As scholars, civil society organizations, international institutions, and engaged citizens around the world contend with the effects of online propaganda, elections, and the public sphere, many eyes have turned to Ukraine. As the historian Timothy Snyder writes in his book, On Tyranny:
In the year before the [American] president was elected, American journalists were often mistaken about his campaign. As he surmounted barrier after barrier and accumulated victory after victory, our commentariat assured us that at the next stage he would be stopped by one fine American institution or another. There was, meanwhile, one group of observers who took a different position: Eastern Europeans and those who study Eastern Europe. To them, much of the president’s campaign was familiar, and the final outcome was no surprise. Ukrainian and Russian journalists who sniffed the air in the Midwest said more realistic things than American pollsters who had built careers on understanding the politics of their own country. To Ukrainians, Americans seemed comically slow to react to the obvious threats of cyberwar and fake news.
Ukraine has long dealt with Russian cyber operations, which the Oxford Internet Institute called “the most globally advanced case of computational propaganda,” and Russian influence in Ukrainian affairs has sparked political upheaval in recent years. The Euromaidan protests, in response to then-President Viktor Yanukovych’s attempt to align Ukraine more closely with the Russian Federation than with the European Union, led to a 2014 revolution in which Yanukovych was ousted and a new government was appointed. In March 2014, Russian troops annexed Ukraine’s Crimea peninsula, and one month later, the War in the (eastern) Donbas region of Ukraine commenced. Having already claimed over 13,000 lives, the war is still ongoing.
Last year’s election of President Volodymyr Zelenskyy also captured international headlines as fact and fiction grew difficult to distinguish. Before running for president, Zelenskyy – an actor and comedian – played a teacher on ‘Servant of the People,’ a popular Ukrainian television show. In one clip that went viral, he criticizes the Ukrianian government’s endemic corruption and later is elected President in the show. He connected with Ukrainian voters’ disillusionment in both fiction and in reality, and Ukrainian voters elected him as their sixth president in April 2019.
To help understand how personal data was being used in Ukrainian’s 2019 elections, Tactical Tech partnered with Tetyana Bohdanova, an elections and civil society development specialist and a Fellow at the Prague Civil Society Centre who has an established history of working with NGOs across Eastern Europe and Eurasia. Bohdanova consulted a number of experts in the course of her research, including with Vita Volodovska, Ukraine’s Digital Security Lab Legal head; with Vadym Hudyma, a Digital Security Specialist at Ukraine’s Digital Security Lab; and with Robert Lorian, a Data Analyst at OPORA, a Ukrainian election monitoring group. While the impact of Russian disinformation campaigns and propaganda on Ukrainian politics have long been studied, other modes of technologically-mediated political influence have been overlooked in the fledgling democracy that declared independence from the Soviet Union in August 1991. In fact, as Bohdanova notes in the introduction, “no investigations have been made into the use of personal voter data in elections and the issues arising at the intersection of privacy and digital campaigning” in Ukraine. The report, entitled “Personal Voter Data Use in 2019 Ukrainian Parliamentary Elections: A Report on Digital Influence Outside the Scope of Disinformation” explores how the five most successful political parties in Ukraine’s 2019 Parliamentary elections leveraged the personal data of Ukrainian voters. Bohdanova’s report includes examples of cybersecurity lapses, campaign finance ambiguities, and legal loopholes in the country’s data protection regime. The points below highlight a few themes from Bohdanova’s report, which can be read in full in English / in Ukrainian .
Before the 2019 elections, Facebook implemented changes intended to promote electoral transparency. While they were a step in the right direction, they also fell short.
- Facebook, with about 14 million users in Ukraine, required political ad buyers in Ukraine to reveal their identity and location along with “Paid for by” disclaimers for Facebook approval. These changes were instituted to promote transparency, limit disinformation, and minimize foreign interference in the election. Facebook also included Ukraine in its political ad library, a searchable database of advertisements intended to contain all political or issue-based content in the country.
- Other platforms, like Google and Twitter, on the other hand, had not introduced similar measures, leaving political ads on platforms like YouTube without any oversight or transparency.
