Influence Operations Everywhere, New Infographics, and A Lesson on Media Manipulation

Threats, Fact Checks, and Reads #5.16.21

For newer subscribers and non-researchers who are unfamiliar with the types of misleading information out there we are working on a simple infographic series that will help readers identify mis/mal/disinformation “in the wild.”

Key Events

The moral underground? Ransomware operators retreat after Colonial Pipeline hack

Intel 471 has observed numerous ransomware operators and cybercrime forums either claim their infrastructure has been taken offline, amending their rules, or they are abandoning ransomware altogether due to a large amount of negative attention directed their way over the past week.

  • The group, which has been named as the one responsible for the Colonial Pipeline incident, also passed an announcement to its affiliates claiming a public portion of the group's infrastructure was disrupted by an unspecified law enforcement agency.

    • The group’s name-and-shame blog, ransom collection website, and breach data content delivery network (CDN) were all allegedly seized, while funds from their cryptocurrency wallets allegedly were exfiltrated.

  • Commentary:

NOTE: Disinformation activity from Kremlin vectors of disinformation may signal Russian state involvement as it follows a pattern of behavior that has indicated so in the past.

Geopolitics of ransomware: Why we tolerate pirates and their lairs

The response so far has mainly been hand-wringing. Victims pay up: it’s cheaper than losing the data. Nobody gets punished. The result: the crime is lucrative and risk-free.

That’s changing, belatedly, with three developments:

  • NSA and other agencies appear to be using their capabilities to make life a lot more difficult for the pirates. The prominent DarkSide hackers have closed down, at least for now, citing pressure from the US.

  • The US government is using its clout as a purchaser to raise cyber-security standards: suppliers who don’t meet them won’t get the business. The simplest and cheapest way of dealing with ransomware is to back up your data properly.

  • The administration and allies are putting more pressure on countries where the pirates are based. 



Global Covid Cases (Total, all-time)

162 million cases

Global Covid Deaths (Total, all-time)

3.4 million deaths

  • Despite concerns early in the pandemic, African countries have largely managed to contain their respective COVID-19 epidemics, and the continent as a whole has fared better than most others. African nations succeeded in limiting the spread of COVID-19. 


US Covid Cases (Total, all-time)

32.6 million cases

US Covid Deaths (Total, all-time)

580,837 deaths

Data: 5/15/2021, 9:20 PM from by the Center for Systems Science and Engineering (CSSE) at Johns Hopkins University (JHU)

The United States’ daily new cases (around 35k) are the lowest since mid-September 2020, which was the lowest point between the second and third surges. 

  • The lowest average in that time frame was 34,096 new cases per day on September 13, and the US could drop below that number in the coming days. 

  • The daily mortality—586 deaths per day on May 11 and 591 on May 12—is at its lowest point since April 1, 2020, early in the country’s first surge. 

Bottom Line: Things are better, much better than they were. 

US Vaccination

We have delivered  339 million doses of the Covid vaccine and given  267 million doses.

  • Daily doses administered* continues to decrease, down from a high of 3.3 million on April 11 to 1.8 million. 

  • Approximately 1.3 million people are achieving fully vaccinated status per day, down from a high of 1.8 million per day on April 12. 

  • A total of 155 million individuals in the US have received at least 1 dose of the SARS-CoV-2 vaccine, equivalent to 47% of the entire US population and 59% of all adults. 

  • Of those, 119 million are fully vaccinated, which corresponds to 36% of the total population and 46% of adults.

  • Among adults aged 65 years and older, progress has largely stalled at 84% with at least 1 dose and 72% fully vaccinated. 

  • The CDC added data for individuals aged 12 years and older to its vaccination dashboard, and in total—including individuals aged 16 and 17 who were previously eligible—2.5 million adolescents have received at least 1 dose, and 1.3 million are fully vaccinated.

  • In terms of full vaccination, 61 million individuals have received the Pfizer-BioNTech vaccine, 48 million have received the Moderna vaccine, and 9.3 million have received the J&J-Janssen vaccine. 

COVID mRNA vaccines induce immune response in pregnant, lactating women

COVID-19 mRNA vaccines trigger an immune response in pregnant and breastfeeding women, and maternal antibodies transfer into infant cord blood and breast milk, a small descriptive study yesterday in JAMA finds.

