The “patriots” behind pro-Kremlin, anti-Morgan Freeman memes

On October 7, a group of self-declared Russian “patriots” celebrated President Vladimir Putin’s birthday by launching a hashtag on social media. As the BBC reported, the hashtag was significantly amplified by automated “bot” accounts. @DFRLab discovered the hashtag was launched by a group involved in multiple Twitter campaigns supporting Kremlin narratives — most notably, a recent social media campaign attacking American actor Morgan Freeman.

The group is small, and — even with the intervention of apparently automated accounts — few of its campaigns have gained significant traction. Nevertheless, some have been reported by Russian state media and Russian diplomatic missions, which amplified and exaggerated their impact.

The group claims that at least one of its campaigns was coordinated with the Russian Foreign Ministry, raising questions as to how this apparently independent, but anonymous, group, is connected to Kremlin structures.

Happy birthday, president

The most recent campaign, and the one which sparked the BBC’s attention, was #СДнемРожденияПрезидент (“#HappyBirthdayPresident”), which was launched in honor of Putin’s birthday.

Launched across social media platforms including Facebook and Russian alternatives VKontakte (VK) and Odnoklassniki (OK), the campaign did not go viral. On Facebook, for example, three public posts on the hashtag achieved only six shares and eight likes, according to a search of public pages.

Traffic was far higher on Twitter. According to a machine scan, between 1600 UTC (2000 Moscow summer time) on October 6 and midnight UTC on October 7, the hashtag was tweeted or retweeted 12,473 times, at a peak rate of some 1,500 tweets per hour at 0600 UTC.

In terms of Twitter movements, this one relatively modest. Our analysis shows the traffic was largely driven by a small group of accounts, amplified by automated “bots” and semi-automated “cyborgs”, rather than a genuine grassroots campaign.

A number of factors support this conclusion. Out of 12,473 posts, 11,088 were simple retweets without additional comment. This accounts for 89 percent of all traffic, a high proportion which is characteristic of artificial amplification.

Some of the most active users seem largely automated. @r_krim, for example, posted the hashtag 109 times, each of which was a retweet. Since it was created in March 2011, this account posted over half a million tweets; in the week of October 14, it posted 4,288 times at an average rate of over 600 times a day.

However, a search limited to its authored posts returned just 40 tweets over the same period. This indicates that just one percent of its posts are authored, revealing the account as a likely cyborg, largely automated, but with periodic user engagement.

Other accounts which retweeted the hashtag appear to belong to a network of bots; they repeatedly share the same content in the same order. These include @NylaJuszczak201, @PamObaidi1942, and @pamidi_brittani. Each account was created in the summer and posted in many languages, including Arabic, Japanese, and Indonesian.

These appear to be commercial bots, whose purpose is to amplify whatever tweets clients pay for; they do not have a uniform political message. It is unclear whether they retweeted the Putin hashtag for ideological reasons or because they were hired.

Other amplifiers were much more politicized, retweeting messages supporting the Russian government and Russian-led separatists in Ukraine. For example, @sv78900 tweeted the birthday hashtag 54 times; every one was a retweet,, which is — again — typical bot behavior.

This account was created in March 2015. It gives no verifiable personal information; as of October 15, all its most recent posts were retweets, many of them pro-Putin, anti-Ukrainian, or anti-Western.

According to a machine scan, @sv78900 posted 3,089 tweets in the week of October 15; according to a Twitter search over the same period, just ten of those were authored tweets. This — again — is typical of a cyborg, retweeting on a large scale but occasionally posting authored content.

Another amplifier, @TnTi_10, posted the hashtag 43 times. Ten posts were retweets, but the rest posted the hashtag and a link to a series of accounts.

This account was created on June 4 and posted just over 50,000 tweets by October 15, an average rate of 493 tweets per day. It gives no verifiable personal information and posts a mixture of political retweets, photographs, memes, and nudity. This is botlike behavior.

Accounts like the sampling above amplified the birthday hashtag, making the message look more popular than it actually was. This practice is known as “astroturfing”, in which small groups of users artificially amplify their signal to give it the appearance of a genuine grassroots movement or conversation.

The accounts which posted apparently original content, rather than retweets, also fit the astroturfing pattern, with a small number of accounts posting a large number of tweets, some of which only consisted of hashtags.

Again, according to the machine scan, 532 out of 1,385 original tweets (almost 40 percent), came from just fifty users. Some of these users appeared human by posting authored content at a high rate; others appeared botlike.

