IRA Again: Unlucky Thirteen
Facebook Takes Down Small, Recently Created
Network Linked to Internet Research Agency
Ben Nimmo, Camille François, C. Shawn Eib, Léa Ronzaud

Introduction
On September 1, 2020, Facebook ​announced that it had taken down 2 recently created pages and
13 accounts on its platform that it attributed to “individuals associated with past activity by the
Russian Internet Research Agency (IRA).” The network largely served to amplify a website called
peacedata[.]net that claimed to be an independent news outlet working in English and Arabic.
Facebook exposed the network after a tip-off from U.S. law enforcement about off-platform
activity.
Before the takedown, Facebook shared the network with Graphika for independent analysis.
The personas that the network created used AI-generated profile pictures and maintained apresence across Facebook, Twitter, and LinkedIn in an apparent attempt to appear moreconvincing; this is the first time we have observed known IRA-linked accounts use AI-generated
avatars. However, the website employed real and apparently unwitting individuals, typically novice
freelance writers, to write its articles. Between February and August 2020, it published over 500
articles in English and over 200 articles in Arabic, some of them original, others copied from a
range of sources.
The network appeared designed to target progressive and left-wing audiences, including in the
United States and United Kingdom. The personas that the network created masqueraded asleft-wing journalists and editors. In keeping with that identity, they published and shared articles
about the race protests in the United States, accusations of foreign interference and war crimes
committed by the U.S., corruption, and the suffering caused by capitalism. They particularly aimed
their posts at progressive groups in the U.S. and UK and criticized both right-wing and center-leftpoliticians while endorsing progressive and left-wing policies. In Arabic, some articles also
attacked France in general and President Emmanuel Macron in particular, and accused them ofan “imperialist” approach toward Africa.

1

The network was in its infancy when it was taken down: the website began publishing in
December 2019, and the Facebook assets were set up in May 2020. Despite their targeted efforts
at audience building, they failed to gain significant traction, measured in likes, shares, andcomments. Most of the network’s English-language posts achieved single-digit engagement
figures; in Arabic, most posts achieved similar results, but a handful gathered thousands each inwhat appears to have been an attempt at false amplification.
The exposure of the network illustrates a number of evolutions in IRA-linked tactics since the last
takedowns in ​October 2019 and ​March 2020​. First, as noted, the use of AI-generated profile
pictures is new for this actor (although it is becoming ​increasingly ​prevalent in influence
operations elsewhere). The ease with which influence operations can now leverage machinelearning to generate fake profile pictures is an ongoing concern. At present, the AI-generated
profile pictures used by influence operations have been relatively easy to recognize, and the useof such images does little to mask other behavioral clues.
Second, the employment of real but unwitting authors builds on the recent practice by IRA-linked
operations of avoiding writing their own content: in ​October 2019​, they largely copied their content
from authentic users, and in ​March 2020​, they employed Ghanaian activists to write posts. Thistactic reduces the operation’s risk of giving itself away through basic language errors and gives it
a screen of authentic writers to hide behind, but it creates a pool of witnesses who may be able toexpose more about how the operation worked. Recruitment posts on freelancing platforms forthis operation were also reminiscent of the earlier days of the IRA, when ​freelance ​writers andspecialists were recruited in a similar fashion (to work in both Russian and English).
Third, it continues a trend of influence operations trying to use a smaller number of moreconvincing and carefully crafted accounts to target communities and publications. Rather than
the thousands of accounts that the original IRA ran to reach for a mass audience in 2014-2017,
this operation used just 13 accounts and 2 pages on Facebook, but it maintained its false
personas across multiple social media platforms, notably Twitter and LinkedIn, and it engaged
directly with a small number of unwitting individuals.
Finally, the operation conducted its targeting with pinpoint precision, if little apparent effect.
English-language Facebook assets run by the operation itself (rather than its co-opted writers)
focused very heavily on a small number of political groups, including Democratic Socialists,
environmentalists, and disgruntled Democrats in the United States. This shows a consistentfocus on a core constituency: left-leaning voters in the United States and United Kingdom who
may be dissuaded from supporting the more centrist leadership of the Democratic and Labour
parties. Relatively few posts — around 5 percent of the English-language articles on the website —dealt primarily with the U.S. election or candidates, and many articles had no direct relation to U.S.
domestic politics, but this facet of the operation suggests an attempt to build a left-wing audienceand steer it away from Biden’s campaign, in the same way that the original IRA tried to ​depress
progressive and minority support for Hillary Clinton​ in 2016.

