INVESTIGATION: Inside the Uganda versus Facebook fight

DFRLab confirms that over 30 pages, 200 Facebook accounts banned on Uganda 2021 election eve

Kampala, Uganda | THE INDEPENDENT | An investigation by Digital Forensic Research Lab (DFRLab) has revealed that hundreds of Ugandan facebook, twitter and instagram accounts were blacklisted in January for inauthentic behavior.

What followed was a protest by government, that then imposed a shutdown on social media and the internet on the eve of Uganda’s 2021 elections. The shutdown was only lifted today, with ICT State Minister Ogwang Ogwang saying government was responding to security threats.

DFRLab, a global network of digital forensic researchers that follows conflict across the world in real time. They released what they say is the first, of several investigations, on such actions.

Chimps Reports, that is mentioned in the report and was also targeted by Facebook, later dismissed the findings, saying there is nothing wrong with their facebook or twitter pages picking content of interest from other websites and other pages, and sharing it. They added that there is also nothing wrong with other pages or accounts picking interesting content from their website, or their pages.

*********

THE FULL STORY

**********

Facebook removes inauthentic assets linked to Ugandan government

Facebook removed content engaging in coordinated inauthentic behavior six days before Uganda’s presidential election (link to full story)

By Tessa Knight in Cape Town

On January 8, 2020, Facebook removed 32 pages, 220 user accounts, 59 groups, and 139 Instagram profiles working, in a coordinated way which their policy discourages, to promote Ugandan president and National Resistance Movement (NRM) leader Yoweri Museveni.

The accounts of at least six government employees and two PR firms were involved in the network taken down by Facebook for using fake and duplicate accounts and misleading pages to target public debate ahead of the January 14 presidential election.

According to a Facebook statement, they removed the assets “for violating our policy against government interference, which is coordinated inauthentic behavior on behalf of a government entity. This network originated in Uganda and targeted domestic audiences.”

The takedown was precipitated by a DFRLab investigation into the inauthentic assets.

The Facebook statement continued:

We found several clusters of connected activity where people relied on fake and duplicate accounts to manage Pages, impersonate at least one public figure in Uganda, comment on other people’s content, and post in multiple Groups at once to make their content appear more popular than it was. Some of these fake accounts had already been detected and disabled by our automated systems. In the fall of 2020, this network actively promoted StopHooliganism hashtag in response to protests against the arrests of the opposition candidate across social media services, including off Facebook.

This operation posted primarily in English. The first cluster of this activity focused on posting in support of the President of Uganda and the ruling party called National Resistance Movement (NRM). The second cluster posted about Lieutenant General Muhoozi Kainerugaba as a potential future presidential candidate. Finally, the last cluster focused on commenting on the opposition Pages, targeting the National Unity Platform in particular and the opposition candidate Robert Kyagulanyi [aka Bobi Wine], in addition to posting comments on the Pages of the government of Uganda. Much of this network’s posts were amplified by other fake accounts in the network. Some of these Pages reposted content from local news aggregators and pro-NRM blogs.

Three days following the takedown, Twitter removed a group of accounts corresponding to some of the accounts removed by Facebook.

In response to the removal of NRM-linked assets on both social media platforms, the Ugandan government implemented a social media lockdown on January 12, preventing users from accessing social media websites such as Twitter and Facebook, as well as messaging applications such as WhatsApp. According to Museveni, the social media giants were not acting “equitably” and therefore would not be allowed to operate in the country.

The President warns that if the social media channels like @Facebook and @Twitter are not being friendly and equitable to some of the Ugandans, then there is no reason as to why we should have them operate here. @OfwonoOpondo #M7Address pic.twitter.com/OOBioV3nGe

— Government of Uganda (@GovUganda) January 12, 2021

The DFRLab identified five GCIC members whose accounts were removed during the takedown. Another account claimed to work for the ICT Ministry and Kampala Post in its Twitter bio.

Of the five accounts, three of them consistently posted pro-Museveni content and amplified the NRM ahead of the January 14 election, using the NRM slogan #SecuringYourFuture at the end of posts praising Museveni and his government.

During the November anti-government protests, two of them used the hashtag #StopHooliganism, which had been inauthentically amplified on Twitter using old images of protests in the country as evidence of Bobi Wine supporters acting like hooligans. A page corresponding with the name of one of these employees was inactive during the lead-up to the election, though was primarily used to promote a campaign to become guild president of a Ugandan university and president of the Ugandan National Student’s Association.

The accounts actively promoted Museveni and worked to denigrate opposition candidate Bobi Wine. In early December after Wine started wearing protective gear to political rallies, one of the GCIC employees shared a post questioning why Wine had not been shot in the head after removing his helmet.

The DFRLab identified at least five user profiles associated with Government Citizens Interaction Center (GCIC) that were removed during the takedown. GCIC is a department of Uganda’s Information and Communication Technology (ICT) Ministry. Also included in the list were aspiring NRM politicians, an opposition member of parliament, and journalists working for pro-Museveni news organizations. The DFRLab found no evidence that the two PR firms included in the set were connected to the government for the purposes of promoting Museveni.

Government accounts

After Facebook announced that Ugandan government employees were implicated in the inauthentic network, the verified Twitter account associated with the government media center posted a tweet confirming that accounts “lost” in the Facebook takedown belonged to employees of the government.

However, GCIC and the ICT Ministry were not the only government organizations represented in the takedown — two Instagram accounts and 11 duplicate Facebook accounts associated with a spokesperson for Museveni’s son were also removed.

