How Have Information Operations Affected the Integrity of Democratic Elections in Latin America?

In October 2020, Nicaragua’s legislature passed a bill that criminalizes the publishing of information not approved by the government in a purported effort to combat “fake news.” The legislation, promoted by Nicaragua’s strongman President Daniel Ortega, raises a host of serious free speech concerns. But the fact that the Nicaraguan government decided to put its marker down on “fake news” speaks in part to a real trend to watch: Across Latin America, information operations have become increasingly prevalent.

Information operations have posed a particularly serious threat to the integrity of democratic elections in the region, and the matter is only going to worsen if left unaddressed. The issue even caught the attention of some U.S. lawmakers, who worry about the increasing cyberattacks seeking to delegitimize elections in Latin America. Sen. Tim Kaine, for example, asked during a Senate Armed Services Committee hearing on March 25: “What might Cyber Command do, together with SOUTHCOM, to try to help our allies in the region avoid this escalating trend of disinformation that destabilizes democratic elections?”

Background

The rise of misinformation (the spread of unintentionally false information) and disinformation (the spread of intentionally false information) as a force in Latin American elections stems from several factors. The region’s long election cycles, characterized by varying electoral systems and numerous runoff elections, complicate the election process in Latin American countries. And then there’s the issue of growing tensions between governments and private citizens, thanks to the region’s declining state of democracy and growing inequality. Moreover, social media platforms like WhatsApp have become an integral part of the communication ecosystem for the public—but these platforms are also the cornerstone of many disinformation and misinformation efforts. Add to that the growth in popularity of hyperpartisan websites and outlets, and Latin America has fertile ground for information operations.

While many of the operations in the region have not been linked directly to foreign governments, U.S. Southern Command’s Adm. Craig Faller spoke to the Senate Armed Services Committee on March 16 about how China and Russia have sought to leverage their influence in the region to amplify division and create distrust in the U.S. government. Faller described how China has strengthened its economic influence in the region through the overt expansion of Huawei telecommunications equipment in order to control the expanding market and using the “COVID-19 pandemic to rapidly expand its corrosive, insidious influence.” The U.S. government has attempted to offset these advancements by providing $230 million to 28 countries in Latin America, in addition to expanding dialogues and information sharing between partner countries.

The years 2021 and 2022 are set to be major periods for elections across Latin America. Five general elections are set to take place in the region in 2021, along with four legislative elections and additional regional-level elections. And more general elections are on the horizon for 2022: Brazil, Colombia and Costa Rica. A roundup of how information operations have affected recent elections, and an overview of upcoming elections in the region, can help to shed some light on the current state of the Latin American information ecosystem and where future information operations may be focused.

Recent Cyber Operations

The specific campaigns that have troubled past democratic elections and their related processes in Latin America have taken various forms—from a coordinated disruption of Colombia’s national voter registry in the run-up to the country’s 2018 parliamentary election to an organized social media campaign aimed at intensifying the ongoing protests in Chile in 2019. The public often focuses on efforts to impact elections, such as ballot interference by a rival party, but these information operations are also executed in a calculated manner at precise moments during the election process. Influencing the public’s perception of a candidate before the preliminary election or spreading false information about a candidate’s response to contemporary developments is equally damaging. Although the operations mentioned below include only information operations targeting elections, information operations have sought to exploit preexisting social fissures in the region, of which there is no shortage of issues: Skepticism of coronavirus-related public health guidance and increasing protests around inequality are just two of many such issues.

2018 Election Spotlights: Brazil, Colombia and Mexico

Brazil. The run-up to Brazil’s 2018 presidential election was tense, with a close race among far-right candidate Jair Bolsonaro, left-leaning Fernando Haddad, centrist Ciro Gomes and others. Bolsonaro was elected in October 2018 with 55 percent of the vote in the runoff election. Factors like declining levels of public trust in institutions and rising economic instability contributed to the anxious political climate, and the information campaigns only heightened the problem.

According to the Atlantic Council’s “Disinformation in Democracies” report that examined the 2018 elections in Brazil, Colombia and Mexico, the various information operations in Brazil shared a common blueprint. A newly created fringe website would pose as a legitimate news outlet and then would relay various falsehoods, creating further public distrust in traditional news outlets and boosting the appeal of certain candidates. Bolsonaro, especially, benefited from and amplified the various faux news outlets and their attempts to label traditional news outlets as “fake news.” The report, based on work by the Atlantic Council’s Digital Forensic Research Lab (DFRLab), describes the essence of these messages as “decontextualized truths, repeated falsehoods, and leaps of logic to create a fundamentally misleading view of the world.” This strategy worked, the report found: “[P]artisan websites outperformed traditional independent media in the corruption debate in the six months that preceded the electoral campaign.”

