First Published by DFRLab.

On January 8, 2020, Facebook removed 32 pages, 220 user accounts, 59 groups, and 139 Instagram profiles working to promote Ugandan president and National Resistance Movement (NRM) leader Yoweri Museveni. The accounts of at least six government employees and two PR firms were involved in the network taken down by Facebook for using fake and duplicate accounts and misleading pages to target public debate ahead of the 14 January presidential election.

According to a Facebook statement, they removed the assets “for violating our policy against government interference, which is coordinated inauthentic behaviour on behalf of a government entity. This network originated in Uganda and targeted domestic audiences.”

The takedown was precipitated by a DFRLab investigation into the inauthentic assets.

The Facebook statement continued:

We found several clusters of connected activity where people relied on fake and duplicate accounts to manage Pages, impersonate at least one public figure in Uganda, comment on other people’s content, and post in multiple Groups at once to make their content appear more popular than it was. Some of these fake accounts had already been detected and disabled by our automated systems. In the fall of 2020, this network actively promoted StopHooliganism hashtag in response to protests against the arrests of the opposition candidate across social media services, including off Facebook.

This operation posted primarily in English. The first cluster of this activity focused on posting in support of the President of Uganda and the ruling party called National Resistance Movement (NRM). The second cluster posted about Lieutenant General Muhoozi Kainerugaba as a potential future presidential candidate. Finally, the last cluster focused on commenting on the opposition Pages, targeting the National Unity Platform in particular and the opposition candidate Robert Kyagulanyi [aka Bobi Wine], in addition to posting comments on the Pages of the government of Uganda. Much of this network’s posts were amplified by other fake accounts in the network. Some of these Pages reposted content from local news aggregators and pro-NRM blogs.

Three days after the takedown, Twitter removed a group of accounts corresponding to some of the accounts removed by Facebook. In response to the removal of NRM-linked assets on both social media platforms, the Ugandan government implemented a social media lockdown on 12 January, preventing users from accessing social media websites such as Twitter and Facebook, as well as messaging applications such as WhatsApp. According to Museveni, the social media giants were not acting “equitably” and therefore would not be allowed to operate in the country.

The DFRLab identified at least five user profiles associated with the Government Citizens Interaction Center (GCIC) that were removed during the takedown. GCIC is a department of Uganda’s Information and Communication Technology (ICT) Ministry. Also included in the list were aspiring NRM politicians, an opposition member of parliament, and journalists working for pro-Museveni news organisations. The DFRLab found no evidence that the two PR firms included in the set were connected to the government for the purposes of promoting Museveni.

Government accounts

After Facebook announced that Ugandan government employees were implicated in the inauthentic network, the verified Twitter account associated with the government media center posted a tweet confirming that accounts “lost” in the Facebook takedown belonged to employees of the government.

WATCH: We demand that @Facebook & @Twitter write directly to the individuals that lost their accounts. Since @Facebook cited @MoICT_Ug in their statement, let them write to us so that there’s a chance for a fair hearing.
Accounts lost on Facebook belong to @GovUganda employees. pic.twitter.com/gGSDYkfgWI

— Uganda Media Centre (@UgandaMediaCent) January 12, 2021

The DFRLab identified five GCIC members whose accounts were removed during the takedown. Another account claimed to work for the ICT Ministry and Kampala Post in its Twitter bio.

Of the five accounts, three of them consistently posted pro-Museveni content and amplified the NRM ahead of the 14 January election, using the NRM slogan #SecuringYourFuture at the end of posts praising Museveni and his government. During the November anti-government protests two of them used the hashtag #StopHooliganism, which had been inauthentically amplified on Twitter using old images of protests in the country as evidence of Bobi Wine supporters acting like hooligans. A page corresponding with the name of one of these employees was inactive during the lead-up to the election, though was primarily used to promote a campaign to become guild president of a Ugandan university and president of the Ugandan National Students Association.

The accounts actively promoted Museveni and worked to denigrate opposition candidate Wine. In early December, after Wine started wearing protective gear to political rallies, one of the GCIC employees shared a post questioning why Wine had not been shot in the head after removing his helmet.

