To start the year, our team took a moment to look back on an exceptional year at the Digital Forensic Research Lab. What started as an experiment is now a leading center at the intersection of government, technology, security, and media.

Last year, our research and reporting spread over five continents. The community of #DigitalSherlocks — both at the Atlantic Council and across the world — grew stronger and better equipped to keep up the fight for facts. In an era when truth is rarely self-evident, we cannot assume our own credibility and worked to earn your trust and support. Throughout 2018, we were thankful for it.

We set out to do something different to solve a collective challenge. We based our work on the simple principle that objective fact is an indispensable foundation of government for and by people. We deployed open-source investigation and digital technologies not only to counter disinformation but also to bolster our core set of values.

To celebrate, we present our “top ten” from 2018. In the new year, we will keep at it.

While those who would seek to undermine democratic institutions will continue to adapt and evolve, so will we. The facts are on our side.

We hope you’ll join us.

Facebook Uncovers Active Influence Operation
Analysis of accounts suspended by Facebook for inauthentic behavior surrounding politics in the United States.

In 2018, @DFRLab expanded our #ElectionWatch work to twelve national and local elections on four continents. We did so as part of an effort to provide independent and credible research on social media’s role in elections and, more broadly, democracy.

A sustained focus of #ElectionWatch was the U.S. midterms. On July 31, Facebook suspended a number of assets for “inauthentic activity.” An initial scan showed the accounts produced coordinated content to set Americans against one another and included behavioral patterns and use of language reminiscent of the troll operations run from Russia in 2014 through 2017.

Facebook shared eight pages with @DFRLab 24 hours before the takedown. Within that timeframe, our team produced an initial assessment, then followed up with three in depth reports on different aspects of the operation.

What was clear from this and subsequent disinformation during the midterms was foreign interference in the United States didn’t stop in 2016, but demonstrated evolving tactics over time and adapted to increased scrutiny. READ MORE →

#BreakingGhouta
An investigation revealing the deliberate destruction of eastern Ghouta, Syria.

From February 18 through April 8, a total of 16,934 documented strikes by the Assad regime and its Russian backers hit eastern Ghouta, a rebel-held enclave outside of Damascus. Over 49 days, an average of 345.6 per day rained down on areas without regard for whether combatants or civilians were hit. On February 21, 2018, the heaviest day of attacks in eastern Ghouta, 1,658 strikes were recorded.

The majority of these attacks used traditional weaponry. However, some attacks included:

Of the civilians that survived, 66,369 people were forced from their homes. Meanwhile, Assad — using any means — gained momentum and consolidated control over the southern front of the seven-year conflict in Syria.

We assembled a team of open-source researchers and investigative journalists to expose the facts on the ground in the latest atrocities committed against Syrian civilians in eastern Ghouta. READ MORE →

Fake News: Defining and Defeating
Real techniques for identifying fake news and disinformation.

Following U.S. President Donald Trump’s decision to present his media critics with so-called “fake news awards,” it was more important than ever to define what “fake news” actually is and what it is not. President Trump’s repeated accusations of fake news are dangerous both for journalists around the world and for the integrity of free and fair democratic discourse in America.

At the beginning of the year, @DFRLab stopped using the term “fake news,” instead opting for our working definitions of disinformation and misinformation. The work of the community to counter disinformation grew throughout the year. Nearly 11 months later, dictionary.com named “misinformation” the word of the year. READ MORE →

How To Spot Russian Trolls
Some clues which identify probable Kremlin accounts.

Since Russia’s attempt to polarize American society and interfere in the 2016 election was exposed, and even more since the poisoning of former spy Sergei Skripal in the United Kingdom, accusations of being a “Russian troll” have proliferated online, often with the flimsiest of evidence.

Such accusations do more harm than good, obscuring the ways in which trolls can be verifiably identified and increasing online polarization within democracies.

In the interests of transparency and reasoned debate, this post listed some of the factors that can be used to identify possible Russian trolls masquerading as citizens of other countries. READ MORE →

Loves For Sale in Brazil
Exposing a Brazilian network which trades clicks for cash.

The Adrienne Arsht Latin America Center and @DFRLab partnered up to identify, expose, and explain disinformation in the lead-up to elections in Colombia, Mexico, and Brazil.

Ahead of Brazil’s presidential elections, a group of apparently young Brazilians was running a network of Twitter, Instagram, and Facebook accounts to trade engagement — likes, followers, and pages — for cash. The network was also involved in boosting partisan, election-related content in Mexico.

