Working with a cyber security analyst, Yle found that Twitter was a hotbed of activity aimed at undermining EU citizens’ confidence in the region. While a few accounts were responsible for disseminating misleading information and outright fake news, ordinary citizens were also unwitting allies in spreading disinformation.
A man with a long beard dressed in white robes reminiscent of Arabic attire furiously attacks a statue with a hammer. A passerby hurls stones at the man and police eventually intervene. The video was tweeted at the beginning of May by an account owned by Compact News (more on this account later).
"A muslim #migrant destroying a statue in #Italy, because part of the body is showing. #Europe does not know what is coming their way in next (sic) 5 to 15 years. #EUelections2019 #EU #NWO."
The video had previously been debunked as fake in October 2018, but it is still widely shared online. According to an extensive analysis of roughly 300,000 tweets by Yle, it was also one of the most popular pieces of EU-related content on Twitter between 29 April and 9 May ahead of European Parliament elections.
Fake news content shared in Finland
Yle’s analysis showed that Compact News’ fake statue vandalism video had been shared in Finland, the UK and the Netherlands, at least. The study further identified several Finnish troll accounts that pushed the fake video. The Compact News account and another account, Partisan FB, both counted active Finnish troll accounts among their followers.
Public broadcasters from Finland, Sweden, the Netherlands, Austria and the UK complied suspected troll accounts active in each country for the analysis, a total of more than 4,200 Twitter accounts.
Troll accounts were defined as accounts devoted mainly to agitating or provoking other users or trying to steer online discussion in a particular direction. Tweets from troll accounts were compared to 300,000 other posts.
The public broadcasters examined how Twitter users were discussing the EU election and whether or not the platform was being used for the dissemination of deliberately misleading information or disinformation.
The project found that among hundreds of thousands of tweets, the most popular sharers deliberately disseminated distorted information. The Yle analysis corroborated suspicions that a growing number of EU citizens are being exposed to distorted or fake news.
According to a recent analysis US data security firm SafeGuard Cyber reported in The Guardian, as many as half of the EU’s 500 million residents have been targeted by disinformation shared by hundreds of thousands of social media accounts.
Top-ranking tweets from dubious accounts
The video tweeted by Compact News at the beginning of May received more than 1,300 "likes" and was retweeted nearly 1,800 times, making it the third most-popular tweet in the analysis.
Other tweets in the top three came from an account titled Partisan FB, which was strongly anti-EU. Both accounts also shared a great deal of content from Russian propaganda media such as Russia Today and Sputnik.
Yle was not able to determine who was behind these accounts. According to one expert, it could be "our neighbour to the east, independent groups or isolated individuals." These accounts spread a narrative in which global threats are explained in a manner that suits Russia.
"In any case these tweets support Russia’s strategic narrative, the purpose of which is to stir up confusion and disrupt normal discourse," said communications chief of the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), Päivi Tampere. The US and Canada as well as most EU member states have a stake in the Helsinki-based organisation.
According to Tampere, the most popular tweets in the Yle analysis are typical examples of attempts to influence opinion with the aim of undermining trust in the EU and democratic society.
Amplifying protest movements
Researchers gathered tweets tagged with more than 30 commonly-used Europarliament election-related hashtags, including #EUElectios2019, #Europawal2019 and #EUvaalit.
Andrew Patel, an expert with Finnish cyber security firm F-Secure, analysed the material employing methodology similar to that used to review Twitter activity ahead of the deadline set for the UK to leave the EU -- Brexit.
In another video, a seemingly-disabled young person appears to hobble down a street. Riot police appear and knock over her walker, causing her to fall.
"More evidence how inhuman #Macron's #France is in 2019. A disabled protester was humiliated by #regime forces, her walker was knocked out of hand. She fell down. No comment of these violations of humanity from any #EU country. #GiletsJaunes #EUElections2019"
The video shared by an account titled Partisan FB was retweeted 6,000 times and racked up 4,200 likes. Yle could not determine the origin of the video.
The tweets mentioned in this article generated significantly more retweets than likes, which is unusual. According to F-Secure’s Patel, the impact of the tweets was likely amplified artificially by purchasing retweets from other accounts. He noted that tweets typically attract twice as many likes as retweets.
"Those accounts all retweeted similar, unrelated stuff, so they definitely look like a 'purchase retweets' service," Patel concluded.
The stand-off between the French government and the demonstrations by yellow vest protesters are examples of situations where external forces attempt to amplify the reach of protest movements. For example, research by a working group of the EU’s East Stratcom Task Force identified many manipulated Twitter posts that boosted the yellow vests’ message.
