BANNER: Ukrainian President Volodymyr Zelenskiy holds a national flag as he visits a position of Ukrainian service members in the frontline town of Bakhmut, Donetsk Oblast, December 20, 2022. (Source: Ukrainian Presidential Press Service/Handout via Reuters Connect)

We’ve reached the end of another extraordinary year — a year of consequences that will reverberate globally for decades to come. From Ukraine’s courageous defense against Russian aggression, to Iranian protesters railing against a stifling autocratic regime, to the LGBTQ community standing up against extremist violence in the US, 2022 will be remembered as a year of resistance and resilience.

The DFRLab covered an extraordinary amount of ground over the last twelve months, publishing more than 200 investigations, case studies, and monitoring reports, as well as hosting our signature events 360/Open Summit and 360 Stratcom. And behind the scenes, we trained more than 1,400 people around the world representing civil society groups, independent media, and academia, exposing them to open-source research techniques as part of our Digital Sherlocks program, as well as in-person trainings on four continents.

Here’s a roundup of some of the highlights.

No story captured global headlines in 2022 like Russia’s invasion of Ukraine. DFRLab monitoring of Russian aggression in Ukraine didn’t begin the day of the invasion in February 2022; in fact, it’s been a part of our DNA since our founding following the publishing of Hiding In Plain Sight, which employed open-source investigations of Russian social media accounts to track Russia’s initial invasion of Ukraine in 2014.

Our coverage of this year’s re-invasion began in earnest in 2021, as we tracked troop movements and materiel shipments across Russia to the Ukrainian border. By January 2022, when it became clear to us that an invasion could happen at any time, we began publishing what became known as the Russian War Report. Day after day, our global team of researchers tracked Russia’s attempts to excuse its invasion plans through disinformation campaigns and false flag narratives, while also monitoring the situation on the ground and in the policy realm as Russia operationalized its invasion plans.

Over the course of the year, we’ve published more than sixty editions of the Russian War Report, but our work on Ukraine and Russia took many forms. With nearly a dozen researchers who speak fluent Russian, not to mention Ukrainian, Latvian, Georgian, Lithuanian, Polish, Romanian, Armenian, Azerbaijani, Estonian, and other languages in the region, we were in a unique position to track Russian narratives as the Kremlin made a case for war built on false pretenses. Our team reported on Russia’s attempts to frame Ukraine as the aggressor, alleging that Ukraine would start the war, engage in an array of subterfuge that proved to be Russian false flags, and even re-sell weapons from the West for profit.

Russia used such pretext to invade Ukraine and attack its cities, including the eastern Ukrainian city of Kharkiv. In the opening weeks of the war, Russia bombarded the city indiscriminately, leading to countless civilian casualties. DFRLab Research Associate Michael Sheldon successfully verified and geolocated more than 130 videos of these attacks on Kharkiv, including the targeting of schools, in the report Two Weeks That Shook Kharkiv. This report eventually led to Stanford’s Starling Lab filing a submission of evidence of war crimes to the International Criminal Court, developing and submitting a cutting-edge cryptographic dossier to preserve multimedia evidence collected by the DFRLab.

As Russia continued its assault on Ukraine, it weaponized social media to give the false impression that the world was on its side. On Twitter, for example, this took the form of fake hashtag campaigns like #IStandWithPutin. Elsewhere on the Internet, Russia attempted to undermine the authority and independence of Wikipedia by rolling out Runiversalis, a Wikipedia knockoff with Kremlin-friendly editorial policies, albeit with questionable results.

On Facebook, the DFRLab helped expose one of Russia’s largest online schemes to date — a massive network of fake pages, groups and user profiles set up to undermine the West’s confidence in Ukraine. Facebook parent company Meta ultimately removed more than 2,000 assets affiliated with this network. Identifying and exposing fake networks is a core DFRLab activity. Most recently, we reported on how a joint DFRLab investigation with the UBC Global Reporting Centre and Simon Fraser University led to Meta removing a network of fake accounts targeting independent Moroccan journalists.

The DFRLab also expanded its efforts investigating China’s attempts to assert control over public discourse regarding its domestic and foreign policies — what the Chinese government refers to as “discourse power.” The DFRLab published two reports on Chinese discourse power, focusing on its overall efforts and its operations in the Global South. In partnership with the Helena Kennedy Centre for International Justice at Sheffield Hallam University and NomoGaia, we also published Financing and Genocide, which investigated how funding supplied by the World Bank’s International Finance Corporation supported Chinese companies exploiting and oppressing ethnic Uyghurs.

