On January 8, 2020, Facebook removed 32 pages, 220 user accounts, 59 groups, and 139 Instagram profiles working to promote Ugandan president and National Resistance Movement (NRM) leader Yoweri Museveni. The accounts of at least six government employees and two PR firms were involved in the network taken down by Facebook for using fake and duplicate accounts and misleading pages to target public debate ahead of the January 14 presidential election.
According to a Facebook statement, they removed the assets “for violating our policy against government interference, which is coordinated inauthentic behavior on behalf of a government entity. This network originated in Uganda and targeted domestic audiences.”
The takedown was precipitated by a DFRLab investigation into the inauthentic assets.
The Facebook statement continued:
We found several clusters of connected activity where people relied on fake and duplicate accounts to manage Pages, impersonate at least one public figure in Uganda, comment on other people’s content, and post in multiple Groups at once to make their content appear more popular than it was. Some of these fake accounts had already been detected and disabled by our automated systems. In the fall of 2020, this network actively promoted StopHooliganism hashtag in response to protests against the arrests of the opposition candidate across social media services, including off Facebook.
This operation posted primarily in English. The first cluster of this activity focused on posting in support of the President of Uganda and the ruling party called National Resistance Movement (NRM). The second cluster posted about Lieutenant General Muhoozi Kainerugaba as a potential future presidential candidate. Finally, the last cluster focused on commenting on the opposition Pages, targeting the National Unity Platform in particular and the opposition candidate Robert Kyagulanyi [aka Bobi Wine], in addition to posting comments on the Pages of the government of Uganda. Much of this network’s posts were amplified by other fake accounts in the network. Some of these Pages reposted content from local news aggregators and pro-NRM blogs.
Three days following the takedown, Twitter removed a group of accounts corresponding to some of the accounts removed by Facebook. In response to the removal of NRM-linked assets on both social media platforms, the Ugandan government implemented a social media lockdown on January 12, preventing users from accessing social media websites such as Twitter and Facebook, as well as messaging applications such as WhatsApp. According to Museveni, the social media giants were not acting “equitably” and therefore would not be allowed to operate in the country.
The DFRLab identified at least five user profiles associated with Government Citizens Interaction Center (GCIC) that were removed during the takedown. GCIC is a department of Uganda’s Information and Communication Technology (ICT) Ministry. Also included in the list were aspiring NRM politicians, an opposition member of parliament, and journalists working for pro-Museveni news organizations. The DFRLab found no evidence that the two PR firms included in the set were connected to the government for the purposes of promoting Museveni.
Government accounts
After Facebook announced that Ugandan government employees were implicated in the inauthentic network, the verified Twitter account associated with the government media center posted a tweet confirming that accounts “lost” in the Facebook takedown belonged to employees of the government.
The DFRLab identified five GCIC members whose accounts were removed during the takedown. Another account claimed to work for the ICT Ministry and Kampala Post in its Twitter bio.
Of the five accounts, three of them consistently posted pro-Museveni content and amplified the NRM ahead of the January 14 election, using the NRM slogan #SecuringYourFuture at the end of posts praising Museveni and his government. During the November anti-government protests, two of them used the hashtag #StopHooliganism, which had been inauthentically amplified on Twitter using old images of protests in the country as evidence of Bobi Wine supporters acting like hooligans. A page corresponding with the name of one of these employees was inactive during the lead-up to the election, though was primarily used to promote a campaign to become guild president of a Ugandan university and president of the Ugandan National Student’s Association.
The accounts actively promoted Museveni and worked to denigrate opposition candidate Bobi Wine. In early December after Wine started wearing protective gear to political rallies, one of the GCIC employees shared a post questioning why Wine had not been shot in the head after removing his helmet.
However, GCIC and the ICT Ministry were not the only government organizations represented in the takedown — two Instagram accounts and 11 duplicate Facebook accounts associated with a spokesperson for Museveni’s son were also removed.
The majority of the accounts using the name of this individual contained a small handful of photographs, or else had not posted new content in years. From the profile pictures uploaded to the accounts, it appeared the accounts were split between two people — an official spokesperson for Muhoozi, and a young man using the same name.
Mysterious PR firms
Included in the takedown were two PR firms, with a combined following of over 10,000 accounts at the time they were removed. Despite the fact that they promoted Museveni and his government, the DFRLab found no indication that they were directly connected to the Ugandan government.
The DFRLab previously identified one of the firms, called Robusto Communications, in its preliminary report into the network. The firm advertised its services on Facebook and Twitter, and even claimed to be hiring for a job as a Twitter administrator for the company. Yet the company lacked at dedicated website. And though it is an incorporated entity, the only offline presence the DFRLab could find for it was a phone number that was shared by an online outlet calling itself Kampala Times, which was also removed during the Facebook takedown.
Both the Twitter and Facebook pages dedicated to the PR firm worked to promote Museveni and members of his parliament. On Twitter, Robusto Communications was part of a smaller network within the large takedown that tweeted the same copy and pasted text promoting Museveni and other members of his party.
On Facebook, Robusto Communications worked to promote Museveni by sharing positive posts from inauthentic news organizations included in the takedown, such as Chimp Reports and Kampala Times. The page also stole news stories from legitimate Ugandan news sites such as the Daily Monitor without crediting them, in an attempt to make it appear more legitimate.
