Of Invasion and Infektion
The Information Ecologist 63
What is this? The Information Ecologist (About page) will try to explore the dynamics of the Information Ecosystem (mainly) from the perspective of Technology Policy in India (but not always). It will look at topics and themes such as misinformation, disinformation, performative politics, professional incentives, speech and more.
Disclaimer: This is usually a space where I write about nascent/work-in-progress thoughts, or raise questions that I think we should (also) be looking to answer.
Welcome to The Information Ecologist 63
Yes, I’ve addressed this image on the new about page.
In this edition:
Just one main section about various analyses that investigated activities by Twitter accounts associated with India and the IStandWithRussia, IStandWithPutin hashtags.
A sub-section that refers to a chapter in Thomas Rid’s Active Measures, which included a Soviet Active Measure with an Indian connection.
Note: I haven’t addressed the conversations around the disturbing images and videos coming in from Ukraine over the last few days. And for those of us who aren’t OSINT experts, Mike Caulfield’s thread holds some lessons.
…
War and Infektion
In 61: Hammers and Splinter > India subplots, I had referred to the activity around the IStandWithRussia and IStandWithPutin hashtags that seemed to include a number of accounts associated with India.
The second India subplot is the presence of seemingly India-associated accounts in Twitter trends such as ‘IStandWithRussia’ and ‘IStandwithPutin’. See this thread by @NovelSci and these threads by (1,2) by @MarcOwenJones.
Also worth noting, 1 of them - professing support for Putin was trending in the low single figures. Some activity over on Koo too.Hard to tell whether there is a strategic aspect to this or just a case of an enterprising ‘digital marketing firm’ receiving assignments due to economic sanctions on Russia (this is wild speculation on my part).
Since then, we’ve had more investigations looking into this aspect.
A DFR Lab investigation observed [Jean Le Roux - DFRLab]:
The Top 12 most retweeted tweets belonged to accounts with low follower counts. Despite this, they seemed to gain very few followers. In some cases, accounts started sharing some of these tweets within minutes of their creation (an example in Jean Le Roux’s post references an account that shared 3 of the top 12 tweets within 2 minutes of being created) even though they didn’t follow any of these accounts. If you head over to the post and look at the collage of these tweets, many of the handles appear to have ‘Indian-sounding’ names.
“A large portion of the sampled accounts appeared to originate in India”. How? (one should bear in mind that OSINT analysis often requires making a lot of educated guesses)
Language cues, tweets about local sports and politics, early follows (likely region-based suggestions), and the time zone in which the accounts were most active all pointed towards India as the origin of many of the accounts in the network.
And that a “large proportion” of the accounts were created this year, and Feb 24th and Mar 2nd were the dates on which the most accounts were created.
Let’s revisit the ‘appeared to originate in India’ aspect.
While Marc Owen Jones’ sample of 20000 tweets referenced India as a frequently appearing user-reported location (though, in that sample, it wasn’t right on top), he cautions that just because a location is reported does not mean it is accurate.
Last week, the New York Times published an investigation based on data from Marc Owen Jones (I assume more data was collected since the article mentions a 2-week period) [Kate Conger, Suhasini Raj - NYTimes]. (emphasis added, I also wish there were fewer blues, it was hard to differentiate between the other countries)
Users who said they were from India made up nearly 11 percent of the hashtag trend in the two weeks after the invasion. Just 0.3 percent were from Russia and 1.6 percent from the United States during that time.
Around the time I published edition 61, Carl Miller posted a network map which indicated that many replies/mentions were directed at accounts in India (if you zoom in, you’ll see accounts of some minsters, Indian embassies, opposition figures and media houses). Worth noting that this map appeared to be account-specific and not hashtag-specific.
Aside 1: One of the network maps on Jean Le Roux’s post did mention Indian and Russian diplomatic accounts (image link).
About 10 days later, Carl Miller posted a map that sub-categorised them based on language clusters, followed by a white paper on March 25th.
Aside 2: If you’re wondering why I was sketching out a timeline, it is because there was a minor subplot developing. Both the tweets I’ve included here reference an information operation. However, researchers like Shelby Grossman (tweet) and Emerson Brooking (replies) pointed out that they provide no evidence of a coordinated information operation.
The white paper, when it came out, didn’t call it a single information operation, either. However, it did make for an interesting analysis. It also highlighted that the information ecosystem is a couple of degrees more complex than we assume and that the way we answer questions like ‘who is winning the information war?’ are influenced heavily by who is asking and what part of it they’re looking at (like the parable about the visually challenged people and the elephant).
While I can’t speak authoritatively about the research methodology and the clustering of accounts based on linguistic similarities, I’ve included an image with some of my notes from the white paper.
Two dates pop up frequently, 24th February (the day the invasion began) and 2nd March (the date of the UN General Assembly vote and ultimately a resolution which “demand[ed] that Russia ‘immediately, completely and unconditionally withdraw all of its military forces from the territory of Ukraine within its internationally recognized borders.’” [UN.org])
Here’s what the white paper said about the mixed Hindi/English cluster (set aside the bit about Kashmir Files being referred to as a ‘commercial cinema release’, since its promotion is very much on-brand with the rest of the content).
