[from the source] Executive Summary: In July and August 2022, Twitter and Meta removed two overlapping sets of accounts for violating their platforms’ terms

[from the source] Executive Summary: In July and August 2022, Twitter and Meta removed two overlapping sets of accounts for violating their platforms’ terms of service. Twitter said the accounts fell foul of its policies on “platform manipulation and spam,” while Meta said the assets on its platforms engaged in “coordinated inauthentic behavior.” After taking down the assets, both platforms provided portions of the activity to Graphika and the Stanford Internet Observatory (SIO) for further analysis. Our joint investigation found an interconnected web of accounts on Twitter, Facebook, Instagram, and five other social media platforms that used deceptive tactics to promote pro-Western narratives in the Middle East and Central Asia. The platforms’ datasets appear to cover a series of covert campaigns over a period of almost five years rather than one homogeneous operation. These campaigns consistently advanced narratives promoting the interests of the United States and its allies while opposing countries including Russia, China, and Iran. The accounts heavily criticized Russia in particular for the deaths of innocent civilians and other atrocities its soldiers committed in pursuit of the Kremlin’s “imperial ambitions” following its invasion of Ukraine in February this year. To promote this and other narratives, the accounts sometimes shared news articles from U.S. government-funded media outlets, such as Voice of America and Radio Free Europe, and links to websites sponsored by the U.S. military. A portion of the activity also promoted anti-extremism messaging. As with previous disclosures, Twitter and Meta did not share the technical details of their investigations. Additionally, neither company has publicly attributed the activity to any entity or organization: Twitter listed the activity’s “presumptive countries of origin” as the U.S. and Great Britain, while Meta said the “country of origin” was the U.S. The findings in this report are based on our own open-source investigation and analysis of the two datasets shared by the platforms. The Twitter dataset provided to Graphika and SIO covered 299,566 tweets by 146 accounts between March 2012 and February 2022.1 These accounts divide into two behaviorally distinct activity sets. The first was linked to an overt U.S. government messaging campaign called the Trans-Regional Web Initiative, which has been extensively documented in academic studies, media reports, and federal contracting records. The second comprises a series of covert campaigns of unclear origin. These covert campaigns were also represented in the Meta dataset of 39 Facebook profiles, 16 pages, two groups, and 26 Instagram accounts active from 2017 to July 2022. For this report, we focused our analysis on the exclusively covert activity to better understand how different actors use inauthentic practices to conduct online influence operations (IO). We did note, however, some low-level open-source connections between the overt and covert activity in the combined Twitter and Meta data. These consisted of limited cases of content sharing and one Twitter account that posed as an individual in Iraq but has previously claimed to operate on behalf of the U.S. military. Without supporting technical indicators, we are unable to assess further the nature of the relationship between the two activity sets. We believe this activity represents the most extensive case of covert pro-Western IO on social media to be reviewed and analyzed by open-source researchers to date. With few exceptions, the study of modern IO has overwhelmingly focused on activity linked to authoritarian regimes in countries such as Russia, China, and Iran, with recent growth in research on the integral role played by private entities. This report illustrates the wider range of actors engaged in active operations to influence online audiences. At the same time, Twitter and Meta’s data reveals the limited range of tactics IO actors employ; the covert campaigns detailed in this report are notable for how similar they are to previous operations we have studied. The assets identified by Twitter and Meta created fake personas with GAN-generated faces, posed as independent media outlets, leveraged memes and short-form videos, attempted to start hashtag campaigns, and launched online petitions: all tactics observed in past operations by other actors. Importantly, the data also shows the limitations of using inauthentic tactics to generate engagement and build influence online. The vast majority of posts and tweets we reviewed received no more than a handful of likes or retweets, and only 19% of the covert assets we identified had more than 1,000 followers. The average tweet received 0.49 likes and 0.02 retweets. Tellingly, the two most- followed assets in the data provided by Twitter were overt accounts that publicly declared a connection to the U.S. military. This report is non-exhaustive and benefited from previous studies by the academic and open-source research communities. We hope our findings can contribute to a better-informed understanding of online influence operations, the types of actors that conduct them, and the limitations of relying on inauthentic tactics.