In June 2016, Spiegel Online ran a story about Anonymous.Kollektiv, a Facebook page accused of publishing hate speech and incitements to violence. The page had been investigated by the German authorities and blocked from Facebook in May 2016.
Following the investigation, Spiegel Online reported that the police had issued an arrest warrant for page manager Mario Rönsch on suspicion of fraud and incitement. However, the investigation was put on hold because the German authorities lost track of Rönsch.
It appears, however, that Mario Rönsch and his Anonymous.Kollektiv are still active and have transformed into a popular fake news site, www.anonymousnews.ru, supported by a page on Russian-based social network Vkontakte.
The site itself publishes alarmist, tendentious and outright fake news, especially with an anti-migrant and anti-government stance. Some of its recent headlines are:
· Disclosed: refugees committed 556,000 crimes — media and politicians are silent
· Merkel’s regime wants to introduce prison sentences to disaffected German citizens
· Merkel’s regime condemns starving pensioners
· Hungarian Secret Service: Thousands of migrants are preparing a civil war in Germany
The site was created on the last day of May 2016 (see WHOIS look up data below):
The connection between anonymousnews.ru and Anonymous.Kollektiv becomes apparent when examining its social media presence. The site’s Vkontakte page is called Anonymous, but its URL is https://vk.com/anonymous.kollektiv. An article pinned to the wall of this page is about the “censorship” of Anonymous.Kollektiv on Facebook and its subsequent move to www.anonymousnews.ru and Vkontakte.
The Vkontakte account has gained some popularity, with over 48,000 followers, 24,750 of whom state their current location as Germany.
According to the website’s public metrics, meanwhile, its articles on average have over 100,000 views. According to data from online analysis tool Alexa.com, the site gets over half a million unique visitors from Germany every month.
Interestingly, one of the sites users tend to visit immediately after the anynomousnews.ru is a site called migrantenschreck.ru, an online retailer of guns that look real, but use rubber bullets.
The guns are advertised as a protective measure against refugees and migrants coming to Germany. Literally translated, “Migrantenschreck” translated means “Migrant fright”. The text in the site’s homepage says:
“Protect yourself and your family! We offer first-class quality goods, sent discreetly at a fair price. Without annoying bureaucratic hurdles or annoying paperwork. Simply order, pay conveniently and receive the delivery. Simple, fast and discreet — that’s the motto of the ‘Migrant Fright’.”
Although the site is currently under maintenance, an archived version of the site lists its location in Hungary (a parallel to its citation of the Hungaruian secret services listed above) and its CEO: Mario Rönsch.
The systematic link between the Migrantenschreck site and anonymousnews.ru becomes more apparent when we look at advertisements on anonymousnews.ru: every page on the site has an advert to migrantenschreck.ru:
Interestingly, both anonymousnews.ru and migrantenschreck.ru. are hosted in Russia and are associated with Russian IP addresses.
The coordinates associated with the two websites are identical. A quick search on Google Maps leads to the Kremlin:
However, these sites are not actually operated somewhere in the Kremlin, but instead the website (iplocation.net) provides the most central point of the city associated with the IP address, thus the Kremlin, much as an IP in Washington D.C. may point to the White House. This does, however, show that the site is taking an advantage of Russian Internet’s permissiveness when it comes to fake news.
Anonymousnews.ru is not the only site taking advantage of the Russian Internet. Forensic research has identified at least two highly biased German news sites that are hosted in Russia — brd-schwindel.org (its recent headlines include: “They are settlers, not refugees”, “The World War as a battle between the dark and the blondes”, “Merkel’s Germany: where people envy North Koreans for their citizen rights and freedom of speech”) and unser-mitteleuropa.com (some of the site’s recent headlines feature: “Asylum seekers are threatening domestic workers”, “Now it’s ok: sex offenders are released in Innsbruck”, “Germany must be Islamized”) :
The IP coordinates of the two sites also point to the Kremlin, meaning that there are no precise coordinates for where this server is actually located.
The .ru domain
This clustering of fake and hate sites to servers in Russia, and to VK, fits into a broader pattern. In May 2016, the same month as Anonymous.Kollektiv was blocked from Facebook, The Atlantic magazine reported on a trend of Western white supremacist groups moving from Facebook to VK.
Separately, since 2015, the Russian government has been encouraging Russians to leave Facebook for Vkontakte after it blocked some anti-Ukrainian content, saying that Russians would have greater freedom of speech there.
That is not to say that Vkontakte does not have any hate speech guidelines. The Russian social networking site, however, has been known to enforce its rules by different standards to Facebook and other western social media networks. Both Vkontakte and Facebook focus their efforts to block ISIS supporters, but Vkontakte also focuses on anti-Kremlin groups, largely ignoring foreign white supremacists.
This reflects a broader pattern in Russia. As the Associated Press reported last year, at least 54 people were sent to prison for posting alleged ‘hate speech’ online. The AP’s investigation revealed that the ‘hate speech’ was often anti-government rhetoric. It suggests that the Russian government, as well as Vkontakte, have the capacity to crack down on what is presented as hate speech, but have a selective way of doing so.
Under Russian laws, the .ru and .rf domains fall under the jurisdiction of state media watchdog Roskomnadzor. Roskomnadzor has been long known for using Russia’s hate speech and extremist laws to target the opposition, while allowing far-right movements based outside Russia to post with impunity:
In 2015, Roskomnadzor blocked 133 domains, according to this thematic breakdown by independent anti-racism NGO the SOVA Center:
· xenophobic material of modern Russian nationalists — 19;
· various inciting anti-government materials (including Anarchist materials) — 4;
· non-violent opposition websites — 18;
· materials of Muslim militants and other calls for violence by political Islamists — 22;
· other Muslim materials –17;
· non-violent Ukrainian websites — 32;
· websites of banned Ukrainian organizations — 18;
· parodies banned as serious statements — 2;
· large body of various texts, blocked in its entirety — 1.
Note that none of these categories includes white supremacist/far-right groups based abroad. The authorities did ban some sites containing “xenophobic material of modern Russian nationalists” and have targeted ultranationalists, recently seen with Egor Prosvirnin of Sputnik &Pogrom, but this can be explained in the context of Russia’s domestic politics. The Kremlin sees the domestic far-right as a threat to the regime, due to their inclination and potential to seek power through violence.
The far-right groups abroad, however, are seen as tools to destabilize societies and infiltrate foreign governments. Considering Russia’s unequivocal support to many far-right groups in Western Europe, their ability to host fake news and hate speech on Russian servers is entirely consistent with the broader relationship. The .ru domain, therefore, provides outlets such as Anonymous.Kollektiv with a safe online haven, free from court orders and bans.
Maks Czuperski is the Director @DFRLab & Special Advisor to the President Atlantic Council. Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab). Donara Barojan is a Digital Forensic Research Associate in the @DFRLab’s Digital Research Unit Baltics.
