Suspected Russian spies floated a series of fake stories on social media including a claim that Remainers were planning to kill Boris Johnson and that the novichok used in the Salisbury attack came from the Real IRA, a new study shows.
The operation was done to provoke tensions between western countries. It was persistent, sophisticated and well-resourced, and involved fake accounts on more than 30 platforms and nine languages, over five years, the study says, according to The Guardian.
In May, Facebook took down a small number of "inauthentic" accounts which it said "originated in Russia". The accounts' behaviour "was consistent with an operation run by an intelligence service", the study carried out by the Atlantic Council's digital research lab found.
The most sensational piece of Russian fake news said that "radical opponents of Brexit" were planning to assassinate Johnson. A forged letter warning of the plot was posted on a mocked-up Facebook page that appeared to belong to a senior Spanish official.
The letter, complete with official seal, was signed by Spain's foreign minister "Josep Borrell Fontenelles". The minister's name was spelled incorrectly. User accounts were created to share the Johnson story in Spanish and English media, and then deleted later the same day.
A meme with Johnson shrugging his shoulders above the words "guess I'll die" was then spread via a Facebook group created in Russia.
Another 2018 fake featured a tweet designed to look like the account of the then UK defense secretary Gavin Williamson. Posted in March, it claimed the Real IRA delivered a "component of the nerve agent" used to poison Sergei and Yulia Skripal in Salisbury. Beneath it was a photo of police officers in hazmat suits.
A fake user – "Edward McGee" – then posted the tweet in an article. It claimed that Williamson had deleted the novichok tweet within minutes because the information was "sensitive and classified". The "McGee" account used a photo of the actor Hugh Laurie.
The fake articles circulated on what the study calls the "soft underbelly of the internet". They appeared on Medium, Reddit, the German website homment.com, San Francisco-based site indybay.org, Spain's globedia.com, and other sites. The stories got little attention.
"In terms of effort this was huge. In terms of bang for your buck I have never seen so little bang for buck," Ben Nimmo of the Atlantic Council said. "It's bizarre."
Nimmo said that this appeared to be the work of an intelligence agency, rather than the notorious "troll factory" based in St Petersburg that interfered in the 2016 American presidential election. The most likely culprit was the GRU, the Russian military intelligence outfit. The GRU hacked and leaked Democratic Party emails, special counsel Robert Mueller said.
"It's guys whose job is secrecy trying to do social media. They were trying so hard to hide their identities they effectively hid their content as well," Nimmo said. The operation was a classic influence campaign, known as "active measures".