BANNER: In this photo from the 2016 Ugandan presidential election, Uganda’s President and the presidential candidate Yoweri Museveni of the ruling party National Resistance Movement (NRM) waves to his supporters as he arrives at a campaign rally in Entebbe, Uganda, February 10, 2016. (Source: REUTERS/James Akena TPX IMAGES OF THE DAY)

A network of PR firms, news organizations, and inauthentic social media accounts has engaged in a coordinated campaign to promote Ugandan President Yoweri Museveni ahead of the country’s January 14, 2021 presidential election, the DFRLab has learned.

A DFRLab investigation into the network, which began as part of its ongoing analysis of pre-election activity, uncovered a collection of Twitter accounts and Facebook pages engaging in suspicious online behavior. Accounts posted verbatim messages supporting the Ugandan government and criticizing the opposition, for example; Some of these accounts included users who appeared to be journalists.

After sharing our initial analysis with both platforms, they conducted an independent investigation and took action against the assets for violating their rules regarding coordinated inauthentic behavior (CIB), with Facebook removing them on January 8 and Twitter on January 10, 2021.

According to a statement, Facebook’s internal investigation attributed the network to a group within Uganda’s Ministry of Information, Communications and Technology:

Museveni, who has ruled Ugandan since 1986, is running for a sixth term, as presidential term limits were scrapped in 2005. In previous elections, Museveni and his political party, the National Resistance Movement (NRM), have been accused of violating free speech and free association, as well as intimidating journalists in an attempt to curb the spread of information. During the lead-up to the 2021 elections, critics accused the incumbent president of using COVID-19 measures to “control and destroy” opposition parties.

Opposition leaders have taken to social media ahead of the election to promote their messages, as freedom of the press is increasingly threatened in Uganda. This is not the first time the Ugandan government has been embroiled in social media scandal; in December 2020, the Ugandan Communications Commission (UCC) requested a number of opposition YouTube channels be removed for inciting violence, a request that was viewed as both “political” and exhibiting “prejudice.”

The DFRLab investigation into this network started as part of ongoing research into disinformation and intimidation targeting presidential candidate Robert Kyagulanyi Ssentamu, commonly known as Bobi Wine, and the Ugandan government’s violent response to anti-government protests. A group of 10 Twitter accounts copying and pasting the same content unravelled a PR firm and news organization using social media to promote President Museveni and other members of his government.

These accounts regularly retweeted Museveni and his proponents with quotes containing the hashtags #SecuringYourFuture and #SevoLution. “Securing Your Future” is Museveni’s current campaign motto, while “Sevo” is a nickname for the president. The accounts were some of the first to retweet Museveni’s tweets, and often included the same text and hashtags when quoting his tweets. They responded quickly to negative comments about Museveni from other users using the same copied and pasted text.

In one instance, eight of the accounts quoted a tweet by government press secretary Don Wanyama, including the standard #SecuringYourFuture and #SevoLution in their quotes. The tweets were posted minutes apart, between 11:17 and 11:21 East Africa Time (EAT).

Seven of the 10 accounts did not contain any identifiable information: their banner images and profile pictures were lifted from sites such as Pinterest, and they posted no personal information about the account operators. The other three accounts claimed to be operated by a PR firm, a news organization, and a journalist.

Two of the primary social media accounts included in the network promoting Museveni and the NRM party were Kampala Times, a news website, and Robusto Communications, a PR firm. According to the corporation tracking database Open Corporates, Kampala Times Media Ltd and Robusto Communications Co Ltd are registered private companies that were incorporated in Uganda in 2019.

Robusto Communications’ now-deleted Twitter account, @RobustoUg, was created on November 10, 2018. It originally posted infrequently, commenting on seemingly random videos of animals and world news, and only began to post share more politically aligned content in January 2019. Despite advertising itself as a PR and communications firm, Robusto Communications did not post any information about its services or post content relating to communications and PR. Instead, the Twitter account focused on retweeting Museveni and his supporters or posting links to the Kampala Times website.

Unlike Robusto Communications, which did not appear to have a dedicated website, WHOIS data revealed that kampalatimesug.com was created on August 21, 2020. The website claimed that Kampala Times was an independent news aggregation service that was fully automated and linked to news websites around the world. It did not provide any other information about the operators of the site or the team members.

Although the website was created in August 2020, the Facebook page for the company was created on May 29 of that year, soon followed by its Twitter account @KampalaTimes_ on June 5. The first post to the Kampala Times Facebook page was a profile picture with information about Robusto Communications, indicating a clear connection between the two companies.

The Facebook page for Robusto Communications, “RobustoUg,” was created two months earlier on March 22, 2019, and included a link to the Kampala Times in its “About” section. Both pages also listed the same contact number.

Despite not having a dedicated website or any other information about its communication services, Robusto Communications posted job applications in May and August 2020 looking for a social media administrator and a Twitter administrator for a “fast growing communication company.”

RobustoUg posted a combination of articles by Kampala Times and information that looked like news stories tagged #KampalaTimes, although the page only started sharing posts by Kampala Times on July 2, 2020. Posts that did not follow this format were primarily copied and pasted from other Ugandan websites without accreditation. A post from December 9, 2020 with 13 shares and 5 likes that was presented as breaking news was lifted directly from a website called Trumpet News. The text and image from another post from December 17 were stolen from the Facebook page of the popular Ugandan newspaper Daily Monitor.

