#ElectionWatch: Macedonian Memes, American Midterms

Macedonian memes significantly decreased during 2018 U.S. midterm elections

(Source: nynettle.com/archive, top left; nynettle.com/archive, bottom left; usapatriotsvoice.com/archive, top right; usapatriotsvoice.com/archive, bottom right)

Around the 2016 U.S. presidential elections, an otherwise unknown town in Macedonia gained notoriety as a hub of “fake news” directed at the United States. However, significantly less activity occurred ahead of 2018 U.S. midterm elections, compared to the disinformation for hire directed at Trump supporters in 2016.

In 2016, there were an estimated 150 new, anonymous websites that spread false news directed at the U.S. political process. Most assessments say that mostly young Macedonians who engaged in the work of disinformation in the English language did so based on economic, rather than political, incentives.

The websites spreading false news were registered with addresses in the industrial town of Veles, located 30 miles south of the capital, Skopje. Although the disinformation attempts by Macedonian websites in 2016 were exposed, some continued to operate and sow disinformation around the 2018 U.S. midterm elections.

@DFRLab identified six Macedonia-based websites that published disinformation, as well as anti-Democratic Party, anti-Muslim, anti-immigration, and otherwise polarizing content aimed at American audiences. Three of the six pages are now defunct. Of the remaining three, one (nynettle.com) has converted its focus to superficial health and beauty articles, another (wuc-news.com) is live but has not updated since May 2018, and the final page (donaldtrumpforusa.com) still intermittently posts far-right material, with the most recent post being January 4, 2019.

The Macedonian websites used to spread disinformation, including which social media platforms they were present on, the general sentiment of their content, and their current status. (Source: @DFRLab)

Around the midterm elections, the mostly anonymous websites were not as persistent and active in spreading disinformation but pushed content with the hope to generate traffic toward the website, thereby increasing ad-generated revenue. The money through advertisements can come from either direct traffic or through social media links. Earnings on any website roughly depends on the traffic quality of the website, but yields are estimated to be between $1.00 and $3.00 USD per 1,000 impressions.

Social media platforms, specifically Facebook and Twitter, have stepped up efforts to degrade this type of content, and many of the accounts or pages of the Macedonian websites that focused on spreading disinformation toward and in the United States have been suspended, likely for spamming real users.

Operating a professional looking fake news website is possible, however, because it is an effective, low-cost operation, as it is possible to post engaging content almost entirely anonymously on a website that looks legitimate.

As a workaround to the direct blocks by the social media companies, these websites tried to maintain a presence on social media through shadow sharers, meaning their content is being shared by inauthentic profiles. For instance, one of the websites’ news was mostly shared by Macedonian users, even though the content was in English and concerned U.S. politics.

Political Manipulation

Some articles on the website on nynettle.com were intended to revive the 2016 presidential elections clashes of between former Democratic presidential nominee Hillary Clinton and President Donald Trump, by denoting the latter’s stance that “it’s finally time to send Hillary to prison” as bold and authoritative. These stories were used to manipulate political opinion and obtain likes, clicks, and re-shares on websites by Trump supporters.

Screenshot of an article on nynettle.com, one of the Macedonian websites. (Source: nynettle.com)
Screenshot of news on President Trump from nynettle.com. (Source: nynettle.com, left; nynettle.com, right)

Most of the content was deceiving and falsely presented. For instance, in one article, “Trump: Guantanamo Bay Is ‘Being Prepared For Deep State Traitors,’” the article claimed that Trump would react against “deep state” actors by sending them to the U.S. military detention center at Guantanamo Bay. The article on nynettle.com used highly divisive and editorialized language such as “Deep State and their ‘frontmen,’ the Barack Obamas and Hillary Clintons, the child traffickers, the satanists, the truly rotten and corrupt, those owed too many favours by too many bent judges and agents to ever keep a straight fair trial.”

Note the letter “u” in “favours,” which is the British, as opposed to American, spelling.

The articles on the website deliberately manipulated facts to obtain more traffic with their sensationalist headlines.

The website received good engagement on social media with more than 11,000 interactions on different articles posted on social media platforms Twitter and Facebook, but most of the traffic to the website was direct.

Visualization showing traffic engagement of nynettle.com. (Source: @DFRLab via rank2traffic.com)

In September, the website saw a sudden increase in traffic from around 20,000 to 80,000 page views. The abrupt increase in traffic was highly suspicious and possibly inorganic.

On Facebook, an article from the website, about a school teacher raping 42 boys, was shared by a fringe Republican candidate from Florida.

