Secondary Infektion
Secondary Infektion is the name researchers gave to a six-year series of campaigns that planted forged documents and fake stories across the internet. From January 2014 into early 2020 it posted at least 2,500 pieces of content in seven languages on more than 300 sites, from Facebook, Twitter, Reddit, Medium and YouTube to small regional discussion boards. Its typical product was a supposedly leaked letter, tweet or blog post attributed to a Western or Ukrainian official, designed to set one government against another. Graphika counted more than 250 suspected forgeries. The operation hid its tracks with unusual discipline, and it failed almost completely: nearly nothing it posted drew measurable engagement, and readers who did notice often mocked it. The one exception was the October 2019 release of apparently genuine US–UK trade documents, which entered the British general election campaign. The case matters for both halves of that record: influence operations are frequently ineffective, and authentic leaked material is far more potent than forgery.
An unidentified "central entity" operating from Russia. No public report has named the organisation or individuals responsible.
Attributed by: Facebook (takedown announcement, 6 May 2019); the Atlantic Council's Digital Forensic Research Lab (June 2019); Reddit (December 2019, for the UK trade-documents leak); Graphika (June 2020).
Confidence, in their words: Facebook described a "small network emanating from Russia". DFRLab called it "a suspected Russian intelligence operation" and said linguistic and contextual clues "support Facebook's analysis that the operation was run from Russia". Graphika in 2020 called it "a large-scale, persistent threat actor from Russia" but "as yet unattributed to a specific actor", adding that the available features "are insufficient for a precise attribution". On the 2019 UK leak, Graphika first said the resemblance was close but not conclusive; Reddit then tied the accounts to the same campaign.
Objective
Inferred from content, since the operator is unknown. Graphika concluded it was "primarily aimed at provoking tensions between Russia's perceived enemies", trying to set "Poles against Germans, Germans against Americans, Americans against Britons, and absolutely everyone against Ukrainians", while also smearing critics of the Russian government and defending Russia over doping and other disputes. Election interference "was never the operation's main focus". DFRLab read the same material as promotion of Kremlin foreign-policy narratives.
Target audiences
- Ukraine, the most frequent target throughout, portrayed as failed, corrupt and an unreliable partner
- Publics in Germany, the United Kingdom, the United States, France, Poland, Spain, Sweden, the Baltic states and Turkey, each addressed in its own language with stories about another country's supposed hostility
- Russian-speaking audiences, the earliest target, with attacks on opposition figures such as Alexei Navalny
- Candidates and leaders across party lines: Hillary Clinton in 2016, Emmanuel Macron in 2017, Angela Merkel, the Kaczynski brothers in Poland, Lithuania's Dalia Grybauskaite; forged material was pushed at audiences on the right (anti-migrant pages, r/the_Donald) and the left alike, and tweeted at figures ranging from Fox News hosts to Bernie Sanders
- Institutions that had criticised Russia: the World Anti-Doping Agency, Bellingcat, and NGOs whose names were put on forgeries
- Journalists and politicians, tagged directly in the hope that they would repeat a story
Timeline
- January 2014Earliest traces: Russian-language posts attacking the Russian opposition. After the annexation of Crimea the operation turns on Ukraine, first in Russian, then in English and German.
- 1 December 2015First attack on Turkey, one week after Turkey shot down a Russian military jet. Graphika treats the timing as one of the clearest contextual indicators of Russian origin.
- 2016–2017Stories attack Hillary Clinton's campaign and then Emmanuel Macron's; after the 2016 doping revelations the operation begins forging World Anti-Doping Agency material. From late 2016 it relies almost entirely on single-use accounts.
- August 2018A forged tweet attributed to US Senator Marco Rubio, accusing Britain of election meddling, and a story that anti-Brexit radicals planned to assassinate Boris Johnson are seeded in several languages. Neither gains traction.
- Late 2018 – early 2019Peak output.
- 6 May 2019Facebook removes 16 accounts, four pages and one Instagram account "emanating from Russia". About 1,100 accounts followed the pages.
- 22 June 2019DFRLab, working outward from the Facebook assets, publishes "Operation Secondary Infektion": over 30 platforms, at least six languages, more than five years. Output drops sharply the following month.
- October – December 2019Apparently genuine US–UK trade negotiation documents are posted on Reddit with a clumsily worded introduction, ignored for weeks, then brandished by the UK opposition leader during the election campaign. Graphika notes the resemblance on 3 December; Reddit bans 61 accounts and links them to the campaign on 6 December.
