VVA Investigative Report
September 17, 2019
prepared by Kristofer Goldsmith
Chief Investigator and Associate Director for Policy and Government Affairs
Vietnam Veterans of America
Download full report (PDF-50MB)
EXECUTIVE SUMMARY
Vietnam Veterans of America’s (VVA) two- year investigation, beginning in August 2017, has documented persistent, pervasive, and coordinated online targeting of American servicemembers, veterans, and their families by foreign entities who seek to disrupt American democracy. American veterans and the social-media followers of several congressionally chartered veterans service organizations were specifically targeted by the Russian Internet Research Agency with at least 113 ads during and after the 2016 election. However, this represents but a tiny fraction of the Russian activity that targeted this community with divisive propaganda: The organic politically divisive content (organic meaning not having to do with ads, rather unpaid posts and comments) created by Russians have a far greater reach than the known paid ads; for even though many of the original sources have been removed from social-media platforms, their posts and comments continue to be propagated and disseminated by foreign administrators (aka admins, who maintain and manage online sites) to spread hateful and politically divisive messages.
In 2018, Facebook released a tool to reveal the countries of origin of Facebook-page admins for pages that have more than 110,000 followers or have purchased ads of a political nature. This tool has not inhibited the creation, rapid growth, and influence of foreign-born Facebook pages. This measure has, however, revealed that known Russian propaganda and similar politically divisive content that targets servicemembers and veterans is being spread by admins from at least 30 foreign countries, with concentrations in Eastern Europe and Vietnam. The tool has also revealed that these pages often have admins in multiple countries, including suspicious combinations of countries with native language barriers and no geographic commonalities: For example, the American-focused Facebook page “Veterans Nation” has spread Russian-generated content and had admins only in Vietnam, Brazil, and Ukraine. A second example is the “Honoring our American Heroes” Facebook page, which has four admins in the US, one in Indonesia, one in Iran, one in Malaysia, one in the Philippines, and one in Vietnam. This cooperation suggests an international conspiracy possibly related to and larger than the previously reported Russian disinformation campaign.
Fake Veteran Accounts
These foreign admins have created individual social-media accounts that purport to belong to American veterans working at reputable veterans organizations. They use these fake-veteran accounts to send friend requests to the relatively small community of veteran advocates and connect with its prominent members who work to shape federal policy. These fake-veteran accounts infiltrate both public Facebook pages and private Facebook groups, where they can spread propaganda and false news, while shaping and moderating/censoring the conversations of the unsuspecting community of American veterans who follow or join these groups and pages. These admins also recruit Americans who have an interest in veterans and other foreign nationals to help moderate the groups and pages and make them appear more legitimate.
One such page, “Veterans of Vietnam,” with nearly 160,000 followers, has had admins in Russia, Ukraine, and Italy. This page has been bolstered by at least three dedicated Russian-generated Vietnam-veteran-focused websites that were created to build the Facebook page’s credibility by sharing information about the Vietnam War and veterans’ benefits. These admins also control a closed Facebook group, “American Veterans of Vietnam,” which solicits information from Vietnam veterans regarding their military experience.
Fake accounts are also being utilized by hostile Chinese intelligence services to connect with high-ranking and influential members of the intelligence and defense communities centered in and around Washington, DC. Chinese officials are seeking to exploit financially vulnerable members of these communities and leverage debts to recruit spies.
Using Established Names and Logos
Foreign admins have been using VVA’s logo and name, and the logos of several other congressionally chartered Veterans Service Organizations (in addition to introducing almost identically named organizations: such as Vietnam Veterans of America versus Veterans of America), to establish influential social-media presences. These foreign admins then exploit the reputations of these established and legitimate veterans organizations to spread false, politically divisive, and hateful content while peddling counterfeit merchandise, both creating income for these criminal organizations and introducing inflammatory political content into the physical world from an online environment.
Separately, individual Snapchat and Instagram accounts have been persistently using VVA’s name and logo to lure its supporters into participating in fraudulent fundraising. These foreign admins ask veterans to supply their personal banking information, claiming that if they solicit money by pretending to be doing fundraising for the VVA, they will then receive a share of the funds themselves, which will be deposited into their personal accounts.