Variants Circulating in the US 

We learned the mRNA vaccines are highly effective against variantsfantastic news. The one variant that has shown some resistance to the vaccine, B.1.351, only reduces how well the mRNA vaccines work. The efficacy of the mRNA vaccines against this resistant strain is equal to that of the Johnson and Johnson vaccine at its maximum estimated efficacy, about 75%.

Multiple variants of the virus that causes COVID-19 are circulating globally and within the United States. There are currently five VOCs in the United States:

  • B.1.1.7: This variant was first identified in the US in December 2020. It was initially detected in the UK.

  • B.1.351: This variant was first identified in the US at the end of January 2021. It was initially detected in South Africa in December 2020.

  • P.1: This variant was first detected in the US in January 2021. P.1 was initially identified in travelers from Brazil, who were tested during routine screening at an airport in Japan, in early January.

  • B.1.427 and B.1.429: These two variants were first identified in California in February 2021 and were classified as VOCs in March 2021.

For more detail: What to Know About Covid Variants


Ads Are Impersonating Government Websites in Google Results, Despite Ban

The company pledged to eliminate ads for sites that charge hefty fees for otherwise free or inexpensive services—but they continue.

Violent Extremists Could ‘Exploit’ Easing of Coronavirus Capacity Restrictions

DHS released an updated summary of the terrorism threat in the homeland. Violent extremists may exploit the easing of COVID-19-related restrictions to attack a broader range of targets. Capacity caps reduced their ability to carry out attacks that require crowd cover. That no longer applies in some locations. 

Domestic extremists motivated by racism, religion, or anti-government sentiments have historically targeted:

  • houses of worship and 

  • crowded commercial facilities or 

  • large gatherings

Racially motivated extremists have been advocating for a race war and cited civil disorder as an opportunity to engage in violence in furtherance of ideological objectives.

Characteristics of common targets for 2020 and 2021:

  • government facilities

  • government personnel

  • Protestors perceived to be ideologically opposed to the extremists

Violent actors use sophisticated recruiting and may exploit groups with shared grievances concerning:

*groups not included by name in the DHS bulletin but for which there is evidence extremists may attempt to radicalize or manipulate

Keep in mind that targeting people when they are young, in the tween to teen years, is common among different types of violent extremist groups. The pandemic likely made kids more vulnerable to recruitment because of the extra time online—although the same is true for adults too.

Violent actors likely to be motivated by:

  • perceived grievance or persecution, 

  • false narratives, a subtle but dangerous form of misinformation, like deliberately cast doubt on someone’s motives to sow mistrust.

  • conspiracy theories

In online spaces frequented by extremists, users have called for violence against elected officials, political representatives, government facilities, law enforcement, religious or commercial facilities, and groups they deem to be ideologically opposed, like a far-right or far-left group targeting the left or the right.

The use of encrypted messaging and small group size may make it difficult to see signs that warn of impending violence.

Messaging from foreign terrorist organizations, including al-Qa‘ida and ISIS, intends to inspire U.S.-based homegrown violent extremists by amplifying the idea of exploiting protests. 

  • In this way, one extremist group can manipulate another for its own goals.

Homegrown extremists often pick soft targets, mass gatherings, and law enforcement, like in 2020 when far-right extremists burned down the Minneapolis Police Department and killed a law enforcement officer in California.

Adversaries have increased efforts to encourage division among Americans.

RIA Novosti publishes claim that 23 people died related to Pfizer vaccine

In some cases, public figures have furthered the same narratives as adversaries, whether for political gain or because they have been genuinely misled.

  • Effectively, elected officials doing so were and are aiding foreign adversaries in their manipulation of the public. 

Worldwide Anti-Lockdown Protests Organized by German Cell

“A wave of global anti-vax and anti-lockdown rallies were entirely astroturfed and coordinated by a small group from Kassel in Germany. Astroturfing refers to “organized activity that is intended to create a false impression of a widespread, spontaneously arising, grassroots movement in support of or in opposition to something (such as a political policy) but that is in reality initiated and controlled by a concealed group or organization (such as a corporation).”

The organization known as Freie Bürger Kassel (Free Citizens of Kassel) created and organized a wave of 129 simultaneous events and protests around the world on March 20, 2021, united under the banner of a “World Wide Rally for Freedom.” 

