COVID-19 Key Developments: April 14-17

Government Responses:

Some governments have begun releasing plans to relax lockdowns and work to return economies back to pre-pandemic conditions. Last week, Italy extended its nationwide closure of non-essential businesses to May 3, but are allowing some small or medium businesses to apply to either maintain operations or, if closed, partially reopen. As of this writing, over 100,000 businesses have reportedly petitioned under this guideline, which requires the business prove they are part of the supply chain for essential services.

On Wednesday, April 15, German Chancellor Angela Merkel announced plans in the country to re-open schools and some businesses across the country over the next few weeks, declaring the pandemic under control in Germany. However, social distancing measures will remain in place nationwide until May 3, and mass gathering events will remain banned until the end of August 2020.

On Thursday, April 16, President Donald J. Trump released recommendations for a three-phase plan to slowly relax lockdown restrictions in states across the US. Under these guidelines, the federal government recommends states initiate the implementation of the first phase after the state has a fourteen day decrease in reported volume of cases. Additionally, North Korea state media continues to report no COVID-19 cases, crediting North Korean leader Kim Jong Un’s leadership.

US CARES Act Funding Distributed:

Federal stimulus checks under the US government’s Coronavirus Aid, Relief, and Economic Security (CARES) Act began to be distributed on Monday, April 13 to individuals with direct deposit information on file with the IRS. However, there were reports of outage issues for the IRS site established to provide direct deposit information if they did not have it on file with the government. On Thursday, April 16, the US Treasury and Small Business Administration (SBA) reported that the $350 billion allotted under the CARES act for small business loans has already been exhausted. Congress reportedly is working on additional legislation to release more funds to small businesses in need of economic relief due to the pandemic.

Law Enforcement Actions:

On April 16, 2020 the Department of Justice announced it charged a former employee of a Georgia-based medical device company with conducting a computer intrusion of his former employer. Christopher Dobbins of Duluth, Georgia was terminated from the company in early March, 2020 and allegedly wrongfully used a fake account to conduct an intrusion of the company’s network in late March. Dobbins reportedly edited and deleted records that caused a major disruption to the delivery of medical supplies. According to the press release based on the FBI’s investigation, Dobbins had created a fake user profile while he was still employed by the company. Shortly after receiving his final paycheck, Dobbins allegedly used the fake user profile to login to the network and subsequently created an additional fake user profile. He then reportedly used the second profile to edit 115,581 records and delete approximately 2,371 records. He then deactivated both fake accounts and logged off of the system. His actions reportedly resulted in the delay of critical personal protective equipment needed by healthcare providers during the COVID-19 pandemic.

Cybercrime and Coronavirus:

The coronavirus pandemic continues to be reflected in cybercriminal activities, as threat actors leverage the pandemic to carry out various online fraud schemes. As relief funds for individuals and businesses under the CARES Act begin to be distributed, Flashpoint is monitoring for relevant discussions by threat actors. This includes efforts by threat actors who are seeking to manipulate or fraudulently benefit from the CARES Act Paycheck Protection Program (PPP), designed to benefit small businesses, and associated schemes which may impact individual stimulus payments.

Misinformation and disinformation trends:

Misinformation and disinformation continues to spread on social media platforms and via chat services.

On April 16, 2020 Flashpoint published an analysis (on the Flashpoint Intelligence Platform) of disinformation campaigns emanating from Russia and China related to COVID-19, which found that while China seems to be conducting a coordinated state-backed disinformation campaign about the origins of COVID-19, the Russian government does not seem to be supporting such a campaign at this point. Nonetheless, disinformation emanating from Russia’s vast disinformation ecosystem that often functions without state interference, still represents a threat to public and private sector organizations. Narratives and major developments observed by Flashpoint analysts in the past week include:

• Iranian influence operation exposed: According to a report by the social media analysis firm Graphika, Iranian actors have pushed memes and fabricated news stories aimed against the United States over the past six weeks. The stories supported the idea that COVID-19 was created in the United States and also attacked the Western media for their coverage of the pandemic. The campaign relied on Iranian state-backed actors, notably the International Union of Virtual Media (IUVM), and was coordinated across various social media platforms.
• Influencers amplified conspiracy theories: Svetlana Alexievich, a Nobel-prize winning Belarusian author raised the possibility of the pandemic being the consequence of the rollout of 5G infrastructure in an interview with Radio Liberty. This debunked conspiracy theory has been one of the major disinformation narratives in recent weeks and has led to attacks on 5G infrastructure in various countries as well as the emergence of a new anti-vaxxer movement.
• Accounts associated with the QAnon conspiracy theory promoted a video featuring Shiva Ayaddurai, a far-right congressional candidate who claimed that Dr. Anthony Fauci was associated with “the deep state.” The video has accumulated more than 6 million views

Attacks on public personalities based on disinformation narratives also continued:

• Following Dr. Shiva’s videos that were promoted by QAnon-linked accounts and extremists, the #FireFauci hashtag was trending on social media.
• Attacks on Bill Gates via social media and other platforms intensified following the spreading of a conspiracy theory claiming that by funding COVID-19 vaccine research he wants to execute population control. This week a coordinated brigading attack took place on Gates’s Instagram account and a Whitehouse[.]gov petition demanding investigation into his activities gained 145,000 signatures in just six days.

Disinformation about death figures is proliferating faster now that a dispute on easing lockdowns is taking center stage in politics. This includes memes about death figures being either overstated or too low when compared (misleadingly) to other causes of death. An article on the fake news site “American Thinker” claimed that the Centers for Disease Control (CDC) had admitted to lying about death figures. This week saw the reemergence of a debunked claim, according to which the fact that the number of cell phone users in China dropped by 21 million during the pandemic necessarily means that the death toll of COVID-19 was in the tens of millions.

A documentary by Epoch Times, a publication with a history of spreading misleading and fabricated information, makes the unsubstantiated claim that COVID-19 was created in a Chinese military lab. Some copies were removed from public media-sharing platforms, but the video, which accumulated millions of views, has continued to spread privatel
y and on extremist platforms.

Disinformation about stimulus checks: 

As noted above, as American households are expecting stimulus checks distributed in the framework of the CARES act, disinformation and misinformation about the payments is increasingly present. A disinformation campaign on social media shared phone numbers with users with the promise of more information about the payouts but redirected them to a phone sex line. Another false narrative spreading on social media claimed that the stimulus check was an advance tax refund.