'Secondary Infektion': Russian online deception operation targeting UK, EU and US exposed
Sky News understands the government is looking at new research in relation to the leak of trade documents during the UK election.
Wednesday 17 June 2020 12:39, UK
A vast Russian online deception operation has been exposed, unveiling a co-ordinated and extensive attempt to create tensions between European countries and the US.
The campaign, dubbed "Secondary Infektion", was waged over six years, in seven different languages and on 300 different online platforms.
These included well known sites like YouTube, Facebook, Twitter and Reddit, but also smaller, fringe blogging forums.
Its aim was to discredit and undermine enemies of Russia and critics of the Kremlin, including NATO, Ukraine, Turkey and the EU.
Secondary Infektion also targeted senior politicians and elections in countries including the US, UK, France, Germany and Sweden.
Research carried out by Graphika, a New York-based analytics company, shows the group had "high operational security abilities, deep resources and strategic patience".
"This operation was all about weakening the Kremlin's critics, at home and abroad," said Ben Nimmo, Graphika's director of investigations.
"It used fake accounts and forgeries to make Kremlin opponents look bad, but it spent so much effort trying to hide that it struggled to have any impact."
Sky News understands the British government was aware of the research and has been looking carefully at the conclusions, particularly in relation to the leak of US/UK trade documents that coincided with last year's general election - an operation that probably ranked as Secondary Infektion's biggest success.
The leaks, on Reddit, became a mainstream debating point and caused political division in the UK.
At the time, then Labour leader Jeremy Corbyn used the classified documents as evidence of what he said were "secret talks" to sell off the NHS.
Labour did not discuss where it obtained the documents, while Reddit said it believed the leak was "part of a campaign that has been reported as originating from Russia".
That event brought a quiet change in Britain's official position on malicious Russian online activity.
In March, the Guardian reported that ministers have been told they can no longer claim there have been "no successful examples" of Russian disinformation affecting UK elections.
It was the first admission by the government of Kremlin attempts to influence elections in this country.
Although it has not been possible to link Secondary Infektion to the Kremlin or Russia's intelligence agencies, Graphika's research reveals how the group's targets reflected Russia's foreign policy aims.
Its tactics and tradecraft were different to Russian spy agencies, but the themes, victims and timings of operations overlapped with those carried out by the GRU.
"It started to attack Turkey after Turkey shot down a Russian jet in November 2015 and it took an interest in sports doping after the World Anti-Doping Agency exposed a Russian state-sponsored doping operation in 2016," says Graphika in its conclusions.
"In 2016 it attacked Hillary Clinton's election campaign and focused on attacking Emmanuel Macron ahead of the French elections in 2017."
One forged tweet was supposedly posted by the US Senator Marco Rubio, claiming that GCHQ spied on Donald Trump in 2016.
In fact, there was no such tweet, only a doctored image.
Only one known outlet reported on it: the German service of Russian state broadcaster RT.
Another account tried to claim extremist Remainers were plotting to assassinate Boris Johnson, and one attempted to push a rumour that Angela Merkel is an alcoholic.
The group typically employed single-use accounts, meaning they often posted only once before shutting the account down and moving on.
This meant the group struggled to build an audience for their campaigns, but they were also very hard to track and link.
:: Listen to the Daily podcast on , , ,
Although the central identity of the Secondary Infektion group is still unknown, in May 2019, Facebook uncovered a small cluster of accounts linked to the group and attributed them to actors based in Russia.
Whilst its intent was serious, the group's campaigns were often marked by moments of clumsiness or let down by basic spelling errors.
One fake article, attributed to Mr Macron, was riddled with grammatical errors, another missed out words and added phrases that a native speaker wouldn't have.
"What kind of Putin troll wrote this?," was the response under one error-strewn tweet.