A network of public relations firms, news organisations and inauthentic social media accounts engaged in a coordinated campaign to promote Ugandan President Yoweri Museveni ahead of the country’s January 14 2021 presidential election. A DFRLab investigation of the network – which began as part of its ongoing analysis of pre-election activity – uncovered a collection of Twitter accounts and Facebook pages engaging in suspicious online behaviour. 

After sharing our initial analysis with both platforms they took action against the assets for violating their rules on coordinated inauthentic behaviour. Facebook removed them on January 8 and Twitter on January 10. 

According to a statement from Facebook’s sub-Saharan Africa team, their internal investigation attributed the network to Uganda’s Ministry for Information, Communications and Technology:

This month, we removed a network of accounts and Pages in Uganda that engaged in CIB to target public debate ahead of the election. They used fake and duplicate accounts to manage Pages, comment on other people’s content, impersonate users, re-share posts in Groups to make them appear more popular than they were. Given the impending election in Uganda, we moved quickly to investigate and take down this network. We found this network to be linked to the Government Citizens Interaction Center at the Ministry of Information and Communications Technology in Uganda. Per our normal reporting process, we will share more details about the networks we removed this month in our January CIB report, which we’ll release at the beginning of February.

Museveni, who has ruled Uganda since 1986, is running for a sixth term, as presidential term limits were scrapped in 2005. In previous elections Museveni and his political party, the National Resistance Movement (NRM), have been accused of violating free speech and free association, as well as intimidating journalists in an attempt to curb the spread of information. In the lead-up to the 2021 elections critics accused the incumbent president of using Covid-19 measures to “control and destroy” opposition parties.

Opposition leaders have taken to social media ahead of the election to promote their messages, since freedom of the press is increasingly threatened in Uganda. 

This is not the first time the Ugandan government has been embroiled in social media scandal. In December 2020, the Uganda Communications Commission (UCC) requested that a number of opposition YouTube channels be removed for inciting violence, a request that was viewed as both “political” and exhibiting “prejudice”.

Initial suspicions 

The DFRLab investigation started as part of ongoing research into disinformation and intimidation targeting presidential candidate Robert Kyagulanyi Ssentamu, commonly known as Bobi Wine, and the Ugandan government’s violent response to anti-government protests. A group of 10 Twitter accounts copying and pasting the same content unravelled a sketchy PR firm and news organisation using social media to promote Museveni and other members of his government.  

These accounts regularly retweeted Museveni and his proponents, with quotes containing the hashtags #SecuringYourFuture and #SevoLution. “Securing Your Future” is Museveni’s campaign motto, while “Sevo” is a nickname for the president. The accounts were some of the first to retweet Museveni’s tweets, and often included the same text and hashtags when quoting his tweets. They responded quickly to negative comments about Museveni, using the same copied and pasted text.  

(Source: @MercyAsiimwe2/archive, top left; @dickenso_okello1/archive, top right; @WildNerve/archive, bottom left; @WerikheM/archive, bottom right)

In one instance, eight accounts quoted a tweet by government press secretary Don Wanyama, including the standard #SecuringYourFuture and #SevoLution. The tweets were posted minutes apart. 

Eight accounts quoted a tweet by Don Wanyama within three minutes of one another. (Source: top row, left to right, @AbrahamMwesigye/archive; @WerikheM/archive; @rashid_kakaire/archive; @MercyAsiimwe2/archive; bottom row, left to right, @dickens_okello1/archive; @RobustoUg/archive; @AkechOlivia/archive; @KampalaTimes_/archive)

Seven of the 10 accounts did not contain any identifiable information: their banner images and profile pictures were lifted from sites such as Pinterest and they posted no personal information about the account operators. The other three accounts claimed to be operated by a PR firm, a news organisation and a journalist. 

Kampala Times and Robusto Communications

Two of the primary social media accounts included in the network promoting Museveni and the NRM party were Kampala Times, a news website, and Robusto Communications, a PR firm. According to corporation-tracking database Open Corporates, Kampala Times Media Ltd and Robusto Communications Co Ltd are registered private companies that were incorporated in Uganda in 2019. 

