Month: February 2023

The Unpublished Project: Part III

Unmasking the Oriental Review

Foto de Towfiqu barbhuiya en Unsplash

Since 2017 we’ve worked on numerous projects, which for reasons of confidentiality have not been published. We will feature five previously unpublished projects now edited. Looking back, this is also a reflection of what’s the same, what’s changed, and what we learned. Our goal is to bring some of our past efforts out of the shadows. Part I Part II ________________________________________________________________

The original report was delivered in June 2020.

Bottom Line Up Front (BLUF)

Oriental Review is a well-established disinformation site and shows strong cross-pollination of authorship and content with other key players in the disinformation ecosystem. Its content is also often propagated and promoted by sites with far greater established reach.

The site describes itself as “an international e-journal focusing on current political issues in Eurasia and beyond. The initiative is launched in February 2010 by a group of freelance bloggers and political analysts concerned with the aggravating security situation in the world.” Since its inaugural post on May 2, 2010 — which republished a New York Times op-ed (see source #1) “Russian Advice on Afghanistan” by Boris Gromov and Dmitry Rogozin — the Oriental Review has published approximately 3,300 articles. The website’s IP address (31.31.203.8) is geolocated to Russia and its content typically supports Russia’s strategic narratives and includes a long history of spreading disinformation.

From CIA conspiracies like a 2011 story titled “Gaddafi’s African “Mercenary” Story is a Disinformation Ploy by the CIA,” (see source #2) to an April 2020 COVID-19 conspiracy titled “Bill Gates, Vaccinations, Microchips, And Patent 060606,”(see source #3) Oriental Review has advanced a broad variety of stories related to color revolution conspiracy theories, anti-EU and anti-NATO themes, Christian traditional values and orthodoxy, historical revisionism (such as in the case of WWII), claims of Russian innocence (with regard to events like the downing of MH17, the Olympic doping scandal, and the Skripal poisoning) and COVID-19 disinformation. The site is also listed as a partner site to One World (see source #4) which was just removed by Twitter after EU DisinfoLab highlighted its connections to Russian disinformation (see source #5).

Background

The Oriental Review domain was registered by a Gennadiy Georgievich Kovtunov with a documented creation date of January 23, 2010 (see Figure A-1). Kovtunov is listed as both the registrant and admin (with contact details, address, phone and personal email: gennady.kovtunov@yandex.ru). While Kovtunov can be credited with registering the domain, there are no references to him on the website. Rather, Andrei (or Andrey) Fomin is identified as the “project pioneer” (see below). He was still listed on site as of January 11, 2011, but as of March 1, 2011, he is no longer referenced.

via Internet Archive — Time Machine

However, Fomin’s social media accounts also point to his involvement in Oriental Review, where he lists himself as its “founding editor” on his LinkedIn and Facebook pages.

Fomin does not appear to have any bylines at Oriental Review but has been published by many other fringe sites, including Global Research (see source #6), The Duran (see source #7), Free21 (see source #8), Off-Guardian (see source #9), Veterans Today (see source #10), Information Clearinghouse (see source #11), VoltaireNet (see source #12), and Fort Russ News (see source #13). Fomin’s author pages for Free21, Off-Guardian, Veterans Today, Information Clearinghouse, VoltaireNet, and Fort Russ News tie Fomin to Oriental Review.

In 2016, Fomin and Oriental Review published an article titled “Does Turkey Need Patriarch Bartholomew?” falsely attributed to Ambassador Arthur Hughes, a former U.S. ambassador, claiming that the Ecumenical Patriarchate in Istanbul was involved in a coup attempt (see source #14). The article was eventually removed.

Reviewing a list of 43 public Facebook friends of Fomin’s, it is clear that Fomin has connections with many individuals in Russian disinformation circles and who have ties to the Russian government. This network of friends includes:

  • Vyacheslav Nikonov: Russkiy Mir, Chairman of the Management Board
  • Israel Shamir: Reportedly WikiLeaks’s representative in Russia. (Shamir’s son, Johannes Wahlström, is a spokesperson for WikiLeaks in Sweden.) (see source #15)
  • Maxim Grigoriev: Director of non-profit Foundation for the Study of Democracy (see source #16)
  • Vladimir Rodzyanko: Co-founder and Managing Director at The Duran (see source #17)
  • Alex Christoforou: President and Chairman at The Duran (see source #18)
  • Modest Kolerov: Chief editor at REGNUM news agency (see source #19)
  • Sergey Nalobin: Director of the Digital Diplomacy Unit at the Department of Information and Press for the Russian MFA (see source #20)
  • Maria Zakharova: Director of the Information and Press Department of the Ministry of Foreign Affairs of the Russian Federation (see source #21)
  • Alexander Ionov: President of the Rodina Party-tied Anti-Globalization Movement of Russia (ADR) (see source #22); hosted the “Dialogue of Nations” in 2016, which brought together representatives from separatist movements around the globe; raised awareness and support for Maria Butina as her “official representative” (see source #23)
  • Ajamu Baraka: American political activist and former Green Party nominee for Vice President of the United States in the 2016 election (see source #24)
  • Mnar A. Muhawesh: Founder and Editor in Chief of Mint Press News (see source #25)
  • Viktor Olevich: Lead expert at Moscow-based think tank Centre for Actual Politics (see source #26)