2

Unlucky Thirteen: The Takedown Set
This is the smallest IRA-linked effort that has yet been exposed: Facebook discovered 13
accounts and 2 pages on its platform, and Graphika found roughly the same number of assets on
Twitter and LinkedIn. Many of the latter were taken down in early August, but they left enoughtraces in online caches and archives to glean some insight into their activity.
As it ​announced the takedown on September 1, Facebook said, “The people behind this activity
relied on fake accounts — some of which had already been detected and disabled by our
automated systems — to create elaborate fictitious personas, manage Pages, post in Groups anddrive people to their off-platform site masquerading as an independent news outlet based
primarily in Romania . . . We began this investigation based on information about this network’s
off-platform activity from the FBI. Our internal investigation revealed the full scope of this network
on Facebook. Although the people behind this activity attempted to conceal their identity andcoordination, our investigation found links to individuals associated with ​past activity by the
Russian Internet Research Agency (IRA). “
The operation was centered on a website, peacedata[.]net. Its Facebook pages were titled@peacedata.net (in Arabic) and @peacedataofficial (in English), and they primarily shared articles
from the website. They claimed to be “a global news organization. Our goal is to shed light on the
global issues and raise awareness . . . We cover stories that are usually untold or kept hiddenfrom the general public.” This is similar to the mission statements of Kremlin outlets RT (“getstories the mainstream media won’t tell you”) and Sputnik (“telling the untold”).
The PeaceData domain was registered on February 6, 2020. However, it carried English-language
content that was uploaded as early as December 11, 2019, according to the page source
information. Some of these early posts were translations credited to “Peace Monitor.” There is aseparate domain, peacemonitor[.]com, that was created on December 10, 2019: it now redirects
to peacedata[.]net. It is likely that the articles now on the PeaceData site that were uploaded in
December through February were originally posted to peacemonitor[.]com and then transferred to
the new domain in February. On December 25, 2019, the Twitter account ​@peacedata_ wascreated.
The Facebook activity started later: the Arabic page was created on May 15, the English page on
May 20. According to Facebook’s page transparency settings, the Arabic page was managed
from Romania and Tunisia. The English page had too few followers to reach the transparency
threshold.

3

Left, page information for the English-language page. Right, transparency details for the Arabic-language
page, showing the manager locations.

The pages were moderately active, typically making between one and five posts per day. The
Arabic-language page was most active in late May and early June, running at a rate of up to 45
posts per week; it dipped sharply through June and mid-July before picking up again in
mid-August. The English-language page never scaled those giddy heights but ran moreconsistently at a rate of around 18-20 posts per week from early June to mid-July before
dropping back to around 10 posts per week thereafter.

4

Weekly rate of posting by the Arabic (orange) and English (blue) pages, May through August, 2020.

Around these two pages, the operation built a cluster of fake personas which it identified as
PeaceData staff. On Facebook, these fake personas included two editors-in-chief, in Arabic (Ali
Ahmed Ghanem) and English (Jake Sullivan), an associate editor in English (Alex Lacusta), and an
Arabic-language freelance journalist (Salim Mokhtari).

Account profiles for Ali A Ghanem, Alex Lacusta, Jake Sullivan, and Salim Mokhtari.

5Three of these accounts showed young men in their profile pictures; the fourth, Jake Sullivan, didnot, but the ​PeaceData website did​. It identified him as an “American living in the Czech Republic.”
The website named a further colleague, communications manager ​Alice Schultz​, and a Google
search for “PeaceData” revealed a cached Twitter account, suspended some time after June 8,
in the name of ​Albert Popescu​, another associate editor.1 These showed a young blonde woman
and a slightly older man as their profile pictures. The Alex Lacusta persona was also on Twitter.

Cached Twitter accounts of A
​ lbert Popescu​ and ​Alice Schultz​ showing the PeaceData affiliation. Note also
the locations they claimed.