  • Additionally, at least 124 protests were scheduled for May 15, 2021.

Along with this new global march, the images introduced the hashtag “#WewillALLbethere” and discreetly included a link to a Telegram “hub” channel for the demonstrations.”

“129 different images and corresponding Facebook events for March 20, each with the intent of seeding a demonstration. 

  • Over 22,000 people registered interest across these Facebook events — a figure that may well have resulted in larger turnouts due to the intentionally vague banner under which the marches were organized, attracting national and regional campaign groups (images were found in the Telegram channels for multiple U.K. anti-lockdown groups).”

“Among the first few messages in each of the channels assessed were from the same group of people and often included “if you want to organize something for your country please direct message,” and encouraged users to share the Facebook event link with locals.

  • Two days before the scheduled May 15 protests, those same 20 groups had amassed more than 25,000 total members. 

  • The invitation link to their “hub” Telegram group has been shared, at least publicly, 3,118 times across their own Facebook events and beyond. 

  • The predominant rallying hashtag #wewillALLbethere has been shared 7261 times in the past 30 days. This data, however, is from CrowdTangle, meaning that further spread through private groups and pages could be far greater.”

Map showing all territories the World Wide Demo events have been planned for on either its website, Telegram groups, or Facebook pages.

This influence operation resembled earlier ones like the QAnon-adjacentSave Our Children and Freedom for the Children UK rallies. In each case, a single group would create a group and event, before reaching out to someone locally to take it over.

Read More: Worldwide Anti-Lockdown Protests Organized by German Cell



  • Chinese diplomats and state media have used an army of fake accounts to covertly amplify their messaging on Twitter, according to an investigation by the Associated Press and Oxford Internet Institute.    

  • Facebook took down a network of inauthentic accounts seeking to influence Ukrainian politics linked to Andriy Derkach, who was sanctioned by the U.S. Treasury Department for election interference. 

  • India will not let the Chinese telecom equipment providers Huawei and ZTE conduct a six-month trial of 5G technology within the country.

  • The U.S. appears to be reengaging with international allies on recognizing and addressing the global danger that internet-enabled extremism, including domestic extremism, poses. 

    • Last week, the United States formally joined the Christchurch Call to Action, a global pledge by governments and tech partners to work together to address online terrorist and violent extremism.

    • In May 2019, the Trump administration refused to sign the historic pledge, citing unspecified “constitutional concerns.

Anti-vax influencers are using QAnon shows to spread misinformation about COVID-19 vaccines

  • Multiple online influencers known for spreading misinformation about the coronavirus and vaccines have been appearing on shows supporting the QAnon conspiracy theory, where they have continued to spread this misinformation.

  • Supporters of QAnon -- some of whom have been tied to violent incidents and participated in the January 6 insurrection at the United States Capitol -- have also played a significant role in spreading misinformation about the coronavirus pandemic since it began. In recent months, as coronavirus vaccines -- which are safe and effective -- have been released, QAnon supporters have turned their attacks on the vaccines, spreading numerous false claims about them. 

  • In recent months, anti-vax influencers have appeared on multiple different QAnon shows, apparently noticing in QAnon supporters an audience primed to be receptive to their message. At least two are part of the so-called “Disinformation Dozen,” influencers identified in a report by the Center for Countering Digital Hate as the originators of an estimated 65% of vaccine misinformation spread on Facebook and Twitter.

Here's How Disinformation Drives Voting Laws

Colonial Pipeline Has Some Disinformation Vectors Working in Overdrive

More disinformation stories can be found in the Hoaxlines database.

Hoaxlines Database

False Narrative Spotted in the Wild


Is Ohio's $1M COVID-19 Vaccine Lottery Real? Yes

In Ohio, vaccination will help protect you from COVID-19 and make you eligible for a million-dollar giveaway.

No, Covid-19 vaccines didn't 'skip' or 'fail' animal trials

All four vaccines approved for use in Ireland have been tested on animals as well as humans.

Tucker Carlson wrongly suggests that COVID-19 vaccines link to higher death rates. He misunderstands VAERS.

CDC investigated the deaths that occurred among people who received a COVID-19 vaccine and found that the vaccines didn’t cause these deaths. The VAERS database helps health authorities to monitor the safety of vaccines. However, it is important to remember that the database contains unverified information and can’t be used on its own to suggest a causal link between vaccination and death.

