How the far-right in Italy automated messaging after the media blackout

In the run-up to Italy’s nationwide elections on March 4, anticipation loomed over the potential for disinformation to impact the outcome. Several localized instances of distortion followed by coordinated, and possibly automated, amplification efforts occurred in the final days — promoted by Italians from the far right of the political spectrum.

On Friday, March 2, #SorosLega5Stelle appeared online. On Facebook and Twitter, images of documents were released and allegedly showed that the Open Society Foundations (OSF), chaired and funded by George Soros, financed a number of initiatives with key organizations and individuals connected to Italy’s far-right Lega party (the League, formerly known as Lega Nord) and the anti-establishment Five Star Movement (Movimento Cinque Stelle, MS5).

https://media.giphy.com/media/jHm8mPd3M2hAJeM7Hb/giphy.gif

The narrative surrounding the document claimed to prove that Soros’ money was funneled into projects associated with Lega and MS5 to change their anti-immigration and euro-sceptic positions. Both issues have been dominant — and polarizing — throughout the 2018 Italian electoral campaign. The images of the documents were rapidly promoted on social media, causing a notable spike in the country’s online political debate.

The operation was driven by Italy’s ultra-right, neofascist CasaPound party and targeted already right-leaning Lega and MS5 and, to a lesser extent, the leftist Piu Europa (More Europe) party. Put simply, the operation was an effort by the country’s extreme conservatives to shift the political conversation even further to the right, exacerbating divisions and polarizing the debate just ahead of the March 4 vote.

To avoid this type of manipulation, Italy has an electoral law that prevents traditional media outlets from reporting on polling data for two weeks before the election and from giving candidates a direct platform 48 hours ahead of the vote. While this has generally been universally observed, since the law dates back to 1956, communication developments like social media have given rise to new gray areas for potential exploitation. As demonstrated in this case, propagators of disinformation campaigns seized the opportunity to act during the Friday and Saturday immediately preceding the Sunday vote, leaving traditional media no window to expose and explain it for the voting public.

The disinformation was exposed by the EU Disinfo Lab and Next Quotidiano. Their reporting corroborated with the @DFRLab’s findings below.

The Narrative

Screenshots of the alleged OSF documents first surfaced on Twitter around 12:15pm CET on March 2. The user, @Corrado23, had a modest 118 followers but significant proportional engagement on its posts, which are exclusively focused on CasaPound political activity.

The screenshot of alleged OSF documents were then tweeted by @RussianTwe in the first original post from the account created in January 2018, which had previously only posted responses to some tweets of CasaPound and its supporters.

The next uptick occurred about 15 minutes later, when Marco Racca, a CasaPound candidate for the Chamber of Deputies, responded to the tweet from @RussianTwe and continued to increase engagement on the hashtag with his slightly larger audience of 1,934 followers.

https://twitter.com/marcoracca/status/969534756999389185

Following Racca’s interventions, the #SorosLega5Stelle was mostly propagated by CasaPound accounts. In total, about 10,500 tweets were published using #SorosLega5Stelle in the six hours that followed the first tweets.

Significant engagement surrounding the hashtag appeared to be organic — meaning real humans and real engagement — spread by CasaPound supporters.

#BotSpot

When #SorosLega5Stelle originally surfaced, a number of its immediate and top amplifiers appeared to be automated or semi-automated in support of CasaPound messaging.

Of the top five users engaged on the hashtag when it surfaced, two accounts appear anonymous bots, three accounts had personal profiles info but exhibited bot-like behavior, and all exclusively parroted CasaPound content, as opposed to creating their own.

The users @hansludwig631, @ClaudiaTozzi22, and @Barbara69427 were among the top five promoters of #SorosLega5Stelle. None of the accounts had verifiable personal information, remained effectively anonymous, and only aggregated pro-CasaPound content via retweets. Each account enjoyed high engagement with modest following. All were indicators of bot-like behavior.

The two other accounts of the top five top engagers on #SorosLega5Stelle also exhibited bot-like behavior with two possibly significant wrinkles: both accounts appear to have profile photos that are unique and geotagged. Yet, both “Stella” (@ste10301278) and “Simone” (@cmlsslazio1900) were otherwise effectively anonymous and only aggregated CasaPound content via retweet.

The Italian election cycle has included instances of “self-bots” or users that willingly opt-in to allow their social media accounts to automatically post when a party they support released a message. The leader of the far-right Lega party, Matteo Salvini, employed the tactic.

Spread on Facebook

Most of the content on Facebook using #SorosLega5Stelle was cross-posted from Twitter around midday on March 2, the same time document photos were first released, to amplify engagement across platforms. The majority of the Facebook posts were from a single user, Filippo Emanuele (@filippo51174 on Twitter), who has 377 followers on Facebook and has exclusively promoted CasaPound content online.

