Online abuse from pro-Russian, and apparently Russian, accounts

On December 21, the British parliament is to debate Russian interference in the United Kingdom’s democratic processes. Ahead of the debate, it was suggested that Russian internet trolls — anonymous, abusive accounts — may be targeting Members of Parliament (MPs) who criticize Russia and its propaganda.

@DFRLab looked into several potential cases and found a group of trolls, which not only appear pro-Kremlin, but share many of the characteristics of earlier accounts run from the so-called “troll factory”, a building in St. Petersburg in which Russians are employed to maintain fake social-media accounts and to post pro-Russian or anti-Western propaganda.

Troll factory accounts played a prominent role in the 2016 United States elections, as the most effective accounts built up tens of thousands of followers and interacting with top officials from President Donald Trump’s campaign.

The pro-Kremlin accounts we found account for only a small proportion of the abusive messages sent to MPs, and to journalists who reported on them; the great majority appear to come from genuine, and genuinely disgruntled, British voters. However, these pro-Kremlin, and potentially troll-factory, accounts directly targeted British MPs. Their behavior, therefore, constitutes a targeted attempt to influence British democratic debate as it happened.

Angry Russians

The most obvious pro-Kremlin posts came from apparently Russian-language accounts. For example, on November 10, Conservative MP Damian Collins tweeted an article by Wired magazine, setting out the first evidence of Russian interference in the UK’s Brexit debate.

One of the replies came from a Russian-language user who posted in capitals, and obscenity.

This account is clearly a Russian patriotic troll. Its profile page features a background of the Russian leadership in combat uniform on an idealized battlefield; its aggression towards Collins marks it out as a troll.

However, as of December 20, 2017, all its most recent posts were shares of videos, suggesting automated behavior. Some of the posts were patriotic, but others appeared unrelated, such as promoting videos on how to make crab sticks and how to make furniture.

The language of these shares was Russian, albeit probably automated. We can therefore conclude that this is a Russian troll account, but not an especially active or effective one; it is likely to be run by a private individual, rather than the troll factory, since we would expect the latter to be much more active.

More questionable is the account @iatetwit. On December 15, Lucy Fisher,a reporter with the Times, tweeted an open letter from MP and Labour chairman of the All-Party Parliamentary Group on Russia Chris Bryant, which warned UK Foreign Secretary Boris Johnson of potential “active measures” against him on a scheduled trip to Moscow.

This drew the ire of an account called @iatetwit, screen name “dayjuska”, who sent two replies a few minutes apart, attacking both Bryant and the British media. Bryant is one of the leading British MPs to have warned of pro-Russian troll campaigns.

@iatetwit is a new account, created on October 3, 2017. It is not a prolific poster, but it has kept up a slow but steady flow of tweets and retweets.

The account is effectively anonymous. It gives no verifiable name or location details. Its profile picture is taken from the Instagram account of former Russian Olympic figure skater Yulia Lipnitskaya (the Instagram account is restricted, but the images are reproduced here).

Early in its life, it posted retweets in Russian and English about sports, especially figure-skating, interspersed with political content in English.

Its English appears non-native, with an inability to use the words “a” and “the” often noted in Russian-speakers.

However, increasingly, it took on English far-right positions, equatded immigration with the destruction of “English” society, and claimed to be English itself.

Other posts were anti-EU and, especially, anti-Irish, in what appears to be an attempt (copied to a journalist, Sky’s Adam Boulton) to provoke inter-ethnic anger in the UK.

Increasingly, it became more troll-like and abusive, progressing deeper into obscenity as it defended Russia against being banned from the Olympics for massive state-sponsored doping by accusing others of the same.

One post returned to an old piece of Kremlin propaganda: the insinuation that Ukraine was responsible for shooting down Malaysian Airlines flight MH17 over Ukraine in July 2014, despite all evidence to the contrary. Another replied to Kremlin propaganda outlet Sputnik, abusing UK Prime Minister Theresa May.

All this behavior is characteristic of pro-Kremlin trolls, and, in particular, the accounts known to have been run by the “troll factory”. There are too few data to allow for a firm identification as a probable troll-factory account as yet; however, the indicators point in that direction.

The professionals?

We can be more confident about an account which trolled another MP, Liberal Democrat Tom Brake. The trolls spread their venom across all the mainstream parties. Brake posted a tweet criticizing Foreign Secretary Boris Johnson for apparently belittling the danger of Russian interference in UK debates; an account called @iamjohnsmith retorted by demanding Brake’s resignation.

