Unheard Voice: Evaluating five years of pro-Western covert influence operations [pdf]
[from the source]<p>Executive Summary:<p>In July and August 2022, Twitter and Meta removed two overlapping sets of 
accounts for violating their platforms’ terms of service. Twitter said the accounts 
fell foul of its policies on “platform manipulation and spam,” while Meta said the 
assets on its platforms engaged in “coordinated inauthentic behavior.”  After 
taking  down  the  assets,  both  platforms  provided  portions  of  the  activity  to 
Graphika and the Stanford Internet Observatory (SIO) for further analysis. 
Our  joint  investigation  found  an  interconnected  web  of  accounts  on  Twitter, 
Facebook, Instagram, and five other social media platforms that used deceptive 
tactics to promote pro-Western narratives in the Middle East and Central Asia. 
The platforms’ datasets appear to cover a series of covert campaigns over a 
period of almost five years rather than one homogeneous operation.<p>These campaigns consistently advanced narratives promoting the interests of 
the United States and its allies while opposing countries including Russia, China, 
and Iran.  The accounts heavily criticized Russia in particular for the deaths of 
innocent civilians and other atrocities its soldiers committed in pursuit of the 
Kremlin’s “imperial ambitions” following its invasion of Ukraine in February this 
year. To promote this and other narratives, the accounts sometimes shared news 
articles from U.S. government-funded media outlets, such as Voice of America 
and Radio Free Europe, and links to websites sponsored by the U.S. military. A 
portion of the activity also promoted anti-extremism messaging.<p>As with previous disclosures, Twitter and Meta did not share the technical details 
of their investigations. Additionally, neither company has publicly attributed the 
activity to any entity or organization: Twitter listed the activity’s “presumptive 
countries of origin” as the U.S. and Great Britain, while Meta said the “country of 
origin” was the U.S. The findings in this report are based on our own open-source 
investigation and analysis of the two datasets shared by the platforms.<p>The  Twitter  dataset  provided  to  Graphika  and  SIO  covered  299,566  tweets 
by 146 accounts between March 2012 and February 2022.1 These accounts 
divide into two behaviorally distinct activity sets. The first was linked to an overt 
U.S. government messaging campaign called the Trans-Regional Web Initiative, 
which has been extensively documented in academic studies, media reports, and 
federal contracting records. The second comprises a series of covert campaigns of 
unclear origin. These covert campaigns were also represented in the Meta dataset 
of 39 Facebook profiles, 16 pages, two groups, and 26 Instagram accounts active 
from 2017 to July 2022.<p>For this report, we focused our analysis on the exclusively covert activity to better 
understand how different actors use inauthentic practices to conduct online 
influence operations (IO). We did note, however, some low-level open-source 
connections between the overt and covert activity in the combined Twitter and 
Meta data. These consisted of limited cases of content sharing and one Twitter 
account that posed as an individual in Iraq but has previously claimed to operate 
on behalf of the U.S. military.  Without supporting technical indicators, we are 
unable to assess further the nature of the relationship between the two activity 
sets.<p>We believe this activity represents the most extensive case of covert pro-Western 
IO on social media to be reviewed and analyzed by open-source researchers to 
date. With few exceptions, the study of modern IO has overwhelmingly focused 
on activity linked to authoritarian regimes in countries such as Russia, China, and 
Iran, with recent growth in research on the integral role played by private entities. 
This report illustrates the wider range of actors engaged in active operations to 
influence online audiences.<p>At the same time, Twitter and Meta’s data reveals the limited range of tactics IO 
actors employ; the covert campaigns detailed in this report are notable for how 
similar they are to previous operations we have studied.  The assets identified 
by Twitter and Meta created fake personas with GAN-generated faces, posed as 
independent media outlets, leveraged memes and short-form videos, attempted 
to start hashtag campaigns, and launched online petitions: all tactics observed 
in past operations by other actors.<p>Importantly, the data also shows the limitations of using inauthentic tactics to 
generate engagement and build influence online. The vast majority of posts and 
tweets we reviewed received no more than a handful of likes or retweets, and 
only 19% of the covert assets we identified had more than 1,000 followers. The 
average tweet received 0.49 likes and 0.02 retweets.  Tellingly, the two most-
followed assets in the data provided by Twitter were overt accounts that publicly 
declared a connection to the U.S. military.<p>This  report  is  non-exhaustive  and  benefited  from  previous  studies  by  the 
academic and open-source research communities.  We hope our findings can 
contribute to a better-informed understanding of online influence operations, the 
types of actors that conduct them, and the limitations of relying on inauthentic 
tactics.