Graphika analyzed these profile pictures and concluded with high confidence that all six werecreated by the form of artificial intelligence known as Generative Adversarial Networks (GAN).
GAN-generated images can often be identified by errors in the symmetry of features, such as

1

It is curious that four of six of these fake personas had names beginning with Al-: Alice Schultz, Ali Ahmed
Ghanem, Albert Popescu, and Alex Lacusta. The reason for this patterning is unclear.
6ears, earrings, and glasses; by vague and distorted backgrounds; and by superimposing a numberof faces on one another and then rendering them opaque.

Left, screenshots of six of the network’s fake personas: Alex Lacusta, Salim Mokhtari, Alice Schultz, Jake
Sullivan, Ali Ahmed Ghanem, and Albert Popescu. Right, all six superimposed and reduced to 35% opacity toshow the alignment of the eyes.

Both Albert Popescu and Alex Lacusta were depicted as wearing glasses; these showedasymmetries that are typical of early generations of GAN-created images.

Profile pictures for Albert Popescu (left) and Alex Lacusta (right), with close-ups of the frames of theirglasses, showing the asymmetry where the arms connect to the frame.

7

The PeaceData personas had some Facebook friends, but not many. Ali Ahmed Ghanem listed
372 and Salim Mokhtari listed 117; Jake Sullivan had two, one of whom was Alex Lacusta.
There are indications that at least some of these “friends” were inauthentic and were acquired togive the IRA-linked accounts an aura of legitimacy. For example, Ali Ghanem’s friends included awoman called Jenny Moly, whose profile picture also appeared to be GAN-generated; a woman
called Ahaana Wilson, whose URL was in the name of Vaibhav Pratapsingh and whose profile
picture was borrowed from an online library of stock photography; and a woman called Hadlee
Martini, whose latest profile picture was also a stock shot and whose original photo appeared to
be GAN generated. These accounts did not engage with PeaceData assets or content in any otherway: they are likely to have been acquired as friends for purely cosmetic purposes.

Ali A Ghanem and his friend J​ enny Moly​; judging by the alignment of the eyes and the background, this photo,
too, is GAN generated. The account primarily posted links to a ​YouTube channel​ apparently run from theUnited Arab Emirates that offered “emotional comfort and relaxation.”

8

Ali A Ghanem and his friend A​ haana Wilson​, whose account’s URL was in the name of Vaibhav Pratapsingh
and whose profile picture was taken from a model posing for stock photography.

Ali A Ghanem and his friend H​ adlee Martini​. The account’s latest profile picture was taken from a model
posing for stock photography (revealed by TinEye); an earlier profile picture appears to have been GAN
generated.

Overall, these assets did not build a significant audience or gain substantial impact. The two
Facebook pages received sharply different engagement: as of August 27, the Arabic page hadreceived 14,000 likes but the English page had only 198. Many of its likes were concentrated in
9short bursts of intense activity: for example, in the first five days of its existence, the Arabic pagereceived 31 likes across 19 posts. One of these posts, on May 19, was a report on aFranco-Algerian discussion on energy exports; it was liked eight times. On May 20, the same post,with almost the same text, received over 9,600 likes.

Likes per day for the first two weeks of activity on the Arabic-language PeaceData page, showing the surge on
May 20, with the minimal engagement before and after.

Posts by the Arabic PeaceData page on May 19 and 20, the fifth and sixth days of its existence, showing thenumber of likes in each case.

10The total Facebook following of these combined assets was just over 14,000, almost all of themfollowers of the Arabic-language page. This is one-twentieth of the following that just one IRA
account in 2016, “Black Matters U.S.,” managed to build up. In terms of English-speaking users,
the follower count was in the low hundreds. This was an operation in the early stages of audiencebuilding, taken down while it was still finding its feet.

Content and Messaging
One of the noteworthy features of the PeaceData operation was that it relied almost entirely on
content that was produced by external writers or publications: it either copied its articles fromother websites or engaged freelancers to write for it. Although the writing came from others, theselection of content and the editorial process were controlled by the operation itself. As such, thearticles that the website published and the social media accounts promoted are worth analyzing
for what they reveal about the operation’s preoccupations and intentions, even when the content
itself was drafted by outsiders.
The PeaceData website, and the social media accounts, concentrated on a number of intersecting
themes. As the “About Us” section on the website said, “We are focused on armed conflicts,
corruption, environment crisis, abuse of power, activism, and human rights. We seek the truth
about key world events, facts and problems hidden from the general public.” Overall, andconsistently across these themes, it took a left-wing stance, opposing what it portrayed asWestern imperialism and the excesses of capitalism.

