BANNER: (Source: @ZKharazian/DFRLab)

This is the first article of a two-part series on an online influence operation targeting Armenia. Part 1 identifies the groups responsible; Part 2 will explain the nature and scope of coordination between them.

The election of Nikol Pashinyan as Prime Minister of Armenia in May 2018, following a series of pro-democracy demonstrations termed the country’s “Velvet Revolution,” ushered in a revitalized sense of trust in government in Armenia and reinvigorated the country’s dense civil society landscape. In 2018, The Economist named Armenia its “Country of the Year,” proclaiming that now this “ancient and often misruled nation in a turbulent region has a chance of democracy and renewal.”

But while the Velvet Revolution has invigorated Armenia’s sociopolitical fabric, it has also galvanized the adversaries of political change. In recent months, several such adversaries, comprising a network under the hashtag campaign #SutNikol (translated from Armenian to “#FakeNikol”), have launched a sophisticated online influence operation with the aim of discrediting Nikol Pashinyan and his supporters by spreading biased narratives and disinformation online.

These groups are implementing a specific online manipulation technique: they masquerade as impartial fact-checking organizations to amass a trusted following among the Armenian public and subsequently inject biased narratives and polarizing statements into the country’s online political discourse. The operation is disingenuous, and it is intensifying.

The primary aim of this analysis is not only to inform the Armenian public but also to provide guidance for future researchers. As the fight against online disinformation intensifies, influence campaigns position themselves as “fact-checking” initiatives to disseminate biased narratives as objective truth. The first step in countering these efforts is to expose and explain them.

On April 15, the hashtag #SutNikol began trending in the Armenian online media environment. On Facebook, Twitter, and other social-media platforms, the hashtag often appeared alongside anti-Pashinyan content that accused the Prime Minister of propagating false promises, lies, and disinformation.

The origins of the hashtag were not immediately apparent. On Twitter, Joshua Kucera, a journalist from Eurasia.net, wondered whether anyone had examined its roots, noting that it “[s]eems… not very grassroots.” An Armenian Twitter account subsequently replied that “the four guys who came up with it are all associated with the former regime.”

Other than this exchange, there has been no open-source investigation of the digital provenance of the #SutNikol initiative. The DFRLab aims to fill that gap.

The DFRLab identified four individuals and two Facebook pages who were primarily responsible for creating and amplifying #SutNikol content online. Three of the individuals — Narek Samsonyan, Arthur Danielyan, and Narek Malyan — were associated with two Facebook pages that promoted a large proportion of the #SutNikol content. The DFRLab could not establish a direct affiliation between a fourth individual, Konstantin Ter-Nakalyan, and either of the two Facebook pages, but he was nevertheless a significant amplifier of the two pages’ content via his personal Facebook page as well as that of his blog, Blognews.am (see the blog’s archived #SutNikol content). Nakalyan was also featured in a #SutNikol video to be discussed in Part 2 of this series.

The majority of the #SutNikol content originated with two Facebook pages: Ադեկվադ (Transliteration: “Adekvad;” translation: “Adequate”) and AntiFake.am. As both groups have an active Facebook presence but no Twitter accounts, this article focuses primarily on their Facebook activity, even though the hashtag was also amplified on Twitter by individuals tied to the groups.

The Adekvad Facebook page offered little information about its operators or mission. In its “About” section, the page identified as a “Cultural Center” and offered a short phrase as its bio: “ԱԴԵԿՎԱԴ` այն, ինչի մասին լռում է Ազատությունը:” (translated from Armenian: “Adequate: That on Which Liberty keeps silent”).

While the identities of page managers were not listed, the page transparency section indicated four managers, all of whom were based in Armenia. This section also revealed that the page was created on June 23, 2018.

In under a year, this page has amassed over 21,000 likes — a significant audience, particularly for a country of only 2.93 million people.

Two men showed up repeatedly in the page’s video logs — Artur Danielyan and Narek Malyan.

The DFRLab could not attribute the Civil Solidarity NGO to individual actors.

Despite billing itself as “independent and impartial mass media,” the content on the AntiFake.am webpage was heavily focused on denouncing Pashinyan. The page offered a “Nikol-O-Meter” and “Fake News Statistics” in its sidebar to “track whether Nikol Pashinyan keeps his promises.” These measures were heavily skewed, not having classified a single one of Pashinyan’s statements as “True.”

Furthermore, while AntiFake.am claimed to focus on exposing “fake news, propaganda, and manipulation” in Armenia via “fact-based investigation,” the website’s most engaged-with articles included polarizing political commentary about Pashinyan “taking credit” for the previous government’s policies, unverified reports that a factory Pashinyan had visited “doesn’t exist,” and outright vaccine-related misinformation about Gardasil, the brand name for the HPV vaccine.

The AntiFake.am Facebook page was created recently, on February 28, 2019. Since then, it has amassed over 7,000 likes.

The DFRLab uncovered some evidence to suggest that AntiFake.am was not an entirely domestic operation. A lookup of the domain’s public Whois record revealed that its IP location was listed as Saint Petersburg, Russia:

A foreign IP location is often a hallmark of an inauthentic influence operation, though it is not conclusive proof of one on its own.

Furthermore, on whois.net, the registrant of the domain and its private contact had been “redacted for privacy.”

The redaction suggests that the operators behind the AntiFake.am website may have tried to hide their identities.

Together, the Adekvad and AntiFake.am pages racked up a combined total of 48,624 interactions, 723,242 video views, and 28,442 page likes by April 22, according to a CrowdTangle analysis. The pages also had a combined like count growth of 10.02 percent in the 7-day period between April 19, 2019, and April 25, 2019, as well as a combined 84.2 percent average weekly increase in the number of interactions from the week of March 17 to the week of April 14.

This operation can accurately be described as inauthentic. The operators of the Adekvad and AntiFake.am pages obscured their pages’ purpose by characterizing them as impartial and objective resources for the Armenian public. The DFRLab also found evidence to suggest that the AntiFake.am website may be affiliated with individuals or entities based in Russia, as well as that the domain’s operators may have attempted to hide their domain registrant information.

It is also intensifying. In just under a year, the two pages have amassed tens of thousands of interactions on Facebook and continue to gain traction.

The second part of this series examines how the operators of the Adekvad and AntiFake.am pages coordinated their efforts to spread biased narratives and inauthentic content.

Register for the DFRLab’s upcoming 360/OS summit, to be held in London on June 20–21. Join us for two days of interactive sessions and join a growing network of #DigitalSherlocks fighting for facts worldwide!