By Shelby Grossman, Daniel Bush, & Renée DiResta
Russia’s global strategy for reasserting itself as a geopolitical superpower has led to an increased presence in Africa, where it has broadened efforts to shape the continent’s politics and pursue new economic opportunities to allay the effects of sanctions.
While the presence of Russian military instructors and paramilitary groups in Libya and the Central African Republic is well documented, there is emerging evidence that Russian-linked companies are now active in the information space as well.
Yevgeny Prigozhin, the oligarch perhaps best known for running the Internet Research Agency, is central to this expansion.
In this post we identify a Facebook operation attributed to entities tied to Prigozhin – including, it appears, the Wagner Group, a Russian organization that has served as a private military contractor in several African countries.
The first allusion to a social media influence operation tied to Prigozhin stemmed from Daily Beast reporting and a document shared with us by the Dossier Center that suggested the existence of a cluster of Facebook Pages tied to the Wagner Group.
We identified an initial cluster of Pages which targeted Libya, and shared the find with the Facebook Threat Intel team.
Facebook subsequently provided us with data on two related networks that they had been investigating previously.
These networks have been targeting the Central African Republic, the Democratic Republic of the Congo, Madagascar, Mozambique, and Sudan, and included “news” Pages and websites, and Pages purporting to belong to political parties as well as a specific politician.
The part of the operation we analyzed included 7 Instagram accounts and 73 Facebook Pages. 1.72 million people liked the Facebook Pages, though we note that some of these likes are possibly the same person across multiple Pages.
The Page managers were quite active; in October 2019 alone there were 8,900 posts.
Activities Targeting Libya
In September 2019 the Daily Beast reported that the Wagner Group had created Facebook Pages targeting Libyans.
The Dossier Center shared with us the internal Wagner Group document that made this claim.
The document stated that as of March 2019, “the company” (the word Wagner employees use to refer to their firm) had created 12 Libyan groups on Facebook that focused on
1) supporting Saif al-Gaddafi,
2) news pages for the main regions of Libya, and
3) supporting Haftar. Wagner is a complex entity.
Although presumed to be founded by Dmitri Utkin, a former lieutenant colonel in Russia’s special forces, there are varying beliefs about ownership and control of the organization; some believe that it is less a mercenary organization than a semi-state force connected to Russia’s Main Intelligence Directorate (GRU).
Wagner’s physical presence in Africa has been widely reported on, particularly in Sudan and Central African Republic.
Its soldiers have also been deployed to protect political consultants sent to engage in election-related activities in support of preferred candidates in several countries, including Libya and Madagascar.
Reports suggest that Wagner Group is supporting strongman Khalifa Haftar’s Libyan National Army militarily as he fights to seize Tripoli from an internationally recognized government.
The Russian government has been supportive of Haftar, receiving him in Moscow and supplying his army with technicians to upgrade Soviet-era munitions.
Our analysis of Pages targeting Libya provides one of the first known assessments of its apparent expansion into online social influence campaigns.
Similar to its actions elsewhere in Africa – such as its involvement in Madagascar – the Wagner Group seems to be hedging its bets by supporting multiple candidates.
The Pages we reviewed indicate, in support of prior reporting, that Russia is also supporting Saif al-Gaddafi and another possible presidential candidate. (For more background on Libya, see the Internet Observatory’s scene setter from October 2, 2019.)
All of the Pages had administrators in Egypt, along with at least one additional administrator in another country.
The document included an example post from a Page called (“Libya Gaddafi”). The post was a photo of Muammar Gaddafi, overlaid on an outline of Libya.
The document described the post as a “Patriotic post aboutthe best time for the Motherland.” We found the Page on Facebook. It was created on December 25, 2018 as a “Journalist” Page.
It had five Page managers based in Egypt and one based in Italy. Its multiple daily posts typically shared older images of Gaddafi and memes featuring his son. Posts had moderate engagement, with a typical post receiving 100 to 300 likes and a handful of comments and shares.
Identifying and Assessing Other Pages
We then identified 10 additional Pages that we attributed to the same operational cluster. Facebook confirmed this attribution. This operational cluster is marked by the following characteristics:
• All Pages had similar (in many cases identical) creation dates. Six of the Pages were created on December 25, 2018, two on December 30, 2018, two on January 20, 2019, and one on January 22, 2019.
• All Pages but one listed “Journalist” in the About section. Ten of 11 About sections were otherwise empty; one Page (“Libya Forever”) also included the phrase “” (“Libya mother Libya, the homeland of Libya, the pride of Libya forever”).
• There was a consistent administration pattern across the 11 Pages. For each Page, the majority of Page Managers (typically five to seven) were located in Egypt, and at least one additional manager was in another country, but no managers were in Libya – despite the fact that all claimed to be Libyan Pages.
Two Pages, “Fezzan News Network” and “Libya News Network,” had more than 14 Page Managers seemingly spread out across seven or more countries.