Since 2014, Andrew Korybko, based in Moscow, has become the Oriental Review’s most prolific contributor (see source #27). Korybko, who is the suspected founder/manager of the disinformation site One World, appears to have subsequently taken on a significant role related to the publication’s editorial output. His Sputnik News bio (see source #28) notes that he “is a political analyst, journalist, and a regular contributor to several online journals, as well as a member of the expert council for the Institute of Strategic Studies and Predictions at the People’s Friendship University of Russia.” It appears that with regard to Oriental Review, Korybko begins his ascendance while Gennadiy Georgievich Kovtunov fades.

Research on the website Kontrus (see source #29) shows that “Kovtunov Gennady Georgievich was registered as an individual entrepreneur on May 28, 2010,” which coincides with his registering the site domain for Oriental Review earlier that year. The site also indicates his main mode of business was “Activities of news agencies.” It is most important to note that in 2014 his business holdings were “appropriated by the tax authority” and that he apparently liquidated his intellectual property (see source #30). This points to the notion that Kovtunov’s business was under duress. This same year, Korybko publishes his first post for Oriental Review titled “Coup in Western Ukraine: the Arab Spring unleashed in Europe” in January 2014 (see source #31).

While there is no information about Kovtunov since his cessation of entrepreneurial activity on June 25, 2014, Korybko has gone on to publish 703 articles (as of June 18, 2020) for Oriental Review. The fact that Kovtunov’s exit corresponds with Korybko’s ascendance and is occurring in 2014 as Russia is taking an overtly hostile posture towards Ukraine.

Leonid Savin is also a contributor (see source #32) to Oriental Review. Savin (see source #33) was previously editor-in-chief at Katehon, the St. Petersburg-based think tank with ties to the far-right. He was also previously editor-in-chief at Geopolitica.ru and has contributed to the Strategic Culture Foundation.

Overall, Oriental Review consistently delivers content aligning with key Russian strategic narratives and themes, such as:

  • Ukraine as a failed or unreliable state
  • U.S. and NATO aggression or interference in other countries
  • European divisions and weakness
  • Global elections
  • Immigration
  • Russia’s doping scandals in sporting competitions
  • Turkey is an aggressive, destabilizing force
  • Defending Russia and its government
  • Traditional values and orthodoxy
  • Historical revisionism

As of February 28, 2023, the Oriental Review is still going strong with many of the same contributors as in June 2020.

_____________________________________________________________

Sources

#1 https://www.nytimes.com/2010/01/12/opinion/12iht-edrogozin.html

#2 https://orientalreview.org/2011/04/04/gaddaffi%e2%80%99s-african-%e2%80%9cmercenary%e2%80%9d-story-is-a-disinformation-ploy-by-the-cia/

#3 https://orientalreview.org/2020/04/29/bill-gates-vaccinations-microchips-and-patent-060606/

#4 http://oneworld.press/?module=partners&action=list&page=2

#5 https://twitter.com/DisinfoEU/status/1272447204150689797?s=20

#6 https://www.globalresearch.ca/author/andrey-fomin

#7 https://theduran.com/members/andre-fomin/

#8 http://www.free21.org/author/andrey-fomin/?lang=en

#9 https://off-guardian.org/2018/03/13/fatal-quad-who-is-assassinating-former-mi6-assets-on-british-soil/

#10 https://www.veteranstodayarchives.com/2015/07/22/the-new-red-menace-and-natos-plans-in-the-arctic/

#11 http://www.informationclearinghouse.info/article43998.htm

#12 https://www.voltairenet.org/auteur125416.html?lang=en

#13 https://www.fort-russ.com/tag/oriental-review/

#14 https://www.rand.org/content/dam/rand/pubs/perspectives/PE200/PE278/RAND_PE278.pdf, https://www.euractiv.com/section/global-europe/opinion/will-ankara-take-aim-at-patriarch-bartholomew/