Within a few hours of Filiipo Emanuele’s stream, a few other Facebook users shared cross-posts from Twitter accounts @RussianTwe and @lucabattanta — both key propagators from the original campaign. After that, the only Facebook post using the hashtag was from Lega La Bufala citing Next Quotidiano’s report exposing the instance of disinformation.

The Fake Document

Several sources claimed that the photos of the documents were doctored to show false information. The screenshots of the documents — allegedly internal documents of the Open Society Foundations— are included below.

Each document depicted alleged funding from OSF to various projects in Italy like “organizing a national day against Islamophobia” or “to encourage young people to actively engage in political process.”

Within Italian politics, the alleged OSF documents name only one candidate, Emma Bonino of the firmly left Piu Europa party. The documents also specifically name one political party, Lega, which is considered far-right, anti-migration, and ideologically opposed to the OSF’s more eurocentric programming.

Next Quotidiano, a center-left leaning online Italian newspaper, the EU Disinfo Lab Italia, and others asserted the documents list incorrect points of contact for certain projects and organizations. Closer studies of the images posted on Twitter also reveal some letters, symbols, and stylistic elements different from those typically used in similar reports released by the OSF, which could indicate tampering.

These sources also posit that the dates listed for the alleged projects in the documents (which are for 2018) are false because the Foundation has not previously released data on its activities for the current year. Comparisons from earlier OSF reports suggest that the data in the photos could be copied from the organization’s 2014 report.

Another interesting aspect of the documents was the specific language used in reference to the Italian political landscape. One of the listed initiatives is described as an effort to target “unfamiliar movement such as the Lega Nord to collect the votes of disgruntled Italians but not to risk the permanence of Italy in the European Union.” The document also described another project with the Associazione Luca Coscioni designed to “pushfrnch [sic] public opinion to encourage Emma Bonino to welcome refugees and work for United States of Europe.” The explicit nature of these descriptions and goals, the naming of Italian candidates with specific ideologies, and the typo in the Bonino project line raise questions over the source of these documents.

The @DFRLab has not independently verified these claims.

Reaction

Both Next Quotidiano and the EU Disinfo Lab Italia released helpful analysis exposing and explaining this disinformation. Next Quotidiano, as a credible, local Italian source, placed a stronger focus on examining the documents and their content, while the EU Disinfo Lab emphasized the propagation of the disinformation, mainly on Twitter.

https://twitter.com/DisinfoEU_IT/status/969901155185758208

The EU Disinfo Lab also highlighted the roles of active Twitter users who were able to amplify the #SorosLega5Stelle and mobilize other communities, including @lucabattanta, an anti-establishment Italian political blogger. Battanta later refuted the accusation, replying to several of the Disinfo Lab’s tweets. The Disinfo Lab also explained that less than one percent of the Twitter users engaging with the hashtag overlapped with the Russian network they mapped, reinforcing the assertion that the operation was orchestrated domestically by CasaPound.

cosa mobilito io? Si presenti nome e cognome prima di citarmi a sproposito.

— Luca Battanta (@lucabattanta) March 3, 2018

In response to this reporting, Twitter Public Policy appeared to quickly remove or suspend several of the malicious accounts that played key roles in the propagation, including @RussianTwe and @nina_moric. Although there was less activity on Facebook, the platform has not yet taken any action in response to the content or users amplifying the hashtag.

While there are still weaknesses in these social media platforms’ approach to addressing these types of threats, this case underscores a positive development in their ability to spot disinformation, decipher the context, and determine a course of action to respond.

Implications

Twitter does not have a decisive audience in Italy, but the occasion of coordinated automation or botnets on that platform is a good indicator for similar influencing activity elsewhere. Those pushing out coordinated messages ahead of the elections would be negligent to invest fully in one platform as opposed to a range of engagement tools. The goal is audience penetration by any means, which is why disinformation is a pervasive challenge. Disinformation, which is deliberate, and misinformation, which is not, can exist anywhere information and engagement meet. Both can effectively take the form of “fake news,” which is at the front of Italians’ collective conversation ahead of the elections.

The timing of #SorosLega5Stelle was of particular interest. Italian election law demands that domestic media outlets refrain from coverage of polling data two weeks prior to voting or candidate activity 48 hours prior to voting. The narrative around #SorosLega5Stelle was released on Friday afternoon ahead of the Sunday vote, with the intent to spread during the normative weekend quiet.

While campaigning via social media does not fall under the institutional norms of Italian elections, the prospect of disinformation — especially social media campaigns that spike in traffic, and thus attention due to automation — in the final hours was a potential vulnerability.

The Atlantic Council @DFRLab’s will continue to monitor the lead-up to Italian elections. Follow along with our #ElectionWatch coverage.

Our #ElectionWatch coverage for the upcoming Italian elections is in partnership with fanpage.it.

Follow along for more in-depth analysis from our #DigitalSherlocks.