democratic institutions. (CFR, The New York Times, Fortune, Washington Post, Wall Street Journal)

The U.K. and NATO prepare to defend against and respond to cyber-attacks: The U.K. National Cyber Security Centre released its 2018 annual report detailing how a £1.9bn investment improved national safeguards against malicious cyber-attacks. U.K. cybersecurity services, which estimate that they repel ten attacks per week, cite state-sponsored actors as the primary source of hostile activity against national media, infrastructure, and commercial targets. NATO also announced that a new command center, capable of both defending and retaliating against cyber-attacks, will be fully operational by 2023. The new center’s capabilities are furthering debate about what types of cyber-attacks would trigger NATO’s Article 5 (collective defense) clause. Meanwhile, on October 17, a Slovakian cybersecurity firm released a report stating that hackers had infected three transportation and energy companies in Ukraine and Poland with sophisticated malware. The report warns that the hackers may have been preparing to launch a major attack against these infrastructure targets. The U.S. cybersecurity firm FireEye assigned responsibility to the Russian GRU-linked group Sandworm. (U.K. National Cyber Security Center, BBC News, Reuters)

Macedonian parliament votes to begin national name change process: On October 20, the Macedonian parliament voted to begin the constitutional process of changing its name to the Republic of North Macedonia, following a contentious referendum. In June, Greece and Macedonia concluded an agreement to change Macedonia’s name in exchange for Greece lifting its veto on Macedonia’s accession to NATO and the EU. In recent months, the Kremlin has used diplomats and oligarchs to encourage resistance to the deal by funding protests and attempting to bribe officials to oppose the agreement. As described by ASD’s Alexander Roberds and Bradley Hanlon, the Russian government has often employed its interference toolkit to prevent the expansion of Euroatlantic institutions, and it is highly likely that it will make “future attempts to meddle in [Macedonia’s] accession process.” The process of changing the Macedonian constitution will require several more rounds of voting by the Macedonian parliament, and the Greek parliament must also formally approve the agreement. (BBC News, Washington Post, The Guardian, Buzzfeed News, Alliance for Securing Democracy)

ASD Director Laura Rosenberger commented on the danger of damaging public confidence in election results in Axios: “You could imagine a period of time of chaos after the midterms in which people would be worried as to whether there was a hack because someone is claiming there was a hack, even if there wasn’t.”

Accounts tracked by the Hamilton 68 Dashboardseized on the international controversy surrounding the murder of Saudi journalist Jamal Khashoggi inside Saudi Arabia’s consulate in Istanbul to steer debate in the United States. Pro-Kremlin accounts used Khashoggi’s murder to criticize U.S. policy in the Middle East writ large, chastising the U.S.-Saudi alliance and Saudi’s war in Yemen, which the UN has called the “world’s worst humanitarian crisis.” Kremlin-oriented accounts also shared several articles accusing Western governments of working with extremist organizations in Syria.

“We are concerned about ongoing campaigns by Russia, China and other foreign actors, including Iran, to undermine confidence in democratic institutions and influence public sentiment and government policies. These activities also may seek to influence voter perceptions and decision making in the 2018 and 2020 U.S. elections. Elements of these campaigns can take many forms, including using social media to amplify divisive issues, sponsoring specific content in English-language media like RT and Sputnik, seeding disinformation through sympathetic spokespersons regarding political candidates and disseminating foreign propaganda.”

 -Joint Statement from the ODNI, DOJ, FBI and DHS: Combating Foreign Influence in U.S. Elections, October 19, 2018 

A reporter for Novaya Gazeta, “one of the last independent news outlets in Russia,” received a number of anonymous death threats last week after drawing the ire of Yevgeny Prigozhin, the Putin-allied oligarch behind the Internet Research Agency (IRA). Often critical of the Kremlin and President Vladimir Putin, at least five Novaya Gazeta reporters have been murdered since 2000. The new threats — a funeral wreath, a severed goat’s head, and six red carnations (even-numbered carnations are reserved for funerals in Russia) sent to the newsroom — specifically targeted Novaya Gazeta journalist Denis Korotkov. According to the newspaper, Korotkov has long been the target of the IRA due to his previous investigative reporting on Prigozhin’s business empire.

The views expressed in GMF publications and commentary are the views of the author alone.