#15 https://www.theguardian.com/commentisfree/andrewbrown/2010/dec/17/wikileaks-israel-shamir-russia-scandina

#16 https://russiaun.ru/en/news/sideevent_syria, https://www.thedailybeast.com/trumps-new-favorite-network-oann-embraces-russian-propaganda

#17 https://ru.linkedin.com/in/vladimir-rodzianko-71aa4010

#18 https://ru.linkedin.com/in/alexchristoforou

#19 ttps://www.rferl.org/a/Russian_Journalist_Not_Allowed_To_Lithuania/1789154.html

#20 https://twitter.com/snalobin?lang=en

#21 https://www.buzzfeednews.com/article/konstantinbenyumov/maria-zakharokva-profile-russian-foreign-ministry

#22 http://aionov.ru/biografiya/

#23 https://tass.com/society/1085168

#24 https://www.gp.org/ajamu_baraka

#25 https://www.mintpressnews.com/author/mnarmuhawesh/

#26 https://www.aljazeera.com/programmes/insidestory/2019/12/peace-eastern-ukraine-191208201628985.html

#27 https://orientalreview.org/author/ak/

#28 https://sputniknews.com/authors/andrew_korybko/

#29 https://translate.google.com/translate?hl=en&sl=ru&tl=en&u=https%3A%2F%2Fkontrus.ru%2F&prev=search

#30 https://translate.google.com/translate?hl=en&sl=ru&u=https://kontrus.ru/businessmans/9240-01/person/310774614800478-kovtunov-gennadii-georgievich&prev=search

#31 https://orientalreview.org/2014/01/24/coup-in-western-ukraine-the-arab-spring-unleashed-in-europe/

#32 https://orientalreview.org/2018/03/29/the-death-of-the-liberal-world-order/

#33 https://www.b92.net/eng/news/world.php?yyyy=2018&mm=06&dd=08&nav_id=104363

________________________________________________________________

Contact admin@mentionmapp.com to discuss our contract threat intelligence research, analysis, and reporting. Our focus is on disinformation, misinformation, and influence operation threats, risks, and vulnerabilities.

The Unpublished Project: Part II

PRC Media Interference & Influence: Target Canada

Foto de Towfiqu barbhuiya en Unsplash

Since 2017 we’ve worked on numerous projects, which for reasons of confidentiality have not been published. We will feature five previously unpublished projects now edited. Looking back, this is also a reflection of what’s the same, what’s changed, and what we learned. Our goal is to bring some of our past efforts out of the shadows. Part I ________________________________________________________________

The original report was delivered in August 2022.

Bottom Line Up Front (BLUF)

The client wanted the basis for a report to focus on the People’s Republic of China’s (PRC) social media-based activity. This final report relates to overt and covert PRC attempts to undermine the people, businesses, government, and national interests of Canada.

The research took place from June to August 2022 and showed no evidence of any PRC malign activities targeting Canada’s information ecosystem. To ensure the absence of evidence wasn’t connected to user inexperience with the primary technology platform, additional information sources have been included such as a review of Chinese state media, cross referencing two recent Mandiant reports, and a survey of the Canadian Alt-Left media and academics.

The absence of malign PRC activity does not represent a reduction of risk or the absence of vulnerabilities Canada faces from an increasingly hostile PRC. During respective meetings in June 2022 (see source #1), NATO and the G7 recognized The PRC’s growing threat.

_________________________________________________________________

Image credit: Margaret Trudeau on 1973 trip to China (Maclean’s)

Despite the absence of signals in the broad media ecosystem indicating potential malign activity, there are still lessons to be applied when considering the PRC’s interests in Canada. In the course of 80 years, the Dr. Norman Bethune mythos includes how his “service to the CCP earned him the respect of Mao Zedong, who wrote a eulogy dedicated to Bethune when he died in 1939” (see source #2). Prime Minister Pierre Elliott Trudeau’s pathos for China is equally important, as “the establishment of diplomatic relations between Canada and China in 1970 was a highly controversial political decision for Canada in the context of the times” (see source #3). As this report will highlight in 2022 it is very clear that the PRC has influenced Canada into being a welcoming nation of fellow travelers.

This report will highlight how the PRC’s efforts to capture Canada’s political, business, and academic interests have left the country complicit, co-opted, corrupted, and complacent. As APSI’s report, The party speaks for you Foreign interference and the Chinese Communist Party’s united front system indicates, “Premier Zhou Enlai,(pictured above with Prime Minister Trudeau in 1973) one of the PRC’s founding revolutionaries and a pioneer of the CCP’s United Front, advocated ‘using the legal to mask the illegal; deftly integrating the legal and the illegal’ (利用合 法掩护非法，合法与非法巧妙结合), ‘nestling intelligence within the United Front’ (寓情报于统战中) and ‘using the United Front to push forth intelligence’ (以统战带动情报).”