Almost all the posts by RobustUg were shared by a profile called Nakamya Ritah, both to its own wall and to multiple Ugandan Facebook groups. The account also shared the first posts created by the Kampala Times page, in June 2020. The Nakamya Ritah profile had no unique images; its profile picture was an image of the Ugandan coat of arms, and its banner image a woman standing in front of an elevator that had been uploaded to Pinterest in 2017. The same image, along with other images uploaded by the Nakamya Ritah profile, was used by some of the Twitter accounts included in the network.

Excluding Robusto Communications and Kampala Times, the eight other accounts involved in the Twitter network also had corresponding Facebook profiles focused on sharing content from both Kampala Times and Robusto Communications, as well as amplifying pro-Museveni content. Although the eight user accounts corresponding to the eight Twitter accounts within the network did amplify the reach of Kampala Times and Robusto Communications, the Nakamya Ritah profile seemed dedicated to spreading posts from the two pages to pro-Museveni Facebook groups.

The email address in the “About” section of the RubustoUg page included the name Nakamya, suggesting a potential connection between the profile and Robusto Communications. A closer look at the Kampala Times website showed that most of the articles were uploaded to the website by a user named Ritah Nakamya, the inverse of the Facebook profile name Nakamya Ritah.

The article bylines changed when clicking on the specific article links. Although the pieces were primarily uploaded by Ritah Nakamya, another user name, Innocent Vuga, also appeared to be responsible for uploading content. A look at the website’s source code indicated that Ritah Nakamya was listed as user number 2, while Innocent Vuga was listed as user number 4. The DFRLab could not identify any information on users 1 and 3; however, Nakamya and Vuga were the only users to upload content to the website.

The URL for Ritah Nakamya’s author profile contained the name “Dickson Okello,” which is very similar to “Dickens Okello,” the name of the journalist whose Twitter account was among the 10 initially discovered by the DFRLab. The Kampala Times website had no other reference to Dickson or Dickens Okello as an author or a user uploading content. Unlike the Nakamya profile, the URL for the Innocent Vuga profile reflected the correct name.

The in-text bylines for the articles themselves often differed from the name of the accredited user uploading the pieces. In some instances, articles uploaded by Ritah Nakamya were allegedly authored by Innocent Vuga or Vuga Innocent. Other names identified in the network by the DFRLab, including Akech Oilvia, were also cited as authors of articles by Kampala Times.

One of the oldest accounts in the network, both on Facebook and Twitter, was that of journalist Dickens Okello. According to ChimpReports, a Ugandan news website whose Facebook page was subsequently suspended in the takedown, Dickens H Okello wrote a combination of local and world news stories from as early as October 2014, with a large number of positive pieces dedicated to NRM politicians and parliamentary speaker Rebecca Kadaga. However, the @dickens_okello1 account, which joined Twitter as @dickens_heavens in August 2013, started tweeting links to ChimpReports and asking for comments and interviews as a ChimpReports journalist as early as December 2013. The Facebook URL for a “Dickens Okello Honeystraw” profile indicated that the account was originally created as “Dickens Honeywell.” According to ChimpReports, Okello’s middle name is Honeywell. Some of the earliest tweets by the Dickens Okello account include references to a personal email address that included the words “dickens” and “Honeywell.”

On Twitter, Okello amplified Museveni and his government as a member of the network of 10 accounts that copied and pasted content and was the first account to engage with @RobustoUg for months. On Facebook, Okello was more original in his posts. He was vehemently pro-Museveni, shared NRM-related content on a daily basis, and attacked supporters of opposition candidate Bobi Wine. His ChimpReports articles were amplified by the accounts within the network, including Robusto Communications and Kampala Times, as well as the Nakamya Ritah account.

The removal of Dickens’ accounts as part of a network allegedly operated by the Ugandan ICT ministry brings into question his legitimacy as an independent journalist, as well as the news organization ChimpReports, which has been operating in Uganda for over a decade. At the time of writing, ChimpReports remains active on Twitter, as does its editor, Giles Muhame, though their Facebook pages were suspended in the takedown.

The Ugandan government and supporters of President Museveni’s NRM party responded angrily to the Facebook takedown. Don Wanyama, senior press secretary to President Museveni, tweeted, “Shame on the foreign forces that think they can aid and plant a puppet leadership on Uganda by disabling online accounts of @NRMOnline supporters.” In a subsequent tweet, he demanded that the national communications regular investigate Facebook and Twitter. “Big techs like @Twitter & @Facebook are being used by opponents of @NRMOnline to stifle pro-NRM voices in Uganda,” he stated. “They should “unfreeze” accounts they froze yesterday & today. We pray @UCC_Official is watching & can act to ensure a fair digital playfield. #StopTechcolonisation”

At the time of writing, the hashtag #FreeNRMAccounts was trending on Twitter.

Meanwhile, Museveni supporters are circulating meme-friendly images to demand the platforms restore the pages and accounts.

The DFRLab will continue investigating the inauthentic networks taken down by Facebook and Twitter and will publish additional reporting in the weeks and months ahead, including a deeper analysis of the content shared by these networks.

Tessa Knight, “Social media disinformation campaign targets Ugandan presidential election,” Digital Forensic Research Lab (DFRLab), January 11, 2021, https://dfrlab.org/2021/01/11/social-media-disinformation-campaign-targets-ugandan-presidential-election/.