The Advent of Targeted Political Communication Outside the Scope of Disinformation in Ukraine

As scholars, civil society organizations, international institutions, and engaged citizens around the world contend with the effects of online propaganda, elections, and the public sphere, many eyes have turned to Ukraine. As the historian Timothy Snyder writes in his book, On Tyranny:

In the year before the [American] president was elected, American journalists were often mistaken about his campaign. As he surmounted barrier after barrier and accumulated victory after victory, our commentariat assured us that at the next stage he would be stopped by one fine American institution or another. There was, meanwhile, one group of observers who took a different position: Eastern Europeans and those who study Eastern Europe. To them, much of the president’s campaign was familiar, and the final outcome was no surprise. Ukrainian and Russian journalists who sniffed the air in the Midwest said more realistic things than American pollsters who had built careers on understanding the politics of their own country. To Ukrainians, Americans seemed comically slow to react to the obvious threats of cyberwar and fake news.

Ukraine has long dealt with Russian cyber operations, which the Oxford Internet Institute called “the most globally advanced case of computational propaganda,” and Russian influence in Ukrainian affairs has sparked political upheaval in recent years. The Euromaidan protests, in response to then-President Viktor Yanukovych’s attempt to align Ukraine more closely with the Russian Federation than with the European Union, led to a 2014 revolution in which Yanukovych was ousted and a new government was appointed. In March 2014, Russian troops annexed Ukraine’s Crimea peninsula, and one month later, the War in the (eastern) Donbas region of Ukraine commenced. Having already claimed over 13,000 lives, the war is still ongoing.

Last year’s election of President Volodymyr Zelenskyy also captured international headlines as fact and fiction grew difficult to distinguish. Before running for president, Zelenskyy – an actor and comedian – played a teacher on ‘Servant of the People,’ a popular Ukrainian television show. In one clip that went viral, he criticizes the Ukrianian government’s endemic corruption and later is elected President in the show. He connected with Ukrainian voters’ disillusionment in both fiction and in reality, and Ukrainian voters elected him as their sixth president in April 2019.

To help understand how personal data was being used in Ukrainian’s 2019 elections, Tactical Tech partnered with Tetyana Bohdanova, an elections and civil society development specialist and a Fellow at the Prague Civil Society Centre who has an established history of working with NGOs across Eastern Europe and Eurasia. Bohdanova consulted a number of experts in the course of her research, including with Vita Volodovska, Ukraine’s Digital Security Lab Legal head; with Vadym Hudyma, a Digital Security Specialist at Ukraine’s Digital Security Lab; and with Robert Lorian, a Data Analyst at OPORA, a Ukrainian election monitoring group. While the impact of Russian disinformation campaigns and propaganda on Ukrainian politics have long been studied, other modes of technologically-mediated political influence have been overlooked in the fledgling democracy that declared independence from the Soviet Union in August 1991. In fact, as Bohdanova notes in the introduction, “no investigations have been made into the use of personal voter data in elections and the issues arising at the intersection of privacy and digital campaigning” in Ukraine. The report, entitled “Personal Voter Data Use in 2019 Ukrainian Parliamentary Elections: A Report on Digital Influence Outside the Scope of Disinformation” explores how the five most successful political parties in Ukraine’s 2019 Parliamentary elections leveraged the personal data of Ukrainian voters. Bohdanova’s report includes examples of cybersecurity lapses, campaign finance ambiguities, and legal loopholes in the country’s data protection regime. The points below highlight a few themes from Bohdanova’s report, which can be read in full in English / in Ukrainian .

Before the 2019 elections, Facebook implemented changes intended to promote electoral transparency. While they were a step in the right direction, they also fell short.

• Facebook, with about 14 million users in Ukraine, required political ad buyers in Ukraine to reveal their identity and location along with “Paid for by” disclaimers for Facebook approval. These changes were instituted to promote transparency, limit disinformation, and minimize foreign interference in the election. Facebook also included Ukraine in its political ad library, a searchable database of advertisements intended to contain all political or issue-based content in the country.
• Other platforms, like Google and Twitter, on the other hand, had not introduced similar measures, leaving political ads on platforms like YouTube without any oversight or transparency.
• Facebook’s changes only kicked off two weeks before the first round of voting in the Presidential election, which prevented the improvements from reaching political advertisements paid for, published, and shared weeks beforehand while the campaign was already well underway.
• Bohdanova cites that Facebook’s changes were not only slow to be enforced, but that they “left significant loopholes.” To bypass Facebook’s geographic restrictions, advertisers could simply rent accounts from advertisers abroad, which Ukraine’s Security Service had specifically cautioned against months before the election.
• In addition, Facebook acted on problematic content very slowly, and even after some pages were found to violate Facebook’s policies multiple times, they were still permitted to try buying ads.
• Political parties relied heavily on Facebook’s products to reach their voting base. Across the five political parties covered in the report, the parties collectively claimed nearly 1.5 million subscribers across Facebook and Instagram. The same parties spent over 1.8M USD to run over 40,000 targeted ads on Facebook.
• The election watchdog group OPORA recorded instances of negative campaigning against some political parties and candidates by Facebook pages not clearly affiliated with any political force.

