2021: DFRLab’s year in review

A year of disinformation campaigns, troll farms, troop buildups, vaccine rumors and a failed insurrection

10 min readDec 20, 2021


The US Capitol, January 6, 2021. (Source: Reuters/John Nacion/NurPhoto)

By Andy Carvin

This past year has been a blur for so many of us, especially due to the never-ending uncertainties of COVID-19. While 2021 may have felt like it passed by faster than 2020, that didn’t make it any less complicated.

At the DFRLab in 2021, we remained laser-focused on the stories that haunted us in 2020 and didn’t seem to let up this year, from the January 6 Capitol Hill insurrection and the aftermath of the 2020 election, to the countless ways bad actors have continued to exploit the pandemic for political or financial profit, to how information technologies have underpinned rising geopolitical competition. And yet, while it would be easy to reduce 2021 to a year of insurrectionists and quarantines, they are not the only consequential stories of the last 12 months.

In so many ways, 2021 was a collection of interrelated challenges reflecting the broader existential moment facing humanity, from rising authoritarianism and the backsliding of democracy to cynical anti-science denialism that undermines public health and further entrenches environmental threats. Humanity is more connected than ever before — a fact that has been easily weaponized by anti-democratic forces and others seeking to undermine trust in public institutions and civic dialogue.

So, to wrap up 2021, I’d like to offer a top 10 list of some of the most important topics we’re proud to have covered this year. Our ever-expanding team of more than two dozen researchers and editors across five continents and more than a dozen countries applied the latest open-source and digital forensic methodologies to bring you a data-driven understanding of our global information ecosystem. The list that follows is just a sample of more than 150 case studies and reports we published over the course of 2021.

My sincerest thanks to all of you who have supported the DFRLab’s work, and our ongoing mission to identify, expose, and explain disinformation where and when it occurs using open-source research; to promote objective truth as a foundation of government for and by people; and to protect democratic institutions and norms from those who would seek to undermine them in the digital engagement space.

Digital authoritarians and the people fighting them

Demonstrators hold placards during a protest against the military coup in Yangon, Myanmar, February 15, 2021. (Source: REUTERS/Stringer/File Photo)

Authoritarians worldwide continue to exploit social media and communications more broadly, while the activists who stand against them do their best to innovate and survive. In April 2021, we released Digital Autocracy: Maduro’s control of the Venezuelan information environment, the culmination of a 16-month monitoring effort of Nicholas Maduro’s regime in Venezuela. The report analyzed the information environment in Venezuela, exploring the Maduro regime’s tactics when promoting influence operations in the country and abroad. It also examined how other nations, especially those allied with Venezuela, such as Russia, Cuba, and Iran, attempted to influence Venezuela. The report revealed that influence operations, mostly from the Maduro regime, have clouded the information environment in the country, helping Maduro control the flow of information to the Venezuelan populace, preventing Venezuela from returning to a more democratic path.

In Russia, we’ve also observed opposition leaders targeted by the digital equivalent of dirty-trick campaigns. Last January, for example, Instagram was flooded with fake accounts using AI-generated faces — photographic deep-fakes — to overwhelm legitimate discussions between activists who had organized a mass rally in support of leading Putin opponent Alexei Navalny. They even used the social platform to distribute fake posters identifying Red Square as the location of the protest, where in fact it was taking place elsewhere. More recently in September, we observed other dirty tricks utilized in an attempt to undermine the Navalny strategic voting campaign. Counterfeit apps in Google’s and Apple’s app store, as well as fake accounts on the widely popular messaging app Telegram, misdirected voters on how to participate during Russia’s 2021 legislative elections, potentially undermining Navalny’s efforts to help voters.

In China, the ruling communist party used its growing influence network to deflect attention away from its crackdown against democracy in Hong Kong and its repression of ethnic Uyghurs in Xinjiang province. The day after insurrectionists attacked the US Capitol on January 6, Chinese Foreign Ministry spokesperson Hua Chunying called out what she referred to as a US government “double standard” for condemning the insurrection while simultaneously celebrating Hong Kong protests as a “beautiful sight to behold.” This quote had actually been used by US House Speaker Nancy Pelosi (D-CA) as part of a 2019 candlelight vigil honoring the victims of the 1989 Tiananmen Square massacre rather than anything to do with Hong Kong protesters. Six months later, China severely criticized Canada for the ongoing discovery of mass graves linked to First Nation residential schools, where thousands of Indigenous Canadian youth had been taken from their families to be assimilated. While Canada continues to reckon with this devastating legacy, China’s remarks could hardly be taken as sincere, as they came in the wake of Canada’s leading role calling for investigations into the genocide of ethnic Uyghurs in Xinjiang Province.

