Analysis: QAnon is a Smear Campaign

QAnon is primarily a continuation of a long-running smear campaign that has usually been directed at the West. Readers should not take this to mean that it is exclusively a smear campaign. There are other elements to QAnon which should not be easily disregarded. Many of those elements have been covered thoroughly in other publications. As such, rehashing them here would seem unnecessary.

Some people who have used QAnon symbols and hashtags are unlikely to be aware that QAnon functions as a smear campaign. The forthcoming analysis is not an indictment of all who use such signs and symbols. Not enough people have been apprised of certain facts about QAnon. Some have been influenced into using such signs and symbols without knowing much about Q at all. Some have no idea that on June 24, 2020, Q directed their more tuned-in supporters to “learn use of camouflage” on the “Digital Battlefield.” Such instructions not only reduce social media platforms’ ability to detect and remove these “digital soldiers” but also allows QAnon supporters to surreptitiously target or even recruit unwitting social media users.

Readers who are familiar with the Internet Research Agency trolls may note the similarities in tactics. These trolls operated out of St. Petersburg, Russia and even have been found to have ‘branches’ in Ghana, Nigeria and even in the US. They have often disguised their social media activity by pretending to be Americans while they target unwitting Americans across the political spectrum, from the far-left, to the center, and all the way to the far-right.

I have recently written about Q and the Internet Research Agency (IRA) trolls. A significant portion of the following material will relate directly to that previous documentation. As such, I would recommend those who haven’t read it to look it over. Even those who have previously read it could benefit from a refresher.

Over a period of nearly two years, I have studied the IRA trolls, QAnon, and other malign activity on social media. I have identified and documented over 700 online trolls which I assess with a high degree of confidence to be operating on behalf of the IRA. Some of those accounts I identified have since been suspended, but many are still present on Twitter and other platforms. My hope is that by reviewing the activity of one such account, readers will come away with a better understanding of this ongoing smear campaign. As we proceed, I’ll be adding my observations where I think it’s warranted.

Within the dataset of IRA account activity, I’ve found numerous cases where the IRA trolls promoted and mentioned suspicious accounts which had yet to be suspended by Twitter. One such account is @joeyyeo13, which has posted over 500K statuses since it became active in early March 2013.

Aside for the very high volume of activity, the YouTube link caught my eye. It leads to an unavailable video, which indicates that the operator hasn’t been paying close attention to this bio. The high follower count is also notable. Pew Research recently released a study of Twitter users and of the top 10% of Republican Twitter users, the median follower count was 354. @joeyyeo13 beat the median figure by 11,166 followers. The higher the follower count, the greater the potential for influence, good or bad.

Beyond the fact that 84 different Russian trolls promoted this account, the primary reason I have a high degree of confidence that @joeyyeo13 is operating on behalf of the IRA is the type of content this account produced. I must note that thick partisan blinders are the primary potential obstacle which might prevent readers from seeing this content for what it is. Partisanship is precisely what such operations seek to exacerbate and then exploit.

Perhaps it is already apparent how this leads directly to QAnon. Before we delve further into that, there are a few matters that must be covered first.

UKRAINE

A sizeable portion of the Internet Research Agency’s early activity related to Ukraine. Their online trolls worked to change the narrative about the ouster of Ukraine’s pro-Kremlin President, Viktor Yanukovych. In 2019, Yanukovych was found guilty of high treason and of aiding in Russia’s war of aggression against Ukraine. The account we are examining pushed false claims in the wake of Yanukovych’s ouster and Russia’s subsequent invasion of Ukraine.

The first video has since been made private. The linked video in the May 9, 2014 tweet is from an account that has since been terminated. A significant number of the linked videos throughout this analysis have since been made private, are unavailable, or are from terminated accounts. The usage of “the Ukraine” in the May 9th tweet is typical of Russian propaganda (and of Westerners who don’t know better). This messaging seeks to undermine the reality that Ukraine is an independent nation, by referring to Ukraine as though it is just a region.

The video in the May 3, 2014 tweet comes from a YouTube channel which is named Атоми Россия (Atomy Russia). The title of the video was already claiming that Donbass belongs to Russia in 2014, despite the reality that it is a region of Ukraine. This region has been under siege by Russian-backed separatist forces since 2014. The labeling of Ukrainians as Nazis is part of an ongoing smear campaign against those who oppose Russian interference in Ukraine.

In the March 2014 tweet, the YouTube link leads to a video from RT (Russia Today). Three of these four tweets attempt to project the blame from Russia onto the US. Such messaging serves as both a smear of the US and as a shield for the Russian government’s ongoing imperialist aims in Ukraine and elsewhere.

