How the influence operation targeted Irish divisions
This article is part of a series analyzing the various aspects of the suspected Russian intelligence operation. Our top post summarizes these findings.
The Russian operation consistently sought to fan divisions between, and within, Western countries. That was particularly apparent in its treatment of Ireland, especially Northern Ireland.
The operation used ostensibly Irish personas on Facebook to post divisive and inflammatory content. Between March 2018 and April 2019, the operation ran at least three false stories targeting Ireland and forged documents and social media posts to support its claims.
Real Minister, Fake Tweet
On March 22, 2018, an account that Facebook identified as belonging to the Russian operation posted a Medium article to at least 15 different news groups.
According to the article, then-British Defense Secretary Gavin Williamson tweeted that the Real Irish Republican Army (Real IRA) terrorist group had helped in the attempted assassination of former Russian spy Sergei Skripal in Salisbury, England, two weeks before. As “evidence,” the article inserted a screenshot of the alleged tweet but claimed that it had been deleted within a few minutes, “which gives reason to believe that the information is sensitive and classified and thus must not be disclosed to the public until Scotland Yard completes its investigation.”
A number of factors expose the alleged “tweet” as a forgery. First, Williamson was one of the United Kingdom’s top ministers at the time. He is followed on Twitter by high-profile journalists including Mark Urban (BBC Newsnight), Carole Cadwalladr (The Guardian), Stephen Castle (New York Times), Deborah Haynes (then of The Times), and Elizabeth Piper (Reuters). Yet not one mainstream outlet reported on the alleged tweet, and a Twitter search for “Gavin Williamson IRA” date-limited to March 2018 only showed four results, none relevant.
It is only necessary to look at the online firestorm provoked by U.S. President Donald Trump’s tweet on the “Prince of Whales” — deleted and corrected after just 24 minutes — to appreciate that such an explosive tweet by Williamson, if real, would have provoked at least some online attention. The lack of any mentions confirms that the alleged tweet never happened.
The second factor is the source account on Medium. Named “Edward McGrew,” it only ever posted the one article. It used an image of British actor and comedian Hugh Laurie, in his role as TV medic “Dr. House,” as its profile picture. This use of a single-shot account on Medium, with a stolen profile picture, was the standard operating practice for this Russian operation.
Third, the article’s use of English was fluent but not native. It struggled with the grammatical articles “a” and “the” and the possessive genitive, as these lines demonstrate:
In case the information about the Real IRA militants’ involvement in Skripal’s poisoning proves true, the law enforcement have to be prepared for the worst-case scenario as terrorists may have a complete set of chemical agents necessary for creating the chemical weapon. Are the Northern Ireland’s police units prepared to provide security for the citizens in such conditions?
The Russian operation often posted its stories to several forums simultaneously, and this was no exception: accounts called “Edward McGrew” posted it to playbuzz.com and politicsforum.co.uk. On playbuzz.com, the author account was created that day, published the one post, and never posted anything else.
Reverse searching the supposed tweet revealed further versions of the story in Ukrainian, French (two locations, one deleted), and German (two locations, both deleted). One of the German locations was mein-suedhessen.de, a site the operation used several times. The article was deleted by June 14, but the associated author profile was still visible. Like the Ukrainian and French authors, the German author only posted this one article.
The reverse image search turned up one other result: a WordPress blog called “Ciencia Maldita” (Spanish for “cursed science”). The Medium post also pointed back to this WordPress blog as its source.
The WordPress blog largely shared articles from known news outlets such as CNN and The Economist on Latin American issues. It posed as a Latin American source, rejecting “norms of political correctness imposed on us by our northern neighbors,” although the author seemed uncertain of basic Spanish, referring to the Russian President as “seignior Putin,” when “señor” (Spanish) or “senhor” (Portuguese) would be more likely in a native speaker.
The blog appears to have been the original source of the fake Williams tweet. It claimed to have found the screenshot online but did not provide a source link, only an image. Its post argued that Russia could not have ordered the Salisbury poisoning and that it must have been a false-flag operation by “senhora” Prime Minister Theresa May, either to disrupt the Russian president’s reelection or to distract the British public from Brexit. These were two tropes of Russian state messaging at the time.
The likelihood is that the “Ciencia Maldita” blog was also part of the Russian operation, used to seed content.
An Email That Never Was
The second attempt came five months later in August 2018. This time, it started on Facebook, when an ostensibly Irish account posted an allegedly leaked email on the Brexit negotiations.
The post claimed that it was sharing an email from Arlene Foster, leader of the Democratic Unionist Party (DUP, the minority party supporting the United Kingdom’s Conservative government), to chief Brexit negotiator from the European Union (EU) Michel Barnier. The alleged email — presented as a screenshot — claimed that DUP members had found the EU’s stance on Brexit “more favourable than the one we received from the UK Cabinet.”
This would have been a political bombshell, as the DUP has consistently opposed any EU-UK deal that would leave Northern Ireland less closely associated with the rest of the United Kingdom.
