Russia-linked disinformation operation still active, new report says
FILE - This Thursday, May 7, 2020 file photo shows the Kremlin's Spasskaya Tower, center, and St. Basil's Cathedral, left, reflected in rain water puddles in the empty Red Square during the evening rush hour in Moscow, Russia. A Kremlin-linked social media disinformation operation, dubbed “Secondary Infektion” by researchers, that sought to interfere with the 2016 U.S. election has continued its work to divide and discredit Western democracies, a new report finds — but its effectiveness has been limited by its own cautious tactics. While the group’s work has slowed, it was operational as of 2020.[AP Photo/Pavel Golovkin]
A Kremlin-linked social media disinformation operation that sought to interfere with the 2016 U.S. election has continued its work to divide and discredit Western democracies, a new report finds — but its effectiveness has been limited by its own cautious tactics.
Dubbed “Secondary Infektion” by researchers, the network was part of Russia's bid to use social media to polarize Americans ahead of the 2016 elections. It's been linked to similar efforts in Ukraine, France, Britain and elsewhere. Since 2014 it has posted thousands of times on more than 300 internet platforms.
Content from Secondary Infektion includes posts denigrating Muslims and immigrants, accusing Hillary Clinton of murder and calling German Chancellor Angela Merkel an alcoholic. Some posts have used forged documents or bogus commentary, such as a fake tweet supposedly sent from U.S. Sen. Marco Rubio accusing Britain of spying on President Donald Trump.
Graphika, a New York City firm that analyzes social media, published a report Tuesday that traces the network's operations. Compared with other Russian disinformation networks operated by Russian military intelligence or the country's Internet Research Agency, Secondary Infektion worked hard to cover its tracks — even if that hindered its work, the report found.
“They were putting a lot of emphasis on staying hidden, rather than quick virality,” said Ben Nimmo, Graphika's director of investigations and one of the report's lead authors.
Many of Secondary Infektion's posts came from “burner” accounts discarded after a single use, before they have time to grow an audience. While that made it harder for analysts to track the network, it also prevented the operation from building accounts with the kind of large, legitimate audiences that are needed to weaponize disinformation.
“Almost none of those efforts achieved measurable impact,” Graphika's report concluded. “Another enduring mystery around the operation is what the operators thought they were doing and why they kept on doing it across six years of activity when their stories so often died unnoticed."
Ukraine was the network's top target, with many posts portraying the country as corrupt. Other posts attacked the U.S. as belligerent, or Europe as weak. Some posts sought to debunk allegations of doping by Russian athletes.
While the group’s work has slowed, it was operational as of this year. One recent post included a claim that the U.S. created the coronavirus as a bioweapon.
The identity of those behind the operation remain unknown, though researchers have used technical and linguistic clues to link it to the Russian government.
Secondary Infektion emerged last year after Facebook removed several accounts later linked to the operation. Researchers at the Atlantic Council's Digital Forensic Research Lab named the network after Operation Infektion, a Soviet disinformation campaign that spread the conspiracy theory that the U.S. created HIV.
Reddit removed several dozen accounts linked to Secondary Infektion last year after concluding they were used to leak confidential government documents days before a general election in the U.K.