Russians ‘used Pokemon Go to sow division’ in run-up to US presidential election

A Russian-linked account reportedly used the popular video game Pokemon Go to draw attention to alleged police brutality in the United States.

A report by CNN adds another detail to the emerging portrait of Russian efforts to shape public opinion and foment discord in the run-up to the 2016 presidential election.

After American intelligence agencies concluded that Russian President Vladimir Putin had launched a wide-ranging campaign to “undermine public faith in the US democratic process”, Facebook revealed that Russian entities had purchased thousands of advertisements intended to widen divisions around contentious issues like race and gun rights.

Among the topics reportedly addressed was the Black Lives Matter movement, which seeks to draw attention to African-Americans dying at the hands of police officers. According to CNN, one of the artificial accounts Facebook has taken down was entitled “Don’t Shoot Us” and was used to disseminate information about incidents of police brutality.

The effort reportedly enlisted Pokemon Go, a game in which players use their smartphones to “catch” digital creatures superimposed on the real world. CNN found that Don’t Shoot Us encouraged users to play near sites of reported police violence and to name their Pokemon “with a US police brutality victim’s name”.

Niantic, the company behind Pokemon Go, said in a statement that “our game assets were appropriated and misused in promotions by third parties without our permission“ and that ”our platform was in no way being used“ because players can’t use the app to share information with other players. 

Facebook did not respond to a request to confirm that Don’t Shoot Us was among the suspended accounts.

Congressional investigators are keenly focused on the role social media platforms may have played in helping to disseminate Russian-generated content. Representatives from Facebook, Google and Twitter have been invited to testify on the matter in an upcoming open hearing.

In an interview on Thursday with Axios, Facebook chief operating officer Sheryl Sandberg said Congress should publicly release the Russian-linked ads the social media giant has turned over.

“Things happened on our platform in this election that should not have happened, especially troubling foreign interference in a democratic election,” Ms Sandberg said.

Reuse content

Russian Hackers Are Using ‘Tainted’ Leaks to Sow Disinformation

Over the past year, the Kremlin’s strategy of weaponizing leaks to meddle with democracies around the world has become increasingly clear, first in the US and more recently in France. But a new report by a group of security researchers digs into another layer of those so-called influence operations: how Russian hackers alter documents within those releases of hacked material, planting disinformation alongside legitimate leaks.

A new report from researchers at the Citizen Lab group at the University of Toronto’s Munk School of Public Affairs documents a wide-ranging hacking campaign, with ties to known Russian hacker groups. The effort targeted more than 200 individuals, ranging from Russian media to a former Russian prime minister to Russian opposition groups, and assorted government and military personnel from Ukraine to Vietnam. Noteworthy among the leaks: A Russia-focused journalist and author whose emails were not only stolen but altered before their release. Once they appeared on a Russian hactivist site, Russian state media used the disinformation to concoct a CIA conspiracy.

The case could provide the clearest evidence yet that Russian hackers have evolved their tactics from merely releasing embarrassing true information to planting false leaks among those facts. “Russia has a long history of experience with disinformation,” says Ron Deibert, the political science professor who led Citizen Lab’s research into the newly uncovered hacking spree. “This is the first case of which I am aware that compares tainted documents to originals associated with a cyber espionage campaign.”

Go Phish

In his 2003 book Darkness at Dawn, journalist David Satter alleged that Vladimir Putin had arranged for Russian security forces to bomb apartment buildings in Moscow in 1999, in an attempt to incite war with Chechnya. In October of last year, Satter received a phishing email that spoofed a message from Google security requiring him to enter his Gmail account credentials, the same tactic used to breach the inbox of Clinton campaign chairman John Podesta last year. Satter, too, fell for the ruse.

Later that month, a Russian hacker group calling itself CyberBerkut released a collection of emails from Satter’s inbox, just as Russian hackers dumped pilfered emails from Podesta, the Democratic National Committee, the political party of French president Emmanuel Macron, and others. But in Satter’s case, one of those emails had been very clearly altered.

The original message had included a report by Satter on Russia-focused work for Radio Liberty, the US government-backed news outlet. But the version of the report released by CyberBerkut had been altered to make it appear that Satter was instead coordinating the publication of critical articles on a wide swath of Russian opposition websites, including the site of Russian opposition leader Alexei Navalny. The additions even included a mention of an upcoming article about Russian officials and businessmen by one Russian journalist who hadn’t yet published it, suggesting that she’d been tracked or hacked as well.

CyberBerkut called the doctored leak evidence of US efforts to meddle in Russian politics, and even to inspire a popular revolution. Russian state media outlets RIA Novosti and Sputnik Radio picked up that thread, quoting sources linking the plot to the CIA.

Others have accused Russian hackers of this sort of disinformation trick. But when the Clinton campaign warned that its hacked emails, posted to WikiLeaks, shouldn’t be trusted, it couldn’t point to any specific fakes in the collection. The Macron campaign similarly warned that the emails published from its En Marche party contained unspecified spoofed documents, though in that case En Marche had seemingly planted them as well, in an effort to confuse hackers. The Satter case provides a concrete example.

Citizen Lab notes that CyberBerkut has published fake documents in other cases, as well. They confirm a Foreign Policy report that found the group had altered documents in a late 2015 release to make it appear that George Soros’ Open Society Foundation had funded Russian opposition media and Navalny’s anti-corruption group.

Hacks of State

The Citizen Lab report goes further, though, showing new evidence that the CyberBerkut isn’t just an independent hacktivist organization. They also show that CyberBerkut has key links to the group known as Fancy Bear or APT28, which cybersecurity firms and US intelligence agencies have agreed pulled off the attacks on the Democratic National Committee and the Clinton campaign.

That detective work began when Citizen Lab analyzed the URL shortener, known as, that the hackers had used to generate the link that led Satter to the phishing site. They found they could generate “adjacent” URLs that were almost certainly created by the same user, and that one of those had been used to hack a reporter at the journalism outlet Bellingcat—an attack that the cybersecurity firm ThreatConnect had tied to Fancy Bear.

In analyzing more of the “adjacent” URLs, they found the hundreds of other likely targets of the Russian hackers, including Russian dissidents and foreign government officials. They also discovered that another of the URLs was tied to what appeared to be a test account that security firm FireEye had previously linked to Fancy Bear. And, of course, the Gmail phishing technique matched exactly with the one used against Podesta earlier in 2016.

Citizen Lab’s Deibert admits that none of this is a “smoking gun.” But it’s strong new evidence linking CyberBerkut’s fake leaks to a group already believed to be backed by the Kremlin. “All we can say is that the indicators we uncovered overlap extensively with other public reporting on APT28,” he says. “These, alongside the context of the targets—which match Russian strategic interests both domestically and abroad—provide very strong evidence that Russia is involved in some manner.”

All of which adds up to the strongest evidence yet that Russian hackers are indeed mixing fakes into their leaks—what the report calls “falsehoods in a forest of facts.” And that could reduce the credibility, Deibert says, of journalists who report on the leaks. It adds
a new layer of falsehoods to an era fraught with fake-news accusations. “Campaigns of this sort have the potential to undermine the public’s already low confidence in media,” Deibert says.

But evidence that Russian hackers are fabricating their leaks could also make them less effective. Mixing fakes in with facts may work for Russian propaganda outlets. When it comes to involving US media in Russia’s influence operations, though, reporters may now think twice about trusting the contents of the next dumped inbox covered in Russian fingerprints.

Go Back to Top. Skip To: Start of Article.