In Myanmar, meanwhile, we witnessed the aftermath of a violent military coup that continues to grip the country. Activists, however, remain undeterred, and have even found the strength to innovate as part of their resistance. As we reported this August, activists in Myanmar are keeping their movement alive through groundbreaking uses of hashtags and coordinating daily campaigns to rally supporters and shame their opponents. Rather than simply slapping on a single hashtag to their tweets, they tap into a combination of strategic and tactical hashtags that serve a distinct, specialized purpose while keeping up a narrative thread, month after month.

The aftermath of the US election: January 6 and beyond

January 6, 2021. (Source: Reuters/Leah Mills)

The year 2021 began with uncertainty and dread for the future of American democracy in the wake of then-President Donald Trump’s attempts to undermine and reverse the results of the presidential election. For six months leading up to election day, the DFRLab worked in close partnership with Stanford University, the University of Washington and Graphika, monitoring disinformation campaigns attempting to interfere with the election. This initiative, the Election Integrity Partnership, or EIP, came together in June of 2020 at the encouragement of the US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, or CISA. EIP coordinated real-time monitoring and evaluation of election disinformation, employing as many as 20 researchers and students at any given time, ultimately involving more than 120 analysts. These efforts helped journalists across the country contextualize disinformation efforts as they occurred, as well as map out broader disinformation trends over the course of the election. This resulted in the March 2021 publication of The Long Fuse: Misinformation and the 2020 Election, a comprehensive report on online interference in the presidential election.

These attempts to interference with election results ultimately culminated with the horrifying assault on the US Capitol on January 6. The insurrection, though, did not happen out of nowhere. It was the culmination of four months of the so-called “Stop the Steal” movement, which saw domestic extremists converge with conservative activists as their interests seemingly aligned. The DFRLab spent those four months conducting daily monitoring of these activities, ultimately resulting in our Stop the Steal social media timeline, published in partnership with Just Security in February 2021.

Sudan’s fledgling democracy and its many opponents

RSF General Mohamed Hamdan Dagalo, aka “Hemeti,” delivers an address in Khartoum, May 18, 2019. (Source: REUTERS/Mohamed Nureldin Abdallah)

It’s been three years since the Sudanese revolution began with protesters marching in the streets, ultimately leading to the overthrow of dictator Omar al-Bashir and a transitional civilian government. The struggle for democracy has been extremely difficult and paved with blood, with an October 2021 military coup throwing the future in doubt. The DFRLab has maintained a close eye on this underreported geopolitical flashpoint, from our discovery earlier this year of a Russian influence operation targeting the transitional government to our analysis of how Sudan’s leading paramilitary group manipulated social media in its favor prior to the coup. Despite these setbacks, protesters continue to march every week, and we’ll be following whatever happens next.

Governments rigging elections with influence operations

In this photo from the 2016 Ugandan presidential election, Uganda’s President and the presidential candidate Yoweri Museveni of the ruling party National Resistance Movement (NRM) waves to his supporters as he arrives at a campaign rally in Entebbe, Uganda, February 10, 2016. (Source: REUTERS/James Akena TPX IMAGES OF THE DAY)

It’s hard for any year to pass without there being multiple instances of governments manipulating social media to ensure their hold on power. In January 2021, the DFRLab uncovered an operation by the Ugandan government in support of President Yoweri Museveni’s re-election. This operation, which Facebook traced to Uganda’s telecom ministry, used social media assets and news websites to promote Museveni while attacking opposition candidate Bobi Wine. Facebook ultimately took action against the network just prior to the presidential election, to which Museveni responded by shutting down social media until the election was over.

More recently, we investigated a sophisticated trolling operation run out of Nicaragua’s postal ministry in support of President Daniel Ortega and his wife, Vice President Rosario Murillo. Facebook identified more than 1,400 assets being used to support Nicaragua’s first family and undermine the opposition. But that wasn’t the extent of it. As we reported in our investigation, the network ran a cross-platform operation that stretched well beyond Facebook and Instagram, including inauthentic assets on Twitter, Telegram, YouTube, TikTok, Blogger, and possibly other platforms, including Pinterest.

