This is my influence operation. There are many like it, but this is mine.
Welcome to a rare weekend edition of Memetic Warfare.
One of the more important skills in IO is developing a solid source array, and using that to then doomscroll.
I’m a big believer in doomscrolling (provided you put the work in to make the algorithm work for and follow the right entities) for IO identification, and thanks to doomscrolling, I came across what appears to be another case of foreign IO.
This US-oriented suspected operation is different than others in that it promotes election denialism on the left, appealing to democrats.
Let’s take a look at some very early findings from me and Max Lesser.
The operation centers around a Twitter account named “ElectionsFocus”, which is already a bad start as it betrays probable non-native use of English.
Looking the image up on Google quickly shows that the logo was lifted from the “BrandCrowd” result below, and that some accounts have already begun to share their content.
The operators intelligently don’t use a domain, as domains are rife with OpSec breach opportunities, and Twitter is easy to set up without exposing yourself. They’ve really ramped up their amplification recently, and are beginning to gain some actual traction online.
Many of their posts share a specific format - an image on the lefthand side, with a text block on the right, edited to make it look like it’s a text snippet from an article.
Election denialism is a big topic:
One of the election denial videos shared by ElectionsFocus is pretty high-investment.
The account that seems toh ave first posted this video is also suspicious. Just look at the non-native English (both dropping the “a” before landslide and using the “u” in favour) amplify and repost the same video:
The account doesn’t do itself any favors in terms of authenticity:
The operation has also amplified at least one poorly-written petition calling for a recount of the votes. The petition has since been taken down.
Claims of foreign interference tilting the elections towards Trump are also big:
Here’s where it gets really interesting. The account frequently posts content from at least two recently created Medium blogs:
This blog was posted by one “Grady Wilson”, who has posted a few times, exclusively about the (entirely unsubstantiated) possibility of the Biden administration utilizing EO 13848 to cancel the results of the election due to alleged foreign interference. Grady has no other information available, only two followers, and a probably stolen profile picture.
The account has also reposted multiple blogs from “Isabella Sutton”
Her blog focuses also on alleged foreign interference and the Biden administration’s attempts to uncover this alleged activity and enact an executive order against it:
Like Grady, Isabella has no personal information, a probably lifted/AI-generated image, and has only posted for about a week or so about the issues we’ve discussed:
We’re not going to look at each article, but just looking at them cursorily shows that they’re almost certainly AI-generated. The ranges from ZeroGPT range from the 60s to high 90s in confidence, not that it means a ton.
If you needed any further confirmation that the two are tied, just note that the blog takes the same promotional sentence from ElectionsFocus and uses:
The operation is reasonably on top of things, and appeals to a liberal American audience by operating on Bluesky:
There’s more here content-wise that’s interesting. The operation has put out at least 6 tweets on bird flu, in one case calling it worse than the Coronavirus.
Anti-tariff posts are also big:
This operation is comparatively new, and still unfolding, so it’s too early to call. The Isabella Sutton Medium blog is growing, and the content from the operation is also increasingly shared by real and inauthentic accounts online, so it’ll be interesting to see where this develops.
One thing that has happened in the past few days is a distinct edge in its content:
From an attribution standpoint, there isn’t enough here to determine quite yet. For the fun of it, I’ll take a VERY early guess and say that MAYBE it could be China, based on two comparatively weak factors:
The use of Medium blogs, a TTP most often used by China
The focus on tariffs and the Coronavirus
Additionally, the operation lacks other trademarks of Russian or Iranian activity, such as specific narratives, TTPs, and general “flair” for lack of a better word. The operation is overall pretty cut and dry, whereas Russian and Iranian operations are usually a bit more colorful, but this in of itself is a terrible heuristic, and I only bring it up because I’m spitballing.
I’ll be keeping an eye on this one, and if I have more time to investigate, who knows - perhaps we’ll be able to attribute it more conclusively. The appeal to democrats and the content itself is super interesting, which I don’t often say - so fingers crossed someone gets to it eventually.
That’s it for this special edition, we’ll be back to normal sometime early next week.