TheCable

For nearly two decades, “Anonymous”, one of the world’s most infamous hacktivist groups, has been in operation. The mysterious online community is making headlines once again – but this time, they are being framed.

A string of Facebook accounts, all under the pseudonym – Anonymous – are spreading disinformation and inciting violence in Nigeria in a coordinated manner. Like the original group, the accounts claim to defend social issues and interests around the world. 

Some of the impacts of these fake accounts include a widespread of hateful words, tribal tension, and altercations motivated by religious differences – very much the opposite of the supposed intent of the authentic group.

A few of the claims made by these accounts have been highlighted for context.

CLAIM 1: ICC’S PROSECUTION OF TINUBU

On March 31, one of the accounts disguising itself as Anonymous claimed that Bola Tinubu, Nigeria’s president, attempted to bribe the International Criminal Court (ICC) so that the latter could forgo an alleged prosecution.

“The ICC on Wednesday, rejected a 400million dollar offer from the man Ahmed T.B,” the post reads.

“The man Ahmed TB thought he could bribe his way through. His attempt to bribe the ICC official provides them with even more evidence to support his prosecution. This got even more interesting. Ahmed T.B is on the highway to prison. Expect his return to the former nation as his plans to buy off the ICC became fruitless.”

So far, the post has gathered 7.9k reactions, 2.4k shares and over 900 comments.

A comb through the comments showed that many believed the post and expressed happiness at the development.

This same content was copy-pasted by 10 pages and shared in 13 groups on Facebook. Seven of these ten pages were fake Anonymous pages. On Twitter, this content was first shared by user @Franciszee1 and then by @ifygold21 after which it went viral.

On April 2, the same account made a post claiming Tinubu offered to meet with a judge and improved his bribe offer which was outrightly rejected.

“Today again, The man Ahmed T.B made yet another move, meet with Judge Luz D. Carmen Ibáñez, improved his proposal to 550 million dollars which was outrightly rejected. Judge Luz who is the President of the court and the most powerful man in the ICC is known for his integrity, remember the role he played in Kenya when we presented the Kenyan case? Same would be repeated in the former Nation Nigeria,” the post reads. 

“The ICC remains the hope of the common man were local Justice system fails to do the right thing. The End is near. Arrest of the man Peter G.O is now not seen as a good option by the Agendists, Elimination as always exposed remains the perfect choice, the man Peter G.O must remain careful and continue to heed to the advice of the Anonymous. As we stated clearly from 2020, Mr Ahmed T.B would be disgracefully sent to prison if he remains alive Pre/Post 29th May and you must not forget to remember.

“We are Anonymous. We are Legion. We do not forgive. We do not forget. Expect Us.”

The post has had 7.7k likes, 2.4k shares, and 678 comments. Most of them thanked the account for the “reliable” information and celebrated the seemingly “downfall” of Tinubu.

This content was also copy-pasted by 5 fake Anonymous accounts which had a total of 2763 interactions.

DID THE ICC PROSECUTE TINUBU?

The short answer is no. The ICC keeps a public file of all its active cases and there is no mention of Tinubu or any other Nigerian politician.

ICC opened an investigation into War Crimes in Nigeria, and in 2020 released the report of its preliminary examination. The crimes examined were committed by Boko Haram and the Nigerian military.

Also, Carranza, the judge in question, is not the president of the ICC and is not a male as the post suggests. She is the first vice-president of the court and is currently in charge of the appeal chamber.

CLAIM 2: BUHARI ORDERS ARREST OF CHIMAMANDA’S FATHER OVER HER LETTER TO BIDEN

The conduct of the recently concluded general election stirred up a lot of concern and agitation in the country. Chimamanda Adichie, a Nigerian novelist, addressed a letter to Joe Biden, the US president, expressing her displeasure at the electoral exercise.

She said the process of the Nigeria presidential election was not only marred by technical faults but deliberately manipulated. She asked that the US intervene in the matter.