Civil war in Ethiopia

An Ethiopian woman stands at a window of a temporary shelter at the Village 8 refugee transit camp in Sudan, which houses refugees fleeing the fighting in Ethiopia’s Tigray region, December 2, 2020. (Source: REUTERS/Baz Ratner)

The ongoing civil war in Ethiopia remains one of the most troubling events of 2021, as both sides use all the tools at their disposal to beat gain an advantage over the other. In April, we reported on the well-organized “click-to-tweet” campaigns that utilized the same methodologies employed in political activism to flood Twitter with messages supporting and antagonizing each side of the conflict. Later, we investigated the dissemination of a pro-Eritrean government report on the war that claimed to document disinformation about the conflict, but was in fact a form of propaganda in its own right. Most recently, we uncovered multiple examples of social media being used to foment ethnic hatred in Ethiopia.

The immigration crisis in Belarus

Afghan refugees caught in a border standoff between Polish and Belarusian border patrols in Usnarz Gorny, Poland, 20 August, 2021. (Source: Reuters/STR/NurPhoto)

Since the beginning of summer, the government of Belarus has actively encouraged immigrants and refugees to come to the country. Their encouragement has nothing to do with altruism, though, as these migrants were then sent off to the Belarusian borders with Poland and Lithuania; both of those countries struggled to cope with the humanitarian crisis as it expanded, week after week, leaving migrants caught in the middle. It’s among the most clear-cut examples we’ve seen in Europe of an online influence operation leading to real-world harm and human suffering, where the exploitation of people seeking a better future for themselves and their families is the tip of a spear in a cynical game of hybrid warfare. The DFRLab has documented the crisis since the beginning, from the expansion of Arabic Facebook groups promoting travel to Belarus, to open-source evidence of how the Belarusian government exploits the migrants.

The Taliban takes Afghanistan

Screencap of a video showing Taliban forces in Rukha, at the edge of the Panjshir Valley. (Source: @AsiaFreePeers/archive)

The fall of Kabul to the Taliban was simultaneously among the most shocking, and unsurprising moments of 2021. As we reported at the time, it was the culmination of a 20-year information war conducted by the Taliban, aggressively exploiting the Internet throughout that period, climaxing with a Twitter propaganda campaign as they retook the capital. With the departure of journalists and human rights workers from the country, we’ve once again had to turn to using open-source techniques to monitor what has happened since, from the resumption of publicly displaying execution victims to evidence of the Taliban successfully gaining control of operational helicopter gunships.

COVID disinformation, from bioweapons to vaccine hesitancy

Protesters argue with police during the protest on December 12, 2020 in Riga. (Source: Edarttv/archive)

The DFRLab has covered the COVID-19 crisis since the first weeks of the outbreak in January 2020, publishing 100 stories on the topic over the course of two years. Our biggest effort this year was our report, Weaponized, which investigated the origins of conspiracy theories that COVID-19 had been intentionally created as a bioweapon, and how various “strains” of these rumors were utilized in Russia, China, the US and Iran. Since then, our coverage has focused primarily on disinformation regarding vaccines, as populist politicians have exploited vaccine fears to further their influence while governments like Russia and China promoting their own vaccines at the expense of vaccines developed in the west.

Russia pressures Ukraine

(Source: Capella Space)

For more than six years, the DFRLab has tracked Russian activity in and around Ukraine. In 2021, these activities came into sharp focus as Russia built up its military presence along the border and in Crimea. In March, we reporting on the presence of Russian radar systems and continued monitoring buildups that spring. The situation has taken on increased urgency, as we continued tracking significant troop movements through December.

Ongoing challenges in India

(Source: @dfrkaul)

The DFRLab spent 2021 monitoring multiple difficulties in the world’s largest democracy. In Jammu and Kashmir, militants have taken up strategies learned from the Taliban while using messaging apps to avoid detection by security forces. Meanwhile, Indian democracy and civic discourse remain under threat, as pro-government influencers amplified hashtags that called for violence against protesting farmers and Indian diplomatic consulates promoted pro-government content published by a bogus fact-checking site.

Andy Carvin is Managing Editor at the Digital Forensic Research Lab.

Cite this case study:

Andy Carvin, “2021: DFRLab’s year in review,” Digital Forensic Research Lab (DFRLab), December 20, 2021, https://medium.com/dfrlab/2021-dfrlabs-year-in-review-e4988220ba17.




@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.