- Facebook’s changes only kicked off two weeks before the first round of voting in the Presidential election, which prevented the improvements from reaching political advertisements paid for, published, and shared weeks beforehand while the campaign was already well underway.
- Bohdanova cites that Facebook’s changes were not only slow to be enforced, but that they “left significant loopholes.” To bypass Facebook’s geographic restrictions, advertisers could simply rent accounts from advertisers abroad, which Ukraine’s Security Service had specifically cautioned against months before the election.
- In addition, Facebook acted on problematic content very slowly, and even after some pages were found to violate Facebook’s policies multiple times, they were still permitted to try buying ads.
- Political parties relied heavily on Facebook’s products to reach their voting base. Across the five political parties covered in the report, the parties collectively claimed nearly 1.5 million subscribers across Facebook and Instagram. The same parties spent over 1.8M USD to run over 40,000 targeted ads on Facebook.
- The election watchdog group OPORA recorded instances of negative campaigning against some political parties and candidates by Facebook pages not clearly affiliated with any political force.
Prompted by Volodymyr Zelenskyy’s campaign, Ukraine’s 2019 elections were the first to be particularly impacted by targeted political communications online.
- President Volodymyr Zelenskyy set a new precedent for Ukrainian politicians by engaging previously politically inactive voters on Facebook, Instagram, and Telegram during the campaigning period. In response, the incumbent president, Petro Poroshenko, used Facebook and Instagram to reach voters.
- Zelenskyy’s Chief Digital Strategist, Mykhailo Fedorov, stated that the campaign segmented voters into 32 different categories based on “age, gender, professional affiliation or political interests and ran over 3,200 targeted advertising campaigns” presumably to these segmented audiences. The campaign sent over 21 million emails, recruited over 600,000 volunteers online (including 20,000 election observers).
- Facebook’s Lookalike and Custom Audience features were used extensively, while A/B testing-style experimentation was not.
- As many digitally-friendly campaigns have done in recent years, Zelenskyy’s campaign enlisted a chatbot to help voters identify their polling station based on their address.
- After Zelenskyy’s election, Fedorov became Ukraine’s Minister of Digital Transformation.
Digital campaigning suffers from a number of legal loopholes in Ukrainian law, and those laws that do exist were not respected.
- In 2010, Ukraine passed a law “On the Protection of Personal Data,” a legislation that prescribed requirements for processing personal data with enhanced protections for political beliefs. Political parties are exempt from notifying authorities when processing the personal data of members, who presumably shared their data with the party deliberately; however, the law does not specify how parties should treat data collected from their supporters or regular voters in the course of campaigning.
- Online campaigning regulations are absent from Ukrainain electoral legislation. As a result, some political actors refrained from reporting spending on online political ads, exploiting legal shortcomings and leaving election monitors and regulators with no assurance regarding fair online practices in the process.
- In the absence of any legal mandates to report online spending, Facebook’s political library became the de facto source of online spending oversight.
- A comparison of campaign finance reports and the Facebook ad library “uncovered substantial underreporting of the online advertising spendings declared by the election contestants when compared against the amounts published by Facebook,” Bohdanova notes. According to one watchdog, only three parties reported spending amounts comparable to those calculated from Facebook’s political ad library.
- Based on original analyses of the websites and social media accounts belonging to the five political parties elected to Parliament, none fulfilled all the requirements of the Law on the Protection of Personal Data (particularly Article 24, which essentially mandates that data processors ensure the security of the data they collect).
- The website of the “Opposition Platform – For Life” party failed to process the voter data it collected using encryption, leaving it accessible to those monitoring the website’s connection.
Although voter data in Ukraine is available from a variety of legal and semi-legal sources, political parties appear to be using data shared by their members, not data available from other sources.
- Voter data is available in several official and unofficial registries compiled by the state, sometimes augmented with commercial databases of unknown origin. Still, political parties seem to rely mainly on voter data they collect firsthand. Bohdanova observes that “we have not come across any indication that political parties have been using consumer databases for their campaigning or attempted to purchase such.”