The actors behind these campaigns remain largely unknown. The report found nothing to suggest involvement by foreign governments or organizations like the notorious Russian Internet Research Agency. Contributing to this lack of transparency into the identity of these actors is the role of the end-to-end encrypted messaging service WhatsApp. The Atlantic Council report identified how WhatsApp’s encryption feature, lack of search functions and absence of a public application programming interface (API) made it difficult for their researchers and others to gather metrics and information to measure the extent of the messages being shared. The difficulties posed by the trade-off between user privacy and transparency are compounded by the public’s heavy reliance on such applications in Brazil and Latin America for everyday communication—the data consumed by the messaging app does not count against an individual’s mobile data plan in many countries in the region, making it effectively “free” for daily communication.

WhatsApp eventually placed restrictions on forwarding, but the app initially allowed users to rapidly forward messages to large numbers of people, which allowed the swift spread of misinformation and disinformation. Such campaigns were granted enormous reach with a user being able to create up to 9,999 groups, each containing up to 256 people, and an ability to forward a message to up to 20 contacts at a time. While these information operations were coordinated through the use of such applications, they still did not rely on automated or artificial means. The candidates themselves were one of the main forces behind the spread of these messages, but nothing indicated the candidates created them.

The messages often contained similar rhetoric—focusing on themes of anti-media and election fraud—and doctored imagery. The anti-media claims mainly consisted of discrediting traditional news outlets as illegitimate and attempting to legitimize the fringe outlets. The election fraud messages were a bit more nuanced. For example, one widely circulated video “showed a voting machine allegedly forcing voters to cast a ballot for Haddad.” Brazil’s electoral court affirmed that the video was manipulated, but the distrust was already sown, with one of Bolsanaro’s sons sharing the video on Twitter. Lastly, doctored images of rallies and protests were used to obscure the number of participants or to push harmful narratives. For example, pro-Bolsonaro supporters sought to create confusion by sharing purposefully inflated or deflated images of the same protests and rallies. Some legitimate news outlets shared the images, which enabled the fringe outlets to discredit them through this circular approach.

The lasting effects of these operations in Brazil are hard to quantify, but their role in shaping the election agenda was clear, as the Atlantic Council report describes—“disinformation preoccupied the media coverage and online political debates; shifted candidates and outlets resources and time towards responding to rumors and false news instead of issues and other matters; and creat[ed] further distrust in traditional media.”

Mexico. Similar dynamics cropped up in the lead-up to Mexico’s 2018 presidential election. Left-leaning Andrés Manuel López Obrador (AMLO) became president in 2018 after a historic election in terms of voter turnout and percentage of votes received. His victory was a win for an “outsider” party, much like the case in Brazil with Bolsonaro. AMLO, like Bolsonaro, relied heavily on the use of social media during his winning campaign—the Atlantic Council report revealed that “presidential candidates [in Mexico] allocated approximately 25 percent of their budgets to online outreach, up from only 5 percent six years before.”

The actors behind the information operations in Mexico were largely domestic, with the efforts led by constituents, media firms, candidates and their parties. Moreover, the uncovered operations in Mexico relied significantly more on inauthentic users than did the Brazilian WhatsApp operations. The Atlantic Council report describes how the operators would often either create a botnet or buy a commercial botnet. (A botnet is a group of compromised computers and other internet-connected devices that are typically controlled remotely by an individual or threat actors. Botnets have a variety of uses that include launching distributed denial-of-service attacks, spreading malware and cryptojacking.) These botnets were used in tandem with other artificial means to amplify disinformation and misinformation content through various channels during and up to the 2018 election. The rhetoric relayed by these operations sought to drown out any positive news about a candidate or to fabricate and propagate falsehoods about a certain candidate and the candidate’s political party through posts and hashtags. One such instance included the circulation of a video titled “AMLOS’ Dark Secret” that falsely accused the candidate of murdering his brother and best friend.

Most of these disinformation operations were politically motivated, like in Brazil, but others were largely nonideological and motivated by financial incentives. Carlos Merlo, of Victory Lab, boasted of a large network of millions of fake accounts on Twitter and Facebook under his firm’s control and available for sale at a high price to politicians and businesses. The DFRLab reported two instances of botnets that sought to promote candidates only from the Partido Revolucionario Institucional (Institutional Revolutionary Party). Both bot accounts and their subsequent networks were created in, and in anticipation of the elections in, the state of Puebla. Although the operators took steps to mitigate their detection on Twitter—for example, by avoiding the use of repetitive language—Twitter was still able to flag the accounts. The operators’ efforts were ultimately unsuccessful, as both candidates failed to win their respective elections. But that outcome was more so the outlier than the norm, as other operations were a lot more successful in their reach and ability to avoid detection.