Headline from PeaceData on ​June 17​.

11

Both the English- and Arabic-language sections of the site divided their articles by theme, allowing
us to represent the operation’s main topics of interest as it perceived them.
In Arabic, these were, in descending order, human rights and their abuse, especially by Westerncountries; wars, especially in the Middle East; and corruption around the world. In English, where
the website offered more themes, the favorites were armed conflicts, especially in the Middle
East; human rights, especially their abuse by the United States and United Kingdom; abuses ofpower by Western and Middle Eastern leaders; corruption; and the environment.

Breakdown of the PeaceData English- and Arabic-language output by theme, as categorized by the site itself.

The English-language section began publishing content in December, but this consisted of
excerpts from other online sources, typically with the attribution given. This was more thanautomated copying: some attempt appears to have been made to curate and edit these sources,
not always with great success.2 The site started posting original English-language articles in
mid-March; by August, it was mainly producing original content.
The Arabic site, by contrast, only started posting articles of any kind in April, but it accelerated
relatively quickly to generate a high volume of posts by June, dropped back sharply in July, andpicked up again in August, mirroring the Facebook page’s behavior.

2

For example, an article on ​Counterpunch that was originally headlined “Greenhouse Gas Emissions andthe Right to Dump Sewage on Your Lawn” became, on the ​PeaceData site, “Calls to reduse [​sic​] GHG
emissions are not anti-free market.”12Articles per week on the PeaceData website; note the early start of English content.

The network wrote about a wide range of countries. In English, the United States was by far themost mentioned, with content divided between analysis of its domestic politics (primarily racial
tensions, capitalism and inequality, and corruption, with some mention of COVID-19 and a small
number of posts about the election) and analysis of its foreign policy (typically portrayed as
aggressive, illegal, or unreliable). Beyond that, the operation ranged widely over Europe and the
Middle East, with a volume of content also covering Africa and the Pacific.

13English-language articles by their mention of different countries. Some articles focused on multiple countries,e.g., U.S. relations with China. Only a small minority of the articles that mentioned the United States directly
concerned the election, candidates, or campaigns.

Geopolitics
Many of the articles on the website, both commissioned and copied from other outlets, dealt withgeopolitical issues, especially international conflict. The majority were marked by an anti-Western
tone and accused Western countries, the EU, or NATO of imperialism or interference in otherstates, but a significant number selected other targets. These included French President
Emmanuel Macron, Turkish President Recep Tayyip Erdogan, and political and business elites in
Kenya; a substantial number of articles also focused on the Saudi-led military campaign in
Yemen, the suffering of the Palestinians, and the rule of law in India, including the conflict in
Kashmir.
Some of these articles, such as the attacks on Erdogan and on Belarusian opposition leader
Svetlana Tikhanovskaya​, reflected earlier known Russian information operations, which haverepeatedly targeted T​ urkey​ and a​ nti-authoritarian leaders​ around Russia’s borders.

14Sample English-language headlines on N
​ ATO​, the ​EU​, U.S. interference in ​Europe​, and the opposition in
Belarus​.

Sample Arabic-language Facebook posts on Western imperialism.

Others focused on political and geopolitical events in the Middle East and South Asia. These
broadly criticized Israel, Saudi Arabia, and Turkey, and some posts also concerned developments
in India. Other articles focused on Latin America, especially in the context of alleged U.S.
“imperialism.”

15

Sample headlines on ​Yemen​, ​Erdogan​, the ​Palestinians​, and I​ ndia​.

Posts by the Arabic-language Facebook page on Yemen, Saudi Arabia, and Turkey.

Not all the operation’s posts focused solely on government activity. One tweet in April, forexample, accused the human-rights NGO Human Rights Watch of being “regime change-hungry”
and “pushing to escalate Washington’s economic war on Venezuela.”

16

Tweet by @peacedata_on April 8, concerning Human Rights Watch.

The website also published articles on climate and health issues, especially the COVID-19
pandemic. COVID-19 coverage did not focus on the spread of the pandemic itself as much as the
response from Western countries (categorized as ineffective) and allegations that various
governments were abusing the pandemic response to further their own ends.

