The Case of News Front: How Influence Operations Travel Across the Internet
9th February 2021
By Elise Thomas
Disinformation has become a significant problem for a wide range of online services and platforms. Since 2016, research has started to reveal the sheer scale of false information and identities online, across social media, blogging websites, dating apps and beyond.
A new investigation by ISD examines two websites presenting as news sites, as well as two blogging accounts, all of which appear to be linked to News Front, a Crimean-based news organisation previously accused of being a source of pro-Kremlin disinformation and influence operations. The investigation provides a window into the actors and tactics that make up the evolving world of online influence operations promulgating pro-Kremlin disinformation.
_______________________________________________________________________
Operating out of Crimea, News Front is a media organisation that publishes content in Russian, English, Slovak, Georgian, Hungarian, French, Serbian, Spanish, German and Bulgarian. Since its creation in 2015, the organisation has repeatedly been identified as a source of pro-Kremlin disinformation and influence operations, and it has allegedly received both funding and direction from the Russian government. In a report on Russian disinformation in August 2020, the US State Department described News Front as “one of the most blatant Russian disinformation sites.”
News Front’s Twitter and YouTube accounts were taken down in early 2020. In April 2020, Facebook announced that it had dismantled a network of accounts and pages linked to News Front as part of an investigation into coordinated inauthentic behaviour. Yet, despite these platform takedowns, News Front continues to operate as part of a broader network of digital assets and entities which propagates its content across the internet. ISD’s investigation seeks to demonstrate how it does this.
Mirroring content across other purported news sites
ISD identified two websites that present as separate news organisations, but whose content is identical to one another and to some (though not all) of News Front’s content. These sites are Summury News (note spelling: Summury rather than Summary) and Real Bomb (also known as RB News).
On both sites, stories are accompanied by supposed social media engagement statistics. However, ISD’s data analysis shows that these statistics – which accompany the articles and which show relatively high and suspiciously stable range of engagement numbers – are fictional. Using CrowdTangle to analyse the data, it becomes clear that the content on both sites has received only a handful of shares across public pages and groups since March 2018.
The lack of any real efforts to drive social media engagement for either site could suggest that the operators of the site are paid to produce content only and are therefore not motivated to improve their social media engagement statistics. While the lack of social media engagement suggests that the impact of these sites upon the public is likely to be low, they nonetheless provide an interesting insight into how stories flow across the News Front ecosystem. Further, they highlight the likely presence of a broader and more deceptive network of sites and digital properties than may appear at first glance.
Blogging platforms to seed affiliated content
Research by Graphika, the Stanford Internet Observatory and others has previously documented the use of blogging platforms in Russia-linked information operations. Perhaps the most significant example of this is the operation investigated by both Graphika and the Atlantic Council’s DFR Lab team, dubbed ‘Secondary Infektion’. According to their research, this multilingual operation spanned several years and more than 300 smaller platforms and social media networks, in addition to the major platforms. Despite this broad sweep, however, it appears the operation had minimal impact on the public and generated little organic engagement.
ISD uncovered at least two blogging accounts that have a partial but not complete overlap in posted content. The two blogging accounts are in the names of ‘Kate Matberg’ on the primarily Francophone site Mediapart, and ‘Anastasia Frank’ on The Duran, a site that website ranking organisation NewsGuard describes as a “pro-Russia website that has published conspiracy theories and false information to advance its views”.
Some identical stories are published across News Front, RB News, Summury News and the blogging accounts; some are published on News Front, RB News and Summury News but not on the blogging accounts; and some are published across RB News and Summury News and the blogging accounts, but not on News Front.
Cloaking domains
A third component News Front’s activities is the use of domain cloaking. Domain cloaking is a method for obscuring the true destination of a link, by loading the original site’s content in a frame on another domain. This is a relatively common method for evading bans imposed by social media platforms and other services, because when the links are posted on the platform they appear innocuous and are therefore not blocked or deleted.
Since being banned by Facebook in early 2020, News Front appears to have made at least two forays into domain cloaking. On 10 October 2020, two domains were registered: excreta.info, which loaded the English language version of News Front, and ambassadeur.info53 which loads the French-language version of News Front. Excreta.info appears to have been deleted in December 2020. The Francophone ambassadeur.info cloaking domain, however, continues to operate and has been in regular use on Facebook.
ISD’s analysis found that links to ambassadeur.info had been posted at least 6,172 times in 161 different Facebook groups and pages as of 15 January 2021. The scale of this activity appears to reflect a sustained effort to promote News Front France’s content to a range of audiences across Facebook.
Responding to online influence operations
The impact of this activity is likely to be low, but ISD’s investigation highlights how pro-Kremlin content and narratives can move across a broad network of platforms and domains, which can be independent of one another or partially or fully centralised.
News Front itself has been publicly identified as a known source of pro-Russian disinformation and influence operations, leading to social media platforms to limit its reach. But the same content is proliferating unchecked across a variety of other forums on the internet and retains some presence on Facebook through relatively simple workarounds.
This finding has implications for how best to respond to such networks. It underscores the fact that actions against specific organisations or domains, while potentially useful, are not likely to be completely effective in stopping the spread of disinformation or covert influence efforts. Instead, it is a constant game of whack-a-mole. Recognising this underscores the importance of fostering resilience to these kinds of influence efforts within societies themselves, as opposed to merely focusing on trying to remove or restrict content. It also reinforces the need to understand the wider internet ecosystem — beyond major social platforms like Facebook and Twitter — in order to effectively respond to disinformation and influence operations.
Elise Thomas is an OSINT Analyst at ISD. She has previously worked for the Australian Strategic Policy Institute, and has written for Foreign Policy, The Daily Beast, Wired and others.
