By Ben Nimmo, DFRLab
Germany holds elections in late 2017. Analysts have already reported that Chancellor Angela Merkel is being targeted with fake news and online attacks, espceially from hyperpartisan and conspiracy sites. In this report, the DFRLab tracks one fake story about Merkel posted on Reddit, revealing a cluster of sites supporting populist and far-right politicians in Europe.
On December 23, German Chancellor Angela Merkel was given an unexpected early Christmas present: a conspiracy theory accusing her of deliberately allowing Islamic State terrorists to operate in Europe so that she could unleash an “EU Army” against fellow EU member states.
The story was a flimsy fake, and failed to penetrate beyond a handful of conspiracy and disinformation sites. It is nonetheless worth studying, as it illustrates the methods which far-right commentators are using to spread disinformation ahead of this year’s German and French elections, especially on Reddit.
A flimsy fake
The fake story was first posted by an anonymous user on online repository pastebin on December 23.
The story was so far-fetched that it would be counterproductive to repeat it. Its main “evidence” was a leaked document dated to November 2001, four years before Merkel took office; its main argument rested on an ignorance of the difference between the EU, US and NATO.
It is valuable because it illustrates one channel by which the authors of fake news try to reach the mainstream.
The pastebin post gained very little traction online. On the day of its posting, it was tweeted by two US-focused accounts, @CarolynWashington, which posts a mixture of anti-Obama, anti-liberal, pro-Trump and conspiracy content, and @5t4rdu5t1n9, which mainly posts attacks on liberals and support for President Donald Trump, and was incapable of spelling Merkel’s name.
It was also shared once on Facebook by an anti-EU account called @DeleteEU, which focuses on pro-Brexit, anti-EU and anti-Merkel messaging. This was the extent of its initial impact.
Launch point: Reddit
On December 24, however, the text was re-posted on subreddit /r/the_donald. Originally devoted to Donald Trump’s presidential campaign, this is a focal channel for conspiracy theories, frequently accused of racism and Islamophobia. The channel played a leading role in spreading the “Pizzagate” conspiracy theory which accused Hillary Clinton of running a pedophile ring. This time the post was claimed by a user called PleadingtheYiff, who has also posted on Pizzagate.
The user claims to be a 25-year-old law school graduate called William Craddick, who has since launched his own site, disobedientmedia.com. This focuses on conspiracy theories, especially ones with a hint of pedophilia, together with posts attacking Hillary Clinton and her circle.
The “PleadingTheYiff” Reddit profile is popular, with over 160,000 upvotes for its posts and over 51,000 upvotes for its comments as of January 27:
Craddick’s own Twitter profile is much less popular, with fewer than 2,000 followers as of February 6. The Disobedient Media Twitter account is even less so, with under 600 followers.
Immediately after posting on /r/the_donald, Craddick posted the story to a clutch of other subreddits: /r/SorosForPrison, which attacks financier George Soros; /r/HillaryForPrison, which attacks Hillary Clinton; /r/conspiracy, focused on conspiracy theories; /r/UK_politics, which mixes UK news and largely pro-Brexit views; and a German stream, /r/the_frauke, named after Frauke Petry, leader of the anti-EU and anti-Islam Alternative für Deutschland (AfD) party.
Craddick confirmed that the German version had been translated by a Reddit user called ImCassandra, who has launched a number of pleas online to fund the AfD. This user is also moderator of the Disobedient Media Reddit channel; according to the Disobedient Media website, one of its co-founders is a German called Cassandra Hasenstein, whose handle on social network Gab is ImCassandra. The fake story about Merkel was thus the work of the Disobedient Media team.
The focus on Reddit is significant: the site has repeatedly served as the insertion point for fictional or fake stories into the mainstream (for example Pizzagate, the claim of US protesters being bussed to a demonstration on November 9, and a horror story about a deadly virus in Arizona). The use of multiple channels simultaneously also has the appearance of a deliberate attempt to spread the story by targeting overlapping audiences.
From the_donald to conspiracy sites
In this case, the attempt was an almost complete failure. The HillaryForPrison version was shared by only one Facebook user; the version on /r/conspiracy was tweeted by four accounts, none of them widely followed. The anti-Soros and UK accounts likewise failed to spread.
Such impact as the fake achieved came from /r/the_donald. An analysis conducted via BuzzSumo shows that the post on this channel scored almost 2.2 thousand impressions on social media, almost all through Twitter (1,200) and Facebook (926).
Other sites that reposted the article achieved far less engagement:
The fact that the story did not go viral makes it relatively easy to identify the main accounts which promoted it. On Twitter, one of the few accounts to have an impact was a pro-Kremlin and anti-liberal account called @paiute023, which has posted conspiracy theories on Pizzagate, the downing of Malaysian Airlines flight MH17 over Ukraine, and the White Helmets rescue organization in Syria.
Another which shared the story was @dreamedofdust, a pro-Trump account which tweeted it three times, twice from /r/HillaryForPrison and once from /r/the_donald. The account is hugely active, having posted 157,000 tweets since June 2016, at an average rate of 625 a day. Each tweet was accompanied by an “if this then this” (ift.tt) code. In all likelihood, this is an automated “bot” account, set up to amplify posts from specific channels.