The PRC’s leadership and state media has been elevating its strategic narrative and propaganda global posturing for the last ten years. It is important to note that “the phrase “telling China’s story well” ((讲好中国故事)), introduced by Xi Jinping within the first year of his administration, in August 2013, encapsulates the notion that Party-state media and even quasi-private actors must work internationally to strengthen and innovate external propaganda, thereby enhancing China’s “international discourse power” (国际话语权) as a key aspect of its “comprehensive national power” (综合国力).”

Furthermore, Miburo Solutions offers an accurate assessment of today’s Propaganda and Disinformation Landscape, writing that “the Chinese Communist Party (CCP) is not copying Russia’s playbook when it comes to propaganda and disinformation — they’re authoring their own… China has grown its audience share globally, maintaining centralization and control, through a different multi-pronged approach combining well-funded, overt state-run print, radio, and television media; a network of public-private partnerships; and a new generation of social media influencers softening the CCP’s image worldwide.”

In the recent Canadian context, with the right issue, perceived slight, or opportunity to manipulate public opinion, the PRC clearly has the resources to target the broader Canadian media ecosystem.

For instance, DisinfoWatch (September 2021) detailed Chinese State Interference in Canada’s 2021 Election, leading with how “an article published September 9, 2021, on the CCP-owned tabloid platform, Global Times, questions the credibility of Conservative leader Erin O’Toole and his party’s foreign policy platform on China. The article appears to include a threat — that if Canada elects a Conservative government and that government adopts the policies in the Conservative’s platform, “China will pay back with a strong counter strike and Canada will be the one to suffer.”

According to DFRLab analysis, (July 2021) China weaponizes discovery of graves at Canadian residential schools to avoid Xinjiang criticism. Chinese state media in a response published 85 articles between 18 June 2021 and 11 July 2021 about 1,100 unmarked graves that had been found at four former Canadian residential schools for indigenous children. Those articles were promoted by at least 24 different Chinese state-affiliated Twitter accounts, which referenced Canada in more than 270 tweets, compared to only 146 mentions of the US in June 2021”

From Facebook to the street, the National Post reports (January 23, 2020) Protesters at Meng Wanzhou trial claim they were offered money “Many of the protestors claim they were offered payment to be there under false pretences. Julia Hackstaff, an actor in Vancouver, says she was offered $100 on Facebook to attend. She said she thought she was appearing for a film shoot.”

Events during June, July, and early August 2022 particularly former US House Speaker Nancy Pelosi’s Taiwan visit, appear to have pushed Canada off the PRC’s information operations agenda.

China State Media

In order to ensure the lack of signals detected were not researcher/user-related, Chinese state media including Xinhua, Global Times, China Global Television Network (CGTN), China Daily, and China News, and the Twitter accounts for Lijian Zhao 赵立坚 @zlj517 Spokesman & DDG, Information Department, Foreign Ministry, China (a key “wolf warrior”), and the Chinese Embassy in Ottawa were monitored and reviewed for all Canadian-related activity. These findings help support the assertion that Canada was not a target of PRC information operations during this time period.

Mandiant

Mandiant released two reports between June and August 2022 illustrating the PRC’s lack of attention paid to Canada.

Pro-PRC “HaiEnergy” Information Operations Campaign Leverages Infrastructure from Public Relations Firm to Disseminate Content on Inauthentic News Sites (August 4, 2022)

“Mandiant has identified an ongoing information operations (IO) campaign leveraging a network of at least 72 suspected inauthentic news sites and a number of suspected inauthentic social media assets to disseminate content strategically aligned with the political interests of the People’s Republic of China (PRC). The sites present themselves primarily as independent news outlets from different regions across the world and publish content in 11 languages… Narratives promoted by the campaign criticize the U.S. and its allies, attempt to reshape the international image of Xinjiang due to mounting international scrutiny, and express support for the reform of Hong Kong’s electoral system — a change that gave the PRC more power over vetting local candidates.”

Reviewing all 72 sites to cross-check for content targeting Canada, 34 returned the same three articles. In particular the article from July 12, 2022 New evidence Canada’s Genocide ! fits with the efforts to reshape to narrative related to Xinjiang.

