A leak of confidential UK government documents in the run-up to last December’s general election has been blamed on Russian actors. But what evidence is there to say the Russian government itself tried to interfere in British politics?
With just about two weeks to go before election day, Labour leader Jeremy Corbyn revealed a trove of confidential documents outlining talks between UK and US officials about a possible future trade deal.
The leak fuelled a debate about the future of the NHS and made the headlines for days, particularly after evidence emerged blaming Russians for the leak.
But a key question remains unanswered, three months after the vote: Was the Russian government directly involved?
Reddit and the elusive ‘Gregoratior’
The 451-page trove of documents first emerged online in October.
A user going by the name “Gregoratior” posted a link to the documents on discussion website Reddit, suggesting the publication would “make some noise”.
Image copyright
Reddit
It didn’t at first: only a small number of Reddit users noticed the post and commented on it.
On Twitter, politicians and journalists also failed to immediately notice the leak, despite repeated attempts by a Twitter account, again with the handle “Gregoratior”, to get their attention. Since then, the account has been suspended.
Image copyright
Twitter
BBC Trending
The programme that takes an investigative look at social media, from the BBC World Service.
Listen to our investigation ‘Did Russia leak British secrets online?’
With less than a week to go before the election, Reddit released a statement linking the “Gregoratior” account to a known disinformation campaign coming out of Russia.
The website banned the account, along with 60 other related accounts suspected of misusing the platform and engaging in what they called “influence operations”.
We asked Reddit if we could examine the evidence the company holds linking these accounts to Russian operators – but they declined to show us.
Image copyright
Press Association
Jeremy Corbyn: “At no stage did the prime minister or anybody deny that those documents were real”
It also remains unclear how the Labour Party got hold of the leaked documents. At the time, they did not reveal their source, and they did not respond to BBC Trending’s recent requests for comment.
At the time of the leak, Mr Corbyn described suggestions that Labour might have benefited from a Russian operation as “nonsense”.
‘Operation Secondary Infektion’
But there is stronger evidence pointing to the involvement of Russian hackers – albeit not conclusive proof that the Kremlin itself is involved.
Last year, Facebook shut down dozens of accounts, pages and groups run from Russia for engaging in what the company described as “coordinated inauthentic behaviour”.
They were linked to what the Digital Forensic Research Lab (DFRLab), part of the Atlantic Council think tank, would later identify as “Operation Secondary Infektion” – a disinformation campaign stemming from Russia.
Through a network of bogus social media accounts, this campaign tried to spread forged documents and false news stories that, according to DFRLab, “attacked Western interests and unity”.
Image copyright
FunnyJunk.com
Among the forged stories were suggestions that Spanish intelligence was aware of a Remainer plot to kill Boris Johnson
Often translated into several languages, many of these stories were published on websites open to contributions from the public.
When the leak of UK-US trade documents hit the headlines, open-source investigators noticed how the files were published and distributed online. Soon, the similarities with “Operation Secondary Infektion” became evident.
“The tradecraft was absolutely identical,” says Ben Nimmo, who worked on the original DFRLab report and is currently head of investigations at US company Graphika.
Nimmo outlined the similarities between the earlier operation and the UK leaks in a report released in December.
“The same type of pages were being used, similar username strategies were being used,” says Lisa-Maria Neudert, a researcher at the Oxford Internet Institute. “It either is an actor who is replicating these efforts or it is the same actor.”
Image copyright
Reddit
Another forged story which was part of the operation suggested the Real IRA had posted an Arabic-language invitation to Islamist fighters online
There was however one key difference: while “Operation Secondary Infektion” spread false stories based on forged documents – often clear and preposterous fakes – the “Gregoratior” leak of trade talk documents seems authentic.
The Cabinet Office declined to comment on the authenticity of the documents, but no government official has yet denounced them as forgeries.
“The big question is still: How did internal UK government documents end up on Reddit in the first place?” says Mr Nimmo.
Due to the possibility that hackers may have been involved in gaining access to the documents, the National Cyber Security Centre is currently investigating.
Moscow denies involvement in leaks
While the evidence points back to Russian territory, it is far more difficult to determine who specifically was carrying out the operation and, more importantly, on whose orders.
“It was sophisticated, it was well resourced,” says Mr Nimmo. “The likeliest candidate is either some form of Russian state operator or some proxy of the Russian state operators.” But he and several other experts stop short of drawing a definitive line to the Russian government.
Image copyright
Getty Images
Russian President Vladimir Putin has denied accusations of Russian interference
“Yes, Russia does have that strategy in their playbook,” Ms Neudert says. “But it could also be private actors, some sort of hacker collective, it could be some sort of tech-savvy trolling… There are many kinds of actors that are hacking private information.”
The Russian Embassy in London denied any links to either “Operation Secondary Infektion” or the leak of UK-US trade documents.
Other experts warned that an exclusive focus on Russia could deflect attention from other campaigns.
“Russia has a habit of trying to interfere in western countries’ elections,” says Elisabeth Braw, a senior research fellow at the Royal United Services Institute think tank. “They are extremely good at corrupting our public discourse.”
“But we have a situation where it’s very easy to blame Russia,” Ms Braw says. “That is extremely dangerous, because we neglect to examine the activities of other countries that want to weaken our societies, such as China, North Korea, or Iran.”
Media playback is unsupported on your device
Unreleased report
In October, the UK Parliament’s Intelligence and Security Committee completed a report outlining the various ways in which Russia has recently tried to interfere with British democracy.
Downing Street delayed the publication of the report, prompting accusations that it might be trying to suppress its key conclusions. Number 10 denies the accusation and says a normal timetable has been followed.
Publication is now expected later this year, once a new Intelligence and Security Committee has been appointed.
Listen: BBC Trending’s “Did Russia leak British secrets online?” is available now
Is there a story we should be investigating? Email us
Follow BBC Trending on Twitter @BBCtrending, and find us on Facebook. All our stories are at bbc.com/trending.