FLIGHT MH17

On July 17, 2014, Flight MH17 was shot down by a Russian Buk missile from territory held by pro-Russian forces in Ukraine, according to the Joint Investigative Team (JIT). In the immediate aftermath of this disaster, Russian trolls began an extensive online campaign to redirect the blame to Ukraine and elsewhere. They also sought to undermine the MH17 investigation. @joeyyeo13 was involved in spreading such messaging.

THE 2016 ELECTIONS

Starting in mid-2016, this acct began posting content regarding Guccifer 2.0, DC Leaks, and Wikileaks. The Guccifer 2.0 persona began dumping material on June 15, 2016 and sought to misdirect attribution from Russian operatives to a fictitious Romanian hacker. @joeyyeo13’s post came the next day.

The Wikileaks dumps provided a perfect opportunity for trolls to fabricate smears targeted at various Americans. The claims made above are not backed up by the content of the Wikileaks dumps, but that is of little importance to such trolls. What is true is irrelevant.

The YouTube link posted on October 15, 2016 goes to RT, where the host attempted to explain away the fact that their tweet about the 6th Podesta dump was published prior to Wikileaks public announcement of the dump. Wikileaks helpfully tweeted out a denial of the accusations, which the host cited. According to Wikileaks’ tweet, if RT had been monitoring this specific URL (https:// wikileaks.org/podesta-emails/?q=&mfrom=&mto=&title=&notitle=&date_from=&date_to=&nofrom=&noto=&count=50&sort=6#searchresult), they might have seen a supposed publication of the sixth batch long before Wikileaks publicly announced it Then they could have put together an article on it, which was linked in @RT_America’s tweet. It perhaps goes without saying, but it takes at least a few minutes to write an article. This article was later updated to show that the supposed basis for the article about Wikileaks 6th dump was the tweet that Wikileaks published 29 minutes after @RT_America’s tweet. Notably, when a journalist asked for actual evidence to substantiate the explanation Wikileaks gave, there was no public reply from Wikileaks.

Evidence and indications of advance knowledge about upcoming Wikileaks publications was a trend in 2016. Another example occurred on November 4, 2016 in advance of Wikileaks tweet about ‘Spirit Cooking.’ That tweet was published at 3:06 AM CST and many Americans would wake up later on the 4th to find #SpiritCooking trending. @joeyyeo13 would contribute to that topic and also propagated accusations about pedo rings.

The tweet at 1:07 AM CST preceded Wikileaks’ tweet by nearly 2 hours. The tweet on October 29, 2016 preceded Wikileaks tweet and may have even preceded #Pizzagate. #Pizzagate, as I’m sure readers are aware, is a baseless smear that emerged just before the 2016 election. It alleged that members of the Clinton campaign and others were part of a pedo ring. It alleged that references to one of America’s favorite foods, namely pizza, were instead code used by child predators. In the months and years after the Pizzagate smear began, various American celebrities and public figures have been subjected to smears based upon references to pizza.

While I cannot be fully certain about whether the earlier tweet preceded #Pizzagate, I am certain that the following baseless ‘pedo’ smears came well before #Pizzagate.

It is not all that surprising that the 2016 election culminated with a coordinated online smear campaign which involved IRA trolls and materials that had been stolen by the GRU. This was just a continuation of an ongoing smear campaign and such smears are a known Kremlin tactic. As the New York Times wrote in 2016, “The idea that Europeans and Russian opponents of the Kremlin are sexual deviants with a taste for pedophilia is a strange but recurring theme in Russian propaganda.”

Such smears would continue after the 2016 election and would target media figures, celebrities, and government officials.

THE ROAD TO QANON

The road to QAnon was partly paved by certain other Anons and phony insiders. I covered some of those Anons and ‘insiders’ and their direct intersection with the Internet Research Agency in my earlier article. Three of them were a ‘FBI Anon’, a ‘Pentagon Insider’, and a ‘DC Insider’, who will appear again below. Five additional Anons will also appear, including a White Rabbit Anon.

Only two of the linked videos are still available. The link in the October 12, 2016 tweet leads to a mirrored copy of a video which is narrated by a computerized voice and features an animated CGI Guy Fawkes mask. The computerized voice claims without evidence that Bill Clinton sexually molested a child and also managed to implicate Hillary, the Israeli government and others in this smear. This was posted prior to the Pizzagate smear and accumulated over a million views, as indicated in the video title. There is a possibility that such content affected the outcome in 2016. Even if Hillary had won, such smears could slowly undermine the credibility of the White House both inside the US and, more importantly, around the world.