A report from New Knowledge offered insights into three such operations—the “Oaxaca-Triquis,” “Bronco,” and “Caso Anaya'” botnets—that were created in the lead-up to the 2018 presidential election. The Oaxaca-Triquis botnet sought to sow further anti-government sentiments in the public by propagating messages surrounding a sensitive issue—the plight of indigenous people in the state of Oaxaca and the mistreatment and displacement by the Partido Revolucionario Institucional-controlled government. The Bronco botnet pushed negative narratives about AMLO and positive ones about independent candidate Jaime Rodríguez Calderón, known as “El Bronco.” The Caso Anaya botnet was composed of two separate networks, with one focused on pro-AMLO content and the other pushing positive messages about candidate José Antonio Meade and about a financial scheme that would benefit presidential candidate Ricardo Anaya if elected.

The level of cooperation observed with each botnet varied, but the underlying significance is that not all networks need to be massive and widespread to be effective. The targeting of certain groups or more isolated communities can be as damaging as a larger operation, especially if the public’s trust in traditional outlets and the government is already low due to corruption or other scandals. These operations have raised interesting questions about how to address instances of political parties and government actors actively engaging in artificial promotion or suppression of certain messages on these platforms, although no evidence has been found to suggest that such activities have occurred.

Colombia. Colombia’s recent elections also involved information operations trying to sway voters at the polls. In 2016, a disinformation campaign destabilized the referendum seeking to end the conflict between the Colombian government and the Revolutionary Armed Forces of Colombia (FARC). Although the referendum eventually passed after the initial shock “no” vote, researchers have identified the specific role misinformation and disinformation played in influencing the initial no vote. And the run-up to the 2018 elections, including two rounds of presidential elections and one congressional, experienced the same.

Overall, the 2018 information operations the DFRLab found in Colombia leaned largely on politicians and other high-level political officials to distribute the content. The Atlantic Council report also identified the operators behind some of these campaigns. In some instances, political officials “directly started or helped distribute false or misleading claims that advanced or solidified their position.” The claims ranged from electoral fraud to the weaponization of bees by opposing candidates—during a rally for presidential candidate Iván Duque, a swarm of bees attacked the attendees after being disrupted by the noise from a helicopter. Duque supporters began sharing messages on social media that accused supporters of candidate Gustavo Petro of being responsible for the bee attack. And a police report confirmed that the helicopter was indeed responsible for the bees’ aggressiveness.

These operations also used fringe websites to distribute these false narratives but published their content in a way that closely resembled authentic news. Some sites, such as “El Nodo” and “El Expediente,” conflated opinion and facts in their pieces to push messages consistent with candidates’ political positions.

The New Knowledge report also uncovered instances of possible foreign government involvement with the “International Spanish Language focused” botnet. Per the report, the international network mainly pushed anti-government messages about Colombia, Nicaragua and Venezuela. In addition, the researchers found that the content in these messages linked to other ongoing information operations—the operators' efforts focused on the upcoming Mexican presidential election and the political status of the region of Catalonia in Spain. The information operation also specifically aimed to exacerbate sensitive issues. In one effort, the network sought to leverage Colombian presidential candidate Petro’s support for the peace deal with the FARC, labeling him a FARC terrorist. In another, the botnet uncharacteristically sent out messages in English that focused on sensitive social issues in the United States.

Overall, these disinformation operations may not have reached high levels of sophistication, but they should not be taken lightly. The actors behind these relatively young operations will continue to learn from and improve on their tactics.

2019 and 2020 Election Spotlights: Bolivia and Venezuela

The aforementioned information operations have largely been led by constituents and other domestic actors. In contrast, the elections and their related events in Bolivia, Venezuela and even Ecuador witnessed the reemergence of another tactic—the outsourcing of disinformation. Specifically, the Stanford Internet Observatory uncovered the involvement of a Washington, D.C.-based strategic communication company engaged in “coordinated inauthentic behavior” targeting people in Bolivia and Venezuela. This trend of outsourcing has increased steadily in recent years, and the Stanford report highlighted Facebook takedowns against other communications firms in Israel, India, Egypt and more for engaging in similar coordinated inauthentic behavior.

The Stanford report describes the firm in question, CLS Strategies, as being quite active in this region with instances of counseling governments and candidates in Nicaragua, Peru and Colombia in recent years. The information operations sought to leverage the existing political instability in favor of opposition leader Juan Guaido of Venezuela and interim-president Jeanine Áñez of Bolivia. The political climate in both countries was quite intense in the lead-up to these operations. In Venezuela, Guaido challenged the legitimacy of president Nicolás Maduro through a variety of efforts. In Bolivia, former president Evo Morales resigned or was ousted—depending on whom you ask—following the contested presidential election in October 2019. Although this problematic election was the basis for this regime change, the contributing developments were long in the making and were further complicated.