Screenshot of an article from nynettle.com reposted to Facebook by fringe Florida candidate Latresa Jones. (Source: Facebook)

The article shared had skewed a report from 2017 on how an HIV positive teacher had sexually assaulted children. The manipulated article by nynettle.com misrepresented the event by using the headline “HIV Positive School Teacher Pleads Guilty to Raping 42 Boys to ‘Transmit’ Virus.” There were no reports that supported the claims of virus transmission or the rape of the 42 boys.

Anti-Islam Content

Another Macedonian website, usapatriotsvoice.com was filled with Islamophobic messages and other race and ethnicity-based content.

A polarizing post from usapatriotsvoice.com. (Source: usapatriotsvoice.com/archive)

The article cited a Muslim leader, Mustafa Carroll from the Council of American-Islamic Relations in Houston, saying Muslims are above the law. According to Snopes, a fact-checking service, Carroll’s statement was not meant to encourage Muslims to ignore the laws of the United States, nor did he say that Sharia law supersedes the U.S. Constitution. In his 2013 speech, Carroll actually said, in full context:

Following the law of the land is part of Sharia. And we follow the law of the land. In fact, Muslims, if we’re practicing Muslims, we are above the law of the land. The law doesn’t affect us at all.

According to the website rank2traffic.com, the now-defunct usapatriotsvoice.com had roughly 108,411 monthly visitors. Other websites showed a similar strategy to garner audience by sensationalizing headlines and skewing quotes.

Anti-Immigration Content

Given the charged conversation around the topic in the United States, immigration was a frequent focus of some of the websites’ content. For instance, wuc-news.com draws most of its engagement using conspiracy theories and anti-immigration content to boost its engagement.

One of the stories on the page summarized Trump’s actions on curbing illegal and legal immigration. The story, however, manipulated and misrepresented facts.

Screenshot from wuc-news.com of an article on President Trump’s immigration policy change. (Source: wuc-news.com/archive)

The narrative targeted an anti-immigrant, far-right audience. The website received high engagement on its Facebook page. Unlike many of the other websites @DFRLab researched for this article, wuc-news.com remains online but has not posted any content on the website since June, but the website Facebook page is still active.

Screenshot of the front page of wuc-news.com, which has not posted any content on the website since May. (Source: wuc-news.com/archive)
wuc-news.com sudden jump in traffic. (Source: @DFRLab via rank2traffic.com)
wuc-news.com traffic mostly from the United States. (Source: @DFRLab via rank2traffic.com)

wuc-news.com has a large audience on Facebook with about 110,000 followers. Facebook banned the website’s URL marking it as spam, as the last website post claims, asking the readers to go back on Facebook and mark the last report before the ban as “Not spam.”

wuc-news.com article complaining about Facebook banning its URL for posting false information. (Source: wuc-news.com/archive)

Since that time, the Facebook page has used links to killuminati.blogspot.com, which posts conspiracy theories and redirects to wuc-news.com when clicking any of the menu links at the top of the page.

The Facebook page of wucnews.com now shares content from blog posts now. (Source: @wakeupcallnews/archive)

The Facebook page also shared highly provocative memes.

A meme provoking mass shooting on the @wakeupcallnews Facebook page. (Source: @wakeupcallnews/archive)

The registrant of the website is a resident of Probishtip, a small town in eastern Macedonia. The town is not linked to Veles, where over 100 pro-Trump and anonymous disinformation websites originated in years past.

Conclusion

Foreign-based websites and social media accounts attempting to influence U.S. political audiences is not a new phenomenon. In 2016, Macedonian websites used false information to encourage division and to gain traffic from Trump supporters and far-right groups to their websites .

Websites like these will continue to attempt to push false information for advertising revenue. Future attempts will likely be more restrained and kept at a smaller scale than previous cases during the 2016 Presidential elections, which were able to compete with the mainstream media.

Out of more than a hundred websites from Macedonia churning out fake news to make money from advertising, only a couple latecomers remain and appear to yield little revenue. That indicates that, in order to succeed, future attempts of internet manipulation will be less blatant in their disinformation, will become harder to discover and recognize, and will be more complicated to explain. This first fake news wave of poorly written articles in crude English appears to be winding down.


Vladimir Petreski is Digital Forensic Research Assistant at the Atlantic Council’s Digital Forensic Research Lab.

Kanishk Karan is a Digital Forensic Research Assistant at the @DFRLab.

Follow along for more in-depth analysis from our #DigitalSherlocks.