Check your U.S. voter registration status or register to vote here.

Russian Op 2: Fanning Irish Flames

How the influence operation targeted Irish divisions

@DFRLab
@DFRLab
Jun 22, 2019 · 9 min read
Image for post
Image for post
(Source: @KaranKanishk/DFRLab)

This article is part of a series analyzing the various aspects of the suspected Russian intelligence operation. Our top post summarizes these findings.

The Russian operation consistently sought to fan divisions between, and within, Western countries. That was particularly apparent in its treatment of Ireland, especially Northern Ireland.

The operation used ostensibly Irish personas on Facebook to post divisive and inflammatory content. Between March 2018 and April 2019, the operation ran at least three false stories targeting Ireland and forged documents and social media posts to support its claims.

On March 22, 2018, an account that Facebook identified as belonging to the Russian operation posted a Medium article to at least 15 different news groups.

Image for post
Image for post
Some of the 15 times the ostensibly Irish account shared the same Medium article to Facebook groups. (Source: Facebook)

According to the article, then-British Defense Secretary Gavin Williamson tweeted that the Real Irish Republican Army (Real IRA) terrorist group had helped in the attempted assassination of former Russian spy Sergei Skripal in Salisbury, England, two weeks before. As “evidence,” the article inserted a screenshot of the alleged tweet but claimed that it had been deleted within a few minutes, “which gives reason to believe that the information is sensitive and classified and thus must not be disclosed to the public until Scotland Yard completes its investigation.”

Image for post
Image for post
Screenshot of the Medium article, including the alleged tweet. (Source: Medium/archive)

A number of factors expose the alleged “tweet” as a forgery. First, Williamson was one of the United Kingdom’s top ministers at the time. He is followed on Twitter by high-profile journalists including Mark Urban (BBC Newsnight), Carole Cadwalladr (The Guardian), Stephen Castle (New York Times), Deborah Haynes (then of The Times), and Elizabeth Piper (Reuters). Yet not one mainstream outlet reported on the alleged tweet, and a Twitter search for “Gavin Williamson IRA” date-limited to March 2018 only showed four results, none relevant.

It is only necessary to look at the online firestorm provoked by U.S. President Donald Trump’s tweet on the “Prince of Whales” — deleted and corrected after just 24 minutes — to appreciate that such an explosive tweet by Williamson, if real, would have provoked at least some online attention. The lack of any mentions confirms that the alleged tweet never happened.

The second factor is the source account on Medium. Named “Edward McGrew,” it only ever posted the one article. It used an image of British actor and comedian Hugh Laurie, in his role as TV medic “Dr. House,” as its profile picture. This use of a single-shot account on Medium, with a stolen profile picture, was the standard operating practice for this Russian operation.

Image for post
Image for post
Medical match. Left, “Edward McGrew” on Medium. Right, Hugh Laurie as Dr House, preserved on Pinterest. (Source: Medium/archive, left; Pinterest/archive, right)

Third, the article’s use of English was fluent but not native. It struggled with the grammatical articles “a” and “the” and the possessive genitive, as these lines demonstrate:

In case the information about the Real IRA militants’ involvement in Skripal’s poisoning proves true, the law enforcement have to be prepared for the worst-case scenario as terrorists may have a complete set of chemical agents necessary for creating the chemical weapon. Are the Northern Ireland’s police units prepared to provide security for the citizens in such conditions?

The Russian operation often posted its stories to several forums simultaneously, and this was no exception: accounts called “Edward McGrew” posted it to playbuzz.com and politicsforum.co.uk. On playbuzz.com, the author account was created that day, published the one post, and never posted anything else.

Reverse searching the supposed tweet revealed further versions of the story in Ukrainian, French (two locations, one deleted), and German (two locations, both deleted). One of the German locations was mein-suedhessen.de, a site the operation used several times. The article was deleted by June 14, but the associated author profile was still visible. Like the Ukrainian and French authors, the German author only posted this one article.