- Ukraine has an official State Registry of Voters with over 30 million records, but it was not used in practice during the 2019 elections,because it could only be viewed on the premises of the Central Election Commission under strict controls, and copies of any kind were not permitted.
- Journalists have identified numerous datasets claiming to contain troves of consumer data as well as datasets compiled by state agencies containing highly sensitive personal data of voters. Bohdanova writes that some data traders were even “offering to compile custom databases containing full names, telephone numbers, gender, and email addresses upon request. Although we have no possibility to verify the authenticity of some of the datasets still available online, the file names suggest that they may have originated from the state bodies or major commercial entities of Ukraine.”
Personal data was also accessible via these two bots operating on Telegram. The first bot linked users’ phone numbers and names and also had the ability to search for personal data connected to facial photos, email addresses, and license plates. The bot operated for free (in exchange with a contact from the user’s address book) or charged 50 USD for more data. The bot on the right contained even more sensitive information, claiming to sell “passport numbers, personal identification codes, declared places of residence, social media passwords, and even bank details.” The bot offered 10 records in exchange for the equivalent of 50 USD in Bitcoin. Its creators remain unidentified, and after a public outcry, it was removed, only to resurface under new names. An investigation revealed that the bot likely accessed data from social media, government registries, and commercial sources.
Source: Personal Voter Data Use in the 2019 Ukrainian Parliamentary Elections: A Report on Digital Influence Outside the Scope of Disinformation__
The exchange of data and digital products through different hands demonstrate how both have become valuable political assets that are shared selectively to help candidates gain an edge.
- Based on media reports, some 2019 presidential campaigns evidently shared databases of their supporters with parliamentary candidates in the same party while others may have taken the data with them when taking positions in the government.
- Bohdanova writes, “For parties and candidates that win an election, voter data collected during the campaign becomes their constituent data. Handling such data in a new capacity deserves careful consideration. Thus, even if the voters consented to their data being used by the party or the candidate beyond an election cycle, they may not expect it to end up in the hands of a government official, be shared with, or used by a state body.”
- This phenomenon can be observed in practice. After Zelenskyy won his presidential election, his Facebook page – which had 180,000 subscribers – simply merged with Ukraine’s new Presidential Administration Facebook page. While this might not seem remarkable, the distinction between the ruling party and the state apparatus is paramount. In a healthy democracy, the elected party temporarily occupies the seat of power instead of overtaking it. In this case, the ruling party’s page and the government’s page were merged, automatically making followers of Zelenskyy’s candidate page followers of the state’s new presidential administration page.
This screenshot above, taken from Facebook, shows the history of the page belonging to Volodymyr Zelenskyy, who won the race for presidency, and amassed 180,000 followers via this page. The red annotation displays the event when, after the election, his campaign’s page was merged with the Ukrainian government’s Presidential Administration page, calling into question the nature in which ownership of digital assets can undermine a healthy level of independence between the ruling party and the state apparatus. As a result, these 180,000 followers – who may have simply wanted to follow election developments more closely – automatically become followers of the government’s Facebook page.
In the same vein, a digital marketing expert in Ukraine posted the screenshot below, which is an email from Ukraine’s recently-established Ministry of Digital Transformation. He claims to have received the email from a single-use email address that subscribed to Zelenskyy’s election campaign. In other words, he started receiving messages from a state body having never consented to sharing his data with the government, only with the campaign. Cases like these blur the distinction between winning campaigns and the governments they staff, which is a critical distinction for functioning democracies. For voters, the considerations involved in sharing their personal data with a campaign may differ from their considerations in sharing data with the state.
Source: Personal Voter Data Use in the 2019 Ukrainian Parliamentary Elections: A Report on Digital Influence Outside the Scope of Disinformation and https://www.facebook.com/photo.php?fbid=10216817878814235&set=a.1082930708439&type=3&theater
In the conclusion, Bohdanova offers a number of recommendations for political parties, regulators, and civil society, including a call for enhanced transparency for online political campaign spending, concrete guidance on essential digital security guidelines to secure voter data, and clearer communication from political actors on how personal data is handled post-election. The full report can be accessed in English / in Ukrainian.