Identity Theft
Foreign entities, primarily individuals from West Africa, have been stealing the identities of servicemembers and veterans, including those who have been killed in action, to target Americans with romance scams. The primary targets of these insidious and cruel scams are older, lonely Americans who are relatively new to social media and the internet. The ploy of posing as a servicemember or veteran for financial gain has serious consequences for both those whose identities are stolen and those who are duped into giving money. The FBI received nearly 18,500 complaints from victims of romance or similar internet scams last year, with reported losses exceeding $362 million, up 71 percent from 2017, according to a recent article published by the New York Times.
Interference in Presidential Campaign
VVA has discovered foreign entities targeting veterans for the purpose of interference in the 2020 presidential campaign. Admins from Macedonia and the United Kingdom controlled the page “Vets for Trump,” from April 2019 to August 2019, which has amassed over 131,000 followers. This page posts explicitly pro-Trump and anti-Democratic-candidate messages and memes. The page also posts pro-Russia/Putin, pro-Assange/WikiLeaks, as well as anti-Robert-Mueller and anti-FBI content. In terms of anti-Democrat content, the page has been primarily focused on attacking the top Democratic presidential candidates: Vice President Joe Biden, Senator Elizabeth Warren, and Senator Bernie Sanders, while also going after Congressman Beto O’Rourke, Senator Kamala Harris, Senator Cory Booker, and Senator Kirsten Gillibrand. While previous reporting revealed in hearings held by committees such as the House Permanent Select Committee on Intelligence (HPSCI) have focused primarily on paid ads by foreign elements — the unpaid, organic posts and comments that appear on pages like this have mostly escaped scrutiny, despite the fact that they have far greater influence because of their tendency to be copied and shared.
While under the control of foreign admins, “Vets for Trump” has also focused on fomenting hatred by using xenophobic and Islamophobic propaganda against the Democratic women of color who are freshmen in Congress. After creating incendiary posts about Representatives Ayanna Pressley, Ilhan Omar, Rashida Tlaib, and Alexandria Ocasio-Cortez, these foreign admins then connect them with propaganda to the 2020 Democratic candidates. These insidious tactics sow discord among Americans, providing fuel for conflict on a public forum between veterans sympathetic to the damaging, false message planted and Americans of other political persuasions.
The foreign admins are skilled and sophisticated enough to operate undetected by not only laypersons but those in political life as well: Followers of the “Vets for Trump” page include at least one elected Republican official who was a campaign surrogate of the Trump campaign during the 2016 election, as well as an individual who was the inaugural chairman of a veteran-centric GOP PAC closely tied to the White House.
This page had coordinated its behavior with a similarly named Facebook page, “Veterans for Donald Trump,” with identical content that was frequently posted at the same time from a mobile phone through at least April 3, 2019. Identical content was again posted on August 22. The “Veterans for Donald Trump” page currently has 14 domestic admins (with no foreign admins able to be seen).
Combating Foreign Predators
Vietnam Veterans of America is presenting this report to the general public so that Americans and Congress can be aware of and have a better understanding of how these foreign admins operate. We are urging the White House, Congress, and the private sector to act quickly to combat this predatory behavior in cyber-environments and to ensure that the exploitation of and attacks against servicemembers, veterans, and our families do not go unpunished.
Although social-media companies have been the primary focus of condemnation for these attacks against Americans — and they are absolutely responsible for their vulnerabilities — our citizens and the politicians who represent us must recognize that these attacks are by foreign enemies. While social-media companies, the US government, and the American public must make efforts to harden our current vulnerabilities, we must also prioritize the endeavor of disincentivizing attacks by punishing foreign adversaries.
RECOMMENDED ACTION
White House
The White House must elevate American cybersecurity to the Cabinet level by Executive Order (EO), thereby prioritizing and centralizing our response and safeguards to risks from bad actors. A Director of Cybersecurity’s role would be to ensure that American cybersecurity is a priority in every aspect of modern government. This EO should create a Civilian Cybersecurity Advisory Board consisting of Chief Internet Security Officers (CISOs) from the American companies that are the most important stakeholders in American internet infrastructure and cybersecurity.
In recognition of the fact that military service results in increased likelihood of targeting by foreign adversaries, the EO should be used to appoint a Deputy Assistant Secretary of Cyber-Health at the Department of Veterans Affairs. The Deputy Assistant Secretary of Cyber-Health would report directly to the VA’s Under Secretary of Health and be charged with the responsibility of developing and prioritizing programs at the VA to improve cyber-hygiene — the practice of taking steps and the precautions necessary to keep data secure from outside attacks.