Image for post
Image for post
Results of a reverse image search of the alleged tweet. Note the forums in Ukrainian (top row, second from left), French (top row, third from left), and German (bottom row). (Source: Google/archive)

The reverse image search turned up one other result: a Wordpress blog called “Ciencia Maldita” (Spanish for “cursed science”). The Medium post also pointed back to this Wordpress blog as its source.

The Wordpress blog largely shared articles from known news outlets such as CNN and The Economist on Latin American issues. It posed as a Latin American source, rejecting “norms of political correctness imposed on us by our northern neighbors,” although the author seemed uncertain of basic Spanish, referring to the Russian President as “seignior Putin,” when “señor” (Spanish) or “senhor” (Portuguese) would be more likely in a native speaker.

The blog appears to have been the original source of the fake Williams tweet. It claimed to have found the screenshot online but did not provide a source link, only an image. Its post argued that Russia could not have ordered the Salisbury poisoning and that it must have been a false-flag operation by “senhora” Prime Minister Theresa May, either to disrupt the Russian president’s reelection or to distract the British public from Brexit. These were two tropes of Russian state messaging at the time.

The likelihood is that the “Ciencia Maldita” blog was also part of the Russian operation, used to seed content.

The second attempt came five months later in August 2018. This time, it started on Facebook, when an ostensibly Irish account posted an allegedly leaked email on the Brexit negotiations.

Image for post
Image for post
The “email” shared by the pseudo-Irish Facebook account. (Source: Facebook)

The post claimed that it was sharing an email from Arlene Foster, leader of the Democratic Unionist Party (DUP, the minority party supporting the United Kingdom’s Conservative government), to chief Brexit negotiator from the European Union (EU) Michel Barnier. The alleged email — presented as a screenshot — claimed that DUP members had found the EU’s stance on Brexit “more favourable than the one we received from the UK Cabinet.”

This would have been a political bombshell, as the DUP has consistently opposed any EU-UK deal that would leave Northern Ireland less closely associated with the rest of the United Kingdom.

But again, a Google search for the terms “Arlene Foster Michel Barnier email” between August 1 and August 14, 2018, returned no relevant results. Two months later, by contrast, many British media reported a genuine set of leaks (from British government sources) that claimed that Foster had called Barnier “hostile and difficult” and that she was preparing for a no-deal Brexit. The alleged email from Foster to Barnier appears to have been, again, a fake.

Two days after the Facebook post, a single-use account on Medium called “Will Dobson” posted a longer article headlined, “After Brexit, Northern Ireland may obtain a special status in the EU.” Based on the forged “leak,” it claimed that the DUP was “ready to sacrifice its arrangement with the [Conservatives] and even leave the United Kingdom ‘under certain conditions’” and warned of “bloody confrontation” in Ireland as a result.

This article was written in largely fluent English but still contained a few apparently non-native sentences, such as:

“Prime-minister’s rigidity can not only spoil stable relations with Ireland, it can also accentuate the growing separatist sentiment inside the country.”

“Requesting the restoration borders between Ulster and the Republic of Ireland is, by far, quite shortsighted for May.”

Characteristically of the Russian operation, the identical article, under the same byline, was posted the same day to indybay.org, beforeitsnews.com, and, bizarrely, cssforum.com.pk, a forum for the Civil Service of Pakistan. It was also posted as a meme to Imgur. On each platform, this was the author’s only post.

Image for post
Image for post
Shared on Imgur: the same false story, posted by another “Will Dobson” single-shot account. (Source: Imgur/archive)

Between August 8 and 10, versions appeared in German on homment.com, Reddit, and Indymedia.org (where the link is now broken), and in Spanish on rankia.com and four separate Reddit threads. All these accounts were created the same day they posted the article; two subreddits rejected the posts, for that reason.

Once more, the Russian operation’s pseudo-Irish account gave the Imgur post a further push, sharing it to a number of political forums.

Image for post
Image for post
Shares of the article and Imgur cartoon, from one of the Russian operation’s known accounts. (Source: Facebook)

The evidence therefore suggests that every stage of this story —an initial Facebook post channeled through Medium, Reddit, and all the other forums and languages, which are ultimately posted back to Facebook — was the work of the same operation.