- Early 2020Still posting at a low rate. One late story claims the United States created the Covid-19 virus in a secret laboratory in Kazakhstan, which Graphika calls a return to the operation's "intellectual roots".
- 16 June 2020Graphika publishes "Exposing Secondary Infektion" with a public database of the articles and images.
Channels
- Self-publishing and blogging sites and small discussion forums, used far more than the major platforms
- Reddit, Medium, Quora, Twitter, Facebook groups and pages, YouTube
- Direct @-mentions of journalists and politicians on Twitter
- Secondary pickup by conspiracy-oriented blogs and by Russian state-funded or Kremlin-aligned outlets
- No advertising: Graphika found no evidence that the operation paid to promote anything
Techniques
The signature move. A story would present an image of a "leaked" official letter, for example one from US senators to the Secretary of State or one from a Ukrainian official seeking a Nobel Prize for the president. Graphika identified more than 250 suspected forgeries, some "surprisingly poorly crafted".
Fabricated screenshots of tweets and blog posts stood in for statements that were never made, such as the Rubio tweet. DFRLab showed the tweet had never existed because nobody had reacted to it at the supposed time of posting.
Words were put in the mouths of real people, including Mike Pompeo, John Kelly and Carl Bildt, and of organisations such as Greenpeace and the Committee to Protect Journalists, both of which confirmed the material was forged.
Each version of each story was usually posted by a freshly invented person who never posted again. The reports note that this protected the operators and also guaranteed that no persona ever built an audience.
A story was planted on an obscure site, then retold in other languages by other fake accounts citing the first post as their source, so that by the time it reached a larger platform it appeared to have a trail of independent coverage.
The aim was pickup by larger outlets. This almost never happened in mainstream media; the recorded successes were a conspiracy blogger and website, from which Russian state outlet Sputnik ran the forged Nobel Prize letter in three languages.
Most stories alleged that one Western government was secretly acting against another: Britain interfering in US elections, the US and Poland ganging up on Germany, the EU scheming against member states.
Kremlin critics were portrayed as "morally corrupt, alcoholic, or otherwise mentally unstable", so that whatever they said next would arrive pre-discredited.
One of the nine recurring themes depicted Muslims and migrants as violent invaders, including a supposed "guide" for migrants to Germany, which DFRLab judged a probable forgery, posted to German discussion forums and then retold in English.
The only effort with real impact used apparently authentic documents rather than forgeries: the US–UK trade papers, posted with their origin concealed in October 2019 and surfacing in the final weeks of the British general election campaign.
Actors, behaviors, content
Actors. A single, well-resourced and persistent entity working from Russia, separate in method from both the Internet Research Agency and Russian military intelligence; Graphika found none of its accounts in the published Internet Research Agency data. Its identity remains, in Graphika's words, "the single most pressing question".
Behaviors. Large numbers of throwaway accounts; one post per account; the same story re-posted across many sites and languages within hours; forged documents as the evidentiary core; consistent concealment that platform security teams described as sophisticated. Quantity was steady over years regardless of results, which led Graphika to wonder whether the operators worked to production quotas rather than audience targets.
Content. Fabricated diplomatic scandals built around forged documents, in stilted language with characteristic Russian-speaker errors. Nine themes, led by Ukraine as a failed state, US and NATO aggression, and European weakness and division.
Did it work? What is actually known
By the researchers' own measure this was close to a total failure. DFRLab: "Its level of ambition was very high, but its impact was almost always low." Graphika: "Almost none of the operation's posts across six years of activity achieved any measurable engagement", and "it would be hard to envisage a less viral strategy". The Facebook pages removed in May 2019 had about 1,100 followers in total and the Instagram account about 80. Many Reddit posts were removed automatically because the accounts were new; visible replies often called the posters Russian trolls. Graphika found slight pickup in two places only: Western conspiracy-oriented blogs, and Russian state or Kremlin-aligned media. The exception is the 2019 trade-documents leak, which received wide coverage after the UK opposition leader presented the papers; its effect on votes was not measured by anyone, and the documents appear to have been real, so whatever influence they had came from their content rather than from deception about facts. Caveats: engagement on public posts is the only metric available; nobody outside the operation knows what its goals or internal measures were; and Graphika stresses its data set is incomplete because much content had already been deleted by moderators.
