Anonymous Ukrainian Telegram channels serve as gateways to fringe media

Allegations against former Ukrainian MP on anonymous Telegram channels made way to fringe media and other MPs’ Telegram channels

(Source: @r_osadchuk/DFRLab via www.flaticon.com)

December 16, 2019 was not a pleasant day for Ostap Yednak, a former member of the Ukrainian parliament, as he found himself targeted by fringe media for alleged corruption. The source of the accusations was not the police, the justice system, nor independent journalists: they came from an anonymous Telegram channel.

This case illustrates how anonymous Telegram channels hosting sensitive kompromat — compromising material used to sabotage a political opponent — can serve as a “gateway” to fringe media sources with a wider audience. This is particularly notable in a country such as Ukraine, where trust in media is low and where the political environment is sensitive and increasingly polarized, especially in light of local elections slated for October. Foreign and local actors actively use the platform for such “revelations.”

Telegram is a popular platform in Ukraine to spread “juicy insider” information about politics, but its credibility is questionable. A recent investigation of Ukrainian Telegram by independent news outlet Liga.net revealed that many of these “insider” channels might be connected to others by their publishing patterns, which would indicate some degree of inauthentic amplification. According to Liga.net, one of the channels spreading the Yednak “investigation” also appeared to be connected to the Telegram channels of current Ukrainian MPs Alexandr Dubinsky and Max Buzhansky.

In this instance, it is unclear to what degree — if any at all — Ostap Yednak was guilty of the allegations.

The original story

On December 1, 2019, Austrian investigative media outlet called Addendum Investigativ published a story featuring allegations of a Ukrainian member of parliament’s supposed involvement in a scheme to prevent police intervention with allegedly corrupt wood-product companies. Addendum Investigativ claimed that a man who had introduced himself as a Ukrainian MP had stopped a police raid on companies that illegally export wood and wood products to Europe.

While the Addendum Investigativ article did not mention the MP’s name, Ukrainian fringe media subsequently connected the Addendum Investigativ story to Ostap Yednak based solely on the proximity of his residential address to the companies involved — Taifun and Zumani — as well as his friendship with the heads of those same companies. The fringe outlets, however, provided no other evidence to support their assertions. Indeed, in a now-deleted Facebook post, Yednak denied being involved in the case and claimed the accusations were disinformation.

While the claims were unsubstantiated, prior to his time as an MP, Yednak worked in the wood products industry, directing wood wholesale and windows construction at various companies. After the 2014 Ukrainian Revolution, however, he built a public profile as a coordinator for the Reanimation Package of Reforms Coalition, an association of nongovernmental organizations that supported the reforms stemming from the Revolution. Based on this reputation, in 2014, he was elected to a single term as a Member of Parliament. In 2016, in the middle of his term, fringe media incorrectly claimed that Yednak wanted to apply to be the head of Ukrainian Forest Agency. In 2019, Yednak left office, having failed in his reelection bid.

Nearly two weeks after its publication, Addendum Investigativ’s story began gaining traction in Ukraine. The first source to republish the story was an anonymous Telegram channel named after the late Israeli Prime Minister Golda Meir.

The channel was created on November 19, 2019, and posted for the first time shortly before the Yednak scandal, on December 3, 2019. It typically posts criticism of and sensitive or “revealing” information about government officials. As of the end of January, the channel had 2,428 members; on average, its posts received around 15,500 views. Some posts, however, received wider dissemination.

Statistics for the Golda Meir Telegram channel as of February 26, 2020. (Source: @r_osadchuk/DFRLab via TGStat)

On December 14, 2019, the channel posted a story that started with “Sorosites are lobbying forest Mafiosi Yednak to the State Forest Agency,” a resurrection of the 2016 story about Yednak’s interest in a post with the agency. “Sorosites” is a term used derogatively in reference to public figures who are pursuing reforms; the term is a reference to billionaire philanthropist and frequent target of the far-right, George Soros. The post received 55,500 views, which was significant for a group of this size and suggested that it was shared by other channels on the platform. According to the Telegram Analytics tool TGStat, five Telegram channels forwarded the post by the Golda Meir channel.

