[from the source]

Executive Summary:

In July and August 2022, Twitter and Meta removed two overlapping sets of
accounts for violating their platforms’ terms of service. Twitter said the accounts
fell foul of its policies on “platform manipulation and spam,” while Meta said the
assets on its platforms engaged in “coordinated inauthentic behavior.” After
taking down the assets, both platforms provided portions of the activity to
Graphika and the Stanford Internet Observatory (SIO) for further analysis.
Our joint investigation found an interconnected web of accounts on Twitter,
Facebook, Instagram, and five other social media platforms that used deceptive
tactics to promote pro-Western narratives in the Middle East and Central Asia.
The platforms’ datasets appear to cover a series of covert campaigns over a
period of almost five years rather than one homogeneous operation.

These campaigns consistently advanced narratives promoting the interests of
the United States and its allies while opposing countries including Russia, China,
and Iran. The accounts heavily criticized Russia in particular for the deaths of
innocent civilians and other atrocities its soldiers committed in pursuit of the
Kremlin’s “imperial ambitions” following its invasion of Ukraine in February this
year. To promote this and other narratives, the accounts sometimes shared news
articles from U.S. government-funded media outlets, such as Voice of America
and Radio Free Europe, and links to websites sponsored by the U.S. military. A
portion of the activity also promoted anti-extremism messaging.

As with previous disclosures, Twitter and Meta did not share the technical details
of their investigations. Additionally, neither company has publicly attributed the
activity to any entity or organization: Twitter listed the activity’s “presumptive
countries of origin” as the U.S. and Great Britain, while Meta said the “country of
origin” was the U.S. The findings in this report are based on our own open-source
investigation and analysis of the two datasets shared by the platforms.

The Twitter dataset provided to Graphika and SIO covered 299,566 tweets
by 146 accounts between March 2012 and February 2022.1 These accounts
divide into two behaviorally distinct activity sets. The first was linked to an overt
U.S. government messaging campaign called the Trans-Regional Web Initiative,
which has been extensively documented in academic studies, media reports, and
federal contracting records. The second comprises a series of covert campaigns of
unclear origin. These covert campaigns were also represented in the Meta dataset
of 39 Facebook profiles, 16 pages, two groups, and 26 Instagram accounts active
from 2017 to July 2022.

For this report, we focused our analysis on the exclusively covert activity to better
understand how different actors use inauthentic practices to conduct online
influence operations (IO). We did note, however, some low-level open-source
connections between the overt and covert activity in the combined Twitter and
Meta data. These consisted of limited cases of content sharing and one Twitter
account that posed as an individual in Iraq but has previously claimed to operate
on behalf of the U.S. military. Without supporting technical indicators, we are
unable to assess further the nature of the relationship between the two activity
sets.

We believe this activity represents the most extensive case of covert pro-Western
IO on social media to be reviewed and analyzed by open-source researchers to
date. With few exceptions, the study of modern IO has overwhelmingly focused
on activity linked to authoritarian regimes in countries such as Russia, China, and
Iran, with recent growth in research on the integral role played by private entities.
This report illustrates the wider range of actors engaged in active operations to
influence online audiences.

At the same time, Twitter and Meta’s data reveals the limited range of tactics IO
actors employ; the covert campaigns detailed in this report are notable for how
similar they are to previous operations we have studied. The assets identified
by Twitter and Meta created fake personas with GAN-generated faces, posed as
independent media outlets, leveraged memes and short-form videos, attempted
to start hashtag campaigns, and launched online petitions: all tactics observed
in past operations by other actors.

Importantly, the data also shows the limitations of using inauthentic tactics to
generate engagement and build influence online. The vast majority of posts and
tweets we reviewed received no more than a handful of likes or retweets, and
only 19% of the covert assets we identified had more than 1,000 followers. The
average tweet received 0.49 likes and 0.02 retweets. Tellingly, the two most-
followed assets in the data provided by Twitter were overt accounts that publicly
declared a connection to the U.S. military.

This report is non-exhaustive and benefited from previous studies by the
academic and open-source research communities. We hope our findings can
contribute to a better-informed understanding of online influence operations, the
types of actors that conduct them, and the limitations of relying on inauthentic
tactics.