How it was caught
Facebook's internal investigations into suspected Russia-linked activity found a small cluster of accounts and removed it in May 2019, sharing its findings with law enforcement and researchers. DFRLab followed the stories those accounts had posted back to their first appearances on other sites and found the same pattern repeated across dozens of platforms. Once the pattern was described publicly (forged document, single-use account, rapid multilingual re-posting, recurring language errors) other teams could recognise it: Graphika, Reddit, Recorded Future and journalists each identified further stories in late 2019 and 2020. Forgeries were confirmed as such by the people and organisations whose names had been used. Graphika credits repeated exposure with the sharp falls in output in July 2019 and January 2020.
Lessons
- »Most influence operations do not work. This one ran for six years with professional concealment and almost nobody noticed or believed it. Ordinary forum users saw through it repeatedly. A sense of proportion is part of media literacy.
- »Treat a screenshot of a letter or tweet as a claim, not as evidence. Check whether the supposed author's own channel carries it and whether anyone reacted at the time. DFRLab exposed a forged senator's tweet simply by observing that no one had replied to it or quoted it.
- »Notice the shape of a story as well as its content: a sensational diplomatic scandal, sourced to a document image, first posted by an account with no history. Any one of these is unremarkable; together they are a pattern worth pausing over.
- »Real leaks are the harder problem. The operation's single success used authentic documents. For journalists and campaigns the question is not only whether a document is genuine but who is supplying it, and why now. Both can be reported.
- »For defenders: publish the pattern. Detailed public description of the operation's habits let independent teams find new material quickly and appears to have forced it to cut back.
- »For defenders: exposure should be proportionate. Graphika warns that fixating on one actor distorts the picture, and overstating a failed campaign hands it the attention it could not earn.
Still contested
- Who ran it. DFRLab judged it a suspected intelligence operation on the basis of resources, persistence and tradecraft; Graphika declined to name any organisation and says the evidence is insufficient. No government has published an attribution to a specific agency.
- What it was for. If virality was the goal it failed; Graphika raises the possibilities that operators were meeting output quotas, or were measured by something outsiders cannot see. There is no evidence to decide between these.
- Whether the UK trade-documents leak belongs to it. Reddit linked the accounts to the campaign and Graphika's 2020 report treats the leak as the operation's work, but Graphika's first analysis said the similarities were "not enough to provide conclusive attribution" and could reflect imitation. How the documents were obtained has not been established in these reports.
- How complete the record is. The 2,500-item data set is a conservative, high-confidence subset; the true volume, and therefore the true engagement, is unknown.
- Whether low engagement means no effect. Public metrics cannot capture private sharing or the impression left on a targeted journalist or official, though no evidence of such effects has been reported.
Sources
- Ben Nimmo, Camille François, C. Shawn Eib, Léa Ronzaud et al., Exposing Secondary Infektion (Graphika, June 2020), report siteScale figures, the nine themes, forgeries and impersonated figures, the single-use account pattern, attribution language, the engagement findings, limited pickup by conspiracy and Kremlin-aligned outlets, the trade-leak exception, and the lessons and open questions.
- Graphika, Exposing Secondary Infektion (report landing page)Publisher record for the 2020 report and its headline findings.
- Atlantic Council Digital Forensic Research Lab, Operation "Secondary Infektion": A Suspected Russian Intelligence Operation Targeting Europe and the United States (22 June 2019)The first cross-platform analysis: origin in the Facebook takedown, over 30 platforms and at least six languages, the Rubio tweet and Boris Johnson stories, the naming after the Soviet-era campaign, and the low-impact assessment.
- DFRLab, Operation Secondary Infektion (full report, PDF)Case studies of individual forgeries and how each was shown to be false.
- Facebook Newsroom, Removing More Coordinated Inauthentic Behavior From Russia (6 May 2019)The initial takedown: 16 accounts, four pages and one Instagram account, the countries targeted, follower counts, and the attribution to a network emanating from Russia.
- Graphika, UK Trade Leaks and Secondary Infektion: New Findings and Insights (December 2019)How the trade documents surfaced and spread, the cautious initial attribution, and Reddit's removal of 61 accounts.
- DFRLab, Secondary Infektion redux? Suspected Russian intelligence operation targets Greenland (2019)An example of other researchers recognising the pattern after exposure, here a forged letter concerning Greenland.