Individual posts also appeared artificially amplified. The most popular tweet came from an account called @vitischeg, exposed by the BBC as the root of the campaign. This account’s tweets are protected, but our machine scan captured it while it was still public, showing that it was retweeted 804 times.

@vitischeg only had 613 followers as of October 14, making the high number of retweets suspicious; among its amplifiers were @NylaJuszczak201, @PamObaidi1942, and @pamidi_brittani, identified above as bots.

The second most-shared post came from an account called @YuryKuznetsov65, which was created on October 6. The same day, it tweeted an announcement that its original account was banned, citing as evidence a link to a website called agitpolk.ru. It followed this with a tweet announcing the Putin birthday campaign, also linking to agitpolk.ru.

Despite the fact the account was less than an hour and a half old, its first post picked up 667 retweets and its second picked up 692. Its amplifiers included @r_krim, @TnTi_10, and @SV78900, together with a number of faceless accounts with very high numbers of retweets — classic signs of bots.

Overall, the hashtag appears to have been pushed by a combination of bots, cyborgs, and online organizers, typical of campaigns launched by small groups which want to make themselves appear larger. @DFRLab chronicled similar activities in France and Poland.

It also appears the bots were operated by, or on behalf of, a small group of activists linked to the agitpolk.ru website.

Who is “Agitpolk”?

The name “Agitpolk”, in Cyrillic Агитполк, consists of two words: the abbreviation “agit” (short for “agitation”), in the sense of political propaganda designed to influence people’s actions, and “polk”, the Russian for “regiment”.

The website agitpolk.ru describes itself as “a group of likeminded people united by our shared love for our country … You can join our organization anonymously, without any proof of identity.”

Its self-proclaimed role is resisting “anti-Russian hysteria”, which is a standard phrase in Russia for criticism of Russia’s interventions in Ukraine and Syria and its interference in the US election. The website states:

The “AgitPolk” community has been active since the summer of 2015, when the anti-Russian hysteria in the information field became more and more evident. Elements destabilizing the situation in Russia strengthened their positions in the media environment; open pressure on [public] opinion occurred from the outside. It was at this time that we decided to coordinate social network users to relay society’s opinion. Since that moment “AgitPolk” has repeatedly shown its positive role in coordinated actions on social networks. Our clear formulation of the goals and objectives of each action bears fruit in attracting the attention of the press, politicians and media people, as well as a real contribution to resolving the situations covered.

Its main tool is Twitter, “one of the quickest ways of connecting with public actors, politicians and media. Our media campaigns are conducted under a single hashtag, reflecting the subject of discussion and allowing us to gather different opinions together.”

According to its domain information, the website was registered on May 19, 2016, via a Russian hosting service called timeweb.ru; the identity of the person behind the registration was not given.

The website links to a Twitter account called @ComradZampolit. This has been suspended, but @DFRLab captured it in an earlier machine scan. Its avatar is the same as that of @YuryKuznetsov65; its bio identifies itself as the “leader of the Agitpolk civil organization”. On October 6, agitpolk.ru announced that @YuryKuznetsov65 would be Zampolit’s “temporary account during a Twitter ban”. It was signed “Yury Kuznetsov”, which was hyperlinked to a VK account called “ComradZampolit”.

The “Comrad Zampolit” identity is effectively anonymous. Its avatar image is a photo of Russian actor Maxim Sukhanov in historical drama “The Role”, featuring an exiled actor who returned to Russia to fight in its civil war. The same image is featured on its VK account, where it claims to be married and live in Moscow but offers no verifiable details.

The name “Yury Kuznetsov” is a common Russian name, and the name of a Soviet and Russian actor. There is insufficient evidence to determine whether it is the real name of “Comrad Zampolit” or a pseudonym.

One other name has been linked with the group by Russian media. This is Pavel Pravdorub, quoted as an “activist” by online outlet riafan.ru and pro-Kremlin TV station Life.ru in December 2016. Life.ru broadcast a short interview with the activist under that name.

The name is associated with a Twitter account, but appears to be a pseudonym. The surname can be translated as “truth teller”; the Twitter bio includes the line, “I tell the truth about things which interest me” (Рублю правду о том, что мне интересно). It is not associated with accounts on VK, OK, or Facebook. The TV interview did not offer clues, which would allow us to verify the identity.