The video that was linked on July 11, 2017 leads to a channel called Gotcha News Network. @joeyyeo13 linked to this channel numerous times. Some additional examples will follow this section. This channel typically featured a woman doing a voiceover in English while text from various fringe websites was displayed on the screen. Some of the visual content gave no indications of the website where the material had been originally posted. The woman did not seem familiar with the content she was reading and regularly stumbled through sections. She also laughed at times in response to something she just read.

After checking for additional information about this channel online, I found that DFRLab had written about this channel and a number of other channels that were all spamming the same content on YouTube. This operation involved the hiring of likely unwitting people to do voiceovers via Fiverr.

Regarding this network of channels, DFRLab wrote, “The content was presented behind a thin veneer of seeming news-like while presenting limited evidence for unsupported assertions. In general, the YouTube channels pushed heavily right-wing, often wholly fabricated disinformation. The content was certainly focused on political divisions in the United States; however, disagreement also generates high click rates and audience growth.” (emphasis added)

The abandonment of this channel, like so many others I’ve found, indicates that any financial aims were secondary to the propagation of this content. Not many creators who primarily are financially motivated would abandon a channel that had accumulated 102 million views over 18 months. This abandonment also indicates that such channels are treated as though they are disposable and easily replaceable.

Mixed in among this content, we also find notable videos like:

The fifth video claimed that the chemical weapons attack was traced back to a hack of the Syrian government and an unauthorized launching of chemical weapons by private citizen Obama. The goal of Obama’s brazen hack, of course, was to start a war with Russia. The Kremlin notably began an extended propaganda campaign about Syria once they started protecting Assad from angry Syrians.

The channel also mixed in various attempts to blame someone besides Russia for the hack of the DNC. It even featured a claim that the DNC files were copied locally, not hacked. @joeyyeo13 posted a tweet with identical wording (minus the “BOMBSHELL”) and a link to a different YouTube video which is no longer available. This may have come from one of the other channels that DFRLab documented. The channel obsessed over Seth Rich and the Awan brothers, all of whom have been used as scapegoats by IRA trolls. The false allegations about Seth Rich were far more definitive, because unlike the Awans he cannot rebut such allegations due to his death.

Claims about Seth Rich and the Awans would continue to be perpetuated by Q. Other smears that were produced by Gotcha News Network and propagated by @joeyyeo13 would later appear in Q’s posts. Some examples include:

The phrases “Panic Mode” and “Red October” made several appearances in Q’s posts. A few days after the tweet about sealed indictments, Q would refer to sealed indictments in post #151. And, as covered in my earlier article, the IRA trolls and Q sought to smear Sen. John McCain in various ways, to include calling him a traitor.

@joeyyeo13 posts included content from a variety of other sources besides Gotcha News Network. There were numerous other baseless claims which would later appear in Q’s posts. Some additional examples will follow. The first example matches up with the false assertion which was made in conjunction with Q’s first post. The context of that post is instructive, as Q emerged in the wake of the announcement that the first charges in Mueller’s probe would occur on Monday the 30th of October, 2017. The general consensus was that it would be Paul Manafort, the man who just happened to have been working with Russian intelligence officer Konstantin Kilimnik to “get whole” with Russian oligarch Oleg Deripaska while Manafort was on the Trump campaign.

Q amplified a 4chan post from a separate user ID which stated that it would be Hillary Clinton (rather than Manafort) and added, “HRC extradition already in motion effective yesterday with several countries in case of cross border run. Passport approved to be flagged effective 10/30 @ 12:01am. Expect massive riots organized in defiance and others fleeing the US to occur. US M’s will conduct the operation while NG activated.” As captured below, this wasn’t the first instance where false allegations of indictments had been propagated.

@joeyyeo13 also posted claims that would have validated Q’s prior ‘prediction’ about the arrest of the Podestas. However, those claims were completely false.

I suppose the best way to wrap this up would be to highlight @joeyyeo13’s seamless migration over to using QAnon hashtags. As seen throughout and as seen below, these smears targeted a multitude of public figures, most of them inside the US. The smears don’t stop there. There is a final point I think is worth emphasizing, even though I know that some folks who do not support Trump may not want to hear this. The proliferation of such accounts online also acts as a smear of Trump supporters who have no interest in Q. By misrepresenting the size of QAnon support online, it misrepresents the views of the average Trump supporter. Such accounts also seek to slowly influence the views of Trump supporters over time. After several years of such messaging, it certainly appears that there has been at least some ‘progress’ made in those endeavors.