Like @iatetwit, this account is functionally anonymous. Its username gives nothing away; it provides no personal information other than a location, which can easily be faked. It has posted 11,000 tweets since creation in March 2017 and gained a modest 556 followers.

The choice of account name — John Smith — and the use of the nouns “tosh” and “tripe”, current in approximately the 1890s, are almost parodically English. However, the account’s behavior is near-identical with that of known troll-factory accounts which Twitter Public Policy closed down in summer 2017. This is certainly a pro-Kremlin troll account, and likely to be a troll-factory one.

@iamjohnsmith repeatedly shares articles by Kremlin broadcaster RT, and tags RT and Sputnik in its posts.

It regularly repeats some main points of Kremlin propaganda, such as accusing U.S. Senator John McCain of supporting Nazis in Ukraine, attacking the Bellingcat group of investigative journalists, and denying the use of sarin gas by the Syrian government, despite all findings to the contrary.

It trolls politicians on both sides of the Atlantic, including McCain, Nancy Pelosi, Brake and Prime Minister Theresa May — hitting McCain and May in the same tweet.

The account’s posts repeatedly tag known pro-Kremlin, anti-Western, and far-right commentators on both sides of the Atlantic. This is a technique known to be used by the troll factory’s accounts, as they try to infiltrate specific user groups, and then use those groups to validate themselves to a wider audience.

Even more tellingly, it tags known troll-factory accounts in its posts, particularly @Pamela_Moore13 (repeatedly) and @TEN_GOP (twice). Both these accounts posed as far-right Americans, but were exposed and suspended as Russian trolls by Twitter in the summer.

@iamjohnsmith’s behavior is a near-perfect match with that of @TEN_GOP and @Pamela_Moore13, with which it sought to interact. It is not possible to say definitively, from open sources, whether it is a troll-factory account; but all the evidence suggests that it is.

Other accounts behaved similarly. On November 23, Conservative MP David Gauke tweeted an exchange he had with RT, in which he refused to talk with what he termed a “propaganda station”. He was soon trolled by an account called @FXdestination, which elevated RT above the Western media.

This account is a high-volume and functionally anonymous tweeter (despite being created in 2011, it has no profile picture).

It regularly shares Kremlin messages on issues including Ukraine, Crimea, the shooting down of MH17, and Turkey’s downing of a Russian aircraft in November 2015 — all hot topics for the troll factory.

In a separate analysis, data expert @conspirator0 highlighted the resemblance between @FXdestination and known troll-factory accounts. The likelihood is that this is a troll-factory user, although open-source evidence does not allow for a definitive decision.

Like @iamjohnsmith, @FXdestination repeatedly tagged @TEN_GOP and @Pamela_Moore13. It also regularly tagged another account, @ProudPatriot101, which also trolled Gauke after his RT post.

Like @iatetwit, @ProudPatriot101 takes an anti-migrant and white supremacist line. Its current screen name is “It’s OK to be white”; its background proclaims it to be “a proud British”, although the noun is missing. Created in 2011, it has posted almost quarter of a million tweets.

However, yet again, it regularly tags @TEN_GOP and @Pamela_Moore13 (and also @FXdirection), and shares Kremlin messaging on issues including Ukraine, Turkey, and MH17.

This behavior is consistent with that of the known troll-factory accounts. It marks @ProudPatriot101 out as a confirmed member of the disinformation community which surrounds the troll factory, and possibly an account run from the factory itself.

Conclusion

Attribution of troll accounts is always challenging, given the easy anonymity which Twitter provides. @khaag65 is a Russian-language account, but seems unlikely to be professionally run; @iatetwit is likely to be Russian-language in origin, and may be a fledgling troll-factory account.

@iamjohnsmith, @FXdirection and @ProudPatriot101 all strongly resemble the known troll-factory accounts. They are anonymous, active, and aggressive; they seek to interact with far-right amplifiers while trolling critics of Russia; and they interact with one another, and with known troll-factory users.

There is a likelihood — though not a certainty — that some or all three of these last accounts are connected with a troll factory. They are certainly active members of the broader pro-Kremlin community which surrounds it.

All have, in the recent past, trolled British MPs directly. Their interactions do not appear to have raised much echo, or to have achieved many retweets; despite their high volumes, only @ProudPatriot101 has a significant number of followers. Neverthless, they represent a direct attempt by pro-Kremlin, and perhaps Kremlin-controlled, accounts to have an impact on UK politicians, and thus on UK politics.

Follow along for more in-depth analysis from our #DigitalSherlocks.