Operation Carthage: How a Tunisian firm influenced elections in Africa

An exclusive investigation has discovered how a Tunisian company conducted a sophisticated digital campaign that attempted to effect mass sentiment change and influence the country’s presidential election as well as other Francophone countries in Africa.

Dubbed Operation Carthage, among the campaigns supported by the operation were Nabil Karoui’s 2019 presidential campaign in Tunisia, Faure Gnassingbe’s 2020 effort in Togo, and Henri Konan Bedie’s current bid in Cote d'Ivoire.

Starting in September 2019, the investigation was carried out by the Digital Forensic Research Lab (DFRLab), a digital research program of Washington DC-based think tank, the Atlantic Council. This outfit uses open source tools and public social media data to identify, expose, and explain disinformation and fake news online.

The company at the heart of DFRLab’s expose, a Tunisian digital communications firm called UReputation, used coordinated inauthentic behaviour (CIB) on Facebook and other online platforms to carry out its disinformation campaign.

On June 5, after conducting an internal investigation, Facebook announced it had taken down over 900 assets affiliated with the operation, including 446 pages, 182 user accounts, 96 groups, and 209 Instagram accounts.

As part of its May 2020 CIB report, Facebook cited that the assets were removed due to them being in violation of its policy against foreign interference.

Facebook stated the network behind it “used fake accounts to masquerade as locals in countries they targeted, post and like their own content, drive people to off-platform sites, and manage Groups and Pages posing as independent news entities.”

“Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to a Tunisia-based PR firm UReputation.”

Over $330,000 was spent in Facebook adverts to support the operation.

The Tunisian campaign

The clue that triggered DFRLab’s investigation was, ironically, a Tunisian fact-checking page on Facebook called “Fake News Checking”. 

Launched in August 2019, it posed as a disinformation monitoring service related to Tunisia’s presidential election coverage.

It became apparent that the site’s fact-checking was consistently unfavourable to then-prime minister and presidential candidate Youssef Chahed, while expressing more positive coverage of media mogul Nabil Karoui, who wasn’t considered a serious contender.

Karoui eventually made it to the runoff stage and stood against Kais Saied, before ultimately losing to him in October 2019.

DFRLab noticed that the page was reminiscent of a similar one created by the Archimedes Group, an Israeli digital communications firm that established inauthentic pages in at least 13 countries. It was taken down by Facebook in May 2019.

An open-source review of “Fake News Checking” and its online presence only raised further suspicion after the excavation of its Twitter account led to a defunct website called 360.tn.

Digging further, a connection was made to a Tunisian-French businessman based in Barcelona named Lotfi Bel Hadj, whose name would resurface frequently over the course of the investigation.

Upon examining the LinkedIn profile of Moez Bhar, the co-founder “Fake News Checking,” a website called ureputation.net was mentioned, which Bhar claimed he had worked for since June 2014.

According to the website, UReputation advertised itself as a communications agency that specialised in “digital intelligence and cyber influence,” including “sending targeted messages to specific categories of recipients to influence their perception of a brand or personality.”

In an interview with DFRLab in October 2019, Bhar suggested that he supported Karoui but maintained that his fact-checking service remained independent.

Following a review of Bhar’s other professional associations, DFRLab discovered multiple Francophone news sites, Revue de L’Afrique and Afrika News, that shared similar website designs and ‘staff’ with suspended Twitter accounts that didn’t appear to exist.

Bel Hadj, a former contributor to Revue de L’Afrique with business interests stretching across the world, was sympathetic to presidential candidate Karoui. He even penned a defense of him in an op-ed while Karoui was jailed for money laundering and tax fraud.

Through open-source evidence, multiple links between Bel Hadj and UReputation began to emerge.

A March 2019 conference near Tunis co-organised by UReputation and HuffPost Maghreb lists Bel Hadj’s LBH Foundation as host, while his former site was registered by a Tunis-based company (misspelled) as “Urepuation”. It had also registered several domains related to the halal food industry, which was one of Bel Hadj’s long-running business interests.

The person who registered the domains turned out to have Bel Hadj, Bhar and others connected to UReputation as Facebook friends.