The President should make permanent and expand the identity-theft insurance and credit-monitoring currently provided to victims of the Office of Personnel Management (OPM) data breach of 2015 to include all servicemembers, veterans, and their families. The EO should also provide complimentary antivirus software to servicemembers, veterans, and their families, which would be a preventive measure against cybercrime and furthermore would reduce the reliance on programs that repair damage after a cybercrime has been committed.
Department of Veterans Affairs
The Secretary of Veterans Affairs should immediately develop plans to make the cyber-hygiene of veterans an urgent priority within the Department of Veterans Affairs. The VA must educate and train veterans on personal cybersecurity: how to mitigate vulnerabilities, vigilantly maintain safe practices, and recognize threats, including how to identify instances of online manipulation.
Department of Defense
The Secretary of Defense should create a working group to study the security risks inherent in the use of common personal electronic devices and apps at home and abroad by servicemembers. The Secretary must also direct commanders to include personal cybersecurity training and regular cyber-hygiene checks for all Servicemembers.
Department of State
The Secretary of State should instruct the State Department to take all possible diplomatic efforts to ensure that countries around the world prioritize the apprehension of cybercriminals who target Americans. The Secretary should draft strong, diplomatic punitive measures against countries that shield or refuse to prosecute cybercriminals from their countries who target Americans.
Department of Justice
The Attorney General must ensure that companies that do business on the internet maintain evidence of and report all cybercrimes and propaganda campaigns suspected to have been committed against Americans by foreign entities.
Congress
Congress should update laws regarding internet privacy and fraud protection, in addition to granting federal law enforcement the jurisdiction to respond to and prevent cybercrimes. Congress should guarantee that law enforcement has the personnel and funding needed so that it can prioritize interdiction of networks of foreign cybercriminals who target Americans for financial fraud. It is essential to have laws that make certain all evidence of cybercrimes and foreign disinformation campaigns are preserved and that statutes of limitation are extended appropriately so that law enforcement and independent researchers can ensure that victims see their perpetrators brought to justice.
Senate and House Committees on Veterans’ Affairs
The Committees on Armed Services must commission studies to evaluate the risk to force readiness presented by cybercrime and foreign-born propaganda campaigns and determine how many servicemembers have already been impacted, as well as what security risks are presented by servicemembers’ use of personal devices and apps at home and abroad. The Committees should pass legislation to offer all servicemembers and their families complimentary antivirus software, in addition to make permanent the offer of lifetime credit-monitoring and identity-theft insurance. This legislation should instruct the Department of Defense (DoD) to make personal cyber-health a priority and require training of all servicemembers in cyber-hygiene.
Social-Media and Internet Companies
Social-media companies, including but not limited to Facebook, Instagram, and Twitter, must maintain all evidence of foreign interference for examination by law enforcement and independent researchers. If current laws or regulations prevent this, these companies should actively petition the government for the appropriate changes. Evidence approved for release should be watermarked, which will verify its authenticity, and maintained in public repository of known propaganda.
Social-media companies should proactively and continually screen military and veterans groups and pages for inauthentic behavior. Furthermore, they should verify military service of those who claim it (especially LinkedIn) — use a “green” checkmark or verification badge, display a clear warning for claimed but unverified military status, or prohibit military/vet status from being claimed/visible unless internally verified.
In addition to screening military and veterans groups and pages, social-media companies should aggressively hunt for criminals using these platforms and report suspicious activity to law enforcement rather than simply rely on reports submitted by users.
Social-media and internet companies must also empower reliable individuals and organizations with tools to assist them in discovering foreign “trolls” — those who deliberately post provocative, incendiary, or false content with the intent to cause harm. The “troll hunters” who produce reliable reporting should be well compensated.
Include locations of all current and past admins in page history — and make the country of origin more prominent so that average users can see this information without a click-through.
Scan for confirmed political propaganda of Russian/foreign origin using artificial intelligence (AI) and notify users/pages; auto-watermark content to identify as propaganda from Russian/foreign source.
Develop AI to detect romance scammers — zero in on suspicious connections between military-affiliated West Africa and the United States, a common link.
Seek out and verify legitimate veterans and veterans organizations who are engaged in politics and policy, and suspend predatory, false ones.
Verify claimed military affiliations, and hide those that are unverified.