The Telegram Analytics search of text from the Golda Meir publication ranged by date of publication from the latest to earliest. The channels are, left to right: Sorosites, Societal control, Max Buzhansky, Novo_stnoy, Dubinsky.pro, and Golda Meir. (Source: @r_osadchuk/DFRLab via TGStat)

The first channel that forwarded Golda Meir’s message was the “Dubinsky.pro,” the personal channel of Alexandr Dubinsky, a TV host and now MP from the Servant of the People political party. His channel has 88,303 members and publishes political commentary, “insider news,” and criticism of the government and of his own political party.

Another channel that shared the same story was that of Max Buzhansky, another MP from the same political party as Dubinsky. He amplified the message shortly after his colleague did. Both MPs are critics of the current ministerial cabinet, routinely branding government officials as Sorosites. The story about Sorosites lobbying for Yednak, therefore, fit comfortably into the typical narrative of their channels.

Telegram, however, was not the only platform hosting the story about Yednak, as several other sources echoed the Telegram channels’ claims on the evening of December 14. The same claim appeared on the Facebook page of an anti-corruption movement based in Odessa, on fringe media outlet Ua-reporter, and on blog aggregator Rnbee.ru. All the publications were similar, with the last paragraph asking a rhetorical question about whether Yednak was “the new face” that the forest agency needed.

Amplification by fringe media

Two days later, on December 16, the same story appeared on other fringe media outlets and news aggregators, by which time the reference to the original Telegram post had disappeared.

The first outlet to publish the news in this second wave was fringe outlet Open-UA on December 16. The article was a verbatim copy of the Telegram post but with additional “evidence” against Yednak, including a different ending and additional hyperlinks to the cited sources. The Open-UA article was the first to connect Yednak to Taifun and Zunami based on his place of residence close to their offices and friendship with their heads. The new conclusion included an additional unsupported allegation claiming that the investigation had attracted the attention of the European Commission, which had reportedly started discussions to ban all wood or wood product imports from Ukraine beginning in Fall 2019; this timeline was suspect from the outset given that the investigation was published in December and no such ban had yet to materialize at the time.

The modified ending concluded, “the question of why such a person is getting ready to take office is rhetorical,” whereas the original ending claimed that Yednak was “Soros’ servant” and blamed government officials for being susceptible to corruption. (Emphasis added.)

Several outlets, including From-UA and lenta.ua, then picked up the claim, republished it verbatim, and linked it back to Open-UA as the original source. None of the articles mentioned the Telegram channels as their initial source, but rather claimed that Open-UA was the first to publish the story. This attribution was false but lent more credibility to the story than if the origin were to be identified as an anonymous Telegram channel.

The spread of the story in the Ukrainian media ecosystem. (Sources: @r_osadchuk/DFRLab)

Some of the fringe websites — Znaj UA, Golos.ua, and Politeka — that republished the claim had already been identified in previous reporting by the DFRLab. The Facebook pages of Ukrainian news aggregators Znaj UA and Politeka, for example, were taken down by Facebook in November 2019 for engaging in coordinated inauthentic behavior.

While many media outlets linked to the Open-UA article, it received negligible engagement on social media, according to a BuzzSumo query. The main audience for it appeared to be on Telegram, where the post was viewed 55,500 times.

BuzzSumo readout showing backlinks and engagement analysis of the Open-UA article that was falsely identified as breaking the story; the article received limited engagement on platforms other than Telegram. (Source: @r_osadchuk/DFRLab via BuzzSumo)

Conclusion

A claim that originated on an anonymous Telegram channel was repackaged, with minor edits, as a “news story” on a fringe media site. The story then made its way through the Ukrainian fringe media ecosystem, as multiple websites republished it but failed to attribute it to its true source, instead linking to the fringe site that obtained the story secondhand from Telegram. Despite receiving wide distribution among fringe media, however, the story failed to gain any engagement.

Non-traditional outlets, such as Telegram channels and aggregators, now constitute a significant portion of Ukraine’s media ecosystem. Often shielded by anonymity, these outlets carry added incentives to amplify, and sometimes wholly fabricate, sensational news claims targeting individuals for potential monetary gain.


Roman Osadchuk is a Research Assistant with the Digital Forensic Research Lab (DFRLab) and is based in Ukraine.

Follow along for more in-depth analysis from our #DigitalSherlocks.