Reconstructing the life of a covert Kremlin influence account

Few Americans were more patriotic on Twitter than the user known as @TEN_GOP. For almost two years, it lauded President Donald Trump, praised the American military, promoted Brexit and the European far right, and interacted with dozens of leading conservatives, while attacking Trump’s election rival Hillary Clinton, liberals, Muslims and the mainstream media.

@TEN_GOP was a heavyweight voice on the American far right. It had over 130,000 followers; it was retweeted by some of Trump’s aides. When it was suspended, in July 2017, voices across the American far right protested.

To some observers, it seemed too good to be true; in October, they were proven right. Twitter confirmed that @TEN_GOP was a fake, run by a Russian operative connected to the notorious “troll factory” in St. Petersburg.

https://twitter.com/AltCyberCommand/status/877737277199327232

What was the secret of its success? @TEN_GOP’s tweets were deleted when Twitter suspended it, but a number of archives remain. The largest consists of a file of over 3,000 tweets dating back to December 20, 2016, shared with @DFRLab by PropOrNot, a team dedicated to tracking Russian propaganda, which identified the account as Russian at that date.

Others can be found online through services such as tweetsave.com (archived here); still others were shared by supporters on Reddit and a selection of blogs. Google searches also return the shadow of the deleted tweets, although the links are now broken.

Based on these sources, @DFRLab has pieced together the story of how @TEN_GOP fooled so many people for so long.

Un-American patriot

@TEN_GOP masqueraded as an American patriot. To preserve that disguise, it regularly posted “character” tweets, including blessing the U.S. military at Christmas…

… and at other times of the year.

Other tweets were simply sentimental. This post, for example, praised U.S. policemen for bringing a lost toddler home.

This one flaunted its patriotic leanings with a comment on the flag.

The account even announced, proudly, and (one would hope) falsely, that it had voted for Trump.

Such tweets served to both Americanize and humanize the account, making it appear less like the information operation run from an office building in St. Petersburg, which it truly was.

Uncivil war

In a sign of its working methods, however, even these sentiments were quickly transformed into venomous political attacks.

Americans were @TEN_GOP’s favorite targets, above all Hillary Clinton, who, as many analysts have documented, was the main butt of Russia’s propaganda throughout 2016.

Its posts were overtly political, and included anti-Clinton ads launched by American campaigns. These were also widely shared by genuine American outlets, showing how @TEN_GOP was working to integrate itself into the anti-Clinton information space.

According to a saved version of @TEN_GOP’s ad post from the Wayback internet archive, this post achieved over 13,000 retweets, an impressive figure at a critical time just before the election.

A week before the election, @TEN_GOP accused Clinton supporters of fraud, part of a narrative that the Kremlin had built up over the preceding months:

American media outlets were another favorite target, especially CNN.

The account interlocked with genuine far-right users and activists, joining in a call for a “meme jihad” against CNN and being shared on subreddit /r/the_donald, one of the main hubs of far-right activism.

Repeatedly, @TEN_GOP urged its followers to retweet its posts, including when it was asking them to identify people in photographs— a Russian operative setting Americans against one another.

This included spreading the conspiracy theory that former Democrat staffer Seth Rich had been murdered as part of a Clinton plot.

In 2017, it turned its fire on “Antifa”, an ill-defined term which is used by the far right to designate both violent far-left activists, and other protesters.

Using tactics such as these, @TEN_GOP established itself as a fully-fledged member of the aggressive far-right community which supported Trump.

Playing with firebrands

While attacking Trump’s critics, @TEN_GOP systematically supported the far-right commentators who made up such a vocal part of his following. This can be seen as a form of both camouflage and marketing, ingratiating the account with the far right, and making it likelier that they would spread its messages.

For example, @TEN_GOP lobbied for Milo Yiannopoulos, who has been permanently banned from Twitter, reportedly for targeted harassment.

According to the data file shared by PropOrNot, @TEN_GOP repeatedly quoted, praised and defended Yiannopoulos; in return, Yiannopoulos’ website quoted @TEN_GOP when it came to his defense.

A search of the Yiannopoulos site showed seven other articles in which @TEN_GOP was quoted or referenced (on February 23, March 22, April 17, April 23, May 2, May 9 and July 7), showing how effective its technique was.

Similarly, @TEN_GOP amplified Trump activist Ann Coulter, sometimes tagging her in posts to ensure that she was notified. According to the PropOrNot file, @TEN_GOP retweeted or mentioned Coulter 25 times between December 2016 and August 2017; some of its posts have been preserved elsewhere online.

On several occasions, Coulter returned the compliment, retweeting @TEN_GOP, and re-posting the tweets to her official Facebook page.

@TEN_GOP engaged similarly with other far-right commentators, and was similarly rewarded. According to an archive of its interactions preserved online at data.world, it was retweeted by leading far-right voices such as Stefan Molyneux, Paul Joseph Watson, and Dinesh D’Souza.

As its reputation grew, it was also retweeted by more mainstream figures, such as Trump’s short-lived National Security Advisor General Michael Flynn — a former U.S. general amplifying a Russian influence account.

The tweet which Flynn shared is deleted, but had this URL: https://twitter.com/TEN_GOP/status/785663973613899776.

This is the URL of the tweet in which @TEN_GOP promoted the anti-Clinton ad described and archived above; Flynn seems to have mistyped it as “add”.

Notoriously, @TEN_GOP was also retweeted by Trump’s son, Donald J. Trump Jr., campaign manager Kellyanne Conway, and digital manager Brad Parscale. A detailed analysis by Luke O’Brien of Huffington Post revealed the extent of its interaction with key pro-Trump figures.