The Partisan FB account deleted the video on Thursday, just one day after Yle reached out to an individual believed to be linked to the account.
Links to Russian state-backed media
At first blush, Compact News, the account that shared the video of the man destroying a statue with a hammer, appears to be that of a news organisation. However that impression fades upon closer inspection.
The account appears to focus on two main themes: Islam and immigration. A link in the account’s info section leads to a blog that mainly features opinions defending France’s “yellow vest” protesters, with ample mentions of police violence, curbs on freedom of speech and a refugee crisis in the country.
Both the Compact News and Partisan FB accounts appear to disseminate a large number of articles from Russian state-backed outlets, with one-third of Compact News’ content coming from Russia.
The sources used include Russia Today, Sputnik News, Voice of Europe and Ruptly, the largest multilingual Russian state-funded media, which circulate fake news and content that is strongly sympathetic to the policies of Russian President Vladimir Putin.
F-Secure researcher Patel said that tweets from these two accounts’ were amplified by random accounts that don’t seem to line up with the content they were retweeting. For example, accounts from different parts of the world have spread Compact News’ tweets about Brexit and British far-right MEP candidates.
Patel observed that the language Compact News and Partisan FB use indicates that the people behind the accounts are not native English speakers. According to F-Secure’s linguistic forensics team both accounts probably have several content contributors.
Yle was unable to determine the identities of the persons responsible for Compact News and Partisan FB. However Compact News’ Twitter account indicates that one Robert Kearney works as a journalist with the outfit.
Targeted by a Russian operation?
Yle reached out to Kearney via his personal Twitter account. He responded, explaining that he is an Italian-background freelance journalist living in the United States. He told Yle that he writes for Compact News but does not know who manages its Twitter account or whether more than one person is involved.
He said that he is very active on Twitter, usually posting up to 150 times a day. He described some of his interests as the rise of nationalism and populist parties. His recent Twitter activity has focused on a recent meeting of European populist parties in Milan and he appears to be an ardent admirer of the divisive head of the anti-immigrant Lega party and Italian Interior Minister, Matteo Salvini. Recent images tweeted by Kearney of a meeting of far-right parties in Milan last weekend also depict Finns Party MP and MEP candidate Laura Huhtasaari.
Many of the Twitter accounts pushing nationalist and far-right content are automated bots, but Kearney seems all too real. He responded to many of Yle’s questions unequivocally and sent photos of himself as well as a link to his Instagram account.
Yle showed the results of its Twitter analysis social media platform researchers. They speculated that multiple people were likely responsible for maintaining the Partisan FB and Compact News accounts, suggesting that their content did not come from automated accounts or bots.
One London-based hybrid threat expert agreed that Kearney appears to be genuine, adding he seems to embrace a far-right worldview, and was a typical case who was susceptible to content from Russian anti-EU media.
"That is definitely the demographic RT and Sputnik targets. So he looks like a classic target of a Russian operation rather than a person who is actually creating the operation, he is their audience. So I think this is why he is sharing RT and Sputnik content," said researcher Ben Nimmo of the London-based Digital Forensics Lab, which specialises in disinformation research and receives support from the US’s Atlantic Council think tank.
Nimmo added that there was no indication that the accounts managed by Kearney, Partisan FB and Compact News were controlled by any state actor such as Russia. However he noted that Russia-friendly media outlets such as Russia Today and Sputnik produce the kind of distorted content that people like Kearney are inclined to disseminate on social media.
"He [Kearney] is their audience. So i think this is why he is sharing RT and Sputnik content."
EU citizens unwitting allies in disinformation campaigns
Ordinary citizens who may be disappointed in their politicians or their daily lives may also unwittingly spread fake news. Russia benefits when emotive and divisive subjects like immigration grab headlines, according to the EU’s East Stratcom Task Force, a group that focuses on proactive communication of EU policies and activities in areas east of the bloc.
It described one of the most commonplace narratives of Russian disinformation as the claim that some EU member states are no longer truly independent. This theme is closely tied to the claim that Islam is a threat to national identity.
Many experts said that the spread of disinformation appears to have changed in the runup to Europarliament elections. Russian election interference efforts appear to lean more heavily toward using a number of local players in European countries.
According to DFPLab’s Ben Nimmo, it may be even more challenging to combat disinformation when instead of Russian state actors, EU authorities have to deal with their own citizens.
"It’s when you have individual citizens of the EU in their own countries spreading false information and doing the kind of thing than Russians did. It’s much more difficult to work out what to do about it politically," he observed.