'Makes no sense': Airlines won't ban vaccinated travelers due to blood-clot fears

In this week’s CoronaCheck, airlines debunk rumors of travel bans for inoculated passengers and we fact check an LNP Senator quoting British writer C.S. Lewis about the value of “homemakers.”

Fact Check: 'X22 Report' Video Does NOT Contain Only True Claims About COVID-19, 2020 Election

CDC Counts All COVID-19 Cases, Not Just Unvaccinated

Will the Centers for Disease Control and Prevention (CDC) only count unvaccinated COVID-19 cases? No, that’s not true: The agency says it tracks all cases, regardless of vaccination status.

  • For obvious reasons, cases will likely be more prevalent in unvaccinated people but that isn’t evidence the CDC only counts unvaccinated cases. It’s evidence vaccines work.

Patients Who Die Within 20 Days Of Positive COVID Test Are NOT Automatically Added To Pandemic Death Tally

Deaths are attributed to COVID-19 according to clinical symptoms and diagnostic; deaths occurring following vaccination are systematically reported and investigated

Death may be attributed to COVID-19 only if the clinical condition of the patient is consistent with the disease’s symptoms. Health agencies continuously monitor the safety of COVID-19 vaccines and any severe adverse event that occurs after vaccination, including death, is reported and investigated. No causal link has been formally established between COVID-19 vaccines and death.

COVID-19 vaccines don’t cause herpes infections

Herpes zoster (shingles) is a viral infection caused by the varicella-zoster virus that also causes chickenpox. This virus doesn’t cause other types of herpes, such as genital herpes.

  • Only people who had chickenpox in the past can develop shingles, which result from reactivation of the pre-existing virus in the body.

  • One study reported six cases of shingles in patients with rheumatic diseases after receiving the Pfizer-BioNTech COVID-19 vaccine, suggesting that the vaccine might trigger viral reactivation in these patients.

    • The study wasn’t designed to establish a causal association between shingles and the vaccine because it didn’t include a group of unvaccinated rheumatic patients.

Scientific evidence demonstrates that COVID-19 and the virus that causes it differs from the flu virus, contrary to claims on social media

Scientific evidence demonstrates that COVID-19 and the virus that causes it are real. Multiple independent laboratories isolated the virus and sequenced its whole genome, confirming that SARS-CoV-2 and not any other virus is what causes COVID-19.


Colonial Pipeline Shutdown Is NOT Related To Whether States Are Red Or Blue

Biden boasts about equitable senior Covid-19 vaccination rate by race

The data needed to back up this claim doesn’t yet exist, though that’s not to say Biden couldn’t know something the public doesn’t. Still, it’s best practice not to say something publicly if one is not prepared to share supporting evidence.

Low unemployment after the pandemic

Democrats were quick to criticize Iowa’s Republican Gov. Kim Reynolds when Reynolds announced on Tuesday, May 11, that the state will stop taking federal funds for supplemental $300 payments to Iowans receiving unemployment benefits. The shift away from that COVID-19-related federal aid program, which means an end to the payment to out-of-work Iowans, is to take effect after June 12, 2021.

  • The announcement came one day after an Iowa Workforce Development memorandum that said Iowa has a workforce shortage, which led Rep. Lindsey James (D-Dubuque) to state on Twitter:

  • “There are more job openings than there are people on unemployment. Let’s name the real problem here – Iowa needs higher wages. #ialegis”

Shareholders push to end secret political spending

Popular Information focuses a lot of attention on the activities of corporate PACs, even though the dollar figures involved are relatively small. Corporate PACs can contribute a maximum of $5,000 per election to a federal candidate. For a typical candidate that has a primary and general election, that’s $10,000 per cycle.

Video Does NOT Show A Woman Pumping Gas Into Plastic Bags; It's From 2019

Does a video show a woman pumping gas into plastic bags at a gas station in May 2021? No, that’s not true.

US Was NOT Energy Independent Four Months Ago


Another three Russian billionaires, plus the oil giant Rosneft, are suing journalist Catherine Belton and her publisher HarperCollins, who is already being sued by Roman Abramovich, for defamation and data protection offenses.