Prompted by Volodymyr Zelenskyy’s campaign, Ukraine’s 2019 elections were the first to be particularly impacted by targeted political communications online.

• President Volodymyr Zelenskyy set a new precedent for Ukrainian politicians by engaging previously politically inactive voters on Facebook, Instagram, and Telegram during the campaigning period. In response, the incumbent president, Petro Poroshenko, used Facebook and Instagram to reach voters.
• Zelenskyy’s Chief Digital Strategist, Mykhailo Fedorov, stated that the campaign segmented voters into 32 different categories based on “age, gender, professional affiliation or political interests and ran over 3,200 targeted advertising campaigns” presumably to these segmented audiences. The campaign sent over 21 million emails, recruited over 600,000 volunteers online (including 20,000 election observers).
• Facebook’s Lookalike and Custom Audience features were used extensively, while A/B testing-style experimentation was not.
• As many digitally-friendly campaigns have done in recent years, Zelenskyy’s campaign enlisted a chatbot to help voters identify their polling station based on their address.
• After Zelenskyy’s election, Fedorov became Ukraine’s Minister of Digital Transformation.

Digital campaigning suffers from a number of legal loopholes in Ukrainian law, and those laws that do exist were not respected.

• In 2010, Ukraine passed a law “On the Protection of Personal Data,” a legislation that prescribed requirements for processing personal data with enhanced protections for political beliefs. Political parties are exempt from notifying authorities when processing the personal data of members, who presumably shared their data with the party deliberately; however, the law does not specify how parties should treat data collected from their supporters or regular voters in the course of campaigning.
• Online campaigning regulations are absent from Ukrainain electoral legislation. As a result, some political actors refrained from reporting spending on online political ads, exploiting legal shortcomings and leaving election monitors and regulators with no assurance regarding fair online practices in the process.
• In the absence of any legal mandates to report online spending, Facebook’s political library became the de facto source of online spending oversight.
• A comparison of campaign finance reports and the Facebook ad library “uncovered substantial underreporting of the online advertising spendings declared by the election contestants when compared against the amounts published by Facebook,” Bohdanova notes. According to one watchdog, only three parties reported spending amounts comparable to those calculated from Facebook’s political ad library.
• Based on original analyses of the websites and social media accounts belonging to the five political parties elected to Parliament, none fulfilled all the requirements of the Law on the Protection of Personal Data (particularly Article 24, which essentially mandates that data processors ensure the security of the data they collect).
• The website of the “Opposition Platform – For Life” party failed to process the voter data it collected using encryption, leaving it accessible to those monitoring the website’s connection.

Although voter data in Ukraine is available from a variety of legal and semi-legal sources, political parties appear to be using data shared by their members, not data available from other sources.

• Voter data is available in several official and unofficial registries compiled by the state, sometimes augmented with commercial databases of unknown origin. Still, political parties seem to rely mainly on voter data they collect firsthand. Bohdanova observes that “we have not come across any indication that political parties have been using consumer databases for their campaigning or attempted to purchase such.”
• Ukraine has an official State Registry of Voters with over 30 million records, but it was not used in practice during the 2019 elections,because it could only be viewed on the premises of the Central Election Commission under strict controls, and copies of any kind were not permitted.
• Journalists have identified numerous datasets claiming to contain troves of consumer data as well as datasets compiled by state agencies containing highly sensitive personal data of voters. Bohdanova writes that some data traders were even “offering to compile custom databases containing full names, telephone numbers, gender, and email addresses upon request. Although we have no possibility to verify the authenticity of some of the datasets still available online, the file names suggest that they may have originated from the state bodies or major commercial entities of Ukraine.”

The exchange of data and digital products through different hands demonstrate how both have become valuable political assets that are shared selectively to help candidates gain an edge.

• Based on media reports, some 2019 presidential campaigns evidently shared databases of their supporters with parliamentary candidates in the same party while others may have taken the data with them when taking positions in the government.
• Bohdanova writes, “For parties and candidates that win an election, voter data collected during the campaign becomes their constituent data. Handling such data in a new capacity deserves careful consideration. Thus, even if the voters consented to their data being used by the party or the candidate beyond an election cycle, they may not expect it to end up in the hands of a government official, be shared with, or used by a state body.”
• This phenomenon can be observed in practice. After Zelenskyy won his presidential election, his Facebook page – which had 180,000 subscribers – simply merged with Ukraine’s new Presidential Administration Facebook page. While this might not seem remarkable, the distinction between the ruling party and the state apparatus is paramount. In a healthy democracy, the elected party temporarily occupies the seat of power instead of overtaking it. In this case, the ruling party’s page and the government’s page were merged, automatically making followers of Zelenskyy’s candidate page followers of the state’s new presidential administration page.

In the conclusion, Bohdanova offers a number of recommendations for political parties, regulators, and civil society, including a call for enhanced transparency for online political campaign spending, concrete guidance on essential digital security guidelines to secure voter data, and clearer communication from political actors on how personal data is handled post-election. The full report can be accessed in English / in Ukrainian.