The third attempt came just over a year after the first. On April 22, 2019, an apparently Ireland-based user posted a sensational claim to the r/ireland subreddit. The post alleged that the Real IRA had posted an Arabic-language invitation to Islamist fighters to “join the RIRA and fight on the Irish soil.” The article was posted by the account u/robeharty, created that same day; it was “his” only post.

Image for post
Image for post
Screenshot of u/robeharty showing the date of its only post (upper red box) and the date the user account was created (“Cake day,” right-hand red box). (Source: u/robeharty/archive)

The Reddit post claimed to have found the invitation on an Arabic discussion forum largely devoted to religious texts and Islamic scholarship. It said that the call was “published on one of the Islamic discussion boards” but did not provide a specific link, only a screenshot.

Image for post
Image for post
Screenshot of the Reddit post showing the text with the reference to “one of the Islamic discussion boards” (upper box) and the alleged screenshot (lower box). (Source: r/ireland/archive)

The English syntax in the Reddit post was distinctly non-native:

“To join the RIRA and fight on the Irish soil.”

“A headhunter of the Real Irish Republican Army published on one of the Islamic discussion boards a message.”

“Muslim extremists from a number of world’s hotspots.”

The DFRLab identified the discussion board from which the Arabic-language post was allegedly taken but found no trace of the alleged post. This suggests that it was either a planted post that was later deleted or a doctored screenshot.

The Reddit article only received one vote and no comments. The following day, however, a user account on Medium called “William Couch” posted a longer article headlined “Following Brexit is a new fight for United Ireland.” This article pointed to the Reddit article as its source; like u/robeharty, “William Couch” only ever posted one article.

Image for post
Image for post
The post by “William Couch.” Note the verbatim quote from the Reddit article and the link to it (upper box) and the screenshot from the Reddit article (lower box). (Source: Medium/archive)

Also like the u/robeharty post, this post contained language errors:

“In 2016 on a public vote…”

“The RIRA never abandoned the idea of military struggle for freedom and independence of united Ireland.”

“Could it really be true that RIRA agreed to make business with Islamic radicals?”

The same day, April 23, the Russian operation’s main pseudo-Irish Facebook account shared a link to the Reddit article.

Image for post
Image for post
The share of the Reddit post by the Facebook account from Russia. (Source: Facebook)

A Google search for the Reddit link embedded in the Medium article revealed that the exact article was posted to two other forums on April 23: homment.com and beforeitsnews.com. Both were attributed to “willcouch;” in each case, this was the user’s only post.

The search also returned a Spanish version of the article, posted to five separate forums on April 24: r/espanol, r/spain, foroexplayate.com, globedia.com, and mediavida.com. Each one was posted by a user account called “Antonio Diaz,” created the same day, which used a picture of the back of Batman’s head for “his” profile.

Image for post
Image for post
Profile pages for u/AntonioDiazz on Reddit, AntonioDiaz on mediavida.com, and Antoniodiaz on globedia.com. Note the identical profile images in the yellow boxes. Each account was created on April 24; the screenshots were taken on May 22. The globedia.com and mediavida.com accounts only posted once, while the Reddit account posted the same article to two subreddits. (Source: Reddit, left; mediavida.com, top right; globedia.com, bottom right)

A further version was posted in French on April 25.

Each of these stories used the same techniques. They started by posting a forgery online, amplified it with a number of accounts created especially for that purpose, and finally boosted the content on Facebook.

None of the stories gained any traction. In part, this was likely due to the nature of the content; in part, it was due to the obsessive secrecy with which the operation was conducted, using a separate burner account for every stage. This meant that the operation never had the chance to build up a following or develop its audience.

What is remarkable is the brazen nature of the forgeries themselves, and the repeated attempts to fan the divisions within Ireland and the United Kingdom. The Russian operation launched not one, but at least three separate forgeries, one attributed to a senior minister, another to a party leader. Each time, the apparent purpose was to exacerbate the already raw divides in Ireland and the United Kingdom.

Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store