The story’s spread online was also modest. On December 24, it was re-posted by five websites: American Buddhist Net, Eugenics and Pandemics, ReBrn, Curious Cosmos and Investment Watch Blog. Two days later a second wave of re-posts followed, on Before It’s News, Earth’s Final Countdown, Public Intelligence Blog and Seemorerocks. On December 27 it was once again re-published by Investment Watch Blog and the SGT Report. In turn, these publications were picked up by other sites — Russia News Now and Above Top Secret.
Like Craddick’s own, these sites are characterized by conspiracy theories, especially “Pizzagate”, hostility to Soros, and outspoken support for Trump. However, they are not uniform. For example, Above Top Secret and Curious Cosmos share content posted by users; Earth’s Final Countdown specializes in doomsday theories; the Public Intelligence Blog is a curated site which appears to call for humanitarian principles and targeted assassination, as its own description of its logo explains: “The logo consists of the Whole Earth within a Rescue Cross, with four symbols: the bowl for food and water; the quill pen for education and communication; the shovel for construction and development; and the stilleto (sic) for the inevitable rogues that need to be killed one at a time.”
Two sites in the list stand out, because they also shared the recent fake story on the US sending “3,600 tanks” to Europe, as the DFRLab has reported. The first is Before It’s News (known as BIN), described as an “extremely crazy conspiracy website” and featured in a Wikipedia list of fake news sites. The second is Russia News Now, also known as the Russophile after its web address (therussophile.org), which specializes in anti-Western and pro-Kremlin articles.
Failing to spread in Germany
In German, the conspiracy theory was an almost total failure — perhaps, in part, because it was posted during the German Christmas celebration (December 24–25). According to a BuzzSumo analysis, it was only shared five times on Facebook — for example, by this pro-AfD site:
It was not picked up by other websites; its only penetration online was a number of comments on assorted anti-immigrant and anti-Islam discussion threads.
A Reddit far-right cluster
In the light of this failure, it is interesting to assess the /r/the_frauke subreddit. It is clearly modeled on /r/the_donald, and linked to a number of similar-looking subreddits promoting populist and extremist politicians in Europe, notably Marine Le Pen, Nigel Farage, Norbert Hofer, Geert Wilders and the anti-EU movement.
Strikingly for a site allegedly focusing on German politics, only one of the moderators is flagged as German; another with a German-sounding name is flagged in Australia. The others are either flagged as located in English-speaking countries, or have English names. This appears not to be a domestic site, but a predominantly English-language one trying to replicate the success of /r/the_donald in Germany.
Equally interesting is the activity of the Australian-flagged moderator called “HelpIveFallenOver”, one of three moderators to have full editing permissions. It also moderates the subreddits dedicated to Le Pen, Wilders and Euroscepticism, together with two subreddits which call the Black Lives Matter movement “anti-white racism” and “terrorists”, indicating a link between these sites.
It is not the only one: this cluster has a number of moderators in common. The accounts called ZodiacT10 and DRMOOMOO420, for example, both moderate the subreddits on Le Pen, Wilders and Euroscepticism; ZodiacT10 also moderates their Italian and Swedish equivalents. An account called RossTheColonel moderates the subreddits on Le Pen, Euroscepticism and Farage, as well as the subreddit HillaryForPrison which originally posted the Merkel fake, and the_donald itself.
The account called milespc (US-flagged) is also widespread. It is the first moderator listed on the Le Pen and Wilders subreddits; it also moderates a clutch of eight other subreddits dedicated to capitalism, the Enigma machine, nationalism and Malikism, although most of them feature either very few posts, or none.
Finally, the great majority of usernames which use a recognizable language do so in English, including on the subreddits for Wilders and Le Pen. The latter includes Anglo-Saxon moderator names or phrases including RossTheColonel, HollowFangs, BoardOwner, SuperSecretBanana, HeavyIndustry and HelpIveFallenOver. Only one name — Chepamec — appears French (possibly derived from the slang pronunciation of J’sais pas, mec, ‘I dunno, mate’). This is, to say the least, a curious state of affairs for a site backing a fiercely nationalist French politician who has criticized at least one French rival for using English.
Conclusion
The failure of the fake Merkel story is therefore instructive for the light it shines on the methods used by far-right and populist commentators to spread disinformation. Reddit emerges as the key pathway, with the subreddit /r/the_donald the only one to achieve any degree of impact. From /r/the_donald, the story spread via a group of conspiracy sites of various hues (mostly garish), and a number of disinformation accounts on Twitter and Facebook.
The post on /r/the_frauke failed dismally, but revealed the existence of a cluster of similar accounts backing far-right and populist politicians in the France, Germany, Italy, the Netherlands and the UK. Their moderators appear predominantly English-language, but not limited to one English-speaking country.
Therefore, as with the Twitter attack on Merkel chronicled by the DFRLab after December’s Berlin terror attack, this fake story was driven by the English-language far right. On this occasion, Reddit, rather than Twitter, was the vehicle of choice. The fake was a failure, but the technique is likely to be used again.
By Ben Nimmo, Nika Aleksejeva, DFRLab
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab). Nika Aleksejeva is a Digital Forensic Research Associate at the DFRLab.