Pro-PRC DRAGONBRIDGE Influence Campaign Targets Rare Earths Mining Companies in Attempt to Thwart Rivalry to PRC Market Dominance (June 28, 2022)

“we observed additional DRAGONBRIDGE activity begin to target the Canadian rare earths mining company Appia Rare Earths & Uranium Corp and the American rare earths manufacturing company USA Rare Earth with negative messaging in response to potential or planned rare earths production activities involving those companies… The campaign also promoted content criticizing the Biden administration’s decision to invoke the Defense Production Act on March 31, 2022, to expedite the domestic production of critical minerals to end U.S. reliance on China for its supply.”

This report informed the Globe and Mail reporting (June 28, 2022) Chinese bots spread disinformation about Canadian rare earths company in targeted attack, report alleges

From the report twelve Twitter profiles were noted, two do not exist, and ten have been suspended none of which referenced Canada nor Appia Rare Earths & Uranium Corp. It was not possible to cross-check/reference Facebook activity related to this campaign. Searching the hashtag #Lynas on August 16, 2022 did capture evidence (four profiles) of the campaign, but nothing directed at Canada.

Canada’s Fellow Travelers

The PRC’s investment or recent lack-there-of in targeted information operations of Canada can to some degree be supported by the history, strength, and activities of its Canadian fellow travelers working in the Alt-Left media space and a cadre of academics.

Canada’s Alt-Left Media

This is not a full survey of the Canadian Alt-Left media space but highlights the echoes of Beijing’s propaganda.

The Canada Files describes itself as “a platform for critical investigation and analysis of Canadian foreign policy and the military-industrial complex. We are a proudly socialist, anti-imperialist news organization.”

This July 31, 2022 tweet is noteworthy https://twitter.com/TheCanadaFiles/status/1553852705583628288

Cooperation between TCF & @socialist_china continues! TCF Contributing Editor @Arnold_August was interviewed on Press TV on its record of countering disinformation against China, also: China-Iran 25 cooperation agreement, BRICS + Belt & Road Initiative.

https://socialistchina.org/2022/07/10/press-tvs-record-countering-disinformation-against-china/?fbclid=IwAR0ALzzLGJ_D-thIl54bBOxW5U3L2qFdmihup0k89kmz8suHyA7Lbph4xxE

*Note > @Arnold_August is not only Contributing Editor, to The Canada Files but an active contributor to the disinformation ecosystem. https://www.arnoldaugust.com/

Arnold August’s extensive work via Global Research https://www.globalresearch.ca/author/arnold-august-2

He published nothing since 2020 via CounterPunch https://www.counterpunch.org/author/frevas3111/

This July 27th tweet further supports Canada files affinity to @socialist_china, “We appreciate the republication of this great article by @socialist_china!”

https://twitter.com/TheCanadaFiles/status/1552359523087785985

Canadian labour activists oppose AUKUS, a new NATO in the Pacific

*Note > Friends of Socialist China We also have an advisory group, composed of the following members: (such as) –

Radhika Desai — Convenor, International Manifesto Group; Professor, University of Manitoba (Canada)

Alan Freeman — Co-director, Geopolitical Economy Research Institute (Canada)

John Riddell — Founding Director, Communist International Publishing Project (Canada)

The Canadian Dimension — Asia section describes itself as “the longest-standing voice of the left in Canada. For more than half-a-century, CD has provided a forum for lively and radical debate where red meets green, socialists take on social democrats”

Decolonizing Canadian Foreign Policy (8 part series)

Amid the wreckage of wars in Iraq and Afghanistan, the United States and its allies have turned their sights on China. University of Victoria professor emeritus and historian John Price examines the rise of the coalition of Anglo settler colonial states of Canada, the United Kingdom, the US, Australia, and New Zealand, and how they are today fomenting conflict in the Asia Pacific.

Alternatives in Canadian foreign policy and the racism of ‘The National’

As noted with the names on Social China’s advisory group, and John Price’s work for the Canadian Dimension there is clearly cross-pollination between Canada’s Alt-Left media and cadre of academics.

Cadre of Canadian Academics

This is not a comprehensive survey of the Canadian academic space but highlights the echoes of Beijing’s propaganda.

Examples of Pro-China commentary:

Anti-China sentiment is becoming anti-Chinese prejudice in Canada (June 21, 2021) Op-Ed written by, Paul Evans HSBC Chair in Asian Research at the University of British Columbia. Yuen Pau Woo is a senator for British Columbia.

Why Alberta must rethink its ban on Canada-China university collaborations (June 2021) John Price Professor Emeritus, Asian and Pacific history, University of Victoria

Simon Fraser University. President’s Faculty Lecture: Dr. Yuezhi Zhao China’s “Belt and Road Initiative:” A Critical Communication Perspective (January 31, 2018) *Note: The report author attended this event, it was neither “critical” nor offered testimony to China’s intellectual property theft, and practice of “debt capture” diplomacy for example. The professor played a 10-minute video with subtitles of Premier Xi Jinping “telling China’s story well.”