DFRLab research into Chinese discourse power took other forms as well. We published a pair of investigations looking at how Chinese consulates in the United States and other English-speaking countries exploit the platform WeChat to influence and monitor Chinese expats studying and teaching abroad. DFRLab China Fellow Kenton Thibaut, meanwhile, examined China’s relationship with Zimbabwe and its influence over state-controlled media there.

Zimbabwe is one of numerous countries across the African continent negatively impacted by foreign interference, their own governments, or both. Over the last two years, the DFRLab has closely monitored Sudan, including the lead-up and aftermath of its October 2021 military coup. This year, we noted how Russian private military company Wagner Group openly bragged about its presence in Sudan via Telegram, sharing footage of foreigners training Sudanese paramilitary and armed forces. Wagner’s influence has also proliferated across West Africa, as we documented in Mali and Burkina Faso; we also investigated pro-Kremlin sentiments in Côte d’Ivoire.

In Latin America, meanwhile, the DFRLab kept a close eye on multiple national elections, several of which raised concerned about the future of democracy in the region. In Chile, we uncovered the disproportionate influence of a handful of Twitter accounts on popular election-related hashtags. In Colombia, we tracked the role that Facebook ads played in spreading disinformation during that country’s presidential primary and general election. Most recently, DFRLab Research Associate Esteban Ponce de León crunched the numbers to uncover a surge in election-fraud Twitter narratives following Jair Bolsonaro’s October 30 loss to former president Lula da Silva.

Having fluent speakers of more than a dozen languages on our team has also allowed us to better understand social media use by diaspora communities. In the wake of a mass shooting at an elementary school in Uvalde, Texas that left twenty-two people dead and eighteen injured, DFRLab Senior Research Fellow Iria Puyosa examined the role of WhatsApp in assisting Latino Americans trying to track down the latest information on the attack.

Tragically, Uvalde was far from the only mass shooting experienced in the US this year. Among the most horrifying incidents involved a white supremacist killing ten people in Buffalo, NY, and a shooter targeting a drag show performance at an LGBTQ nightclub in Colorado Springs, CO, killing five people and wounding nineteen others. Both of these attacks are emblematic of the ever-evolving threat of far-right domestic extremism, which led to the DFRLab launching its domestic extremism monitoring efforts prior to the 2020 US presidential election.

At the start of this year, during the first anniversary of the attack on the US Capitol, we released After the Insurrection, an in-depth report on how far-right groups scattered across social media platforms and reorganized around new issues, such as exerting their influence over local school boards. Our domestic extremism monitoring team continues to track the online evolution of the far right and its real-world effects, including growing transphobia across the US.

Amidst this ongoing stream of researching and publishing, we also managed to host our first major offline event since the beginning of the pandemic. In June 2022, the DFRLab convened more than 400 in-person attendees and thousands more online representing civil society, academia, the tech industry and the public sector for our 360/Open Summit in Brussels. We were joined by Secretary of State Tony Blinken with Nobel Prize Winner Maria Ressa, Director of NATO’s Strategic Communications Centre of Excellence Jānis Sārts, and Hong Kong democratic activist Chung Ching Kwong, to name only a few of our incredible speakers.

Also in attendance were more than 100 of our “Digital Sherlocks” — representatives of civil society who have participated in dozens of open source trainings we’ve conducted since the start of the pandemic. This year alone, we’ve trained more than 1,400 Sherlocks from nearly 100 countries on topics including geolocation techniques, social media analysis, OSINT research ethics and mitigating vicarious trauma. Our Digital Sherlocks program remains one of the most exciting and rewarding activities on our team’s annual calendar.

Lastly, we wrapped up the year with our other signature event, 360/Stratcom. 360/StratCom is our annual government-to-government forum at which government and civil society leaders, including the inaugural US Deputy National Cyber Director for Technology & Ecosystem Camille Stewart Gloster, convene to drive forward a democratic tech agenda for the interconnected world. This year included the release of An Introduction to the Freedom Online Coalition. Published by the DFRLab’s Democracy and Tech initiative, the report outlines the history and activities of the coalition of nearly three dozen countries working together to safeguard a free and open internet.

As 2022 comes to a close, we’re already hard at work on new projects and initiatives — stay tuned for details in the weeks and months ahead. Expect to see ongoing coverage of the war in Ukraine, Chinese discourse power, and influence operations across Latin America and Africa. We’re also establishing new teams that will expand our ability to cover North Africa, the Middle East, and the Caucasus.

When it comes to building digital resilience around the world, there’s no shortage of work to be done. We hope you continue to join us so we can all do our part making a difference, both online and offline.

Andy Carvin, “2022 at the DFRLab: a year in review,” Digital Forensic Research Lab (DFRLab), December 22, 2022, https://medium.com/dfrlab/2022-at-the-dfrlab-a-year-in-review-e6cf43710c22.