One government employee shared a post questioning why opposition candidate Bobi Wine was not shot in the head. (Source: Facebook)

However, GCIC and the ICT Ministry were not the only government organisations represented in the takedown – two Instagram accounts and 11 duplicate Facebook accounts associated with a spokesperson for Museveni’s son were also removed.

The majority of the accounts using the name of this individual contained a small handful of photographs, or else had not posted new content in years. From the profile pictures uploaded to the accounts, it appeared the accounts were split between two people – an official spokesperson for Muhoozi, and a young man using the same name.

Mysterious PR firms

Included in the takedown were two PR firms, with a combined following of more than 10,000 accounts at the time they were removed. Despite the fact that they promoted Museveni and his government, the DFRLab found no indication that they were directly connected to the Ugandan government.

The DFRLab previously identified one of the firms, Robusto Communications, in its preliminary report into the network. The firm advertised its services on Facebook and Twitter, and even claimed to be hiring for a job as a Twitter administrator for the company. Yet the company lacked a dedicated website. And though it is an incorporated entity, the only offline presence the DFRLab could find for it was a phone number that was shared by an online outlet calling itself Kampala Times, which was also removed during the Facebook takedown.

Both the Twitter and Facebook pages dedicated to the PR firm worked to promote Museveni and members of his parliament. On Twitter, Robusto Communications was part of a smaller network within the large takedown that tweeted the same copy and pasted text promoting Museveni and other members of his party.

Robusto Communications’ Twitter account was part of a small network that tweeted the same content. (Source: top row, left to right, @AbrahamMwesigye/archive; @WerikheM/archive; @rashid_kakaire/archive; @MercyAsiimwe2/archive; bottom row, left to right, @dickens_okello1/archive; @RobustoUg/archive; @AkechOlivia/archive; @KampalaTimes_/archive)

On Facebook, Robusto Communications worked to promote Museveni by sharing positive posts from inauthentic news organisations included in the takedown, such as Chimp Reports and Kampala Times. The page also stole news stories from legitimate Ugandan news sites such as the Daily Monitor without crediting them, in an attempt to make it appear more legitimate.

The Robusto Facebook page (right) stole the text and image for a news story from a popular Ugandan news site (left) seven hours after the story was originally posted. (Source: Daily Monitor/archive, left; RobustoUg/archive, right)

The second PR firm, White Bear Communications, also actively promoted Museveni and his campaign. They appeared to use their social media accounts to advertise and promote companies and services, and, like Robusto Communications, advertised a position to work for the company shortly after the creation of its social media pages.

On Twitter, Facebook, and Instagram, White Bear Communications started off by promoting its services, creating posts about business and marketing strategies, and advertising other companies. Unlike Robusto Communications, which started off promoting Museveni and members of his government, White Bear Communications appeared to operate as a more general interest advertising firm until October 2019.

White Bear Communications posted advertisements for a plethora of different companies. (Source: Instagram, top right; Facebook, top left; Twitter/archive, bottom)

On Twitter, the account continued to post advertisements for hotels and game lodges until October 12 2019. @WhiteBearCOMM then was inactive until March 18 2020, when it started consistently retweeting tweets by Museveni, Chimp Reports and other pro-NRM accounts. Any original tweets by @WhiteBearCOMM included hashtags such as #SecuringYourFuture or #SevoLution. Securing your future was Museveni’s campaign motto, and “Sevo” is a nickname for the president.

During the period in which the Twitter account was inactive, the Facebook page dedicated to White Bear Communications posted fewer advertisements and more celebrity gossip and world news, interspersed with content about Museveni. By November 2 2020, when Museveni was nominated as the NRM’s presidential candidate, the White Bear Communications page started tagging posts with the hashtags #SecuringYourFuture, and sometimes #Sevolution.

In some instances, the White Bear Communications page copied content directly from Museveni’s social media pages, government accounts such as the Uganda National Roads Authority, or pro-Museveni pages such as NRM Achievements. Two weeks before the election the White Bear Communications page created several posts using content copied directly from Museveni’s official website, firmly aligning itself with the president. Most of the tweets were signed off using the hashtag #SecuringYourFuture, or #IWillVoteM7.

