Mapping Coordinated Networks That Circulate Problematic Information on the war in Ukraine

Team Members

Fabio Giglietto, Giada Marino, Roberto Mincigrucci, Emanuele Ghebaur,

Yassir Arroud, Abdoulaye Diallo, Inès Girard, Mafalda Guedes Vaz, Avidov Hadjadj, Anton Hansen, Hanna Hosman, Joost Ingen-Housz, Chiara Mastroianni, Henna Paakki, Camilla Palermo, Romain Pfältzer, Carlos Rosas, Eveline Van Duffel

Contents

In this report we will present the activities carried out and the main results that emerged within the research project "Mapping Coordinated Networks That Circulate Problematic Information on the war in Ukraine", facilitated by University of Urbino team from the Vera.ai. The project aimed at mapping the networks of actors who share problematic information about the Russian invasion of Ukrainian territories that occurred in February 2022.

The work is based on a methodology that implies the use of CooRnet, a CrowdTangle based library that using a set of links outputs a list of Facebook/Instagram accounts (pages, public groups, or verified profiles) that performed CLSB on one or more of these links. Through this methodology, we identified 1,509 entities that performed CLSB organized in 117 components and 122 clusters. These networks were analyzed in depth by students, identifying a number of accounts that circulated problematic information.

1. Introduction

Since the Russian invasion of Ukrainian territories occurred in February 2022, many scholars and journalists have observed a rise in the spread of problematic information across Europe. Such problematic information has the intention of distorting people’s perception of the causes of the conflict, creating a hostile environment for supporting the Ukrainian side.

In this regard, this project aims to map the leading networks of actors sharing problematic information on the topic. Given the fuzziness of the phenomenon and the frequency at which malicious actors change their strategies, it may be useful to shift the focus from the analysis of content to the dynamics of information spreading within online networks. Therefore, we propose an approach that summarizes the interplay between manipulative Actors, deceptive Behavior, and harmful Content, called A-B-C approach (François 2019), mapping and analyzing networks of social media actors that engage in coordinated link sharing behavior (CLSB) to spread problematic content. More precisely, CLSB refers to the coordinated shares of the same news articles in a very short time by networks of social media entities. This strategy is employed by social media actors to boost the reach of content and game the algorithm that presides over the distribution of the most popular posts. Noticeably, CLSB has been proven to be consistently associated with the spread of problematic information (Giglietto, Righetti, Rossi, et al., 2020).

2. Research Questions

RQ1: Are there any coordinated networks that share problematic content regarding the Ukrainian conflict? Do the entities in the network overlap with those of other problematic networks?

RQ2: What kind of sources are circulated by these networks? Are there recurring domains?

RQ3: To what extent OSINT enables tracing back the origin of these networks?

3. Methodology and initial datasets

The methodology implies the use of CooRnet. CooRnet is a CrowdTangle based library that detects coordinated link sharing behavior (CLSB) on Facebook/Instagram. Given a set of links, CooRnet outputs a list of Facebook/Instagram accounts (pages, public groups, or verified profiles) that performed CLSB on one or more of these links.

In a previous work - Global CLSB maps 2022 - we identified 818 coordinated accounts (115 Facebook Pages and 703 public groups organized in 95 networks) that performed “coordinated link sharing behavior” on Facebook by rapidly sharing at least four different news stories rated as problematic by Facebook third-party fact-checkers between January 2017 and December 2021. We consider this list a useful starting point for searching for problematic information related to the Russian/Ukrainian conflict because the accounts on this list have previously disseminated problematic information on Facebook.

Through CrowdTangle (CT), we created lists composed of these account (a list consisting of 115 pages and another consisting of 682 groups), retrieving from them published posts about the Ukrainian war. To retrieve posts we used war related keywords (Ukraine, Russia, Putin, Zelensky, Kiev, Zaporizhzhia, Donetsk, Mariupol, Kharkiv, Kherson, Luhans'k, Luhansk, Saporischschja, Donezk, Charkiw) within a time frame from 20/02/2022 to 03/12/2022.

