In a video posted to X on Thursday, a man claiming to be a Haitian immigrant says he's already voted for Vice President Harris in Gwinnett County, Ga., and is headed to vote again in nearby Fulton County. Seated in what appears to be in a van next to another purported Haitian immigrant, he says they arrived in the U.S. six months ago and have already become American citizens.
State and federal officials say the video was likely created by Russian propagandists trying to undermine confidence in the election.
"This is obviously fake and part of a disinformation effort. Likely it is a production of Russian troll farms," Georgia Secretary of State Brad Raffensperger said on Thursday. On Friday, federal officials weighed in, saying they also believe the video was "manufactured" by Russian influence actors.
"This Russian activity is part of Moscow's broader effort to raise unfounded questions about the integrity of the U.S. election and stoke divisions among Americans," the Office of the Director of National Intelligence, the FBI and the Cybersecurity and Infrastructure Security Agency said in a joint statement.
The video is the latest hoax that researchers say matches the output of a Russian operation known as Storm-1516, which they say is pumping out a steady stream of phony material in the final days of voting. The operation is known for producing staged videos that it launders through online influencers and sham news outlets. It has been tied by Clemson University to the notorious Russian "troll factory" that targeted the 2016 presidential election.
In just the past two weeks, researchers at Clemson and Microsoft have linked Storm-1516 to a fake video purporting to show ballots marked for former President Donald Trump being destroyed in Pennsylvania and baseless accusations against Democratic vice presidential nominee Tim Walz. Federal officials also attributed those videos to Russia.
"Immediately I was suspicious of this [Georgia] video, just when I saw the style and production value," said Darren Linvill, co-director of Clemson University's Media Forensics Hub, which first identified the Storm-1516 operation last year.
The subject matter also matches the Russian tactic of amplifying existing divisive narratives to American voters, he said.
"This is connecting to existing stories that are being told about the Haitian community, about immigrants being used for voting," Linvill said. "The Russians understand these schisms, and they use those schisms to spread their messages."
The account that Linvill identified as the first to share the video on X has since deleted it. In a direct message exchange with NPR, the person running the account wrote, "I took it down because I wasn't sure if it was 100% accurate and I don't want to be liable for misinformation."
It's not clear exactly how the fake Georgia video reached this X account. The account told NPR it saw the video on Telegram, but did not respond to follow-up questions.
The video has continued to spread widely on social media, primarily X, spurring Raffensperger to call publicly on X owner Elon Musk and leaders of other platforms to take it down.
"X found these posts to be violative of our Civic Integrity Policy and we are taking action against the posts," a spokesperson for X said. Another X account that posted the Georgia video, which has also posted other content connected to Storm-1516, has been suspended.
Facebook is putting labels on the video informing users that U.S. intelligence officials have said it was manufactured by Russian influence actors.
The IRA's successor
In 2016, Russian operatives working at the Internet Research Agency in St. Petersburg impersonated Americans and posed as news sources on social media to push false and misleading stories to U.S. voters.
The IRA was the creation of Yevgeny Prigozhin, the Russian oligarch and erstwhile confidant of Russian President Vladimir Putin, who died in 2023. In a recent report, Clemson identified connections between Storm-1516 and another group founded by Prigozhin in 2021 called the Russian Foundation to Battle Injustice.
"We believe this is IRA 2.0. It's the same people, it's the same network, it's the same old ownership," Linvill said.
Today, Linvill says Storm-1516 has refined some of the IRA's methods. Its videos sometimes appear on websites disguised as news outlets, such as a site posing as a nonexistent San Francisco television station that shared a staged video accusing Harris of injuring someone in a 2011 hit-and-run. (There's no evidence the incident occurred.)
Some sites sharing the operation's content are part of a network of websites masquerading as local U.S. news outlets that the misinformation-tracking company NewsGuard and the New York Times have reported are run by John Mark Dougan, a former deputy sheriff from Florida who now lives in Moscow. Dougan denies working for the Russian government. However, a European intelligence agency obtained documents showing he is working directly with Russian military intelligence, according to reporting by the Washington Post.
Linvill says Storm-1516 is also now relying on real people, rather than bots or fake accounts, to spread their messages and videos.
He said that reflects both a change in Russian tactics and an environment in which many Americans are more receptive to claims of malfeasance amid Trump's ongoing attacks on election integrity.
"They've put effort into building the network. They put effort into making these connections with real humans," Linvill said. "But it is also true that people are now primed for [that]. You can't separate these things. The Russians changed their tactics to conform to the changes in our reality."
As Election Day approaches, government officials are cautioning Americans to be on the alert for more Russian attempts to target confidence in the election.
"We are very concerned about how our foreign adversaries will specifically target after Election Day, in that period of time where election officials around the country are taking the incredibly important work of certifying the official results," a senior CISA official, who spoke to reporters on the condition of anonymity, said on Friday.
Linvill says he's braced for a new fraudulent video every day. "I'm sure they've got them queued up," he said.
NPR's Miles Parks contributed reporting.
Copyright 2024 NPR