APSI’s recent report, Assessing the impact of CCP information operations related to Xinjiang, shows the effort to influence the academy is pernicious. It is interesting how information from Mandiant’s “HaiEnergy” report, and the July 12, 2022 article New evidence Canada’s Genocide ! connects with “the CCP’s Xinjiang-related narratives, the party is increasing its funding of academic research on influencing international perceptions of Xinjiang and other ideological topics sensitive to the CCP… evolving CCP information operation pipeline in which academic activities flow into online propaganda and engagements with international organizations offline such as the UNHRC.”

Ripped from the Headlines

While potentially of interest to a local audience, these recent news articles do not appear to be resonating in the broader information ecosystem of PRC trolls.

Former journalist on Hong Kong ‘wanted’ list receives ‘friendly’ visit from CSIS agents (August 17, 2022)

Ex-Vancouver newspaper editor of Sing Tao on Hong Kong’s wanted list (August 16, 2022)

SFU prof targeted by China for groundbreaking Uyghur research (August 11, 2022)

While referencing work being done in support of the PRC’s worldview by Canada’s Alt-Left media and its academics, capturing the country’s political elite is neither a new phenomenon, most importantly has to be keenly and continually observed.

Canadian MPs hope for trade visit to Taiwan this fall despite tensions with China (August 17, 2022)

MPs, senators should consider the consequences of Taiwan visit, Trudeau says (August 19, 2022)

Regarding the book “Willful Blindness” Canadian Senator Yuen Pau Woo who has been criticized for supporting the Beijing party line leads the criticism. Chinese Canadian leaders say journalist Sam Cooper did “not check his facts” about them (May 2021). Three examples from Cooper’s closing chapters highlight why this book has been the subject of derision from the “friends of Beijing:”

  • China’s fentanyl represents hostile state activity.” (p. 306)
  • “Vancouver was becoming a global technology node for narcos, state actors and cyber criminals.” (p. 312)
  • “Canadian politicians, community leaders and business leaders need to be aware of the threat of ‘elite capture’ and espionage… At these United Front events, Chinese consulted will place agents looking for “talent” to cultivate Xi’s foreign interference plans.” (p. 345)

Conclusion & Recommendations

Between the Speaker of the House, Nancy Pelosi’s visit to Taiwan, Sino-Russo relations related to the war in Ukraine, and a contracting Chinese economy, Canada clearly didn’t warrant the PRC’s attention (wrath) during the Summer of 2022.

When the geo-political table stakes are high enough such as human rights or the Meng Wanzhou case clearly, the PRC is willing to invest in information operations targeting Canada. Yet, as this report suggests the PRC has an established network of operations and operators influencing all of Canada’s key institutions, as Sam Cooper concludes in ‘Willful Blindness’, “this is 30 years of a crime trend that has entrenched itself into our upper levels of Canadian society. It’s frightening. The connectivity onto our business elites and corridors of power in Ottawa. It will take a long time to turn the tide.” (p. 388)

There will be no legislative solution to ridding the Canadian media ecosystem of PRC propaganda. But, three steps the Canadian government can take to reduce the negative impact of PRC malign influence will be instituting FARA (Foreign Agent Registration Act), RICO Laws (Racketeer Influenced and Corrupt Organizations), and closing the remaining Confucius Institutes still operating in the country (see source #4).

We also need to further research and ask, does the PRC perhaps engage more in microtargeting than mass media using information collected through cyber breaches, WeChat, and TikTok?

_________________________________________________________________

Sources

#1 ‘Systemic challenge’ or worse? NATO members wrangle over how to treat China

#2 https://en.wikipedia.org/wiki/Norman_Bethune

#3 The Canadian Policy Context of Canada’s China Policy since 1970 (p. 33)

#4 Universities, school boards across Canada defend ties with China’s Confucius Institute
________________________________________________________________

Contact admin@mentionmapp.com to discuss our contract threat intelligence research, analysis, and reporting. Our focus is on disinformation, misinformation, and influence operation threats, risks, and vulnerabilities.

The Unpublished Project: Part I

The White Helmets Project 5 Years Later

Photo by Towfiqu barbhuiya on Unsplash

Since 2017 we’ve worked on numerous projects, which for reasons of confidentiality have not been published. We will feature five previously unpublished projects now edited. Looking back, this is also a reflection of what’s the same, what’s changed, and what we learned. Our goal is to bring some of our past efforts out of the shadows. ________________________________________________________________

The original report was delivered in March 2019.