But again, a Google search for the terms “Arlene Foster Michel Barnier email” between August 1 and August 14, 2018, returned no relevant results. Two months later, by contrast, many British media reported a genuine set of leaks (from British government sources) that claimed that Foster had called Barnier “hostile and difficult” and that she was preparing for a no-deal Brexit. The alleged email from Foster to Barnier appears to have been, again, a fake.
Two days after the Facebook post, a single-use account on Medium called “Will Dobson” posted a longer article headlined, “After Brexit, Northern Ireland may obtain a special status in the EU.” Based on the forged “leak,” it claimed that the DUP was “ready to sacrifice its arrangement with the [Conservatives] and even leave the United Kingdom ‘under certain conditions’” and warned of “bloody confrontation” in Ireland as a result.
This article was written in largely fluent English but still contained a few apparently non-native sentences, such as:
“Prime-minister’s rigidity can not only spoil stable relations with Ireland, it can also accentuate the growing separatist sentiment inside the country.”
“Requesting the restoration borders between Ulster and the Republic of Ireland is, by far, quite shortsighted for May.”
Characteristically of the Russian operation, the identical article, under the same byline, was posted the same day to indybay.org, beforeitsnews.com, and, bizarrely, cssforum.com.pk, a forum for the Civil Service of Pakistan. It was also posted as a meme to Imgur. On each platform, this was the author’s only post.
Between August 8 and 10, versions appeared in German on homment.com, Reddit, and Indymedia.org (where the link is now broken), and in Spanish on rankia.com and four separate Reddit threads. All these accounts were created the same day they posted the article; two subreddits rejected the posts, for that reason.
Once more, the Russian operation’s pseudo-Irish account gave the Imgur post a further push, sharing it to a number of political forums.
The evidence therefore suggests that every stage of this story —an initial Facebook post channeled through Medium, Reddit, and all the other forums and languages, which are ultimately posted back to Facebook — was the work of the same operation.
Those Islamist Catholics
The third attempt came just over a year after the first. On April 22, 2019, an apparently Ireland-based user posted a sensational claim to the r/ireland subreddit. The post alleged that the Real IRA had posted an Arabic-language invitation to Islamist fighters to “join the RIRA and fight on the Irish soil.” The article was posted by the account u/robeharty, created that same day; it was “his” only post.
The Reddit post claimed to have found the invitation on an Arabic discussion forum largely devoted to religious texts and Islamic scholarship. It said that the call was “published on one of the Islamic discussion boards” but did not provide a specific link, only a screenshot.
The English syntax in the Reddit post was distinctly non-native:
“To join the RIRA and fight on the Irish soil.”
“A headhunter of the Real Irish Republican Army published on one of the Islamic discussion boards a message.”
“Muslim extremists from a number of world’s hotspots.”
The DFRLab identified the discussion board from which the Arabic-language post was allegedly taken but found no trace of the alleged post. This suggests that it was either a planted post that was later deleted or a doctored screenshot.
The Reddit article only received one vote and no comments. The following day, however, a user account on Medium called “William Couch” posted a longer article headlined “Following Brexit is a new fight for United Ireland.” This article pointed to the Reddit article as its source; like u/robeharty, “William Couch” only ever posted one article.
Also like the u/robeharty post, this post contained language errors:
“In 2016 on a public vote…”
“The RIRA never abandoned the idea of military struggle for freedom and independence of united Ireland.”
“Could it really be true that RIRA agreed to make business with Islamic radicals?”
The same day, April 23, the Russian operation’s main pseudo-Irish Facebook account shared a link to the Reddit article.
A Google search for the Reddit link embedded in the Medium article revealed that the exact article was posted to two other forums on April 23: homment.com and beforeitsnews.com. Both were attributed to “willcouch;” in each case, this was the user’s only post.
The search also returned a Spanish version of the article, posted to five separate forums on April 24: r/espanol, r/spain, foroexplayate.com, globedia.com, and mediavida.com. Each one was posted by a user account called “Antonio Diaz,” created the same day, which used a picture of the back of Batman’s head for “his” profile.
A further version was posted in French on April 25.
Each of these stories used the same techniques. They started by posting a forgery online, amplified it with a number of accounts created especially for that purpose, and finally boosted the content on Facebook.
None of the stories gained any traction. In part, this was likely due to the nature of the content; in part, it was due to the obsessive secrecy with which the operation was conducted, using a separate burner account for every stage. This meant that the operation never had the chance to build up a following or develop its audience.
What is remarkable is the brazen nature of the forgeries themselves, and the repeated attempts to fan the divisions within Ireland and the United Kingdom. The Russian operation launched not one, but at least three separate forgeries, one attributed to a senior minister, another to a party leader. Each time, the apparent purpose was to exacerbate the already raw divides in Ireland and the United Kingdom.
Follow along for more in-depth analysis from our #DigitalSherlocks.