  • Her book Putin’s People was published a year ago, so the flurry of claims came in just before the deadline.

  • Laws in the UK differ from the US, so lawsuits like this are weaponized to silence critics


Fox undermined coronavirus science in 325+ segments since January 25

During those segments, Fox pushed at least 547 arguments undermining public health measures, confidence in health officials, vaccine efforts, or coronavirus facts and data.

We examined the difference in Fox coverage of Dr. Fauci from 2010 to 2016, compared to the pandemic-related coverage of 2020 and 2021. 







Any Questions?

Although pundits and public figures have been quick to assert that mixed messaging from experts caused the public’s vaccine hesitancy, that doesn’t logically follow the evidence. 

This stance also ignores what we know about the opinion of political elites and followers, something it seems unlikely elected officials would be ignorant concerning. Despite reporting trust in scientists people tend toward the stance of political figures. This is despite reporting low trust in politicians.

Bottom Line

The effect would not be partisan if the driver was public health communicators or scientists. The data clarify the issue. 

Recommended Reads

Ending the Confusion on What “Information Operations” Actually Means

How corporate PACs are plotting to "move beyond" January 6

DuHaime provided a hypothetical series of tough questions: "Why did you give to this person? This person voted after a Capitol insurrection where a police officer was killed, and you decided to max out to that person? Why did you do that?" He said that is a "really tough question" but "there is probably a good answer."

One suggested response DuHaime offered is that the Republican objector "supported ten other things that are important to your industry."

—Popular Information

Fix Section 230 and hold tech companies to account

Making social media sites act on content such as nonconsensual porn and violent conspiracies would make the internet more equal and free.

Producing a Vaccine Requires More Than a Patent

The drive for intellectual property waivers originates in part from the world’s experience fighting the last war, against HIV/AIDS. Patent pools, intellectual property waivers, and other liberalizing mechanisms were urgent in assuring equity of access to lifesaving drugs during that epidemic. But these tools are better suited to medicines and other pharmaceuticals than to vaccines.

Producing vaccines—particularly those as technologically complex as the messenger RNA (mRNA) inoculations against COVID-19—requires not only patents but an entire infrastructure that cannot be transferred overnight. The sharing of patents is an important and welcome development for the long term, but it may not even be the most pressing first step.

A Lesson on Media Manipulation

When I saw this story trending, I was surprised. We already knew planned operations were being used against the opposition.

Then I realized, last year was a pandemic and even when there are no distractions it's easy to miss these efforts to manipulate us. Maybe people missed it, I thought. For those people, I'm going to try to break down how, thanks to technology a small number of people can influence our opinions, often without us noticing. It's like toxic radiation, except this radiation gives you Stockholm syndrome.

Evidence strongly suggests we've been subjected to coordinated influence efforts repeatedly, both before and after the election. The most well-known example before the election targeted Rep. Ilhan Omar (MN-D) with a doctored video that seemed to show voting fraud.

What happened was likely a carefully planned influence operation 

I'll break that down, but first, you need to understand how our experience of reality is being hacked. Here are some articles that show how single instances weave together to shape a false narrative.

Manipulating perception often involves considerable strategy. Sometimes bad actors exploit data voids. A data void is an absence of material for a given term.

If you pick an obscure term, make a deceptively edited video that appears shocking that includes the chosen uncommon term, that's the recipe for media manipulation. Think about what happens when the provocateurs and their bot army start chattering about that new hashtag? 

 It trends.

The hashtag they're pushing is intentionally uncommon. It catches your eye. You don't know what it means, so you Google it. What happens now?

If the term is rare enough that almost no content exists, then the search engine may surface content specifically published ahead of time, for this precise reason. You're meant to find it. This may not quite be clear, so let's do an experiment.

Let's say you see the term "Hoaxlines" trending. What a weird word you think, and you wonder what that is. You decide to Google it. OK, pause and go google Hoaxlines. I'll wait. 

You're back! What did you find? What's that you say--how is the front page of Google all me? 

A data void. I made up the name of our disinformation database, ensuring when someone searches for Hoaxlines they can't miss our disinformation database.

This can be smart for branding, but you can see how people with nefarious intentions could use this to ensure a lot of people see seriously disturbing or false content that no platform would allow. 

How do they know what will make you look?

