Fake stories and forged documents targeted Europe’s leading power

This article is part of a series analyzing the various aspects of the suspected Russian intelligence operation. Our top post summarizes these findings.

Germany was one of the information operation’s key targets. One story was a virulently anti-immigrant scare and was picked up by German anti-immigrant media in a rare show of impact. Repeatedly, the operation ran stories that would, if successful, have raised tensions between Germany and key allies, notably the United States, Poland, and Turkey.

Some of these stories attacked or impersonated real individuals who had official status. Out of respect for their privacy, and to prevent the falsehoods from returning to circulation, the DFRLab has chosen not to publish all its findings. The case studies below are therefore a subset of the broader targets in Germany.

Alt-Russian, Not Alt-Right

The operation appears not to have been very active on Twitter, with one exception: an account called @KPrydius that posed as a young Ukrainian woman living in Germany. This account can be attributed to the Russian operation with high confidence because it used the same profile picture and banner as a Facebook account known to belong to the operation. This Facebook account also pointed to the @KPrydius Twitter account.

The account posted in Russian, German, and Ukrainian. Many of its posts were politically engaged, voicing anti-establishment and anti-immigration views, such as attacking the mainstream media as “liars” and arguing that “very many” refugees are criminals. The account also posted criticism of Ukrainian then-President Petro Poroshenko and argued with other Ukrainians about Crimea.

In one particularly disturbing set of posts on December 11, 2018, the account shared a link to an article on the German-language forum called homment.com five times. Each post included anti-immigrant comments and tagged a different Twitter user, including members of the anti-immigrant Alternative for Germany (AfD) party.

The homment.com article, posted on December 6 by a user called “jensscherer,” claimed that users on a closed Arabic-language discussion forum had shared a “guide for migrants” that explained how much money they could expect from the German state and what crimes they could get away with, including “sexual molestation of German women.” The article published a screenshot of the “guide” with captions in Arabic and German.

The DFRLab could not find the post on the forum in question. Linguistic analysis by two native speakers suggested that the Arabic captions did not originate in that language but in another language that was then translated into Arabic. The context — a group trying to help immigrants by advising them that it is permissible to commit sexual assault in Germany — also seemed intrinsically questionable, given the emphasis genuine rescue organizations place on safety and the rule of law.

The likelihood is that the “guide” was a forgery, planted on or attributed to the discussion forum by users trying to stir up hostility toward immigrants.

Also on December 6, a profile also named “Jens Scherer” posted the same article to a second German discussion forum, nexusboard.de. The supposed author’s nexusboard.de profile showed that “his” account was created on December 6, 2018, posted the one article and that “he” never returned.

The following day, an author called “Mark Douglas” posted an article in non-native English on Medium, homment.com, scoop.it, and indybay.org. Headlined “Being a Migrant to Germany — a Visitor’s Instruction,” the Medium post named the German homment article as its source but provided a different screenshot of the guide in Arabic and English, indicating access to the original material.

The article was outspokenly racist and written in clearly non-native language, with errors characteristic of Russian speakers attempting fluency in English:

“Recently a virus video has gained the ground in the web.”

“Either job or adaptation has nothing in common with the Muslims.”

“This weakness is being used by the migration parasites whose hordes are attacking sick Europe and keep living well at its expense. (…) The unique real resistance to the migrations’ invasion is the outraged comments in the web about how insolent the intruders are laughing out loud at the coddled civilization with the laws that doesn’t work.”

Pick Up on the Right

Some of the amplification of this story came from accounts run by the Russian operation, but the most important impetus came from the German far right. A week after the above-mentioned Twitter account began pushing the story, the associated Facebook account shared a link to a German-language pickup of the story.

This pickup article originated from a German anti-immigrant site, Journalistenwatch.com. The site attributed its copy of the “guide” to the Arabic forum, via unspecified “social networks.” The DFRLab has not been able to find online versions of the “guide” earlier than those publicized by the Russian operation, marking the Russian operation as the probable source of the document.

Crucially, the Journalistenwatch article performed far better online than the original versions, according to a scan using the BuzzSumo online tool. By the end of May, the “guide,” likely created by this operation, was circulating widely on anti-immigrant discussion forums.

The launch of this race-baiting content bears every hallmark of the Russian operation — the use of an unverifiable (and possibly forged) source; the poor English grammar and nonexistent idioms; the creation of single-use accounts on Medium, homment.com, and indybay.org; and the amplification by two accounts known to be part of the network. All of those indicators match the techniques that the operation used elsewhere. This content differed, however, in that it actually gained traction in Germany.

This constituted a particularly vicious and dangerous attack on one of Germany’s most explosive political issues by operators emanating from Russia.

About Germany, But Not of It

One story was about Germany but was not posted in German or on German sites, as far as the DFRLab could establish. On August 1, 2018, an apparently Irish Facebook account run by the Russian operation posted a link to a Medium article on relations between the European Union, Turkey, and the Kurdish community. The account added the text “Pity news for my friends from Kurdistan.”

The phrase “pity news,” using “pity” as an adjective, is non-native English. The Medium article, attributed to a user called Salih Demirkan, was also written in a non-native form of English, as shown by quotes such as this:

“Armenian and Kurdish Diasporas, for their parts, will have heavy times in Turkey because of strengthening positions of nationalist forces in Turkish Parliament.”

The alleged author only posted one article. “His” profile photo was taken without attribution from celebrity Adam Levine.

The Medium article centered on a letter allegedly sent by German Vice-Chancellor Olaf Scholz, a Social Democrat, to the chair of the People’s Democratic Party in Turkey on behalf of the Party of European Socialists (PES), the pan-European alliance of Social Democratic parties, and stating the PES’s supposed intention of abandoning cooperation with the Turkish group:

Unfortunately, domestic problems the EU is facing adjust our further cooperation (…) Our bloc in general and the Social Democratic Party of German (SPD) in particular have had to take the side of Germany’s Chancellor Angela Merkel in supporting external borders of the EU and neighboring states situated along the routes of main flows of migrants (…) Regrettably it forces us to suspend our further efforts to counter the dictatorial regime of President Erdogan.

Several factors about the letter expose it as a forgery. It was attributed to Scholz, rather than PES President Sergei Stanishev, who usually speaks on behalf of the group. It was also attributed to Scholz as Vice-Chancellor but presented on PES notepaper. Furthermore, the article presented a Facebook link, now deactivated, as its only source. The use of language throughout was clumsy, polemic, and hinted at dark anti-Erdogan conspiracies.

Like so many products of this operation, a user with the same name posted the same article to homment.com, dash.org, indybay.org, and debatepolitics.com.

Over the same period, in late July and early August 2018, a Spanish translation appeared on numerous forums, including Reddit (r/espanol, r/es, and r/noticias_en_espanol), taringa.net, globedia.com, and foroexplayate.com, all of which featured in other parts of this operation. A Facebook account that the platform later took down as part of the Russian operation amplified the Spanish post.

The DFRLab did not find a German version of the article, suggesting that the purpose of this story was to damage the reputation of Germany and, more generally, European Socialists outside the country, rather than having an impact within.

An Important Target

This targeting of Germany stands out within the context of the broader operation. Only Ukraine received more consistent attention. Some of the operation’s content appeared designed to stir up tensions in Germany; other items appeared designed to stir up tensions between Germany and key NATO allies, such as Turkey, Poland, and the United States.

Few of these stories gained traction. The Turkish story, for example, barely registered in a BuzzSumo analysis. A story accusing the United States of espionage circulated briefly in discussion forums, but it failed to penetrate elsewhere.

Overall, this part of the operation showed that the operators viewed Germany as one of their most important targets. With the significant exception of the anti-immigrant piece, they achieved limited success.

Reema Hibrawi is an Associate Director at the Atlantic Council’s Rafik Hariri Center for the Middle East.

Follow along for more in-depth analysis from our #DigitalSherlocks.