In our 19-November post, we reviewed disinformation signals on the US presidential elections for the 2-week period following voting day (3-November). The signals were sourced from Newly Registered Domains (NRDs) pertaining to election terms or concepts, and the EUvsDisinfo database of pro-Kremlin disinformation targeting the US presidential election. In this Part-2 post, we pick up where we left off in Part 1.
In week 3 any uncertainty of the election results was effectively resolved. With the certification of Biden victories in the pivotal states, and the formal ascertainment by GSA (General Services Administration), Biden was recognized as the president-elect. And while we have seen a gradual decline in the volume of new domain registrations, we have observed a shift in disinformation themes.
US Disinformation: For the week 17Nov – 24Nov, we observed 673 election-related newly registered. Figure 1 shows a declining trend in the total daily registration volume for election-related NRDs for the 3-week post-election period.
In the first two weeks, the dominant concepts or themes in the domains were about vote counting (count legal votes, count all the votes), election stealing (stop-the-steal), fraud, and states (Michigan, Georgia, Pennsylvania, Arizona, Nevada, Wisconsin). But in week 3, as the recounts had been certified, we saw a conceptual shift from ‘counting votes’ to ‘nullifying the election’, as shown in Figure 2.
In the first two weeks we saw that 75% of the domains were parked or inoperative. And for the domains that resolved to working web sites we noted that the orientation of the sites was mostly ‘red’ (Trump, GOP). All of the domains that we assessed as disinformation (demonstrably false and designed to deceive) also had a red orientation. That pattern continued in week 3, as described and shown in the example below.
On 23-Nov, the LookingGlass Cyber Solutions (full disclosure: LookingGlass is my employer) NRD monitor reported the 5 domains shown below. According to the whois domain registration database, all were created on 21-November under an anonymous registration, using GoDaddy as the domain registrar and hosting company.
- Nullifyelection[.]com
- Nullifyelectionresults[.]com
- Electionnullification[.]com
- Nullifytheelectionresults[.]com
- Nullifytheelection[.]com
Caution – in addition to being disinformation, all domains are classified as malicious based on submissions to the Hybrid-Analysis (CrowdStrike) scanner / sandbox, and all are redirected to the domain, trumpvotersmattter[.]com, which is also classified as malicious.
A partial view of the landing page is shown in Figure 3. The provenance of this site cannot be determined from whois or by any links on the website. All that can be inferred is the orientation of the site as red. The site features quotes from Thomas Jefferson, Hitler, others, with Josef Stalin featured at the top: STALIN SAID: “The people who cast the votes, don’t decide the election. The vote counters do.” The site is essentially a long scroll of memes or videos linking to recognized disinformation sources such as OAN and Newsmax TV.
Russian Disinformation: In our previous post, we reported 22 disinformation campaigns featuring the US presidential elections, but noted that these campaigns were not targeting US audiences. In their analysis published 24-November-2020, EUvsDisinfo describes changes in the Russian approach to the disinformation on the US presidential election from one of “amplifying disinformation to influencing the perception of the vote”. Disinformation themes originate in the domestic US information space and are based on the following narrative:
- the election result was enabled by a coordinated vote-rigging enterprise involving ballot counters, postal workers, dead people,
- faulty software, and
- arbitrary judicial rulings.
Outlook: With the transition to the Biden administration underway, the election is essentially over. Despite this, we can expect that the disinformation campaigns from both US sources and Russian sources will continue. The volume may decrease, and the themes will change to reflect current events. But the goal remains the same: to weaken the Biden administration, US allies and the West in general, and democracy itself.