The majority of the accounts using the name of this individual contained a small handful of photographs, or else had not posted new content in years. From the profile pictures uploaded to the accounts, it appeared the accounts were split between two people — an official spokesperson for Muhoozi, and a young man using the same name.

WATCH: We demand that @Facebook & @Twitter write directly to the individuals that lost their accounts. Since @Facebook cited @MoICT_Ug in their statement, let them write to us so that there’s a chance for a fair hearing.
Accounts lost on Facebook belong to @GovUganda employees. pic.twitter.com/gGSDYkfgWI

— Uganda Media Centre (@UgandaMediaCent) January 12, 2021

Mysterious PR firms

Included in the takedown in the ‘inauthentic network’ were two PR firms, with a combined following of over 10,000 accounts at the time they were removed.

Despite the fact that they promoted Museveni and his government, the DFRLab found no indication that they were directly connected to the Ugandan government.

The DFRLab previously identified one of the firms, called Robusto Communications, in its preliminary report into the network. The firm advertised its services on Facebook and Twitter, and even claimed to be hiring for a job as a Twitter administrator for the company. Yet the company lacked at dedicated website. And though it is an incorporated entity, the only offline presence the DFRLab could find for it was a phone number that was shared by an online outlet calling itself Kampala Times, which was also removed during the Facebook takedown.

Both the Twitter and Facebook pages dedicated to the PR firm worked to promote Museveni and members of his parliament. On Twitter, Robusto Communications was part of a smaller network within the large takedown that tweeted the same copy and pasted text promoting Museveni and other members of his party.

On Facebook, Robusto Communications worked to promote Museveni by sharing positive posts from Chimp Reports , Kampala Times and Daily Monitor.

The second PR firm, named White Bear Communications, also actively promoted Museveni and his campaign. They appeared to use their social media accounts to advertise and promote companies and services, and, like Robusto Communications, advertised a position to work for the company shortly after the creation of its social media pages.

On Twitter, Facebook, and Instagram, White Bear Communications started off by promoting its services, creating posts about business and marketing strategies, and advertising other companies. Unlike Robusto Communications, which started off promoting Museveni and members of his government, White Bear Communications appeared to operate as a more general interest advertising firm until October 2019.

On Twitter, the account continued to post advertisements for hotels and game lodges until October 12, 2019. @WhiteBearCOMM then was inactive until March 18, 2020, when it started consistently retweeting tweets by Museveni, Chimp Reports and pro-NRM accounts.

Any original tweets by @WhiteBearCOMM included hashtags such as #SecuringYourFuture or #SevoLution. Securing your future was Museveni’s campaign motto, and “Sevo” is a nickname for the president.

During the period in which the Twitter account was inactive, the Facebook page dedicated to White Bear Communications posted fewer advertisements and more celebrity gossip and world news, interspersed with content about Museveni. By November 2, 2020, when Museveni was nominated as the NRM’s presidential candidate, the White Bear Communications page started tagging posts with the hashtags #SecuringYourFuture, and sometimes #Sevolution.

In some instances, the White Bear Communications page copied content directly from Museveni’s social media pages, government accounts such as the Uganda National Roads Authority, or pro-Museveni pages such as NRM Achievements. Two weeks before the election took place the White Bear Communications page created several posts using content copied directly from Museveni’s official website, firmly aligning itself with the president. Most of the tweets were signed off using the hashtag #SecuringYourFuture, or #IWillVoteM7.

White Bear Communications also consistently retweeted and tagged a pro-Museveni account advertising different services as well as more politically oriented tweets. Similarly, this account tagged White Bear Communications in political tweets and advertisements.

Inauthentic Franks

In 2020 a number of anonymous Facebook accounts were set up to promote Museveni and his son, Muhoozi.

The accounts contained no personal information about the users operating them and used stock images of Museveni or his son as profile pictures. Many of them used the surname “Frank.”

While some contained the occasional generic status update, such as “I am thinking,” the majority were used exclusively to post pro-Museveni content or share posts from Museveni’s official page and other NRM-related pages.

Many of the accounts were also friends with one another and engaged with each other’s content. The content itself garnered significant engagement — even the first stock profile pictures of Museveni or Muhoozi uploaded to the some of the “Frank” accounts received over 100 likes.

Politicians

Included in the takedown were accounts belonging to politicians and political aspirants.

Dixon Ampumuza, a member of the NRM, campaigned to be a member of parliament, however in August 2020 he pulled out of the race alleging his supporters were harassed by security personnel, according to Uganda Radio Network.

However according to Chimp Reports, Ampumuza pulled out of the race because he did not agree with the mode of voting.

Ampumuza went public with his account being taken down on Twitter, where he accused Facebook of criminalizing those who supported Museveni.

Ampumuza’s LinkedIn page also claims he is the CEO of The Ugandan, a news website whose Facebook page was also removed in the January takedown for engaging in coordinated inauthentic behavior. The website itself stopped publishing new content after its corresponding Facebook page was removed on January 8.

The Facebook page allegedly belonging to opposition MP Cecilia Atim Ogwal was also removed.

Ogwal has been a member of parliament since 1996 where she represents the Forum for Democratic Change, an opposition political party that received 35.61% of Ugandan votes in 2016, and only 3.24% in 2021.

Although it was not a verified account, Ogwal’s page appeared to be legitimately operated by the politician, regularly referring to discussions Ogwal lead in parliament shortly after the house adjourned. Unlike the other pages removed by Facebook, Ogwal’s page did not lobby for Museveni to be re-elected. It also vocally protested the application of COVID-19 regulations and standard operating procedures (SOPs) being utilized as tools to silence opposition candidates.