• Approximately 200 posts were cross-posted verbatim across the cluster of Pages.
• Suspicious follower growth marked by at least four surges in Page likes, on a timeline that was consistent across Pages. See Figure 5.
• Consistent post timing and frequency. Most Pages posted at least twice a day, on most days.
Pro-Khalifa Haftar Pages
Four of the Pages we reviewed supported Haftar. (“Knights of Libya”) was unique in that it stopped posting in July. The other three were (“Libya First” — the name and profile photo appear to be stolen from this Page) (“Libyan National People“), (“Libya Forever“), and (“Voice of Libya“).
The five Pages posted similar content: they extolled Haftar’s military conquests, provided military updates from Libyan National Army press conferences, shared pro-Haftar poetry, pushed anti-Qatar and anti-Turkey narratives (two governments allied with the Government of National Accord), and suggested that the Government of National Accord was supporting the Muslim Brotherhood.
Pro-Saif al-Gaddafi Pages
The next set of Pages were Gaddafi nostalgia Pages that intermittently threw in posts intended to bolster his son’s political prospects.
This set of Pages included the one discussed above, “Libya Gaddafi,” and also (“Falcons of the Conqueror”).
The two Pages are almost identical in messaging, but generally shared unique content. They primarily shared old photos of Gaddafi and claimed that everything was better under his rule.
One post said (translated from Arabic): “A leader with a future view of the situation knew that those we see today fighting over power are not worthy of governance but looting and corruption.”
Not everyone engaged positively with the Page content; one user wrote that “it looks like you never lived in Libya under Gaddafi, otherwise you wouldn’t post these imaginary things” (translated and summarized).
A typical post supportive of Saif might have text that says “Dr. Saif, President of Libya” with a photo of Saif.
Though less focused on modern political issues than the other Pages, posts on these Pages occasionally touched on these debates, for example posting this seemingly original meme suggesting that the internationally recognized Prime Minister’s time is running out:
Regional News Pages
As in other Russia-affiliated influence operations (see below), four of the Pages were set up as “news networks”: “Libya News Network,” “Fezzan News Network,” “Cyrenaica News Network,” and “Tripoli News Network.” (The last three correspond to the three historic provinces of Libya.)
These Pages, three of which were created on December 25, 2018 (the fourth, “Cyrenaica News Network,” was created on December 30), posted on average more than twice daily.
As of October 28, they all had between 30,000 and 50,000 followers.
A typical post on the mimic news Pages consisted of a photo – often of military equipment, or of a political or military figure – followed by a brief description of some action or political commentary.
Although they purported to be news organizations, they very rarely posted links to sources or content outside of Facebook.
While they did not typically display the overt partisanship we find on the pro-Haftar or Gaddafi-nostalgia Pages, these Pages nevertheless had a distinct anti-Government of National Accord slant.
The Pages appear to have changed in tone over time, tending to move from more neutral content at the beginning of 2019 to more stridently pro-Haftar content as the year went on.
The first post on the “Tripoli News Network Page,” for example, simply relayed the United Nations’ call for an end to the conflict in Libya.
Later in the year, the Page frequently posted content that was highly critical of Turkey (an ally of the Government of National Accord).
Initial analysis suggests that these Pages changed course regularly in response to current events and did not stick rigidly to any single topic. Further analysis of their content might reveal other trends.
Instagram Account There was a personal Instagram account associated with these Libya Facebook Pages.
The individual is associated with a social media firm that provides web development and digital marketing services. While the website for what appears to belong to the person’s company is down, a Facebook Page, YouTube channel, Udemy courses, a Medium account, and a GitHub page remain.
It seems possible that this individual or their firm managed the Libya Facebook Pages; we have chosen not to reveal their name for privacy reasons.
This appears to be a person from the region, suggesting that Wagner may have subcontracted to create a degree of deniability and obfuscation in their operation. 2.6 Takeaways These 11 Pages published content that was in consistent alignment with Russia’s foreign-policy aims in Libya.
They served as boosters for Khalifa Haftar and Saif al-Islam Gaddafi, two political figures whom Russia has supported, and disparaged the Government of National Accord in Tripoli.
To this end, these Pages generated and shared ideologically charged content while purporting to be reliable news sources. This content was consistent in form across Pages and, in many cases, shifted with current events.
Finally, despite the fact that most of the Page managers were based in Egypt, these Pages were intended to appear local and to influence Libyans’ impressions of the conflict in their country, and of Haftar and Saif in particular.
***
Shelby Grossman is a research scholar at the Stanford Internet Observatory. She was previously an assistant professor of political science at the University of Memphis.
Daniel Bush is a Postdoctoral Fellow at the Stanford Internet Observatory, where he studies internet culture in Russia and Ukraine.
Renée DiResta is the Research Manager at the Stanford Internet Observatory. She investigates the spread of malign narratives across social networks, and assists policymakers in understanding and responding to the problem.
___________
Stanford Internet Observatory
