COVID-19 Astroturfing

19 April 2020 | Jarrett Broder

A disturbing Trend...

It would appear that a number of grass-roots groups have sprung up across the U.S. in disagreement with shelter-in-place / stay-at-home orders from local and federal government decision makers. These groups present themselves as locally organized individuals attempting to portray a unified message of what they claim is the majority voice of a state or region. On their own, they appear to be legitimate, “grass-roots” organizations calling concerned citizens to action. However, when a deeper dive was performed by one Reddit user, it seems evident these movements are merely another example of Astroturfing.

Astroturfing is the attempt to create an impression of widespread grassroots support for a policy, individual, or product, where little such support exists. Multiple online identities and fake pressure groups are used to mislead the public into believing that the position of the astroturfer is the commonly held view (Bienkov, The Guaradian, 2012).

Taking a closer look at the Reddit article, some groups that appear to have sprung up seemingly overnight were actually all generated within roughly that timeframe. As user Dr_Midnight points out;

“Following their own links: one is from the ‘Pennsylvania Firearms Association’, and the other is from the group ‘Minnesota Gun Rights’ - both with the exact same layout … Both of these domains are registered with the same registrar and were registered on the exact same day at the same time.”

As of the writing of this article, it appears some WHOIS domain information has been updated and those domains that were previously registered with public registrant information have been converted to private/proxy registrations. It is worth pointing out that many other ‘reopen” domain names were all registered on April 17, 2020.

Update 20 April: MotherJones and Krebs on Security appear to have shed some light on the mystery behind the difference in dates of site registration and why some of the previously public information available on domain registrations has now become public. In an effort to thwart the registration of additional pro-reopen websites, a man named Michael Murphey out of Jacksonville, Florida, proactively registered the domain names to prevent bad actors from using those domains to promote or organize people looking to protest the stay-at-home orders. From Mother Jones:

"Murphy snapped up domains for every still available iteration of reopenAL.com, reopenAK.com, reopenAR.com, and so forth, that hadn’t already been purchased, along with every domain he could for variations like liberateWV.com, liberateWY.com, and liberateWI.com. The idea was to preempt any further such purchases by people genuinely seeking to organize protests. "


Jarrett Broder
20 April 2020