“Secondary Infektion” – Powerful, Useless and Dangerous
Secondary Infektion is a campaign that since 2014 has used fake accounts and forged documents to sow conflict between Western countries. Researchers from the research company Graphika have tied the campaign to Russia. The campaign is technically sophisticated, it covers its tracks very well. At least 2 500 pieces of content: fake letters, forged blogs, have been published.
The report describes a massive project, with high technological capacity and ability to use loopholes in the security systems of the social media platforms. The ambitious project has invested huge resource to forge letters, blog posts, news articles – however, all without actually achieving anything.
EUvsDisinfo has written about research into the Secondary Infektion earlier, including a fake letter from the EU’s top diplomat Josep Borrell, speculating on an assassination of UK Prime Minister Boris Johnson.
Big effort, small impact
The new report from Graphika demonstrates several examples of fake documents, and often with very similar methodology: a forged claim is published by a fake account on social media and quickly shared with media outlets. The idea is to insert a claim into the media environment through “burner accounts” – i.e. accounts that are immediately deleted and never used before – in hope of getting traction in mainstream media.
The report notes that this method is advanced and that the operatives behind it are very good at hiding their tracks. It is a sophisticated means of disinformation, but with very little impact. The researchers write:
Very few of Secondary Infektion’s stories achieved any impact, as defined by external user engagement with its content. This is one of the most puzzling aspects of the operation: what did the operators think they were doing, and why did they not change their methods to achieve higher traction?
The researchers find only a few examples where an insert of a fake documents seems to have managed to get some traction. A fake claim on Ukraine and the US lobbying to nominate the then president of Ukraine to the Nobel Peace Prize was picked up by British conspiracy theorist David Icke and later, by the Canadian conspiratorial site Globalresearch.com. From here, the claim moved on to Russian state-owned news agency Sputnik and various other Russia-based sites.
In one example, Secondary Infektion managed to achieve substantial impact: documents, connected to US – UK trade negotiations leaked to the public in late October 2019. The leak itself initially appeared on accounts of Reddit and fringe media without attracting much attention. The leak only made the news when it was e-mailed directly to UK political activists in November.
An Unidentified Object
The Secondary Infektion operation covers nine dominating themes; all key elements in pro-Kremlin ecosystem disinformation campaigns:
All those topics are well represented in the EUvsDisinfo Disinformation Database. Around a third of the content, connected to the operation is devoted to the narrative of Ukraine as a failed or unreliable state. The researchers find a surprisingly high number of articles, devoted to the Russia’s military presence in Syria.
The researchers conclude that the operation is advanced, well organised and can be tied to Russian interests {?}. But it is impossible – so far – to tie it to any known Russian organisation or authority. The researchers write:
Secondary Infektion remains an unidentified threat actor. Despite the work of multiple teams, we do not have a confirmed attribution to a specific group. We there do not have a clear picture of its overall capabilities and motives. Key questions remain unanswered: who was behind it? What were they trying to achieve? Why did they let so many of their stories sink without a trace on the unregarded backwaters of the internet? Why did they not target some of the other frequent targets of Russian information operations, for instance the Syrian conflict in general and the White Helmets rescue group in particular?
The researchers note several examples of obvious incompetence. Basic mistakes in vocabulary and grammar; misspelt names, Russian terms used instead of English… To summarise – a huge, advanced operation with very little impact and rid with strange mistakes. Should we really take this seriously? The researchers say we should. Secondary Infektion demonstrates how influence operators are developing capacity to hide themselves. Forgeries are getting more and more sophisticated. The operation has been active since 2014 and it is still impossible to attribute it. The current infodemic around the COVID-19 outbreak is a fruitful soil for further attacks against the public discourse and democracy itself. And as the attacks continue, the disinformation operatives are developing their skills.