As the Tunisian elections approached its climax, one of Bhar’s tweets about Karoui’s incarceration linked to another suspicious site called Maghreb-Info.com, which disseminated pro-Karoui stories.

Some posts on the “Fake News Checking” Facebook page began to draw increasing scrutiny. One was an unsourced poll that allegedly tabulated more than 420,000 voters to show Karoui had a significant lead prior to the first round of voting, which was clearly inaccurate.

DFRLab’s domain reviews of two of the candidates on the poll – Karoui and Kais Saied – saw Bel Hadj turn up again, this time on a WHOIS search for kaissaied.com, revealing a Barcelona address for Digital Big Brother, a company that identified Bel Hadj as its owner.

Having collated these various online assets, DFRLab reached out to Facebook as part of their ongoing partnership with the tech giant concerning election integrity.

Subsequent investigations by Facebook then led to the removal of 900 plus assets across Facebook and Instagram that were attributed to UReputation.

It then became clear that Tunisia wasn’t the influence campaign’s only target.

African operations

With exclusive access to the data set prior to Facebook’s removal, DFRLab would review more than 500 of those flagged assets and found ties to 10 countries: Chad, Comoros, Congo-Brazzaville, Côte d'Ivoire, Gambia, Guinea, Mali, Niger, Senegal, and Tunisia.

Not all were problematic, but some did raise red flags; including what appeared to be hallmarks of political influence operations that targeted two presidential campaigns: The February 2020 election in Togo and the upcoming October 2020 election in Côte d'Ivoire.

From the crop of assets reviewed, a new crop of content began appearing on Facebook in January 2020, all clearly in favour of the re-election of Togolese President Faure Gnassingbé, who was running for a fourth term.

Over the course of the month, a slew of new pages popped up on Facebook in support of Faure, with many of the page administrators based in Tunisia. 

Further crops of pro-Faure pages popped up which began to accrue thousands of followers within a short period of time.

Additional pages would follow between January 20 and January 30 dedicated to Faure’s opponents, but none of these were highly produced and had only a fraction of a following, in a possible attempt to weaponise it against Faure’s contenders.

There were also pro-Faure pages that claimed to be Togolese news outlets that suddenly appeared during the period.

Around the same time, a number of websites that DFRLab had previously analysed during the Tunisian elections began to produce pro-Faure content, including Revue L’Afrique and Afrika News.

Bhar, who was employed by both websites, had made a visit to Togo during this period too.

Using SecurityTrails, DFRLab discovered that from several new subdomains added by the server administrators of the ureputation.net website, one was a copy of Faure’s official campaign page.

Once again, there was a strong connection to UReputation’s involvement.

While Faure Gnassingbe was re-elected in a landslide on February 24, the impact the influence campaign had on the election remains unclear.

In Cote d'Ivoire, the influence cooperation dedicated at least 50 Facebook pages, groups and other assets to support former Ivorian president Henri Konan Bedie, also known as HKB, for this year’s election in October.

Unlike Faure’s operation, some pro-HKB pages even stretched back to 2016. Along with political content, the operation produced many that posed as faux-news outlets.

From 2019 until the time of Facebook’s takedown, the campaign created at least 11 new Facebook pages and several Instagram accounts. Many of these pages were expressly designed to promote HKB’s candidacy.

One of the pages identified, with more than 60,000 followers pointed to the website hkb2020.com, had been serving as a placeholder page. 

A WHOIS search showed the domain was registered in September 2019 to the same address as kaissaied.com during the Tunisian election – Bel Hadj’s Digital Big Brother address in Barcelona.

Altogether, Operation Carthage’s digital tentacles were vast in scope: approximately 3.8 million Facebook accounts followed one or more of the reported 900 assets, with nearly 132,000 joining operation-administered groups and over 171,000 following Instagram accounts.

DFRLab highlights a worrying trend – “disinformation as a service” – where digital companies and PR firms begin to adopt disinformation campaigns and online influence operations as part of their suite of services.

Like the takedown of Archimedes Group or a similar case involving online assets connected to PR companies in Egypt and the UAE suggest, Operation Carthage is only the latest instance where unscrupulous digital communication firms profit from engaging in 'coordinated inauthentic behaviour' on Facebook and other social media platforms.