Facebook, in its August 2020 Coordinated Inauthentic Behavior (CIB) report, disclosed it had removed a network of “55 accounts, 42 pages and 36 Instagram accounts” linked to CLS Strategies. The efforts typically consisted of amplifying negative messages about the opposition, Maduro’s and Morales’s parties in this case, and promoting the leadership claims of Guaido and Áñez. In the Venezuela operation, certain fringe sites, like “FAN Chavista” with more than 20,000 followers, promoted content and false narratives that supported Guaido’s claim. Interestingly, once other opposition leaders, such as Henrique Capriles, no longer supported the Guaido claim, the operation quickly reversed course and began discrediting Guaido about a year after the operation began.

The Stanford researchers were afforded more insights into the operation in Bolivia in part due to CLS disclosing its arrangement with the Bolivian government in its Foreign Agents Registration Act statement with the U.S. Department of Justice. Under this agreement, CLS was to work on behalf of the Bolivian government for a period of 90 days and a fee of $90,000—a substantial amount for one of the poorest countries in the region. The information operations consisted of various Facebook pages and other accounts propagating content in support of Áñez and disparaging Morales and his Movimiento al Socialismo party. The pages and accounts were created in early February 2020 and were active for a month or so with an eye toward the rescheduled presidential elections that were set to occur in May 2020 but were rescheduled twice due to the pandemic. While the messages consisted of predominantly negative content about the opposition and some falsehoods, some of the efforts also sought to combat fact-checking organizations.

Outlook of Upcoming Elections

If these information operations were indicative of what is to come, then there is much to look out for in 2021 and 2022, with numerous high-profile elections coming up in the region. Figure 1 illustrates the sheer number of elections and their nearing dates.

Note. Gray coloring indicates a major election in 2021. An asterisk denotes head of state election in 2020 or 2021.

Figure 1. Victoria Gallegos identified the various elections and their respective dates in Latin America. Gray shading indicates a major election in 2021. An asterisk (*) denotes a head of state election in 2020 or 2021.

These types of divisive information operations and tactics have long impacted this region and numerous elections in other parts of the world. But there are dangers and factors unique to Latin America that raise concerns and questions about the stability of upcoming elections. First, cybercriminals and related actors have recorded substantial profits over this past year. And the Latin American region continues to be a favored target, with a reported increased concentration of malware attacks affecting their energy, retail, automotive and other sectors. This lack of security can help reinforce narratives that the integrity of systems, not just the voting process, is insufficient. Lastly, these information operations often circle back stateside due to an information feedback loop. Misinformation campaigns were specifically targeted at the Latino community during this past U.S.election cycle to create further public division and instability. And the misinformation and disinformation content found in Spanish-speaking circles in the U.S. often emanates from abroad. The content is created and amplified by many of these previously mentioned fringe sites and outlets, and then individuals transmit this content via WhatsApp groups and other media to family members and friends in the U.S.—creating a powerful ecosystem for formulating wide-ranging mistrust.

If the most recent example is any indication of how things will go for upcoming elections, it may well mark the start of a challenging period for the region. Peru’s first round of presidential elections occurred this past April, with far-left candidate Pedro Castillo going up against right-wing candidate Keiko Fujimori—daughter of the jailed dictator Alberto Fujimori—in the runoff election scheduled for June. This next election will mark the sixth president or sitting president in the past five years for Peru. Between 2001 to 2020, three former presidents were jailed during their respective bribery investigations and another killed himself to avoid arrest. Another former president was impeached in November 2020—Martín Vizcarra was a popular independent president who led the country from 2018 until his impeachment under the controversial “moral incapacity” charge—and his successor resigned just after five days.

New information operations have already been discovered in Peru ahead of the runoff election in June. Facebook’s April 2021 CIB report describes two separate takedowns of inauthentic behavior in anticipation of the election. The first consisted of more than 80 Facebook and six Instagram accounts linked to individuals associated with the Fuerza Popular (Popular Force) party (Keiko Fujimori) and an advertising firm. The second takedown also involved 80 Facebook accounts, along with some pages and Instagram accounts, seeking to target the Ancash region and linked to a marketing firm in the same region.

Despite these mounting challenges to the integrity and stability of the election process, ongoing efforts are aimed at combating these regional problems. Existing multilateral efforts, such as the Organization of American States’s working group focused on cooperation and confidence-building measures in cyberspace or UNESCO’s new resource platform to combat disinformation in Latin America and the Caribbean, offer some hope. Gen. Paul Nakasone, commander of U.S. Cyber Command and director of the National Security Agency, also hinted during the Senate hearing that officials have already begun deliberations on facilitating information sharing surrounding disinformation with regional allies. This can serve as a foundation for future U.S. bilateral and multilateral engagement to disrupt the information feedback loop and hopefully also hamper future information operations in Latin America.