Adichie’s letter generated a lot of criticism and commendations alike. To take sides with the author, the false Anonymous accounts levelled false allegations against the government.

On April 8, the group made a post claiming ex-President Muhammadu Buhari ordered security agencies to arrest Adichie’s father over her letter to Biden.

“Breaking News: Buhari orders DSS to arrest Chimamanda Adichie’s father over their daughter’s writeup against Tinubu,” the post reads,

“The Nigerian DSS is currently blocking all the way that leads to Chimamanda Adichie’s hometown and compound blocked over a plot to arrest her father this Saturday morning.

“The king of her village has denied the military entry into the main village square which leads to Chimamanda Adichie’s hometown.”

DID BUHARI ORDER THE ARREST OF ADICHIE’S FATHER?

Again, no. 

On June 10, 2020, James Adichie, the novelist’s father, died at the Chira Memorial Hospital situated within Awkuzu Oyi LGA in Anambra where he was admitted to.

Although the author was initially silent on the tragic news, she eventually took to her Facebook page to pen an emotional tribute where she conveyed her grief.

A few months later, the author also lost her mother.

It is perplexing to imagine how the president would issue an arrest warrant for a man who died three years ago. And if such miracles happen, there has been no official statement from the author, DSS, or the presidency regarding the development. Such a matter would have been of national interest.

INCITING VIOLENCE 

Closely related to the string of false claims they put out are posts crafted to fuel anger and spark tension.

On April 5, one of the “Anonymous” accounts said attacks had been plotted on Biafrans and asked citizens to be watchful.

In response, one Onwa Chinagorom advised that concerned Biafrans retaliate immediately. 

“Prompt retaliation wouldn’t be a bad idea this time around,” Chinagorom commented.

“Yoruba be careful, when this war starts you people can not withstand it,” another chimed in.

The online discourse came at a time when the United Kingdom had expressed concerns of ethnic tension rising in Lagos as a result of the guber polls.

Biafrans are predominantly Igbos from the eastern region of Nigeria. In 1967, that unit of Nigeria, led by Odumegwu Ojukwu, declared independence from Nigeria to form a new country officially named the Republic of Biafra.

 After a 30-month civil war which ended in January 1970, the region was reabsorbed into Nigeria. 

The Indigenous People of Biafra (IPOB), led by Nnamdi Kanu, was set up in 2012 to further push for the independence of certain states within the country.

In its quest for independence, the group has since become stronger and emboldened. However, in September 2017, it was outlawed and tagged as a terrorist organisation by the Nigerian government.

A few days to the Lagos governorship election, divisive statements and ethnic slurs were rife on and off social media.

The division and ethnic profiling reached a crescendo when voters of south-east extraction were attacked in some parts of Lagos during the governorship polls.

Some other inciting posts have alleged that Tinubu sent thugs to attack Biafrans in Lagos and that there was a plan to eliminate Datti Baba-Ahmed, the vice-presidential candidate of the Labour Party.

Again, comments on the posts showed that most of the people were swayed by the posts and thanked the assumed Anonymous for providing intel. 

In the electoral timeline, the National Human Rights Commission (NHRC) said the country recorded 88 deaths linked to the electoral process during the gubernatorial polls.

The deaths were fuelled by electoral violence, voter intimidation, and hate speech.

TECHNIQUES EMPLOYED BY FAKE ANONYMOUS ACCOUNTS

An investigation using open-source information and tools freely available on the web showed techniques employed by the accounts in question.

Some of the methods used by these networks of accounts include:

1. Use of copy-pasted content: A telltale sign that strings these accounts together is the use of copy-pasted content. To drive interactions and boost engagements, the accounts share the exact content at almost the same time. Examples of this kind of content are shown below.

Copying and pasting of content by fake Anonymous accounts (Source: CrowdTangle/Python).

2. Repurposing pages: These anonymous pages were discovered to be accounts previously dedicated to a different course. This can be seen by the previous names of these pages.