Through CooRnet, we extracted all links shared within these posts and we tracked the networks of accounts that shared these links in a coordinated manner within a short period of time.

In total, we identified 1,509 entities that performed CLSB organized in 117 components and 122 clusters.

(For a more detailed description of the methodology click here).

4. Findings

The image above represents a graphic depiction of the networks analyzed. Using this map and underlying data, each participant individually explored the map and identified the most interesting case to focus on. Based on this preference three groups of participants emerged respectively focused on studying a specific cluster or component.

Overall 3 insights were produced: 1) Cluster #5 Media Ecosystem of Anti-Establishment French Facebook Groups; 2) Cluster#10 North and South America Anti-Nato; 3) Cluster #9 Right-wing Brasilian.

Cluster #5 Media Ecosystem of Anti-Establishment French Facebook Groups

Cluster#5 consists of the informational ecosystem of the French anti-establishment movement on Facebook. The first key insight within this cluster is that the rejection of the current political system seems to unite a variety of actors, from pro-Russian groups to traditional politics and populist protests like the “Gilets jaunes” (“Yellow Jackets”). Our second key insight is that each subgroup in the cluster tends to privilege one type of media (be it social, mainstream or alternative).

A such cluster was composed of 131 groups that in 2022 published 1,8 million Facebook posts.

To go into more detail about the cluster, we conducted further analysis on those posts where links were present (around 300.000 posts). Based on these posts, we reconstructed sub-networks of actors; categorized media sources and classified the content of stories.

In particular, 3 sub-network can be identified: the first one is composed of "Pro-Russia" groups (such as the group “Putin’s great Russia”); the second is close to the traditional left-wing (for example the group “The voice of the France insoumise”), while the last one the populist nebula opposing COVID-related sanitary measures such as “Stop the sanitary regime” or “Say no to the vaccinal pass”.

As for the media sources, we see the populist group shares mostly links from social media, the political group mainly relays mainstream media and the pro-Russian group shares links from alternative media.

Regarding the contents, used topic modeling in Cortex to identify the main topics of the posts. Overall, the stories shared by the French anti-establishment movement point towards a sweeping rejection of the current political system. Other recurring themes were Pro-Russia propaganda or opposition to health measures against the pandemic

Cluster#10 North and South America Anti-Nato

A second studied cluster concerns a mixed group of far-left groups in Latin America (Argentina, Peru and Mexico) and far-right US groups that promote anti-Nato content by coordinated link sharing on Facebook. Together these form a component that represents 16% of the total network of problematic social media actors.

During the course of our analysis, the most unexpected as well as interesting finding was a connection between the far-left-wing Latin American clusters and the right-wing and alt-right USA cluster. These groups are united through link sharing behavior by the "Bible Prophecy in the News" Facebook group. The group relates to Eastern Lighting, a Chinese religious cult gathering followers with attention-grabbing content and events, enticing people into joining the cult, and also promoting sensational content on the Ukraine invasion.

For the analysis of this cluster, two different periods of time have been investigated: 10 months before and 10 months after the declaration of war. Then, we downloaded a corpus of 10.000 posts that had the most interactions for each period and conducted an analysis of term co-occurrences within this corpus. Finally, we focused on analyzing only Ukraine related terms.

A closer look at the main terms posted in these clusters reveals a shift in the narratives before and after the Ukraine invasion began. The narratives seem to follow the evolution of popular or newsworthy topics in the global political environment, leveraging them to promote anti-NATO ideologies. Overall, the main objective of these groups seems to be the construction of and push toward anti-NATO sentiment, before the war by utilizing NATO-critical narratives related to vaccinations, the Cuban embargo, and domestic corruption, and starting from the Ukraine invasion by pushing pro-Putin narratives on the conflict.