There is no reason to suspect that any of these commentators thought the account they were amplifying was a Russian paid troll. It is far more likely that they were simply fooled by its mimicry, as it acted like one of them, sharing their narratives and boosting their posts.

In fact, as the thousands of far-right comments protesting at its eventual suspension show, they took @TEN_GOP as “one of us”.

Into the media

@TEN_GOP’s increasing status among the far right meant, in turn, that mainstream journalists began quoting it as a representative of the American far right as a whole — once again showing how completely the operator behind the account had managed to fool observers.

Glenn Greenwald of the Intercept, for example, sourced a tweet to it.

Again, the full URL to which Greenwald linked leads to an archived tweet.

Mainstream outlets quoted it as a conservative voice, including the Washington Post (which has since corrected its article to remove the tweet), LA Times, and Huffington Post (three times, with a later editor’s note in one).

These articles are noteworthy both for the way in which @TEN_GOP was taken as a voice of the American far right, and for the range of subjects it commented on.

The Kremlin’s propaganda agencies amplified @TEN_GOP repeatedly. Sputnik, for example, whose official task is to “report the state policy of the Russian Federation abroad”, quoted it in multiple languages.

RT America, the Kremlin TV station’s American brand, even retweeted @TEN_GOP, together with a link to an article on Clinton’s health. The RT tweet read that “some” were “outraged” that the “pneumonia-stricken” candidate should have been seen “hugging” a girl.

Neither the article, nor the accompanying five-minute video, mentioned the word “pneumonia” anywhere.

The tweet from @TEN_GOP, however, did, sharing a photo which did not include a hug.

This appears to be a case in which a Russian propaganda outlet used a Russian troll as the sole source for a claim which undermined Clinton’s campaign.

A Russia apologist

With its bona fides as a far-right American established, @TEN_GOP was able to insert pro-Russian messaging into its posts.

Both RT and Sputnik, for example, quoted it as mocking the claim that Russia had interfered in the election.

Unsurprisingly, @TEN_GOP repeatedly attacked the claim that Russian accounts such as itself had attempted to interfere in the election.

It attacked the Obama administration’s decision to expel 35 Russian diplomats, as well as financier George Soros, long a target of Kremlin smears, and now adopted as a hate figure of the American far right.

It praised the joint Russian and Syrian siege of Aleppo and its aftermath, a campaign which, as @DFRLab and many others have documented, involved massive civilian suffering and a number of apparent war crimes. According to the PropOrNot file, @TEN_GOP returned to this theme repeatedly.

Time and again, it not only tweeted about Russia, but was shared to Reddit, mingling its messaging into the far-right community.

Judging by the volume of its tweets in the PropOrNot and other files, only a small proportion of its tweets were overtly pro-Kremlin. Its main task appears to have been to promote far-right American views and attack Clinton; the fact that it was able to carry out all its tasks simultaneously shows how vulnerable the American far right is to foreign influencers.

Foreign policy

One more aspect of @TEN_GOP’s activity merits attention, and that is its foreign policy. It posed as both Islamophobic and pro-Israel, and attempted to interact with far-right leaders across Europe.

Its hostility towards Muslims amplified and validated other far-right voices, repeating its successful technique for infiltrating the online community. This included echoing both American voices…

… and European ones.

On occasion, its posts simply trolled Muslims, in very much the style of genuine far-right Americans.

@TEN_GOP was also lavish in its praise of European heroes of the far right, such as French presidential candidate Marine Le Pen, Dutch politician Geert Wilders, and British anti-EU campaigner and Member of the European Parliament Nigel Farage.

In turn, it was picked up by a far-right subreddit dedicated to Le Pen (a group which, as @DFRLab has shown, was closely tied to the American far right.)

It also attacked mainstream European politicians. Germany’s Angela Merkel was a particular target, as both a supporter of refugees and a critic of Russia.

French presidential candidate (now President) Emmanuel Macron was another.

@TEN_GOP particularly focused on the leak of emails hacked from Macron’s campaign — a leak launched just before the final round of voting, in an apparent attempt to undermine Macron’s momentum.

In moments such as these, @TEN_GOP reinforced the messages carried by other elements of the Russian propaganda establishment, reinforcing the Russian government’s supporters abroad, and attacking its critics.

Conclusion

@TEN_GOP was a masterpiece of disinformation and disguise: a Russian account which masqueraded as an American for over eighteen months, fooling both friends and foes of President Donald Trump in the media, on social media, and even in the Trump campaign.

Its success came from its stepwise approach. First, it imitated genuine far-right commentators by posting hyper-partisan tweets, and attracted their attention by mentioning and praising them. Their responses gave it an appearance of legitimacy which allowed it to interact with higher-profile figures, including in the campaign, and to be quoted by genuine media outlets.

Throughout, it maintained its chosen character, posting tweets that made it out to be an American patriot, a supporter of Trump and the far right, an enemy of Islam and a critic of liberalism. A number of analysts suspected, and eventually proved, that it was Russian in origin; but their comments were not enough to stop it posting.

@TEN_GOP’s brief, but spectacular, career, shows how open America remains to foreign influence efforts. It was an anonymous account with no connection to the Republican party it linked itself to, yet it gained immense credence, first on the far right, and then in the main stream, entirely because of its partisan posts. Far-right commentators supported it; mainstream outlets and politicians quoted it; liberals attacked it; all were fooled by it.

As long as social-media users continue to blindly accept and share anonymous, hyper-partisan accounts, they will remain open to whatever successor accounts the operators behind @TEN_GOP are running now — and to any other disinformation actors with sufficient skill at camouflage.

---

Follow along for more in-depth analysis from our #DigitalSherlocks.