Facebook’s page transparency feature shows the fake Anonymous accounts have changed their handle name at least once. (Source: Facebook) (Left, right)

3. Use of Fake location: The anonymous accounts would often set their location to the US. However, Facebook uses IP addresses to determine where a page is operating from. In the two pages below, we discovered that both pages are run from Nigeria but in all their posts, their locations are set to the US, specifically Hawaii. This same location was used by several other false Anonymous pages under review. Therefore, we can conclude that these pages are part of a network of accounts operated by the same persons or entity.

Facebook says the accounts are run from Nigeria, but the handlers set the account location to show US.  (Source: Facebook) (top, bottom)

4. Same names and profile pictures: We also observed that these anonymous accounts sometimes had the same name and profile images making them difficult to differentiate. However, using the unique Facebook IDs and Facebook’s page transparency feature, we found that the pages were indeed different, although under the same name. 

Although the two pages look the same, they are actually different.  (Source: Facebook) (left, right)

5. Recruiting users into private conversations or groups: These accounts often engaged in other side businesses such as betting and would often recruit unsuspecting customers into private conversations or dark social platforms. Recruiting into dark social media platforms has been a technique used by disinformation agents to attract users to a closed platform, where they could bombard them with disinformation messages or means to scam them.

6. Other platforms for disinformation: These accounts also have other associated profiles where they spread misinformation. One of them is the Instagram page by the name, anonymoushackgame. The account poses as a sports betting business and is also known for sharing disinformation. This account has a linked Telegram account, commanderxanons, which users are directed to for further details.

Sample posts from identified Instagram accounts linked to a network of fake Anonymous accounts. (source: Instagram) (left, middle, right)

A comprehensive search of the online alias @laissenousavancer3 across multiple public databases and platforms (Source: CfA using Maltego).

WHO ARE THE PEOPLE BEHIND THESE ACCOUNTS?

During this investigation, TheCable discovered 8 fake Anonymous accounts, as part of a network of accounts that actively shared election-related disinformation in Nigeria.

A comb through some of the accounts revealed an interesting discovery. Amid the bubbling chaos of election disinformation, an active get-rich-quick scheme brewed on the side. (Source: CrowdTangle)

The accounts, through what appears to be some form of sports betting, promised to manipulate game results for those interested. 

“Pay no attention to any who contacts you to resell our tickets to you at a low cost, our subscribers would never message you privately. All deals are done with us directly,” one of the accounts said to its 34k followers.

The pattern is the same on the other accounts with hundreds of participants actively relying on them for updates. For believability, the accounts have made use of real faces to prove success in their poverty alleviation schemes and to convince individuals who are flirting with the idea of giving the scheme a try.

In this video, a woman is heard thanking Anonymous for the help and support she and others have enjoyed and urges interested persons to take the opportunity.

The video had 3k views and 50 comments, all either thanking the group for changing their lives or expressing interest in becoming a part of the scheme.

Page transparency checks showed that some of the accounts have different handlers from different countries managing the same page. 

This account, for example, has six handlers from Nigeria, one from Canada, and one in a hidden location. Also, this account, created in 2021, has six handlers from Nigeria.

Some have changed the account name over the years, while others are new accounts as recent as April 2023.

Despite the red flags that colour these accounts, they are still managing to evade detection while carrying out their fraudulent schemes and spreading disinformation. Numerous social media users who are unsuspecting are paying the price and becoming unwitting victims.

Conclusively, although the disinformation campaign by these fake accounts finds its way to other platforms such as Twitter, however, findings reveal that the contents are not driven by any of the authentic Anonymous accounts. 

This article was produced with mentorship from the African Academy for Open Source Investigations (AAOSI), to tackle disinformation that undermines our democracies, as part of an initiative by the International Centre for Journalists (ICFJ) and Code for Africa (CfA). Visit https://disinfo.africa/ for more information.