None of the so-called coordinated, inauthentic activity focused on the 2020 election or sought to “promote or denigrate political candidates,” said Nathaniel Gleicher, the head of security policy at Facebook. But Facebook and Twitter linked the operation to some of the same Russian actors that employed similar tactics four years ago to spread falsehoods during the 2016 presidential race.
“It looks very similar to the kinds of tweets the Internet Research Agency did in 2016,” said Shelby Grossman, a research scholar at Stanford Internet Observatory, referring to the troll army of the Kremlin.
“The themes are similar. The language feels similar,” she continued. “I wouldn’t be surprised if the motivation was dividing people in the run-up to the election.”
The takedowns Thursday are likely to rattle Washington at a moment when U.S. intelligence leaders once again are sounding the alarms about suspected Russian interference. This week, a senior Trump administration official told Congress that Russia’s online efforts did not explicitly seek to benefit a particular candidate. In earlier briefings, intelligence leaders told lawmakers that Russia’s online efforts had “developed a preference” for Trump.
Four years ago, so-called Russian trolls seeded posts, photos and videos on major social networking sites in support of Trump, and in opposition of then-Democratic candidate Hillary Clinton. Many of those Facebook posts, tweets and YouTube videos also sought to stoke social and political discord, including by trying to discourage black and Latino users from voting in the first place.
In response, tech giants including Facebook and Twitter raced to bolster their digital defenses, hiring more workers to review content and investing more heavily in artificial intelligence that could spot coordinated, fake accounts. But Russia’s tactics also have evolved, reflecting a better understanding of American politics and a heightened ability to take advantage of Facebook, Twitter and other social media sites to spread falsehoods at scale.
In October, Facebook said it had removed a network of Russian-backed accounts that had posed as locals to weigh in on political issues in swing states, at times praising Trump and attacking former vice president Joe Biden. The disinformation operation — discovered in its early stages — also sought to sow divisions among a then-packed Democratic primary field.
On Thursday, Facebook and Twitter leaders said they could not speculate on whether the Russian-linked network they removed might have eventually pivoted into politics. “We know we caught this early enough on that these accounts were broadly unsuccessful in obtaining a large-scale audience,” said Yoel Roth, the head of site integrity at Twitter.
The campaign disabled Thursday spanned 49 accounts and 69 pages on Facebook, with another 85 accounts on Instagram. More than 13,000 users followed one or more of the pages, and 265,000 followed one or more of the since-suspended accounts on Instagram. Twitter, meanwhile, said it discovered 71 accounts associated with the operation on its platform.
In an unusual turn, though, malicious, Russian-linked actors essentially helped set up a nongovernmental organization, called EBLA, based in Ghana. Gleicher said Russia’s approach aimed to make it “harder for us to find them.” Many of the details about the group’s origins were reported by CNN and shared with the tech companies in advance.
The Russian operation directed much of its attention to U.S. social media users, the tech giants said. At one point, the group tried to hire an staff person in Charleston, S.C., but didn’t succeed, said Darren Linvill, a communications professor at Clemson University, who said he initially found some of the suspect Twitter accounts.
An archived version of one of the closed Facebook pages, EBLA, shows that it was created Oct. 1, 2019, and posted on a range of issues apparently targeting African Americans, including on the subjects of racial violence. The contact information showed a phone number in Ghana. The page is no longer available online.
A post from Feb. 5 read, “There is always a justification for the violence a white man committed on a black man. This is because our history was thwarted the very first day we refused to put down the history by ourselves. You cannot tell someone to write your history when that person is guilty of those crimes and yet expect them to write them to suite you. #blackcommunity #martinlutherking #socialissues #BlackHistoryMonth #BlackLove.”
Other posts on the page quoted the Rev. Martin Luther King and complained about what it called “hair discrimination.”
Several researchers studied the disinformation campaign along with the tech companies. They noted the sophistication of the operations, which resembled previous efforts in themes but relied on new techniques for delivering them.
“Information operations’ increasingly creative use of proxies, including of real groups and organizations wittingly or unwittingly participating in these campaigns, is a clear and problematic trend, we’ve observed over the last few months,” added Camille Francois, chief innovation officer for Graphika, a network analysis firm that studies disinformation.
The firm issued its own report Thursday on the Ghana-based campaign, called “IRA in Ghana: Double Deceit,” that details the similarities and differences with efforts by Russia’s Internet Research Agency during and after the 2016 presidential election.
On its website, which remained online Thursday afternoon, EBLA described itself as a Ghana-based nongovernmental organization. “EBLA is a network of strong advocates of human rights. We envisage a world where individuals live freely in peace and harmony through the respect of rights,” the site says.
Linvill, the Clemson professor, first found a suspicious set of accounts in July and flagged them for Twitter. After those were closed, he said, Linvill found a second mysterious set in September.
Both sets of accounts acted in ways similar to ones previously used by the Internet Research Agency to target African Americans. They pushed themes of black pride, racial oppression and police violence, interacting heavily with both American Twitter users and also accounts that Linvill had determined were Russian. The oddest thing, however, was that the location of the Twitter accounts was listed as Ghana.
Both Linvill’s work and the report by Graphika highlighted the apparent tactical shift. The Ghanaian accounts were tied to real people and a real organization, rather than merely being fake accounts.
“Most of these accounts were real people, which is the best way to hide your disinformation. You just connect it to an actual human,” Linvill said. “You have to go three steps to figure out these real people were being paid by Russia.”
He also said that Ghanaian police recently shut down EBLA, whose full name is Eliminating Barriers for Liberation of Africa.
The Ghanaian group, EBLA, which did not respond to an email or calls seeking comment Thursday, posted an ad on LinkedIn seeking a “Chapter Coordinator” in Charleston. “We call on interested African Americans and other POC [people of color] to join our cause,” the notice said. It listed a contact number in Ghana.
Isaac Stanley-Becker contributed to this report.