Robusto Communications’ now-deleted Twitter account, @RobustoUg, was created on November 10 2018. It initially posted infrequently, commenting on seemingly random videos of animals and world news, and began to share more politically aligned content in January 2019. Despite advertising itself as a PR and communications firm, Robusto did not post any information about its services, nor content relating to communications and PR. Instead, the Twitter account focused on retweeting Museveni and his supporters or posting links to the Kampala Times website. 

Unlike Robusto Communications, which did not appear to have a dedicated website, WHOIS data revealed that kampalatimesug.com was created on August 21 2020. The website claimed that Kampala Times was an independent news-aggregation service that was fully automated and linked to news websites around the world. It did not provide any other information about the operators of the site or the team members. 

Although the website was created in August 2020, the Facebook page for the company was created on May 29 that year, soon followed by its Twitter account @KampalaTimes_ on June 5. The first post to the Facebook page was a profile picture with information about Robusto Communications, indicating a clear connection between the two companies.  

The first post to the Kampala Times Facebook page was an image with information about Robusto Communications. (Source: Kampala Times/archive)

The Facebook page for Robusto Communications, RobustoUg, was created two months earlier, on March 22, and included a link to the Kampala Times in its “About” section. Both pages also listed the same contact number. 

Despite not having a dedicated website or any other information about its communication services, Robusto Communications posted job applications in May and August 2020 looking for a social media administrator and a Twitter administrator for a “fast-growing communication company”.

The Facebook “About” pages for Robusto Communications and Kampala Times listed the same contact number. It also included a link to the Kampala Times website (Source: Kampala Times/archive, left; RobustoUg/archive, right)

RobustoUg posted a combination of articles by Kampala Times and information that looked like news stories tagged #KampalaTimes, although the page only started sharing posts by Kampala Times on July 2 2020. Posts that did not follow this format were primarily copied and pasted from other Ugandan websites without accreditation. A post from December 9 2020 with 13 shares and five likes that was presented as breaking news, was lifted directly from a website called Trumpet News. The text and image from another post from December 17 was stolen from the Facebook page of popular Ugandan newspaper Daily Monitor.

The Robusto Facebook page stole the text and image for a news story from a popular Ugandan news site seven hours after the story was originally posted. (Source: Daily Monitor/archive, left; RobustoUg/archive, right)

Almost all the posts by RobustUg were shared by a profile called Nakamya Ritah, both to its own wall and to a number of Ugandan Facebook groups. The account also shared the first posts created by the Kampala Times page, in June 2020. The Nakamya Ritah profile had no unique images; its profile picture was an image of the Ugandan coat of arms, and its banner image a woman standing in front of an elevator that had been uploaded to Pinterest in 2017.  The same image, along with other images uploaded by the Nakamya Ritah profile, were used by some of the Twitter accounts included in the network. 

Excluding Robusto Communications and Kampala Times, the eight other accounts involved in the Twitter network also had corresponding Facebook profiles focused on sharing content from both Kampala Times and Robusto Communications, as well as amplifying pro-Museveni content. Although the eight user accounts corresponding to the eight Twitter accounts within the network did amplify the reach of Kampala Times and Robusto Communications, the Nakamya Ritah profile seemed dedicated to spreading posts from the two pages to pro-Museveni Facebook groups.  

The email address in the “About” section of the RubustoUg page included the name Nakamya, suggesting a potential connection between the profile and Robusto Communications. A closer look at the Kampala Times website showed that most of the articles were uploaded to the website by a user named Ritah Nakamya.

Most of the articles uploaded to the Kampala Times website were tagged with the name Ritah Nakamya. (Source: Kampala Times/archive)

The article bylines changed when clicking on the specific article links. Although the pieces were primarily uploaded by Ritah Nakamya, another user name, Innocent Vuga, also appeared to be responsible for uploading content. A look at the website’s source code indicated that Ritah Nakamya was listed as user number two, while Innocent Vuga was listed as user number four. The DFRLab could not identify any information on users one and three; however, Nakamya and Vuga were the only users to upload content to the website. 

The URL for Ritah Nakamya’s author profile contained the name “Dickson Okello”, which is very similar to “Dickens Okello”, the journalist whose Twitter account was among the 10 initially discovered by the DFRLab. The Kampala Times website had no other reference to Dickson or Dickens Okello as an author or a user uploading content. Unlike the Nakamya profile, the URL for the Innocent Vuga profile reflected the correct name. 

