ReOpen States Anti-Quarantine Campaigns Wrought with Red Flags and Astroturfing

As the coronavirus quarantine wears on, cabin fever has set in for many Americans. As people grow tired of staying at home and the impact of the economic shutdown continues to escalate, frustrations have mounted to the point that rallies are now taking place across the country to protest shutdowns. ZeroFOX Alpha Team has analyzed hundreds of Facebook groups being used to organize anti-shutdown rallies and protests all over the United States. This analysis has demonstrated similarities between the activity in these groups, with the coordinated activity of the 2016 presidential election. Additionally, ZeroFOX has identified multiple instances of legitimate non-profit organizations being hijacked to support this coordinated activity. Lastly, we compare these group’s tactics, techniques & procedures (TTPs) to some of the tactics used by the Internet Research Agency (IRA) during the 2016 US Presidential election.

Recommendations

Continue monitoring the Alpha Team Tab for updates on coordinated campaigns such as the ones detailed in this report. Reach out to [email protected] for assistance, if needed
For more information on social media influence campaigns, and what platforms are doing to prevent them, see here.

Details

In 2018, the Mueller report revealed the extent of Russian interference in the 2016 U.S. presidential election. Much of this interference manifests itself as coordinated campaigns conducted on various social media platforms by an agency known as the Internet Research Agency (IRA). The IRA created a variety of social media groups, political ads and posts focused on spreading highly polarizing content. Additionally, the IRA created a number of fake social media accounts used to share content originating from these groups. Ultimately, the content amplified by the IRA sought to promote the election campaigns of both Donald Trump and Bernie Sanders, in an effort to prevent Hillary Clinton from being elected. To support this agenda, the IRA also purchased ad space on Facebook to influence opinions and sow discord of US citizens.

Figure 1. Ad purchased by IRA promoting Trump and political division (source: NYTimes)

Figure 2. Sponsored Anti-Trump Ad by IRA (source: NYTimes)

The lessons learned from the influence operations of the 2016 Election have helped the networks combat blatant abuse, misinformation and astroturfing. But when they are not so blatant is when these companies have to take a case-by-case analysis of the potential abuse. One such potential abuse going on in the current COVID-19 climate is the enabling of “anti-quarantine” and “re-open” groups and rallies being organized.

On April 15, 2020, ZeroFOX Alpha Team observed a sudden rash of Facebook groups created to promote anti-quarantine rallies and protests. These groups follow naming conventions like “Marylanders Against Excessive Quarantine,” and “Reopen Michigan.” The most active of these, “Pennsylvanians Against Excessive Quarantine”, is currently listed as gaining 840 new posts each day. The groups are primarily used for posting articles related to reopening state businesses and for organizing protest activity to support the cause. In total, ZeroFOX identified 177 anti-lockdown groups, and 61 future protest events as of April 20, 2020.

Figure 3. A selection of “Operation Gridlock” anti-quarantine Facebook events

Although Facebook announced Monday, April 20, 2020, that the platform would take action against these events, Facebook’s content moderation depends on employees who have been affected by COVID-19, as the platform itself states upon entering the page reporting process.

The curious nature of these groups, though, is that they were seemingly created all around the same timeframe and by the same people, yet, are labeled and organized as a grassroots movement. The creation of many of these groups can be traced back to the same individuals, as reported by the Washington Post.

As discussed in this article, many of these groups are operated by the Dorr brothers and have similar group descriptions.

Figure 4. Group Description for Pennsylvanians Against Excessive Quarantine

Figure 5. Group Description for Ohioans Against Excessive Quarantine

Both URLs listed in Figures 4 & 5 link to petition websites for their respective states, with very similar appearances.

Figure 6. ReopenPA[.]com home page

Figure 7. Reopenohio[.]com home page

Both of these sites reference gun rights groups in the top left corners. A further look into the “Pennsylvania Firearms Association” suggests it may not be the legitimate non-profit it claims to be. A quick Google search for the group name reveals that there is another similarly named group, the “Pennsylvania Firearm Owners Association,” which has been registered as a non-profit since 2007. The latter group has made posts on their forum discussing the group run by the ReopenPA founders.

Figure 8. PFOA Member discussing Pennsylvania Firearms Association

The forum posts says

If one looks at their affiliates page ('https://www.pennsylvaniafirearmsassociation.org/affiliated-groups/') it appears like 3/4 of their so called affiliates were put together by the same person or group. This really looks like a get rich quick by riding the coattails of public sentiment and PAFOA.

The affiliates page of the suspect Pennsylvania Firearms Association includes many other groups of dubious nature. The Dorr brothers are behind many of these, as linked in non-profit registration records, including the Iowa Gun Owners group which has been publicly called out by Iowa lawmakers as being a scam. Similarly, the Dorr-controlled Minnesota Gun Rights group had its nonprofit status revoked in 2016 for failing to file required forms that account for the group’s financials. Very few Dorr non-profits report their financial records as required for non-profit organizations. Additionally, many of the Reopen domains for states mentioned in Dorr-controlled gun groups either redirect to sites hosted on the gun group website itself, or link to the gun group on the homepage.

Figure 9. Affiliate Groups Listed on Pennsylvania Firearms Association Website

Alpha Team did not find any ads purchased by these Reopen groups. This could mean that the Facebook political ad prevention mechanism is working, or that the groups did not purchase any ads.

Conclusion

Many of the tactics used in these Reopen campaigns have some similarities to the IRA’s tactics. First, there is a coordinated campaign that masquerades as a grassroots movement. This was one of the more effective strategies that the IRA employed against US Citizens during the 2016 Presidential election. Secondly, these grassroots movements tend to be divisive and polarizing, further creating a rift between US Citizens and increasing tension, which can lead to dehumanization of the two sides. This was also apparent during the 2016 election, where bouts of violence happened at rallies, which arguably were fueled by some of these polarizing groups. Although freedom of speech is touted by most of these public platforms, the use of social media platforms in coordinated influence campaigns is a matter separate from the issue of free speech. These influence campaigns can be leveraged by opportunists, looking to cash in on donations to a falsified cause, or as in the case of the Russian IRA, to influence entire elections. With the 2020 presidential election quickly approaching, it has become crucial to proactively identify efforts to sway public opinion to fit the agenda of influence groups, rather than doing so after the fact, as was the case in the 2016 election.