LONDON – In August 2018, Spanish authorities uncovered a plot by anti-Brexit campaigners to assassinate Boris Johnson, a leading Brexiteer who now is the favorite to be Britain’s next prime minister. Or did they?
That story and others like it were created by a network of social media accounts operating from Russia that have attempted to seed false narratives across 30 online platforms, a study by the Atlantic Council’s Digital Forensic Research Lab has found.
The effort employed scores of accounts posting in at least six languages on platforms including Facebook and Twitter, as well as multiple other blogging sites and forums.
The aim was to “divide, discredit and distract” Western countries by planting false information about topics ranging from alleged British meddling in the 2018 U.S. midterm elections to Irish paramilitary involvement in the poisoning of a former Russian spy in England last year.
The network was traced by following connections to a group of 16 accounts suspended in May by Facebook, which said they were “part of a small network emanating from Russia.”
Western officials have warned that countries such as Russia, as well as domestic political groups, are increasingly spreading false or misleading information online in order to disrupt politics and public opinion.
Moscow has repeatedly denied the allegations, most recently after the European Union said it had evidence of “sustained disinformation activity by Russian sources aiming to suppress turnout and influence voter preferences” in May’s European Parliament elections.
Ben Nimmo, a senior fellow at the Atlantic Council’s DFR Lab, said the accounts failed to attract a large following — likely due to efforts not to get caught — but the operation is notable for its audacity and sophistication. “This operation was trying to provoke divisions between Western countries,” he said. “It faked everything, from the documents it based its stories on, up to the accounts that boosted them.”
Nathaniel Gleicher, head of cybersecurity policy at Facebook, said the accounts and pages removed by Facebook in May had been a small part of “a broader operation that was primarily active on other internet platforms.”
“We know that these threats are not limited to a specific type of technology or service. The better we can be at working together, the better we’ll do by our community,” he said.
A Twitter spokesman said the company welcomed the findings and had a team “dedicated to identifying and investigating suspected platform manipulation on Twitter, including potential state-backed activity.”
The alleged plot to kill Johnson began on Aug. 8 last year when a fake account on Facebook posted a letter purportedly sent by Spanish Foreign Minister Josep Borrell to a fellow lawmaker.
The letter, written in informal Spanish and with Borrell’s name spelled wrong, says the minister has been informed of a “possible attack on Boris Johnson by radical Brexit opponents who want to stop him from being nominated prime minister” and would alert British authorities.
Asked about the authenticity of the letter, a spokesman for Borrell said the document was “fake, fake.”
DFR Lab said the operation’s focus on narratives supporting the Kremlin and linguistic errors typical of native Russian speakers supported Facebook’s assessment that the accounts were operated from Russia.
“The scale of the operation, its trade craft and its obsession with secrecy indicate that it was run by a persistent, sophisticated and well-resourced organization, possibly an intelligence agency,” DFR Lab said in its report.
Other narratives pushed by the network included a screenshot of a tweet allegedly posted and then deleted by former British Defence Minister Gavin Williamson.
Pictures of the tweet included in blog posts online show Williamson saying people connected to the Real Irish Republican Army had supplied “a component of the nerve agent” used to poison a former Russian military intelligence officer in the English city of Salisbury last year.