Bottom Line Up Front (BLUF)

This client the target of a long-running disinformation campaign. The project supported the client’s MRM (Media, Research, and Monitoring) efforts, which attempted to counter disinformation efforts against it.

The White Helmets have been victimized by a vicious, sustained disinformation campaign since at least 2014. This report tells the story of 9262 unique Twitter profiles driving the online conversation about the White Helmets and analyzes the online Twitter activity of thirteen public figures and well-known proponents of pro-Kremlin narratives and the bots supporting the amplification of their messages. From August 2018 until March 2019 data from a variety of Twitter sources (audience engagement with specific Pro-Kremlin profiles and the hashtag #WhiteHelmets) was collected and analyzed. The primary project goal was to identify automated behavior connected to the amplification of messages and manipulation of platform metrics contributing to a campaign of global disinformation.

_________________________________________________________________

As the key goal of this project was to identify Twitter profiles that are most likely bots, it is important to start with two definitions: (see source #1)

  1. Bots are defined as “Pieces of software designed to automate repetitive tasks, such as posting content online. On social media, bots often purport to be genuine human agents, with the intent to deceive both humans and algorithms”
  2. If a live event is an organic experience, then a programmatic event can be defined as a synthetic one. As a synthetic event is meant to imitate a natural product, making synthetic social participation an act of manipulation. As social bots only represent one tool in the information operators’ toolkit and a small percentage of the Twitter audience, this report will present evidence that suggests the White Helmets are victims of a concerted campaign of targeted, manipulated disinformation.

By combining message amplification (collective volume) and engagement metrics (retweets, likes, replies) synthetic manipulation is intentional behavior that over time can:

  • Normalize perception: read the same narrative enough, see the same memes over and over and it can be perceived as fact or truth
  • Censor: Flooding an online conversation constitutes a form of censorship, either by drowning out organic points of view or silencing organic voices following harassment
  • Gaming: This activity also influences or “games” algorithms driving search engine results, further amplifying disinformation by allowing manipulated content to disproportionately dominate the online conversation

Disinformation tactics and campaigns erode trust in public discourse and institutions while crowding out truthful content and debate. Human-like profiles imitating organic engagement constitute “Triple P” (Pervasive, Persistent, Partisan) information threats, which actively erode truthful online discourse.

This report’s findings present an important case study representing a much bigger socio-political problem that requires policymakers to respond. The results presented in this report raise important questions related to a variety of suspect Twitter audience behaviors. This has been a process to establish identification methods, classifications, and definitions specific to bots, which will be an ever-evolving process as the tools and tactics for information warfare adapt to automated detection methods and policy changes by social media platforms.

The report is not:

  • Firm attribution
  • Proof of Impact
  • Harassment of profiles engaged in suspect activity

The report is:

  • Specific to Twitter
  • Provides the client with a foundational dataset to support counter-disinformation monitoring, analysis, and response

Research Methodology (edited):

Analysis A: The hashtag #whitehelmets is a highly relevant conversation. Using the Mentionmapp scheduling tool profile data connected to those using the hashtag was exported from the Twitter API at random moments each day during two time periods.

Analysis B: Focused on mentions or retweets of “The Dirty Dozen”: (see source #2) As of February 27, 2023, all but two of the thirteen profiles are still active on Twitter.

Unlike the hashtag #whitehelmets which can be deemed “the conversation” and as such could attract a wider and potentially diverse range of audience participants, those profiles choosing to engage directly with the Dirty Dozen could have different motivations and intentions. By collecting profile data from both the hashtag and those engaging with the thirteen specific accounts, it was agreed this approach could provide a broader audience whose activity would be analyzed over the duration of the project.

Ten weeks of analysis was based on segmenting the audience into three categories by their seven-day average daily tweet volume (see source #3)

  • Cyborgs (72+ tweets/day)
  • Moderates (36–71 tweets/day)
  • Low-volume (>1–35 tweets/day) (see source #4)
  • All of the combined data returned 9262 unique profiles.

Mentionmapp further segmented the data to analyze a dataset of 1770 unique profiles for which there is reasonable evidence to classify as bots/bot-like based on the following considerations:

  • Profiles with 0–2 replies
  • Skewed following/followed ratio such as those following twice as many as being followed back
  • Time on platform
  • Manual profile review to identify evidence of pro-Kremlin narrative
  • The Low-volume group was included to account for seven-day tweet average fluctuations

Findings:

Mentionmapp benchmarked the Twitter activity of four distinct categories of synthetic and/or suspicious activity:

  • Bot_Cyborgs: these profiles consistently exhibited highly suspicious behaviors with every scan.
  • Bot_Modulators: this category reflects profiles that modulate their tweet volumes between cyborg to non-cyborg
  • Bot_Moderates & Low-volume: there can be modulation between these two groups)
  • The attrition class: profiles that have been suspended; user not found; not authorized, and dormant. Mentionmapp continues to track these profiles because profiles may reappear

In a sample of profiles other forms of suspect behavior were noted such as: * A decline in profiles being followed (in one example, a profile demonstrated a 76% reduction in the number of profiles being followed.