Some of the main conspiracist post-invasion narratives about Ukraine that have been spread worldwide are also present in our component groups. We can mention for example the one related to Zelensky and the traffic of gold (“oro”) or the narratives related to how Russia’s intervention was justified in order to save Ukraine from the so-called neonazis. The most popular narratives include alternative stories about the war, for example digressing attention from the conflict by comparing the Russian invasion to the situation that involved the UK & the Falkland Islands. The usage of the terms that relate to these narratives significantly increased during the second period, as we can see in the network of term co-occurrences and in the bar graphs of narrative shifts.

Cluster #9 Right-wing Brasilian

The latest in-depth study conducted concerns a network of predominantly far-right Brazilian accounts supporting Bolsonaro. We conducted a qualitative analysis of war-related posts to understand the discussion regarding the Russia's war against Ukraine within these groups. The main results produced by our analysis revealed a marked propensity to support pro-Russian and anti-Western positions. Another element that deserves attention is the tendency to instrumentalize the conflict for political reasons: in fact, many of the posts analyzed were published during Brazil's 2022 election campaign, and the topic of war likely ended up in the political dispute.

We also noticed a substantial presence of religious-type posts, in the sense that they asked for prayers or thoughts for the war and wished for peace

5. Discussion

Overall we noticed two common trends.

We observed how, as the Russia's war against Ukraine became relevant and newsworthy, known coordinated networks jumped on the bandwagon to exploit the attention devoted to the topic. We thus see clusters formerly devoted to spreading problematic information on covid, starting to deal with the ongoing war. Beside discussing about war, the data points to the emergence of the role these groups play as a bridge between the populist far left and right.

This is evident in cluster 5, where French groups supporting Le Pen share common content with those supporting far-left Melenchon. A similar pattern emerges within component 10, composed of Spanish-speaking South American clusters of leftist groups (Peru, Venezuela, Argentina, Mexico) and a US-based conservative pro-Trump cluster. Commonly shared content supports pro-Russian and Putin positions.

Additionally, the study points out a "religious approach" to war often concealing a pro-Russian political stance. Many coordinated accounts publish content in which they ask for prayers for Ukraine, and criticize the war using religious arguments. Prayers for a ceasefire, along with the pacifist rhetoric conveyed by this side end up favoring Russia, which would benefit enormously from Western disengagement in the war in Ukraine. This rhetoric emerges prominently in cluster 9 and component 10, where these kinds of entities and the religious pacifist narratives are the bridges among different political groups and even countries, for example Brazilian pro-Bolsonaro and US extremely conservative. In the case of the United States, a religious group is even the node that connects the U.S. cluster with the Mexican one.

6. Conclusions

The analyses conducted in the project allowed us to understand how the war in Ukraine is a topic that is sensitive to problematic behavior in sharing content on social networks. Many accounts that had previously been shown to share problematic information regarding different issues, with the outbreak of war devoted attention to the topic. This demonstrates the effectiveness of the A-B-C approach: very often it becomes difficult to chase after content alone, but it is necessary to carefully analyze the whole dynamic of information spreading within online networks.

The analyses produced in the project also can be an important starting point for future research, both for those wishing to delve into the dynamics occurring within one or more clusters in particular, but also for those needing lists of problematic actors to verify the discussion dynamics related to other topics.

7. References

François, C. (2019). Actors, Behaviors, Content: A Disinformation ABC Highlighting Three Vectors of Viral Deception to Guide Industry & Regulatory Responses (One). Transatlantic High Level Working Group on Content Moderation Online and Freedom of Expression.

Giglietto, F., Righetti, N., Rossi, L., & Marino, G. (2020a). It takes a village to manipulate the media: coordinated link sharing behavior during 2018 and 2019 Italian elections. Information, Communication and Society, 1–25. https://doi.org/10.1080/1369118X.2020.1739732

Posters

Poster 1.pdf

Poster 2.pdf

Data set

Data set and outputs