COVID-19 headlines on ​India​, ​Saudi Arabia and Yemen​, the ​USA​, and the ​elites​.

17

COVID-19 content from the Arabic Facebook page.

United States
Beyond these thematic issues, the operation focused on specific issues in a short list of
countries, most notably the United States. Here, the website’s portrayal was wholly negative: it
presented the U.S. as war-mongering and law-breaking abroad while being wracked by racism,
COVID-19, and cutthroat capitalism at home. Headlines that were published in August included:
●
●
●
●
●
●
●

How US Sanctions Worsen the Syrian Humanitarian Crisis
Evictions and Foreclosures – The Inevitable Looming DisasterUS Continues Airstrikes in Somalia, Killing More Civilians
US Armed Forces: A Serious Threat to the Environment
The U.S. Seizure of Iranian Oil Tankers: Sanctions or Piracy?
Mount Rushmore Is No Longer a Symbol of Freedom
Era of US Domination of Latin America Coming to an End

The site paid particular attention to racial and political tensions. This included substantial
coverage of the protests that followed the murder of George Floyd and criticism of both President
Donald Trump and his challengers, former Vice President Joe Biden and Senator Kamala Harris.

18

Arabic-language Facebook posts on racism and race protests in the United States.

The English-language content on Biden and Harris was noteworthy for its hostile tone. One ​article
by a guest writer accused the pair of “submission to right-wing populism [...] as much about
preserving careers as it is winning votes.” Another ​accused Harris and other Democrats of“deliberately avoid[ing] being held accountable by setting no moral standard for the public to holdthem to.” A third ​article​, ostensibly about alleged crimes in the Balkans, argued in its very firstparagraph that Biden was an example of “toxic relationships between morally depraved
governments and the most heinous of people,” while a fourth ​accused him of “apparent prejudiceagainst the Palestinians . . . [and] general racism.”

Posts on Biden and Harris in ​July​ and ​August​. The earlier article was focused on the Balkans, but its firstparagraph referenced Biden as an example of “toxic relationships between morally depraved governments
and the most heinous of people.”

19

In line with the network’s assumption of a left-leaning persona, the content on Trump was also
hostile. Articles that PeaceData appears to have commissioned from genuine English-speaking
writers portrayed Trump as ​unreliable​, ​meddling in the International Criminal Court, ​rigging the2020 election, and “​unstable and unhinged​.”PeaceData posts on Trump in J
​ une​ (left) and A​ ugust​ (right). Note the low number of reactions to either
article.

More broadly, PeaceData’s articles, whether commissioned from independent writers or copiedfrom other outlets, took a strongly progressive, left-wing, or even ​revolutionary approach topolitics. For example, they opposed ​Big Oil​, attacked ​Fox ​News (“the propaganda arm of the GOP”)
and Amazon billionaire ​Jeff Bezos (“Congress is scared. All businesses are scared. And you
should be scared too”), condemned ​corporate industries (“a menace to the environment”),
attacked the ​QAnon conspiracy and the ​Boogaloo movement​, and wrote on ​systemic racism in
the United States. A few articles attacked both Biden and Trump at once.

20

Headline on Palestine dated June 18. The a​ rticle​ called Trump “bumbling” and accused Biden of racism.

There is no indication that the freelancers who wrote the articles were anything but sincere in
their writing. However, in the context of an operation run by fake personas from Russia, thedecision to espouse progressive positions and attack both center-left and right-wing politicians
indicates an attempt to woo more left-wing audiences for future influence operations. This isconsistent with the operation’s targeting of progressive Facebook groups, discussed below; it isalso consistent with the original IRA’s attempt to depress support for then-Democratic candidate
Hillary Clinton by i​ nfiltrating and influencing​ progressive audiences.

