It is no secret that “fake news” is a reality. Since the 2016 race to the White House the term “fake news” referring to disinformation campaigns has dominated discourse on traditional and new media. As information becomes more readily available with less checks and balances, “Media Literacy,” meaning the ability to distinguish real news from fake news, has become more important than ever. This is especially true when it comes to political campaigns, elections, and democracy. However, “Media Literacy” remains low and users continue to be deceived by disinformation campaigns, resulting in a severe bias of their political stand, and eventually, their vote.

Considering this, social media giants and traditional media outlets are taking radical steps in their attempts to curve disinformation, however, their efforts are not merely enough given the magnitude and frequency of “Fake News” campaigns. OSINT tools with the ability of mass data collection and analysis have proven beneficial in the identification and dismantlement of disinformation campaigns, making them vital to maintaining free fair elections and ensuring democracy.

Political Wars Through Disinformation

On September 2019, an impeachment inquiry against US President Donald Trump was initiated by Speaker of the House, Nancy Pelosi. Accusations against President Trump included his intentional withholding of military aid to Ukraine in a effort to strong arm newly elected president Volodymyr Zelensky to pursue a criminal investigation against former vice-president, Joe Biden, and his son. As the political climate in the United States became tense, conspiracy theories accusing Ukraine of interfering in the 2016 election and a defamation campaign against Ukrainian President Zelensky surfaced.

The investigation focused on the on-going defamation campaign against Ukrainian President Volodymr Zelensky, being carried out through the spread of disinformation on social media to shift discourse away from Trump’s impeachment to corruption in Ukraine. Due to its timing and potential political implications on stability in the Ukraine, investigators employed a multi-focal approach to identify the main perpetrators, their origins and ultimately disavow the “fake news” messages circulating.

Using OSINT to Identify Coordinated Inauthentic Behavior

The investigation began by identifying and collecting all discourse associated to President Zelensky’s official social media channels. Using the ProFoundTM platform’s mass data analysis capabilities, investigators promptly detected that there was a surge in content against Zelensky, originating from the United States, directly related to discourse on Trump’s impeachment process. Almost forty percent of all the discourse was negative, with fifteen percent of negative discourse originating from bots. The use of bots to amplify negative messaging against a specific target suggests coordinated inauthentic behavior common in disinformation campaigns. Thus, investigators redirected their focus on the bot campaign to find the perpetrators behind them.

The most prominent bot accounts spreading disinformation were identified, their content analyzed, and their connections visualized using the ProFoundTM platform. Although the accounts did not have one common connection, investigators were able to identify mutual connections linked to the top five bot accounts. Discourse analysis showed that in addition to spreading disinformation against Zelensky, all accounts analyzed published pro-Trump content using one primary website.

Employing a dedicated crawler created through the platform’s Robot StudioTM, investigators collected all the content on the website. By way of discourse analysis, they deciphered the messaging strategy and keywords being utilized in the disinformation campaign. Broad queries using these keywords were created, allowing investigators to monitor and receive alerts when new messages surfaced on social media.

In parallel, investigators identified a username attributed to the founder of the website, immediately making him a person of interest in the investigation. Through the username information, a one-click intelligence report was generated via the ProFilerTM. It surfaced the person of interest’s real name, and related social media channels. This intelligence was cross-referenced with the top bot accounts identified earlier in the investigation. A direct link between the webpage founder and the bot network was evident due to the coordinated behavior between his personal accounts, webpage, bot network publishing and messaging strategy. This indicated that he may be the handler of the bot accounts or directly involved in the commissioning of the service. Investigators blacklisted the account, and began mapping out his extensive bot network.

The Role of OSINT in Ensuring Democracy

Everyone leaves a digital trace. When dealing with disinformation campaigns and the massive spread of “Fake News”, the perpetrator’s main weakness is their goal itself. Ultimate reach of a desired message is the measurement of a successful campaign and its Achelous tendon. The mass data analysis capabilities provided by OSINT tools allow law enforcement the capability to capitalize on the reach of “fake campaigns” to identify their modus operandi, messaging, and ultimately facilitate their dismantlement.

As demonstrated by the case above, by following disinformation campaigns, OSINT tools can facilitate the identification of keywords, mapping of bot networks, analysis of mass discourse and the cross referencing of data to identify the criminals behind these efforts. In addition, the intelligence gathered can be used to report large-scale coordinated inauthentic behavior to social media giants thus hindering these campaigns objectives.

By adopting OSINT tools to fight disinformation, law enforcement can dismantle “fake news” networks that have advert effects on elections, individuals’ reputations, and democracy.