This anonymity around the Agitpolk group is striking. We have previously identified other Kremlin-linked “volunteer” pro-Kremlin groups, and a number of ostensibly independent propaganda websites have also been exposed for links to the “troll factory” in St. Petersburg.

Agitpolk could, therefore, be another front organization for Kremlin disinformation. It could equally be a group of genuine Kremlin supporters. There is insufficient evidence to decide this point.

Attacking Morgan Freeman

Most of the group’s hashtag campaigns have been domestically focused and achieved little impact. A campaign in May hailing Defense Minister Sergei Shoigu’s birthday (#СДнемРожденияШойгу, “Happy birthday Shoigu”) gathered just 2,161 tweets; a campaign attacking anti-corruption campaigner Alexei Navalny (#ТьфуНаТебяАлексейНавальный, roughly “Ugh to you, Alexei Navalny”) achieved just 1,712.

We scanned these hashtags after ComradZampolit was suspended, meaning some tweets using either hashtag have likey been suspended or deleted; nevertheless, these low figures cannot be considered a success.

The most striking campaign was #StopMorganLie, the only English-language hashtag Agitpolk has recently used, launched on September 20 in reaction to a video in which Freeman accused Russia of interfering in the 2016 U.S. elections:

The Internet has been stirred up by a video in which the famous American actor Morgan Freeman talks about the ongoing war between Russia and the United States, manipulates the facts of modern Russian history and openly slanders our country. “Agitpolk” is launching a campaign, #StopMorganLie: together we will show that Russia is not the aggressor, as shown in the clip, and that all this slander is pure propaganda! We begin the #StopMorganLie campaign on September 20 at 14.00 Moscow time.

@DFRLab scanned this hashtag at the time, before @ComradZampolit was suspended. Shortly before zero hour, an account called @Oksanaylia1, which was heavily involved in the Putin birthday campaign, posted four separate tweets using #StopMorganLie. These were all authored tweets, not retweets; this appears to be a human-operated, activist account, and one of the drivers of the online campaigns, like @ComradZampolit.

Two hours later, @ComradZampolit joined the drive, posting a series of tweets announcing the campaign and urging supporters to tweet or retweet.

In the next few hours, @ComradZampolit posted twelve other authored tweets and forty-one retweets. Three of its posts were among the four most-retweeted posts. This activity is typical of “shepherd” accounts which steer astroturf campaigns.

In total, these three tweets garnered 1,778 retweets. Overall, the hashtag campaign garnered 9,842 posts. This means just three tweets from @ComradZampolit accounted for 18 percent of all traffic on the hashtag.

Again, much of the traffic was generated by apparent bots and cyborgs, including some of those used on Putin’s birthday. For example, @SV78900 posted the hashtag 108 times. Almost all its posts consisted of retweets with the hashtag added, as the below screenshot of our machine scan demonstrates.

@R-Krim and @TnTi_10 were also among the amplifiers.

Much like on Putin’s birthday, almost 90 percent of posts were retweets without additional comment. Hundreds more were retweets or replies with only a hashtag added, such as the below series from @deepseacaptain, a probable cyborg.

All these factors indicate that #StopMorganLie was an astroturfed hashtag, amplified by a combination of high-activity online activists, cyborgs, and bots, rather than a genuine grassroots movement.

Official support

Nevertheless, Russian government accounts also picked up the hashtag and spread it to their followers. Notable among them was the Russian Consulate General in Geneva, which used the hashtag to promote a reaction by Kremlin spokesman Dmitry Peskov.

The Russian Embassy in South Africa, known for its undiplomatic posts, also used the hashtag, linking Freeman’s comments to marijuana. It was retweeted by @ComradZampolit, a number of probable bots, and the Russian Foreign Ministry’s office in the town of Smolensk.

The hashtag was also used by Kremlin-funded TV outlet RT, which tweeted it early on September 21 to promote a web story headlined, “#StopMorganLie: Twitterati disappointed in Freeman after his ‘War with Russia’ video”. The tweet itself read, “#StopMorganLie: Freeman’s video causes opposite effect & people are disappointed”.

RT’s promotion is vague, repeatedly claiming that “people” reacted negatively to the Freeman video without providing any analysis of who, or how numerous, the “people” were.

Key quotes include:

“People said that the ‘democracy’ statement is pure hypocrisy”

“People on social media said that Freeman’s video is itself ‘shameful’ propaganda”

“Freeman’s accusations about the Russian government are merely ‘baseless claims’, people said on Twitter.”

