Report Unmasks Russian Ops That Clumsily Aped US and Foreign Leaders

A report from Graphika says this tweet attributed to U.S. Senator Marco Rubio is a fake. Published as part of a Russian disinformation campaign, the bogus tweet accuses the U.K. of interfering in America’s 2018 midterm elections. (Courthouse News image)

(CN) — As midterm elections grew near, a Twitter account in the name of Senator Marco Rubio shared an inflammatory message.

“British GCHQ that spied on @realDonaldTrump in 2016 is back in the game,” the tweet attributed to Rubio, complete with a blue checkmark, said in July 2018. “Now they intend to use #DeepFakes to support Democrats during the midterm elections.”

Only the tweet was not Rubio’s, and there was no such espionage plot from U.S. allies in the United Kingdom.

There was, however, a six-year Russian misinformation campaign titled “Secondary Infektion” that flooded countries across Europe and North America with fake stories and forged documents to provoke tensions between perceived enemies.

Those are the findings of a 120-page report released Tuesday by the New York-based research firm Graphika.

According to researchers Ben Nimmo, Camille Francois, C. Shawn Eib, Lea Ronzaud, Rodrigo Ferreira, Chris Hernon and Tim Kostelncik, the operatives posted 2,500 pieces of content in seven languages over 300 platforms. Most used burner social media accounts abandoned after one post, primarily focused on Kremlin-friendly messages depicting Ukraine as a failed state, NATO as a source of global aggression, Muslim immigration as a threat, and Russia’s doping scandals as a rush to judgment.

“Little is yet known about the central entity behind the operation: its identity is the single most pressing question to emerge from this study,” the report’s executive summary states. “The Facebook security team uncovered a small cluster of accounts run by the operation for the first time in May 2019 and provided the original attribution to actors based in Russia.”

Graphika’s team reported that Facebook’s discovery led others to uncover Secondary Infektion late last year and early this year.


Rubio was not the only target of online fakery: Forging U.S. Senate letterhead in early 2016, one document excoriated NATO ally Turkey as a “harbor for radical islamists [sic] protected by the country’s authorities.”

The missive mimicked the signatures of a bipartisan team that included Rubio; Bob Corker, a then-serving Tennessee Republican; Tim Kaine, then a vice presidential candidate; Ron Johnson, a Wisconsin Republican from; Tom Udall, a New Mexico Democrat; and Rand Paul, a Kentucky Republican. 

Graphika called the false narratives reminiscent of early “Active Measures,” the name given to Russian disinformation campaigns and political warfare. The Mueller report found that the so-called troll farms by Internet Research Agency and Concord Management before the 2016 presidential elections fell into the category of Russian state-linked attack.

For the Secondary Infektion attacks, the United States was neither the only nor the primary target: Ukraine, hit with 32% of the posts, was the largest target. The United States came second at 14%, followed by Poland at 11%, and Germany, the United Kingdom, European Union, and various other government and international entities in single-digit percentages.

“The stories it created were nothing if not eye-catching,” Graphika’s researchers wrote, referring to Secondary Infektion. “They claimed, for example, that extremist Remainers were plotting to assassinate Boris Johnson, that Ukraine was lobbying for President Petro Poroshenko to win the Nobel Peace Prize, and that the EU was lobbying for German Chancellor Angela Merkel to do the same; that Merkel was an alcoholic, and that Poland’s ruling Kaczynski twins suffered from a genetic disorder that made them mentally unstable.”

In Sweden, a fabricated blog post attributed to Carl Bildt called for a “Mueller Commission”-style investigation into his country’s elections in November 2018.

What the posts had in imagination, they lacked in effectiveness.

“Almost none of those efforts achieved measurable impact,” the researchers found. “Particularly between late 2016 and early 2020, Secondary Infektion relied on high OPSEC single-use burner accounts for almost everything it posted (it typically created, used and abandoned each account in less than an hour). This meant that the operators never had the chance to build an audience: each time they created a new account, they effectively reset their following to zero. It would be hard to envisage a less viral strategy.” (Parentheses in original.)

For the researchers, the failure of this campaign showed the United States and other democracies have become more prepared for these threats.

“All these factors have implications for future elections, not least the US presidential election in 2020,” the report states. “On the positive side, Western audiences proved remarkably robust against Secondary Infektion’s trademark combination of fake documents and fake accounts. The repeated exposure of Secondary Infektion’s operations by platforms, journalists, and researchers may have triggered the steep drop in output observed in July 2019 and January 2020. If this model can be continued and reinforced, our collective defenses will be in a significantly better state than in 2016.”

Rubio’s media office and Graphika did not immediately respond to press inquiries.

%d bloggers like this: