Disinformation campaign removed by Facebook linked to Russia’s Internet Research Agency

Group affiliated with notorious Russian troll

Disinformation campaign removed by Facebook linked to Russia’s Internet Research Agency

Share this story
THE FOCUS

Group affiliated with notorious Russian troll factory ran a Turkey-based blogging platform connected to pro-Kremlin think-tanks

Internet Research Agency head Evgeny Prigozhin (L) assists Russian Prime Minister Vladimir Putin during a dinner with foreign scholars and journalists at the restaurant Cheval Blanc on the premises of an equestrian complex outside Moscow, November 11, 2011. (Source: REUTERS/Misha Japaridze/Pool/File Photo)

On September 24, 2020, Facebook took down a small network of assets — a single Facebook page, five user profiles, and three Instagram accounts — linked to United World International, a fringe blogging outlet that spread anti-Western geopolitical narratives in English as well as Turkish. The outlet appeared to be managed by several people connected to the Russian Internet Research Agency (IRA), the notorious Kremlin-linked troll farm known for its interference in the 2016 U.S. presidential elections.

In its announcement, Facebook stated:

This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site masquerading as an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.

The people behind this activity posted off-platform articles primarily in English and Turkish about global news and current events relevant to the countries they targeted, including local elections; geopolitical conspiracies; presidential and parliamentary elections in Hong Kong, Spain, the UK, and the US; social and racial injustice; police brutality; the coronavirus pandemic; criticism of US sanctions in the Middle East, US foreign policy, and US allies including Israel; and politics in Venezuela.

We began this investigation based on information from the FBI about this network’s off-platform activity. Our internal investigation enabled us to find the full scope of this network on Facebook. Although the people behind this activity attempted to conceal their identity and coordination, our investigation found links to individuals associated with past activity by the Russian Internet Research Agency (IRA).

The disclosure of this inauthentic network attributed to individuals connected to the IRA illustrates the adaptability of the troll farm — rather than focusing on sowing internal divisions, as it notoriously did during the U.S. elections, the assets connected to United World International primarily focused on advancing Russia’s geopolitical interests, particularly vis-à-vis Turkey and the Middle East.

Over the years, researchers, journalists, and the tech platforms themselves have done extensive work to document the Internet Research Agency’s organization, tactics, and activities aimed at influencing public opinion. While the troll factory is most infamous for its interference in the 2016 U.S. presidential election, its activities date back to at least 2013, with much of its early work uncovered by Russian investigative journalists and focused on targeting Russian domestic audiences.

The troll factory has also been the subject of numerous platform takedowns, several of which the DFRLab has reported on extensively (for example, here, here, and here). Most of this activity has consisted of online influence operations targeting U.S. audiences. The IRA’s interference campaign in the 2016 election has been the subject of an extensive, five-volume Senate Intelligence Committee investigation, and has also resulted in indictments and financial sanctions of some of the actors involved.

It’s not clear that the Internet Research Agency still exists at the same scale and scope it did when exposed by independent Russian journalists or at the height of its activity targeting the United States before and after the 2016 elections.

The impact of this latest network however, was quite limited: the main Facebook page of United World International had only 5,000 followers, and while the outlet had an active social media presence across multiple platforms, it failed to amass a significant follower base or receive sustained engagement across any of them.

United World International on social media

The United World International website describes itself as “a place where intellectuals can come together” to achieve the goals of, among other things, “objecting to the current unipolar world order.” The site presents itself as an independent news and analysis website with contributors from all over the world.

The UWI website posted anti-Western articles about the Middle East and Turkey in English from the uwidata.com page. Articles from the site were shared on the social media, including to its Facebook, Twitter and Instagram accounts.

Although the website has a Turkish version, UWI mainly posts its articles in English, and its social media presence is predominantly English-language based. This suggests the target audience of this fringe outlet is English-language speakers, with Turkish speakers as a possible secondary audience.

Examples of posts on the United World International Facebook page. (Source: United World International/archive, top left; United World International/archive, top right; United World International/archive, bottom left; United World International/archive, bottom right)

The social media numbers for the site’s online presence were middling. Since June 22, 2018, the Facebook page has garnered 4,925 followers and the Instagram account 3,101 followers. Cached versions of the website’s now-suspended Twitter account, shows it has around 6,700 followers before its suspension. A YouTube channel created in July 2018 contained just seven videos and had be viewed only a total of roughly 5,500 times. The channel had just 68 subscribers.

The “About” sections of Facebook, Instagram, Twitter and YouTube. (Source: United World International/archive, top left; united.world.international/archive, top right; @uwidata/archive, middle right; United World International/archive, bottom)

An analysis using CrowdTangle shows that at first, the page posted photos more than links. Links became more prevalent starting in January 2020, along with increased activity in terms of post count, reversing a steady decline from 2019.

The post count and distribution across post types of the Facebook page United World International. (Source: DFRLab via CrowdTangle)

The Facebook page was administered by users outside of Turkey, including one each in Russia, Spain, and Belgium.

The Facebook Transparency section also indicated that the page was administered by users based outside of Turkey, in Belgium and Spain. (Source: Facebook)

On Twitter, the tweets by @uwidata gained little traction, with most of its recent posts gaining less than 10 engagements each.

An analysis using social media Monitoring tool BrandWatch confirmed this. During the lifetime of the Twitter account, it peaked at 175 mentions on September 10, the majority of which were prompted by the account’s response to French president Emmanuel Macron.

An analysis using BrandWatch (above) indicating a significant spike in mentions of the @uwidata account on September 10. This was prompted by a response to French president Emmanuel Macron (below). (Source: DRFLab using BrandWatch; Twitter/archive)

All in all, the network was not particularly successful despite being active for nearly two years.

A linguistic analysis of the text found on the UWI Youtube channel suggested that the authors of the channel were Russian. A description of the channel, as well as the video description underneath the channel’s first video made use of the word “politilogists,” which is the Anglicized version of the Russian word for “political scientists” (политологи). This is a common mistake among Russian speakers.

The description of the first video by United World International YouTube channel with highlighted ‘politologists’ in a green box (top) and the search of the word in Merriam-Webster online dictionary (bottom) (Source: United World International/archive; Merriam-Webster)

Other videos uploaded to the channel featured interviews with various guests hosted by Elif İlhamoğlu. According to the UWI website, İlhamoğlu is a Turkish journalist and political scientist. He has also authored several articles for Sputnik Turkey, a Kremlin-owned news agency. An archived copy of the first version of the website indicated it initially employed a lone analyst in Koray Gürbüz, a Turkish author and foreign relations commentator. This suggest that the site was using legitimate authors, an operation which has echoes of the PeaceData takedown in early September 2020.

The UWI website

The UWI Facebook page directed users to an off-platform website hosted on a dedicated server in Turkey, but no additional information about the registrant is available in Whois records. According to DNSlytics’ reverse analytics tool, the UW website has the same Google analytics ID as to the chattelebot.fun website that is on hold “due to Registrant verification failure.”

DNSlytics reverse analytics tool results showing UWIData.com shares a Google Analytics code with one other website. (Source: DNSlytics)

A backlinks analysis, providing a list of webpages that cited UWI, revealed that it was frequently mentioned on a website of French think-tank Strategika. Strategika mentioned UWI as partners, with an active link to it in all of its web pages.

Backlinks analysis of uwidata.com website (on the left) and the partners’ section of strategika.fr webpage (on the right) with connected Russian sources in green boxes (Source: @r_osadchuk/DFRLab via BuzzSumo backlinks tool, strategika.fr/archive)

The Dugins

The UWI page, according to Facebook, was administrated by a Facebook account called Daria Platonova or Dari Dashjbh Dashjbhtp. Both accounts belonged to the same person, and there was a corresponding Instagram account, @daridashjbh.

The same image posted on Facebook accounts Daria Platonova, Dari Dashjbh Dashjbhtp, and Instagram account @daridashjbh. (Source: Dari Dashjbh Dashjbhtp/archive, top left; @daridashjbh/archive, top right; Daria Platonova/archive, bottom)

The number of posts and frequency of posting on each account suggested that Dari Dashjbh Dashjbhtp and @daridashjbh are personal accounts, while Daria Platonova is public-facing account. The account Daria Platonova positioned itself as “the political observer of the Geopolitika.ru portal.”

The header of account Daria Platonova. Her role as a political observer at Geopolitika.ru is underlined pink. (Source: Daria Platonova/archive)

Geopolitica.ru is a platform for geopolitical analysis that was registered by Aleksandr Dugin, a controversial Russian philosopher that played some role in the rehabilitation of Russia-Turkey relations. Geopolitica.ru shared the same Google Analytics code with the website geopolitika.ru, which is pronounced the same as the former in Russian.

Relationships of Google Analytics (in magenta) according to BuiltWith tool (Source: @r_osadchuk/DFRLab via BuiltWith)

The creator of Geopolitika.ru is Aleksandr Dugin, who was sanctioned by the United States Department of Treasury in 2015 for his role in the Eurasian Youth Union “for being responsible for or complicit in actions or policies that threaten the peace, security, stability, or sovereignty or territorial integrity of Ukraine.”

In some places and photos, Daria’s surname is not Platonova, but Dugina. Daria Dugina is the daughter of Aleksandr Dugin and has accompanied him on various trips to meet with high-level officials.

References to Daria Dugina. (Source: Dari Dashjbh Dashjbhtp/archive, top left; Dari Dashjbh Dashjbhtp/archive, right; Beginner’s Luck/archive, bottom left)

Aleksandr Dugin also appears on many posts by Dari Dashjbh Dashjbhtp as early as since 2012. For instance, they were together at a meeting with the President of Moldova, Igor Dodon. The date of the posts showing Dodon shaking hands with Dugin, and Dodon standing beside Daria was posted on the same day — May 27, 2017.

Aleksandr and Daria Dugin meeting with Igor Dodon. (Source: Dari Dashjbh Dashjbhtp/archive, top; Dari Dashjbh Dashjbhtp/archive, bottom)

Currently, the website geopolika.ru redirects directly to another partner website, Katehon. Its editor-in-chief, Leonid Savin, is also editor-in-chief of Katehon.

A redirect analysis of geopolika.ru via redirectdetective.com (Source: @r_osadchuk/DFRLab via Redirect Detective)

Katehon poses itself as a think tank focused on geopolitics in an English edition of its website. In contrast, in Russian, it states its aim to develop “ideological, political, diplomatic, economic and military strategy for Russia of the future” with a special role of religion. The president of Katehon’s supervisory board is Konstantin Malofeev, a Russian millionaire with connections to the Russian orthodox church and presidential administration, who founded Tsargrad TV, a known source of disinformation. Malofeev was sanctioned by the U.S. Department of Treasury and the European Union in 2014 for material support and financial backing of Russian-backed separatists in eastern Ukraine. Another known figure from the board is Sergei Glaziev, former advisor to Putin in 2012–2019. Dugin is also on the board in the Russian edition of the website, whereas he is omitted in English.

The comparison of Russian (on the left) and English (on the right) editions of Katehon’s ‘About Us’ page. (Source: Katehon/archive; katehon/archive)

According to Russian independent media outlet The Insider, both Malofeev and Dugin are connected and worked together with loyal to Kremlin foreigners.

There is no apparent connection between Dugin and IRA. Still, their paths crossed in 2017, when Dugin met with Kemi Seba, leader of Pan African project that was supported by the Russians, associated with Yevgeny Prigozhin, the Putin ally and businessman who was behind the IRA.

Conclusion

The DFRLab found numerous indicators of assets connection to pro-Kremlin organizations, including the family connection between the administrator of the outlet’s Facebook page and connected Russian think tanks.

The webpage promotion by other outlets suggests that pro-Kremlin actors created a network of platforms that aim at foreign audiences to amplify Kremlin messages by serving as a platform for like-minded foreign experts.


Nika Aleksejeva is a Digital Forensic Research Associate with the Digital Forensic Research Lab and is based in Latvia.

Roman Osadchuk is a Research Assistant with the Digital Forensic Research Lab (@DFRLab) and is based in Ukraine.

Follow along for more in-depth analysis from our #DigitalSherlocks.