It also referred to the online response as an “outcry”, quoting a number of English-language tweets as evidence.

Those tweets were genuine. However, according to @DFRLab’s machine scan, only 1,013 posts on the hashtag were in English. Of those, 713 were retweets, leaving just 300 original English-language posts:

Of the original English-language posts, a number came from primarily Russian-language accounts.

These primarily Russian accounts were among the ones quoted by RT as “people” who expressed an “outcry” at Freeman’s remarks. Strangely, as of October 15, the tweets from @iz_mosvki and @lite_irina were no longer featured in the RT article; however, an archived version shows their use.

RT’s article failed to mention the fact that this was a hashtag campaign launched by the Agitpolk group. RT also failed to mention that the hashtag was used under 10,000 times, which is a very small movement on Twitter, even for astroturfed campaigns (@DFRLab has chronicled campaigns which achieved between 15,000 and 45,000 tweets), and hardly an “outcry”. Finally, RT failed to mention that most of the traffic was in Russian language; not one tweet embedded in the article was in Russian.

The use of the word “people” appears an act of camouflage. The statement is technically true — people did tweet the hashtag, and some people posted in English — but obscures the fact that the “people” were few in number, largely Russian-speaking, and significantly amplified by bots.

In fact, by reporting on a very small and artificially-amplified hashtag as if it were an “outcry”, RT effectively worked as an astroturfer itself.

Friends in high (and low) places

This is not the only occasion on which Agitpolk has interacted with official accounts. On February 10, 2017, the group launched the hashtag #ПамятиДипломатов (“in memory of diplomats”), honoring Russian diplomats who had died abroad. This is an innocuous campaign, but what is striking is that Agitpolk claimed that it was launched “with the support of foreign representations of the Russian Foreign Ministry.”

Verified accounts including the Foreign Ministry, Consulate General in Geneva, and Embassy in South Africa used the hashtag; significant amplifiers of the Freeman and Putin tweets, including @devivi777 and @russiainheart, also did so. Others, such as @Oksanaylia1 and @TnTi_10, seem not to have.

If Agitpolk’s claim of coordination with the Ministry is true, it reveals that the group has contacts in remarkably high places. Cooperation on this campaign is understandable — paying tribute to diplomats who were killed in the course of their duties — but the question remains how a small and anonymous group achieved such high-level cooperation on a communications campaign.

Agitpolk has also been amplified by a more shadowy group. As mentioned above, some of its campaigns have been reported, and thus amplified, by website riafan.ru (in December 2016, February 2017, and October 2017).

As early as 2015, open-source researcher Lawrence Alexander traced riafan.ru back to the “troll factory” in St. Petersburg; in March 2017, the Moscow Times reported that it had been re-branded as a “patriotic” website featuring original, but strongly slanted, reporting. Its amplification of Agitpolk may be no more than a biased outlet choosing to amplify a like-minded campaign; it may also suggest a closer relationship.

Conclusion

The “agitation regiment” appears to be a small group of online activists whose aim is to make pro-Putin and pro-Russian hashtags trend through astroturfing. They are not especially effective: the hashtags on Shoigu and Navalny, for example, only achieved a few thousand tweets each.

Hitherto, the group appears to have operated largely unnoticed outside Russia. For example, when the Washington Post reported on the hashtag on September 22, it questioned “whether the anti-Freeman blowback was less of an organic reaction than a Kremlin scheme.”

Agitpolk’s campaigns are clearly not organic ; the key question is whether the group is a covert “Kremlin scheme”, or an independent initiative. The group certainly claims to work with Russian diplomatic missions. Some embassies have used its hashtags; it has also been amplified by at least one outlet from the troll factory.

However, few of the group’s hashtags have generated significant traffic. The Putin birthday post was its most successful, but only achieved around 12,500 tweets. The attack on Freeman was less effective, with under 10,000 tweets. Other campaigns achieved a fraction of the impact.

Given the resources under the Kremlin’s control, it is therefore more likely that this group of Putin cheerleaders is a voluntary movement which official (and covert) outlets amplify on occasion, when the message suits their purposes. That being the case, the most telling factor about its social-media campaigns is perhaps how small they are, and how few genuine Russian internet users have shared them.

---

Follow @DFRLab on Twitter for more in-depth analysis from our #DigitalSherlocks.