The report ‘corresponds to what the intelligence community knows as active measures’ to spread information, one expert told i
Wednesday, 4th December 2019, 11:09 am
The UK Government papers were on social media site Reddit for over a month before they were highlighted by the Labour Party and subsequently reported on last month – though Labour has not confirmed that this leak is where they got them. They detail initial talks between British and American trade negotiators – proving the US wants to secure access to the NHS for its firms, according to Jeremy Corbyn.
Graphika’s investigation does not suggest that the documents are fake, but instead tracks the series of efforts to get the leak acknowledged and picked up, over the end of October and start of November.
Graphika said that the NHS documents were first posted on Reddit by a user called Gregoriator, who made similar grammatical errors to those behind Secondary Infektion.
Two days later, a user named Max Ostermann posted three articles in German summarising the original leak on Reddit and on two small German language sites, meinbezirk.at and homment.com – a site with under 5,000 unique visitors a month – but then disappeared. Graphika claimed that this employment of single-use burner accounts and the combination of websites strongly mirrored the Russian operation, though the original attempted used a wider number of sources, and a wider number of languages.
“That’s a very specific combination,” said Ben Nimmo from Graphika.
A now suspended Twitter account called @Gregoriator then tried to spread the leak in late October by tweeting a link to the Reddit post to multiple public figures, including celebrities such as Stephen Fry and Bette Midler, and politicians from the Lib Dems and Labour.
The report’s conclusion provides two hypotheses’, one of which is that this leak could be from the same people behind Secondary Infektion, and the other is that it could be copycats for an unknown reason.
“At this juncture and based on the available open-source information, Graphika cannot provide attribution of the operation and hopes that further analysis of this material by others will lead to additional insights,” the report said.
Similarities to Russian interference
Other cyber experts agreed the case bears similarities to a disinformation operation. “I used my own technology to verify the claims and they’re completely legitimate,” said Dr Julio Amador, research fellow at Imperial College. “It seems what the report is claiming is quite true.”
Dr Amador, who studies data-mining algorithms, said the issue is still incredibly difficult to verify it is a Russian disinformation operation. In his experience, disinformation campaigns look for cracks in a society, and there couldn’t be anything more effectively divisive in the UK than the NHS, he said.
“It corresponds to what the intelligence community knows as active measures, in hoping it catches the attention of someone doing a mass market campaign.”
The concern, however, is that when dealing with the facts provided, while the distribution has some similarities to Secondary Infektion, there’s not enough to make any conclusions he said.
While the report might spark questions over Russian interference, and a desire for firm answers, it is clear there is not enough to go off yet. The initial operation was widespread, with Facebook removing nearly 100 actors, and the information being disseminated in 6 languages, across the platforms Facebook, Twitter, Medium and Reddit, as well as 11 different sites and blog networks. The NHS release appeared in just German and English, and across fewer locations, though this could suggest it is just part of a wider campaign, not the primary element.
“We need to be careful about the conclusions we draw,” said Lisa-Maria Neudert, Research Assistant at the Oxford Internet Institute. “Really, this is a report on the distribution.”
The pages the leak were posted on were extremely fringe, with one of them only having 5,000 unique visitors a month. It was not shared on sites where UK traffic would surge, and many of the ones used were German, she pointed out.
“There isn’t enough evidence to create a conclusion on Russian interference, but there are questions about the veracity of how the NHS document was spread”, she said.