United Kingdom
The operation’s stance on the United Kingdom was very similar; indeed, some PeaceData articles
bracketed the U.S. and UK together to discuss such issues as housing and poverty. The UK-facing
content attacked Britain’s record of foreign engagement, criticized the ruling Conservative (“Tory”)
party, accused the UK of war crimes and interference, and mocked it for its stance on Russia.
Headlines included:
●
●
●
●
●
●
●
●

The ‘Russia Report’ Shows the UK Government Hates it When Someone Else Corrupts
Democracy Better than it Does
UK increases defence spending amid coronavirus pandemic
How [senior Conservative MP] Jacob Rees-Mogg is making millions from exploiting
coronavirus
How Tory austerity and welfare reform have worsened UK current economic crisis
Challenges Pakistani Immigrants Face In The United Kingdom
Criminal landlords exploit housing crisis to demand sky-high rents for illegal slums
British Empire colonial practices
War crimes: Britain guilty but never questioned

The website’s articles were hostile to the current leader of the Labour party, Sir Keir Starmer,
whom they portrayed as “​more centrist than left​” and accused of showing a “​disregard for humanrights​” and “​ weaponizing” anti-Semitism​ “to achieve his own political ends.”

21

Headlines on the PeaceData website about Starmer i​ n​ M
​ ay​, before the Facebook page began posting .

At the same time, they offered scathing criticism of the incumbent Conservative party, describedas having a “​special flair​” for corruption, and of Prime Minister Boris Johnson, described(alongside Trump) as a “​far-right, plutocratic, racist spiv​.” As with the U.S.-centric content, thiseditorial stance suggests a desire to appeal to left-wing audiences.

22

Headlines on the Conservative party in ​March​ and ​May​.

Wikileaks and Whistleblowers
One theme that the website covered repeatedly, though not at a high volume, was the fate of
Wikileaks founder Julian Assange and two American whistleblowers, Chelsea Manning and
Edward Snowden. Most of the articles were copied from other websites. Headlines on this issue
included:●●Julian Assange and Chelsea Manning’s Crucifixion by US Hardliners (copied fromglobalresearch[.]ca, an outlet often noted for its conspiratorial content)
Julian Assange and the Erosion of the Right to a Fair Trial

23

●
●
●
●

Chelsea Manning Spends Her Birthday Behind Bars​ (copied from mintpressnews[.]com)
Prosecution Of Truth: Brief History Of Julian Assange’s Case
Vindictive court rulings prove British state wants Assange dead (copied from the World
Socialist Website)Will Trump Pardon Edward Snowden?

These articles systematically presented Assange and the leakers as victims of an oppressive
system. Snowden, for example, was termed a “​global hero​,” and Manning was labeled a “​fighter
against the concealment of the truth​” who was subjected to “police state viciousness.” The courtcase against Assange was referred to as a “​kangaroo court​,” “​political persecution​,” and a“​perceived international conspiracy.​” Assange himself was described as “​rotting to death​” in a UK
prison, the victim of “​Starmer’s crusade against whistleblowing​,” and a victim of “​mendacious andvindictive​” treatment by the UK legal system.
The PeaceData website also referenced Wikileaks in its coverage of another issue: the chemical
attacks on civilians in Douma, Syria, in April 2018. On ​five ​occasions ​between ​December ​2019 and
May 2020, peacedata[.]net reproduced articles that alleged, based on Wikileaks leaks, that theOrganization for the Prevention of Chemical Weapons (OPCW) had doctored its report on theDouma attack. PeaceData’s decision to reproduce these reports is consistent with earlier Russian
operations against the OPCW, notably the attempt by agents from Russian military intelligence tohack the OPCW​ in April 2018.

Targeting
The operation focused very strongly on progressive and left-wing groups in the United States andthe United Kingdom. In the U.S., it prioritized supporters of Senator Bernie Sanders, Green Party
leader Howie Hawkins, and self-identified Democratic Socialists. In the UK, the network prioritizedsupporters of former Labour Party leader Jeremy Corbyn.

24

Posts by operation asset Alex Lacusta of a PeaceData article attacking Biden and Harris, shared to groups“The Progressive Party,” “Social Democrats USA-Socialist Party, USA,” and “Democratic Socialism UK.”