We also observe that Russia-related message decreases sharply after the UN vote, but overall volumes of messaging does not. Our speculation is that many of the RED accounts are members of a ‘paid to engage’ spam network that can be rented to supply amplification to a number of different clients, and has over our time of study been used to amplify BJP politics, a commercial cinema release and also the invasion of Ukraine.
This is not surprising. It still doesn’t answer the question of who paid, of course, which would require a tremendous amount of investigative work to establish a clear money trail.
I must admit, though, that some aspects of the Tamil cluster surprised me — that it contained pro-invasion messaging and increased activity around Kashmir Files despite amplifying anti-BJP messaging — wasn’t something I expected. Specifically with regard to Kashmir Files, though, the white paper did not specify if the content was pro/anti.
Aside 3: When I read things like this, I am reminded of one of the articles from The Guardian’s ‘The Facebook Loophole’ series [Julia Carrie Wong, Hanna Ellis-Petersen - TheGuardian]. While that article got attention for Facebook’s inaction related to a network connected to a BJP MP, it also highlighted how much we’re constantly being played… by everyone:
… Facebook saw immediate efforts to reconstitute with new accounts and, in the weeks ahead of the 2020 state elections in Delhi, the network that had previously boosted a Congress politician in Punjab began supporting AAP, the anti-corruption party in Delhi.
In the comments of posts by BJP politicians in Delhi, the fake accounts represented themselves as supporters of Modi who were nevertheless choosing to vote for AAP in the state elections. The intervention may have been a result of political actors attempting to support the party in Delhi with the best chance to defeat the BJP, since Congress enjoys little support in local Delhi politics. Facebook undertook multiple rounds of checkpointing to knock out the network.
Do friends target friends with information operations?
While we may never find who paid for the Indian-language clusters’ amplification of pro-invasion messaging, it is worth taking a queue from Mike Caulfied’s tweet thread and looking at history.
Chapter 22 of Thomas Rid’s Active Measures references a Soviet Active Measure trying to create the narrative that AIDS was a bio-weapon created by the US (that should sound familiar for many reasons) that had an Indian connection. As per the source material he cites, it was at some point code-named Operation INFEKTION by the HVA (the foreign intelligence branch of East Germany’s Ministry for State Security).
“AIDS may invade India: mystery disease caused by U.S. lab experiments.” So read the sensational first-page headline in Patriot, an Indian newspaper, on July 16, 1983. Patriot, under a picture of five smiling girls, printed an anonymous letter from a “well-known American scientist and anthropologist.” There was no name in the byline, only “New York.”
The Patriot letter was a masterfully executed disinformation operation: comprising about 20 percent forgery and 80 percent fact, truth and lies woven together, it was an eloquent, well-researched piece that gently led the reader, through convincing detail, to his or her own conclusion.
He points out that The Patriot had been funded by the Soviet Union, when it opened in 1962, “for the explicit purpose of circulating Soviet-friendly stories and publishing disinformation”. And while the article did not seem to have any direct impact (Rid notes that neither was it picked up in India, nor was it noticed in Europe and the US), it did play a role later:
In KGB's efforts to further a narrative in coordination with partners code-named Denver (in 1985).
The point of departure of the planned active measures campaign, as the KGB told its Soviet bloc partners, was the “factual” article published in Patriot. The KGB then instructed its partners to help spread the theory that AIDS was U.S.-made to “party, parliamentary, social-political, and journalistic circles in Western countries and the developing world.” The “facts” published in the Indian press offered the blueprint
In October 1985 - it was attributed as a source in an article that, as per Rid, would prove to be consequential in the future.
On October 30, Literaturnaya Gazeta ran the headline “Panic in the West: or, What Is Hiding Behind the Sensation Surrounding AIDS.”23 The paper was the KGB’s “prime conduit in the Soviet press for propaganda and disinformation,” according to Oleg Kalugin. The piece that relaunched the DENVER campaign closely mirrored the earlier measure in the Indian press. Its author, Vitaly Zapevalov, accurately cited details about the new disease and its spread in American cities over the past two years, basing his analysis on authoritative U.S. news reports.
“Why,” he asked ominously, would AIDS “appear in the USA and start spreading above all in towns along the East Coast?” Next, the Gazeta piece outlined several covert American biological warfare programs, again based on verifiable public sources. Zapevalov also cited accurate details about Fort Detrick. The author then referred to the two-year-old Patriot forgery to connect the dots. “All of this information, taken together with the AIDS mystery, leads to serious considerations. The solid newspaper Patriot, published in India, for instance, openly expressed an assumption that AIDS is the result of similar inhuman Washington experiments.”
I’ve just quoted specific sections here, I recommend reading the complete chapter (and perhaps the whole book).
A thread you’ll note in most of the analysis of pro-invasion messaging/narratives is that it also points out ‘Western Hypocrisy’ - which is perhaps both real (that doesn’t mean it is a valid ground for whataboutery, though), and a genuine sentiment that many people share. That’s something the chapter brings out clearly - both in terms of camouflaging false claims with the truth. And the false beliefs, which were eventually amplified, had taken root organically.
So, do friends target friends with information operations? As my colleagues Nitin Pai and Pranay Kotasthane will tell you - there are no friends in international relations, only interests.
So the bit about “no friends in international relations, only interests”, well, Takshashila’s courses cover a lot of public policy related concepts like that.
You can find out more here.