The second PR firm, named White Bear Communications, also actively promoted Museveni and his campaign. They appeared to use their social media accounts to advertise and promote companies and services, and, like Robusto Communications, advertised a position to work for the company shortly after the creation of its social media pages.
On Twitter, Facebook, and Instagram, White Bear Communications started off by promoting its services, creating posts about business and marketing strategies, and advertising other companies. Unlike Robusto Communications, which started off promoting Museveni and members of his government, White Bear Communications appeared to operate as a more general interest advertising firm until October 2019.
On Twitter, the account continued to post advertisements for hotels and game lodges until October 12, 2019. @WhiteBearCOMM then was inactive until March 18, 2020, when it started consistently retweeting tweets by Museveni, Chimp Reports and other pro-NRM accounts. Any original tweets by @WhiteBearCOMM included hashtags such as #SecuringYourFuture or #SevoLution. Securing your future was Museveni’s campaign motto, and “Sevo” is a nickname for the president.
During the period in which the Twitter account was inactive, the Facebook page dedicated to White Bear Communications posted fewer advertisements and more celebrity gossip and world news, interspersed with content about Museveni. By November 2, 2020, when Museveni was nominated as the NRM’s presidential candidate, the White Bear Communications page started tagging posts with the hashtags #SecuringYourFuture, and sometimes #Sevolution.
In some instances, the White Bear Communications page copied content directly from Museveni’s social media pages, government accounts such as the Uganda National Roads Authority, or pro-Museveni pages such as NRM Achievements. Two weeks before the election took place the White Bear Communications page created several posts using content copied directly from Museveni’s official website, firmly aligning itself with the president. Most of the tweets were signed off using the hashtag #SecuringYourFuture, or #IWillVoteM7.
White Bear Communications also consistently retweeted and tagged a pro-Museveni account advertising different services as well as more politically oriented tweets. Similarly, this account tagged White Bear Communications in political tweets and advertisements.
Inauthentic Franks
In 2020 a number of anonymous Facebook accounts were set up to promote Museveni and his son, Muhoozi. The accounts contained no personal information about the users operating them and used stock images of Museveni or his son as profile pictures. Many of them used the surname “Frank.” While some contained the occasional generic status update, such as “I am thinking,” the majority were used exclusively to post pro-Museveni content or share posts from Museveni’s official page and other NRM-related pages.
Many of the accounts were also friends with one another and engaged with each other’s content. The content itself garnered significant engagement — even the first stock profile pictures of Museveni or Muhoozi uploaded to the some of the “Frank” accounts received over 100 likes.
Politicians
Included in the takedown were accounts belonging to politicians and political aspirants.
Dixon Ampumuza, a member of the NRM, campaigned to be a member of parliament, however in August 2020 he pulled out of the race alleging his supporters were harassed by security personnel, according to Uganda Radio Network. However according to Chimp Reports, Ampumuza pulled out of the race because he did not agree with the mode of voting. Ampumuza went public with his account being taken down on Twitter, where he accused Facebook of criminalizing those who supported Museveni.
Ampumuza’s LinkedIn page also claims he is the CEO of The Ugandan, a news website whose Facebook page was also removed in the January takedown for engaging in coordinated inauthentic behavior. The website itself stopped publishing new content after its corresponding Facebook page was removed on January 8.
The Facebook page allegedly belonging to opposition MP Cecilia Atim Ogwal was also removed. Ogwal has been a member of parliament since 1996 where she represents the Forum for Democratic Change, an opposition political party that received 35.61% of Ugandan votes in 2016, and only 3.24% in 2021.
Although it was not a verified account, Ogwal’s page appeared to be legitimately operated by the politician, regularly referring to discussions Ogwal lead in parliament shortly after the house adjourned. Unlike the other pages removed by Facebook, Owal’s page did not lobby for Museveni to be re-elected. It also vocally protested the application of COVID-19 regulations and standard operating procedures (SOPs) being utilized as tools to silence opposition candidates.
Although it did share one screenshot from a profile that was also removed, as well as one link to Chimp Reports, Ogwal’s page was a significant outlier in the takedown as it did not actively promote Museveni. However, the accounts included in the small network the DFRLab previously identified liked and amplified content from Ogwal.
Influencers and prominent accounts
Facebook and Twitter accounts that were particularly vocal during the protests after Bobi Wine was arrested in November 2020 were removed by both social media platforms. The accounts used old images of protests and riots in Uganda as evidence that Wine’s supporters were violent thugs, tagging each other in their posts in an attempt to amplify the hashtag #StopHooliganism.
Some of the influential accounts Facebook identified as part of the inauthentic network included a popular blogger and NRM supporter, another blogger who switched from supporting Wine to supporting Museveni ahead of the election, and the editor of Chimp Reports, one of the inauthentic news organizations included in the takedown.
Ultimately, the network of pages, accounts and groups worked together to amplify Museveni and his political party ahead of the January 14 election. The inclusion of prominent government employees in a network using coordinated inauthentic behavior to promote an incumbent president and the ruling party brings into question the authenticity of the National Resistance Movement’s campaign strategies.
Tessa Knight is a Research Assistant, Southern Africa, with the Digital Forensic Research Lab (@DFRLab).
Do you have a story in your community or an opinion to share with us: Email us at Submit an Article