* Another showed a sudden 80% decline, suggesting that lost contacts were the result of closed networks of profiles); high-volume cyborgs going dormant; the existence of suspicious profiles with near-identical screen names

Mentionmapp’s experience monitoring suspect profiles suggests that a number of these profiles (modulators and the “not authorized”) are being operated to avoid being detected for violating the platform’s terms of service and subsequent suspension/deletion.

Questions, Observations, and Conclusions (then)

In many ways, this project has been the exploration of an uncharted ecosystem. This descriptive analysis tests a sound but preliminary foundation of methods and processes, but the questions still far outweigh the answers.

This project contributes to the analysis of the complexities of the digital information ecosystem, attempting to define and describe the problem while considering models of adversarial intent.

From a Mentionmapp Analytics perspective, we reflect on the following implications for further research:

  • Models are needed to understand how state actors and their proxies operate and manipulate bots and this might differ from other bad actors. A behavioral model of adversarial intent has yet to be developed.
  • Bot scores provide indicators or signals, which allow analysts to track noticeable fluctuations in scores over time. Further research is required to understand if adjustments are also automated or if they are facilitated by human profile operators themselves.
  • Confidence classifying bot profiles declines as tweet volume declines. Low tweet volume starts to appear more human-like, evading automated detection and removal. This could also reflect programmatic augmentation such as using scheduling tools (Buffer or Hootsuite), which are often operated without nefarious intent.
  • Further research and analysis are required to refine and agree on a common classification of bot types. Classification definitions must take into account volume, manipulation of metrics, coordination of multiple accounts, chatbots, and more.

In conclusion, the collection of bot/bot-like profiles suggests there is enough synthetic behavior targeting the White Helmets specifically and promoting Pro-kremlin narratives to cause significant concern about

Reflection

As per the client’s requirements, this project was Twitter-centric and bot-focused, and clearly, the volume of Tweets was an attribute that was given prime consideration. In retrospect, it would have been interesting to dedicate resources to examining the behavior, attributes, design, connections, and narrative patterns of the low-volume profiles. Profiles like these fly under the radar, yet over time a large enough collection could cumulatively support a campaign of strategic disinformation narratives.

Beyond the scope of the project, it would have been valuable to have analyzed links and documented the websites that the audience was being directed to. We’re claiming any correlation but noted recently that as of February 2022, RT is the fifth most visited website by Syrian audiences behind, Google, YouTube, Facebook, and Wikipedia with SputnikNews ranked fourteenth.

DIGITAL 2022: SYRIA

Five years later, eleven of the thirteen “Dirty Dozen” profile are still actively advancing and amplifying pro-Assadist, pro-Kremlin, anti-imperial, anti-West, and a variety of corrosive conspiracy theories into the information ecosystem.

_________________________________________________________________

Sources

#1 European Think Tank article “Polarisation and the use of technology in political campaigns and communication”

#2 The “Dirty Dozen” was a list of profiles provided by the client based on their internal research. The group represents the most influential key profiles engaged in negative discourse about the White Helmets

#3 DFRLabs is a leader in disinformation research, specifically related to automated (bot) activity. DFRLab’s (December 2016) definition of “suspicious”: “For the purposes of this analysis, a level of activity on the order of 72 engagements per day over an extended period of months — in human terms, one tweet or like every 10 minutes from 7 am to 7 pm, every day of the week — will be considered suspicious. Activity on the order of 144 or more engagements per day, even over a shorter period, will be considered highly suspicious. Rates of over 240 tweets a day over an extended period of months will be considered as “hyper-tweeting” — the equivalent of one post every three minutes for 12 hours at a stretch.”

#4 Given that bots are assets, it’s fair to suggest their operator may adjust and change their activity as a form of countermeasure. At some point, the deletion or suspension of assets is a cost. As well, by focusing on only high-volume profiles (cyborgs) we run the risk of missing other programmatic behaviors that in the aggregate are eroding and damaging the information landscape.
________________________________________________________________

Contact admin@mentionmapp.com to discuss our contract threat intelligence research, analysis, and reporting. Our focus is on disinformation, misinformation, and influence operation threats, risks, and vulnerabilities.