The opposition Labour Party said on 27 November that the classified documents, which first appeared online on 21 October, showed the ruling Conservatives were plotting to offer up the state-run National Health Service for sale in trade talks with Washington.
The NHS is much loved by Britons and has become an important issue in the 12 December election, in which Labour trails the Conservatives despite cutting its lead in some opinion polls.
Researchers at Britain’s Oxford and Cardiff universities, the Atlantic Council thinktank and social media analytics firm Graphika said the way the documents were first shared online mirrored a campaign called Secondary Infektion.
Secondary Infektion uncovered by the Atlantic Council in June, used fabricated or altered documents to try to spread false narratives across at least 30 online platforms, and stemmed from a network of social media accounts which Facebook said “originated in Russia“.
“It’s on the same set of websites (as Secondary Infektion), it’s using the same types of accounts and making the same language errors. It’s either the Russian operation or someone trying hard to look like it,” said Ben Nimmo, head of investigations at Graphika.
Reuters has been unable to verify whether the documents are genuine. Labour and the British government declined immediate comment. In Washington, the US Trade Representative did not respond to requests for comment.
It is not clear who was behind either operation and cyber experts say it is hard to attribute malicious actions online with certainty.
Moscow has denied allegations of election meddling and the Kremlin did not immediately respond to a request for comment.
“Whoever did this … was absolutely trying to keep it a secret,” said Graham Brookie, director of the Atlantic Council’s Digital Forensic Research Lab. “It carries the spectre of foreign influence.”
A link to download documents with the same content and metadata as the documents released by Labour was first shared on Internet discussion site Reddit by a user who made language errors typical of non-native English speakers.
A person with the same username and profile picture copied the Reddit post to a website known for hosting conspiracy theories, and a Twitter account with the same name and profile picture then tweeted the link to journalists and politicians.
Another account simultaneously shared links to the Reddit post on three German-language blogging websites.
The researchers interviewed by Reuters said the websites used to put the information online, Twitter activity and language errors all resembled the Secondary Infektion campaign.
Lisa-Maria Neudert, a researcher at Oxford University’s Project on Computational Propaganda, said if Russia was behind the leak, its aim may not have been to help any particular side in the election.
“We know from the Russian playbook that often it is not for or against anything,” she said. “It’s about sowing confusion, and destroying the field of political trust.”
Reuters has been unable to establish how the Reddit user or Labour acquired the unredacted documents. The Reddit user did not respond to written questions and the Twitter account was suspended last week.
A Reddit spokeswoman said: “The integrity of our site is of paramount importance and we are investigating these findings.”
Twitter said it was unable to comment on individual accounts for privacy and security reasons but that it aggressively enforces its own rules barring “spammy content” on its service. Facebook declined comment.