Facebook took action against the entire network of commercial and political disinformation in Brazil based on our original research on this diseconomy of online engagement. READ MORE →

Twitter Troll Farm Archives
Seven key takeaways from a comprehensive archive of known Russian and Iranian troll operations.

On October 17, Twitter released an archive of over 10 million tweets posted by accounts from 2013 through 2018. Of the total, over 9 million tweets were attributable to 3,800 accounts affiliated with the Internet Research Agency, also known as Russia’s St. Petersburg troll factory. Over 1 million tweets were attributable to 770 accounts, originating from Iran.

Each set is included in the same archive; however, because the actors and activity were separate, our analysis was conducted accordingly.

In an effort to promote shared understanding of the vulnerabilities exploited by various types on online influence operations, as well as social media’s role in democracy, @DFRLab had a brief advance opportunity to analyze the nearly complete archive. READ MORE →

New Russian Electronic Warfare Systems in Eastern Ukraine
Monitors find recently-developed complexes on the wrong side of the Russo-Ukrainian border.

A brand-new electronic warfare system which the Russian Armed Forces brought into service this year was identified in eastern Ukraine, along with several other modern systems.

The sighting underlined a significant escalation and Russia’s increasing attempts to prevent drone-based monitoring of the conflict in Ukraine. It provided yet more proof of Russia’s ongoing military involvement in the conflict in its western neighbor, and its continued investment in attempts to mask that involvement.

Over the past four years, the OSCE Special Monitoring Mission (SMM) to Ukraine has observed and photographed a number of Russian electronic warfare (EW) systems in the conflict area. These systems are known to have targeted the SMM’s drones, hindering the monitoring group’s ability to observe violations of the Minsk accords.

We took a closer look. READ MORE →

Bots Target Malaysian Elections
17,000 bots target Malaysian opposition party ahead of the General Elections on May 9.

Our #ElectionWatch work spanned four continents in 2018 from local elections in Moldova to national elections in Mexico. The furthest our coverage reached was Malaysia, where a tip ahead of general elections revealed a great deal of automated content. Twitter bots launched two hashtag campaigns promoting #SayNOtoPH and #KalahkanPakatan (translation from Malay: Defeat Pakatan). Pakatan Harapan (PH) is currently Malaysia’s ruling coalition.

The two hashtags — #SayNOtoPH and #KalahkanPakatan — were used 44,100 times by 17,600 Twitter users, the majority of which were bots. The campaign reached more than 300,000 users and generated more than half a million impressions. It is hard to say how many of those impressions came from real users considering the bots behind the campaign had very few followers, most of which were other bots. READ MORE →

Tributes to Russian Mercenaries from Ukraine to Syria
Tracking Russian mercenary statues erected in Syria and Ukraine.

On February 22, the first images of a statue dedicated “to Russian volunteers” (российским добровольцам) in Luhansk appeared on Russian social media platform VKontakte. This monument appeared to be an exact copy of a statue erected outside of Palmyra in Syria as early as January 2018. Furthermore, both statues had a military insignia similar to the “Wagner Cross” of the infamous Russian Wagner Group mercenaries (Группа Вагнера). Both Syria and Ukraine are known locations in which Wagner mercenaries operate for hire.

The Wagner Group is believed to be funded by Yevgeny Prigozhin, an oligarch with close ties to Russian President Vladimir Putin. He has a been included in our reporting on security issues in Ukraine, Syria, and Libya.

Prigozhin was indicted in the United States due to the work of Special Counsel Robert Mueller’s investigation findings for his alleged support of the Internet Research Agency. He also is subject to economic sanctions by the United States. READ MORE →

Banks, Bribes, and Alleged Latvian Launderers
What we do and do not know about reports of corruption against the president of the Bank of Latvia.

On February 19, the Associated Press published an article by journalist Carlo Piovano, which alleged Ilmars Rimsevics, Governor of the Bank of Latvia and a Latvian member of the European Central Bank (ECB), was the central figure of a bribery scandal and protected money launderers.

Rimkevics was also photographed sitting by a table with Dmitry Pilshchikov, who was then the head of the Russian Research Institute of Information Technology (НИИИТ — NIIIT). The aim of the image was to illustrate Rimsevic’s ties with a Russian elite.

Ahead of the Latvian general elections, the story was at the heart of political conversations in both Latvian and Russian. READ MORE →

We’re just getting started and have much more planned for 2019.

Follow along with all the latest reporting from the #DigitalSherlocks.