The operation’s most active inauthentic asset was the Alex Lacusta persona. Using the
CrowdTangle analytical tool, which is owned by Facebook, Graphika discovered a large number ofposts that this persona made to Facebook groups. Each post shared a link to a PeaceData article,
together with a stub of text, typically quoting directly from the article in question — possibly as away to reduce the scope for language errors by copying existing content. We assert with highconfidence that the persona was run directly by the operation, since it was identified as a
PeaceData editor both on its own account and on the PeaceData website. As such, the groups it
posted to represent a list of targets chosen by the operation itself and thus reveal which
communities the operation was most eager to influence.
Overall, the operation had a clear preference for groups that identified with socialism in generaland the Democratic Socialism movement in particular and for groups that ​opposed ​themainstream Democratic Party, as represented by Biden and Harris. The Alex Lacusta persona
posted articles to six different groups that referenced socialism and Democratic Socialism; fourgroups that identified themselves as “progressives”; and two groups focused on “DemExit,” a callfor voters to leave the Democratic Party and create their own, more progressive alternative. This
resembles the original IRA’s ​attempts in 2016 to engage with left-wing Democrats, especially
supporters of Senator Bernie Sanders, and discourage them from voting for Hillary Clinton.

25

Shares by Alex Lacusta of an article on nuclear weapons to two “DemExit” groups. The two posts together
achieved five likes and two shares.

This was not Alex Lacusta’s only focus, however. The account also shared links in groups that
focused on the environment, the plight of the Palestinians, Venezuela, race and police brutality,
Native Americans, and supporters of Julian Assange.
The following list represents the names of all the groups to which the Alex Lacusta persona
shared PeaceData articles, together with the number of different articles that the persona posted
there. This is unlikely to represent the operation’s entire activity, as some accounts were taken
down, apparently by automated systems, before Graphika could analyze them, but it is the mostcomprehensive overview we have so far of this operation’s targeting.

26

The groups to which Alex Lacusta shared PeaceData articles, together with the number of shares to eachgroup, the size of the group, and the reactions the post received. The follower numbers were collected on
August 25-26.

Inauthentic Networking
The website and Facebook assets were not the whole extent of the network. As mentioned above,
a number of PeaceData personas, including Alice Schultz, Alex Lacusta, and Albert Popescu, werealso present on Twitter; all three were taken down in August but left t​ races​ in ​Google​ c​ aches​.
These assets had a very regular pattern of posting. For example, all the tweets that the operationaccount @Alex_Lacusta made were posted from Monday to Friday and within a roughlyeight-hour shift.

27

Polar plot of tweets by @Alex_Lacusta showing the regularity of its posts. (Time in UTC.)

Graph of tweets by @Alex_Lacusta broken down by day.

28

The operation also maintained a heavy presence on LinkedIn. Again, the accounts were taken
down before the end of August, but Google searches revealed the remains of accounts for
PeaceData itself and for most of its purported staff. A number of these were registered in
Romania, in line with the management of the Facebook page; others, such as Ionatan Lupul andAlbert Popescu, featured Romanian names. Still others claimed locations across the UnitedStates and Europe.

Results of Google searches for PeaceData on LinkedIn.

The operation used this inauthentic network for inauthentic networking: it advertised for freelance
writers to provide its content. This was a cross-platform effort and involved not only tweets but
ads on a variety of freelance sites. Of note, an ad on ​Upwork underlined that “the themes arealways discussed and agreed with an author.” This is a rare indication of the detail of PeaceData’s
editorial process. The Upwork ad also gave a fixed price of $75 for its articles and said that it was
looking for no fewer than 10 “freelancers with the lowest rates.”

29

Cached tweet​ by @peacedata_, now suspended, advertising for passionate writers willing to be published for
not much money, which is the fate of passionate writers.

Cached excerpt from an ​advertisement​ on the freelancers’ website guru.com in the name of Albert Popescu,
advertising for writers on “anti-war, corruption, abuse of power, human rights violations, and such like.”30

PeaceData advert placed on U
​ pWork​ on August 20, 2020, for 10 freelancers. Note the claim of a German
location (bottom right) and the fixed price of $75 (center left). Note also the search for freelancers with thelowest rates.

Tweet from @peacedata_ approaching an Arabic to English translator. The tweet did not indicate what
“translator job” was intended.

A number of authors responded, and some of them subsequently posted their articles to theirown social media accounts. (Graphika has chosen not to publish their names, as they appear tohave unwittingly fallen for a deception operation by a sophisticated foreign actor.) Some of theauthors had an established portfolio and wrote regularly for other outlets; others indicated that
this was their first paid writing job.
31

Share of an article on PeaceData by the author; note the reference to the “first paid article” and the referencing
to “proving” that they “deserve a full-time position.”32

Post by another author, showing their “first article on an independent news source.”

