#ElectionWatch: Insta-Deception Targets Ukraine

24 Instagram pages masqueraded as news aggregators in central and western Ukraine

@DFRLab
@DFRLab
Feb 19, 2019 · 5 min read
(Source: @DFRLab)

On January 17, Facebook removed 41 Instagram pages targeting Ukraine that it said “shared characteristics” of accounts operated by the Internet Research Agency (IRA) troll factory in Russia. The takedown came shortly before Ukraine’s presidential elections and amidst growing fears that the Kremlin would seek to influence the electoral process.

Facebook shared the account names of 24 Instagram pages with @DFRLab shortly before the takedown. All 24 masqueraded as local news aggregators publishing posts in Ukrainian and appeared to target Ukrainians living in central and western Ukraine. The pages managed to reach an audience of nearly 100,000 users, although there is evidence to suggest not all engagement was organic.

The “Today” Network

All but one of the removed accounts had the word “today” in their usernames and were named after different Ukrainian districts (e.g., kharkivtoday_, kiev_today_, and lvivtoday_.

Profile names of the 24 Instagram accounts removed by Facebook. (Source: Facebook)

Nearly all of the “today” network pages used the same graphics and format. All but one of the 24 pages used a small triangle on the bottom left corner of uploaded photos to mark posts with news stories. The triangle contained the text “новини TODAY,” which translated from Ukrainian is “News TODAY.”

Instagram accounts from the Today network using the same graphics, taken before the accounts were shut down. (Source: Instagram)

Radio Free Impersonator Page

Low-engagement (defined as a low total number of reactions to the posts) rate of Ukrainerealiyi Instagram page sharing content from ukrr.info. Yellow circles represent pictures posted; blue circles are links shared. (Source: @DFRLab)

The website appears to imitate the U.S. government-funded Radio Free Europe/Radio Liberty’s (RFERL’s) news page; it has a similar logo, color scheme, and website layout. Prague-based RFERL has a substantial audience in Ukraine and an office in Kyiv.

RFERL’s Crimea Realities on the left compared to anonymous Ukraine Realities on the right. (Source: Crimea.realities/archive, left; Ukrr.info/archive, right)

Although Ukraine Realiyi’s reporting was not impartial, different articles exhibited different biases. On the one hand, the site reported on the Belarusian Ministry of Foreign Affairs’ statement saying that Russia was a threat to Ukrainian and European security. On the other hand, it also reported on Russian Ministry of Defense’s claim that the missile that downed Malaysian Airlines flight MH17 over Ukraine in July 2014 was Ukrainian without providing any of the widely available evidence to the contrary.

The website also featured articles on intelligence and local politics that presented bias in the form of skewed facts. For instance, the most engaged-with article, which received most of its traffic via Instagram and Facebook, regarded Vasyl Hrytsak, the Head of Security Service of Ukraine (SBU), and his statement on news about Russia’s bombing of Ukrainian naval vessels, which resulted in an injury of a counterintelligence SBU officer.

Article, which received the highest engagement, on SBU head Vasyl Hrytsak’s comment regarding the bombing of Ukrainian naval vessels. (Source: ukrr.info/archive)

Ukrr.info’s piece claimed that Hrytsak handed over a Ukrainian counterintelligence officer to Russia — no reports could verify this claim — and called for his resignation. Hrytsak has been a vocal and transparent critic of the Russian Federation’s annexation of Crimea, making Ukrr.info’s assertion particularly salient, given it portrays the SBU head as cooperating with Russia.

The Today Network’s Limited Impact

The geographical spread of the Instagram pages masquerading as local news aggregators. (Source: Google Maps/archive)

The 24 Instagram pages taken down by the platform posted more than 24,000 posts and accumulated nearly 80,000 followers. The campaign indicated a clear, covert attempt at building an audience in central and western Ukraine. @DFRLab’s analysis of the pages’ followers shows that the network did manage to achieve its objective as the vast majority of the pages’ followers did come from central and western Ukraine.

Map showing the locations of users who followed the pages from the Today Network. (Source: @DFRLab)

Not all engagement appears to have been organic. A closer investigation of the accounts revealed that some of the users engaging with the Today Network’s content were Turkish, not Ukrainian. It suggests that the engagement may not have been organic and the network used artificial amplification to build up an audience.

Conclusion


Donara Barojan is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab)

Kanishk Karan is a Digital Forensic Research Assistant at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab)

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade