Questions about dissemination of documents do not mean they are fake, but pose new puzzle

Leaked documents said by Labour to prove that the NHS was “on the table” in trade talks with the US were initially disseminated online by anonymous posters operating in a way similar to a Russian information operation known as Secondary Infektion, according to a social media research firm.

A 19-page report published on Monday by the consultancy Graphika said that while it could not conclusively prove a Russian origin to the leak, the early distribution of the cache of files via Reddit, three German-language websites and an anonymous Twitter account reflected a method of operation seen repeatedly over recent years.

There is no suggestion either that the NHS documents, produced by Jeremy Corbyn at a dramatic press conference last week, were fake, but the Graphika investigation highlights an intriguing series of efforts to get the leak picked up more widely at the end of October and beginning of November.

Ben Nimmo, the head of investigations at Graphika, said: “What we are saying is that the initial efforts to amplify the NHS leak closely resembles techniques used by Secondary Infektion in the past, a known Russian operation. But we do not have all the data that allows us to make a final determination in this case.”

Secondary Infektion is the name given to a Russian operation exposed by Facebook earlier this year, operating across six languages and dozens of platforms. Subsequent analysis by the Atlantic Council demonstrated it was behind a string of largely failed attempts to disseminate fake news, including a blatantly false story that British remainers were planning to assassinate Boris Johnson.

Graphika said that the NHS documents were first posted on Reddit by a user called Gregoriator, who made grammatical errors that matched those made by “Secondary Infektion”, for example by posting that the document cache showed that “Great Britain is practically standing on her knees” in seeking a US trade deal.

Leaked papers prove Tories want to sell off NHS, claims Corbyn Read more

Two days later, a user called Max Ostermann posted three articles in German summarising the original leak on Reddit and on two small German language sites, meinbezirk.at and homment.com, before disappearing.

“This practice of employing single-use burner accounts on exactly the same combination of websites used by Secondary Infektion’s operators is a strong behavioural parallel,” Graphika’s report concluded.

A Twitter user using a now suspended account called @Gregoriator then tried to disseminate the leak in late October by tweeting a link to the Reddit posting to a range of public figures, including Labour and Liberal Democrat politicians and even to celebrities such Stephen Fry and Bette Midler, but again this did not appear to succeed.

It was only when Corbyn showed a redacted version of the trade talks documents during his head-to-head debate with Johnson on 21 November that the situation changed.

The redacted documents had been obtained by pressure group Global Justice Now via freedom of information, but after the debate a spokesman told the BBC the group had been emailed and alerted to the presence of the unredacted documents online.

On Monday night Labour would not say where it had obtained the NHS cache from, in the light of the Graphika report, but pointed out that no one had disputed they were genuine.

A party spokesman said: “These documents reveal the plot against our NHS. And, of course, neither the UK nor the US government have denied their authenticity. Given what they reveal, it’s not surprising that there are attempts to muddy the waters to cover up what has been exposed.”

Graphika’s report concluded: “The most pressing question is not who was behind the dissemination operation, but how the unredacted documents ended up in their hands in the first place. Public information on how the leak happened might begin to fill in the blanks on the actors behind it.”