As noted above, the operation also copied content from other sources, which it published withattribution. On February 14, 2020, the @peacedata_ Twitter account asked the anti-corruption
NGO Transparency International (handle @anticorruption) for permission to reproduce its
reporting; on February 25, PeaceData ​published​ a Transparency report.

33

Preserved tweet from @peacedata_ showing the outreach to Transparency International.

The conversation appears to have gone both ways, with at least one PeaceData tweet indicatingthat a potential contributor contacted the operation’s Twitter feed.

Preserved tweet from PeaceData showing the outreach from another user.

Partners and Sources
PeaceData’s efforts to build a persona and an audience went beyond GAN-generated profile
pictures and posts to Facebook groups. As we have noted, its early posts in English — from
December through mid-January — exclusively reproduced content from better known websites
without naming the author, although they did provide a link to the source. From mid-January until
March, they continued copying external articles but added the author bylines. All these articles
appear to have been chosen from a roster of sites whose content would appeal either to a
progressive audience or to an anti-Western one: this appears to have been an attempt to give thewebsite an authentic feel and political stance before it began searching for freelance writers.

34

Main sources for copied articles without credit on the PeaceData website, December 2019 - February 2020.

The most quoted website during this initial period was Mint Press News, a U.S.-based site with afocus on the Middle East that has ​described U.S. foreign policy as “an imperialist agenda that
believes it’s possible for America to bomb its way out of every difficult situation.” In all, PeaceData
copied 32 articles from this source. In second place, with 28 shares, was the World Socialist
Website (wsws.org). The third most popular was CommonDreams.org, billed as “breaking news &views for the progressive community,” and the fourth was the Strategic Culture Foundation, a
Russian think tank whose ​founders are linked to the Russian Academy of Sciences. Other
important sources included a website called The Mind Unleashed, ​self-billed as a “Conscious
Media Aggregation organization,” and Citizen Truth, billed as “alternative news for free thinkers,
independents, and political misfits.” The final website among the eight most shared wasthegrayzone.com, a pro-Kremlin site based in the United States.
Some of these early shares came directly from state-aligned media. PeaceData copied two
articles from the pro-Kremlin outlet SouthFront and translated a French-language article from the
Kremlin outlet RT. However, it also shared a small number of articles from the Iranian outlets
PressTV and the Tehran Times and from the Chinese state outlets Xinhua and the Global Times.
On five occasions, PeaceData published articles that it listed as “​partners​.” Between August 11
and August 19, the website published two articles each from ​Citizen ​Truth ​and ​MintPress ​Newsand one from ​Popular Resistance​, a website that traces its origins to the ​Occupy Movement of
2011.

35

The “partners” section of the PeaceData website showing the five articles published in August.

The exact nature and mechanism of these partnerships has not been made public. However, on
August 13, CitizenTruth.org published an ​article by PeaceData on the QAnon conspiracy. Popular
Resistance, meanwhile, published ​five articles by PeaceData between June 29 and August 25,
concerning, respectively, ​U.S.-Saudi cooperation on nuclear power​, ​U.S. “aggression” against
Venezuela​, ​claims of the U.S. military assassinating journalists​, the protests in Belarus as“​Western regime change​,” and ​defense spending as a driver of white supremacism​.
It is unclear whether these shares were part of an existing partnership or a precursor to it, butsuch cross-posting gave PeaceData access to more content, a broader amplification network,and an aura of legitimacy in the audiences where these outlets were seen as authoritative.
However, the extra reach appears to have been limited. For example, Popular Resistance ​tweeted
the Belarus article but received only two retweets and four likes; it does not appear to have
tweeted the other articles. Similarly, Citizen Truth posted the QAnon article on ​Facebook ​twice but
received only two reactions, one comment, and no shares.
Overall, PeaceData struggled to make a measurable impact. The web articles showed few
reactions; the social media posts generally did not receive many engagements. In fact, theoperation’s greatest success — to the extent that it had any — lay in its ability to co-opt unwitting
authors to write its content. The IRA’s 13 accounts managed to deceive that pinpoint audience;
they do not appear to have reached a substantially larger one.

36