  • Everyone is different, yes, but what if they seized upon some existing fear the public had at the time. Maybe we're all very nervous about something. 

  • Emotion is a big part of the tactic, so a subject that is already bothering a lot of people is a prime target. 

  • Fear and anger affect how we think, and not in good ways.

What gets you emotional?

  • I don't know about you, but for me--voter fraud would make me a bit miffed. 

  • I think it's safe to say that about most people. 

  • Fair?

If you saw something like this—how does it make you feel?

What term do you suppose was trending when a video claiming to show ballot harvesting showed up on the platform?

  • Of course, ballot harvesting. They had a website ready for you if you decided to google it, but plenty happened on Twitter too.

Hardworking researchers documented much of what happened:

 "On Thursday, Sept. 24th, an account tweeted it would be releasing "UNDENIABLE VIDEO PROOF OF SYSTEMIC VOTER FRAUD" on Monday, Sept. 28.

The teaser and the accompanying hashtag #BallotHarvesting were amplified by prominent conservatives across social media. Users were encouraged to sign up at www.ballot-harvesting[.]com to receive the evidence by email on Sept. 28."

-Project Veritas #BallotHarvesting Amplification — Election Integrity Partnership

The following Sunday the New York Times released a report on nearly two decades of Trump tax returns. You may recall, these were not flattering. Social media was on fire talking about it. 

Roughly an hour later after the Times story published, Mike Lindell announced that the shocking video would now be coming out today (Sept 27) and not tomorrow (Sept 28) as planned.

"Among the earliest, Donald Trump Jr. independently uploaded the same O’Keefe video and a message propagating the #BallotHarvesting narrative within seven minutes of O’Keefe’s original post.” 

--Project Veritas #BallotHarvesting Amplification — Election Integrity Partnership

Donald Trump Jr’s video upload was notable as it did not have the Twitter label ‘From James O’Keefe’ as other blue-check influencers did on their video re-shares. This detail, along with metadata showing the Donald Trump Jr. version was separately uploaded and re-encoded by Twitter," meaning he had his own separate copy within 7 minutes of the original posting. 

  • A more likely scenario seems to be one where Donald Jr. had access to it before it was published on Twitter.

Eventually, as with all data voids, the media has to scramble to cover the subject, which takes time since the event was unpredictable and manufactured. When the media finally negates the claims, that's part of the plan. It stokes fear and paranoia.

The experience is only more convincing. While journalists rush to answer questions about this term, people follow a predictable pattern. They look for answers, but as there is no content, all they find is the content that has been crafted to influence their perception.

The methods for targeting someone based on publicly available data is, in some settings, regarded as a weapon. If it's SCL doing it in the Middle East, it's a psychological operation. If it's in the US during an election, it's a campaign.

Ultimately, affecting how we feel is usually an attempt to affect how we act—how we vote for example. 

Violations of the restriction on covert propaganda on Americans by the government are difficult to prove and unlikely to spur meaningful repercussions, but that doesn't mean researchers can't tell you or that you have no recourse as a constituent. The blessing and the curse of data is that it's difficult to hide and often says the things we’d rather left unsaid.

When Conspiracy Theories Come To Church

Before 2020, Rev. Josh Gelatt did not know much about QAnon. Gelatt had been lead pastor at Cascades Baptist Church in Jackson, Mich., since 2016. On occasion, he had heard congregants allege that “Democrats, liberals, and socialists are evil,” and that “they’re out to close churches and take away guns in the United States.” He had heard Christian nationalistic claims, such as “we are God’s chosen country.”

Gelatt, who does not identify as a Democrat or a Republican, was reasonably concerned. Then in spring 2020, Gelatt noticed what he called an “alarming twist” in his congregation.

After the murder of George Floyd in May, Cascades Baptist Church erupted with QAnon’s apocalyptic conspiracy theories, which the FBI has warned may lead some adherents to domestic terrorism. In the church and on social media, Gelatt witnessed members share false allegations that then-presidential candidate Joe Biden had “an island with an underground submarine where he receives his pedophile orders” and that there were “underground railroads between various cities run by Hollywood elites.” Congregants claimed that then-President Donald Trump was going to “seize power, execute the liberals, and expose pedophile rings.”

















@stanfordio/@stanford TV analyzer