The Facebook page for White Bear Communications copied a tweet for Museveni’s official Twitter account. (Source: Facebook, left; @KagutaMuseveni/archive, right)

White Bear Communications also consistently retweeted and tagged a pro-Museveni account advertising different services as well as more politically oriented tweets. Similarly, this account tagged White Bear Communications in political tweets and advertisements.

Inauthentic Franks

In 2020 a number of anonymous Facebook accounts were set up to promote Museveni and his son, Muhoozi. The accounts contained no personal information about the users operating them and used stock images of Museveni or his son as profile pictures. Many of them used the surname “Frank”. While some contained the occasional generic status update, such as “I am thinking”, the majority were used exclusively to post pro-Museveni content or share posts from Museveni’s official page and other NRM-related pages.

Many of the accounts were also friends with one another and engaged with one other’s content. The content itself garnered significant engagement – even the first stock profile pictures of Museveni or Muhoozi uploaded to some of the “Frank” accounts received more than 100 likes.

Some of the content posted by the inauthentic “Frank” accounts received significant engagement. (Source: Facebook)

Politicians

Included in the takedown were accounts belonging to politicians and political aspirants.

Dixon Ampumuza, a member of the NRM, campaigned to be a member of parliament, but in August 2020 he pulled out of the race, alleging his supporters were harassed by security personnel, according to the Uganda Radio Network. However, according to Chimp Reports, Ampumuza pulled out of the race because he did not agree with the mode of voting. Ampumuza went public with his account being taken down on Twitter, where he accused Facebook of criminalising those who supported Museveni.

Ampumuza questioned Facebook’s decision to remove NRM-related content, asking if supporting Museveni was a crime. (Source: @dampumuza/archive, left; @dampumuza/archive, right)

Ampumuza’s LinkedIn page also claims he is the CEO of The Ugandan, a news website whose Facebook page was also removed in the January takedown for engaging in coordinated inauthentic behaviour. The website itself stopped publishing new content after its corresponding Facebook page was removed on January 8.

The Facebook page allegedly belonging to opposition MP Cecilia Atim Ogwal was also removed. Ogwal has been a member of parliament since 1996 where she represents the Forum for Democratic Change, an opposition party that received 35.61% of Ugandan votes in 2016 and only 3.24% in 2021.

Although it was not a verified account, Ogwal’s page appeared to be legitimately operated by the politician, regularly referring to discussions Ogwal led in parliament shortly after the house adjourned. Unlike the other pages removed by Facebook, Ogwal’s page did not lobby for Museveni to be re-elected. It also vocally protested against the application of Covid-19 regulations and standard operating procedures (SOPs) being used as tools to silence opposition candidates.

The page allegedly belonging to opposition MP Cecilia Atim Ogwal condemned police brutality and selective application of Covid-19 SOPs to silence the opposition. (Source: Facebook)

Although it did share one screenshot from a profile that was also removed, as well as one link to Chimp Reports, Ogwal’s page was a significant outlier in the takedown as it did not actively promote Museveni. However, the accounts included in the small network the DFRLab previously identified liked and amplified content from Ogwal.

Influencers and prominent accounts

Facebook and Twitter accounts that were particularly vocal during the protests after Wine was arrested in November 2020, were removed by both social media platforms. The accounts used old images of protests and riots in Uganda as evidence that Wine’s supporters were violent thugs, tagging each other in their posts in an attempt to amplify the hashtag #StopHooliganism.

Some of the influential accounts Facebook identified as part of the inauthentic network included a popular blogger and NRM supporter, another blogger who switched from supporting Wine to supporting Museveni ahead of the election, and the editor of Chimp Reports, one of the inauthentic news organisations included in the takedown.

Ultimately, the network of pages, accounts and groups worked together to amplify Museveni and his political party ahead of the 14 January election. The inclusion of prominent government employees in a network using coordinated inauthentic behaviour to promote an incumbent president and the ruling party brings into question the authenticity of the NRM’s campaign strategies. DM

Tessa Knight is a Research Assistant, southern Africa, with the Digital Forensic Research Lab (@DFRLab).

The DFRLab team in Cape Town works in partnership with Code for Africa.

Follow along for more in-depth analysis from our #DigitalSherlocks.