The URL for the Ritah Nakamya profile included the name Dickson Okello, while the URL for the Innocent Vuga profile reflected the correct name. (Source: Kampala Times/archive, left; Kampala Times/archive, right).

The in-text bylines for the articles themselves often differed from the name of the accredited user uploading the pieces. In some instances, articles uploaded by Ritah Nakamya were allegedly authored by Innocent Vuga or Vuga Innocent. Other names identified in the network by the DFRLab, including Akech Oilvia, were also cited as authors of articles by Kampala Times.

Before clicking through to the actual articles they appeared to be written by Ritah Nakamya. After clicking on a specific link the byline changed. (Source: Kampala Times/archive, left; Kampala Time/archive, right)

Dickens H Okello

One of the oldest accounts in the network, on Facebook and Twitter, was that of journalist Dickens Okello. According to ChimpReports, a Ugandan news website whose Facebook page was subsequently suspended in the takedown, Dickens H Okello wrote a combination of local and world news stories from as early as October 2014, with a large number of positive pieces dedicated to NRM politicians and parliamentary speaker Rebecca Kadaga. However, the @dickens_okello1 account, which joined Twitter as @dickens_heavens in August 2013, started tweeting links to ChimpReports and asking for comments and interviews as a ChimpReports journalist as early as December 2013. The Facebook URL for a “Dickens Okello Honeystraw” profile indicated that the account was originally created as “Dickens Honeywell”. According to ChimpReports, Okello’s middle name is Honeywell. Some of the earliest tweets by the Dickens Okello account include references to a personal email address that included the words “dickens” and “Honeywell”.

On Twitter, Okello amplified Museveni and his government as a member of the network of 10 accounts that copied and pasted content, and was the first account to engage with @RobustoUg for months. On Facebook, Okello was more original in his posts. He was vehemently pro-Museveni, shared NRM-related content daily and attacked supporters of opposition candidate Bobi Wine. His ChimpRep0rts articles were amplified by the accounts within the network, including Robusto Communications and Kampala Times, as well as the Nakamya Ritah account. 

The removal of Dickens’s accounts as part of a network allegedly operated by the Ugandan information and communications technology ministry brings into question his legitimacy as an independent journalist, as well as the news organisation ChimpReports, which has been operating in Uganda for more than a decade. At the time of writing, ChimpReports remains active on Twitter, as does its editor, Giles Muhame, although their Facebook pages were suspended in the takedown. 

Aftermath

The Ugandan government and supporters of Museveni’s NRM party responded angrily to the Facebook takedown. Wanyama, the senior press secretary to Museveni, tweeted: “Shame on the foreign forces that think they can aid and plant a puppet leadership on Uganda by disabling online accounts of @NRMOnline supporters.” In a subsequent tweet he demanded that the national communications regulator investigate Facebook and Twitter. “Big techs like @Twitter & @Facebook are being used by opponents of @NRMOnline to stifle pro-NRM voices in Uganda,” he stated. “They should ‘unfreeze’ accounts they froze yesterday & today. We pray @UCC_Official is watching & can act to ensure a fair digital playfield. #StopTechcolonisation”

At the time of writing, the hashtag #FreeNRMAccounts was trending on Twitter. 

Meanwhile, Museveni supporters are circulating meme-friendly images to demand the platforms restore the pages and accounts.

Freedom of Expression has always been a Human Right in everyone’s perspective. I humbly appeal to twitter ,Facebook,Instagram platforms to please allow @NRMOnline accounts prosper #StopTechcolonisation #FreeNRMAccounts pic.twitter.com/xHA8ywc1WV

— Andrew Nyesigwa (@nyesigwa) January 11, 2021

The DFRLab intends to fully investigate the inauthentic networks taken down by Facebook and Twitter and will publish additional reporting in the weeks and months ahead. DM

Tessa Knight is a Research Assistant, Southern Africa, with the Digital Forensic Research Lab (@DFRLab) and is based in South Africa.

The DFRLab team in Cape Town works in partnership with Code for Africa.