BANNER: Twitter pages for the German services of Sputnik, RT and NewsFront.

As Germany prepares for elections in September, concerns have risen over the potential for interference by outside forces, especially Russia.

Chancellor Angela Merkel has spoken of the danger of “social bots,” automated accounts which masquerade as humans to distort discussions on social media. The head of German domestic intelligence has warned of potential Russian hacking and disinformation.

To assess Russia’s capabilities and potential influence, @DFRLab analyzed the social media followings of three German-language propaganda organs linked to the Kremlin — @RT_Deutsch, Sputnik Deutsch (@de_sputnik), and NewsFront Deutsch (@newsfront).

The analysis shows that the most active amplifiers of these outlets do, indeed, include apparent bots, but they are not the most important factor. The signals are significantly boosted by pro-Kremlin activists, far-right users, and anti-migrant users, who have been known to work together to harass critics.

Together, this network represents a potential channel by which disinformation could be inserted into the German information space ahead of the elections.

The German outlets of RT, Sputnik, and NewsFront can all be qualified as Russian propaganda, in the technical sense of “delivering a message to be propagated.”

RT and Sputnik are overtly Kremlin funded, and their editorial stances routinely match Russian government policy. NewsFront claims to be independent, but its editorial stance also matches that of the Kremlin, and according to a whistle-blower interviewed by German daily Die Zeit, it is funded by the Russian secret services, and sometimes directed by the presidential administration.

They are not major players in the German media market. On Twitter, NewsFront’s German service had only 2,254 followers as of June 21, Sputnik’s service had 14,700 and RT’s had 29,200.

This is far lower than established German outlets, such as local broadcaster NDR (86,100), the dpa press agency (258,000), daily Die Welt (1,230,000), and Zeit Online (1,890,000).

RT Deutsch performs rather better on Facebook, where it had 270,000 followers as of June 21. Sputnik Deutschland is some way behind, with 181,000, while News Front Deutsch has just 11,000.

This puts the two official Kremlin outlets ahead of the regional NDR, which had 140,000 Facebook followers on the same date, but substantially behind the national Zeit Online (773,000) and Die Welt (868,000).

All three Kremlin outlets are active on Twitter, but not outstandingly so. Over the 30 days to June 21, NewsFront posted an average of 31 tweets a day, RT averaged 50 and Sputnik averaged 71.

This is more active than NDR (19) and dpa (27), on a par with Zeit Online (69) and well behind Die Welt (183).

There is one way in which the Kremlin outlets stand out, and that is the dedication of their following. To measure this, @DFRLab conducted a machine scan of tweets mentioning or retweeting each outlet over a one-month period (in the case of Die Welt and Zeit Online, a sample of 30,000 tweets was chosen, due to the very high volume of tweets posted in a month).

In total, 14,000 tweets mentioned dpa. They were posted by 6,258 users, making an average of 2.2 mentions per user. All the other German outlets fell in a similar range, with up to 3.4 tweets per user in the case of Die Welt. This range of activity is also characteristic of other major media outlets, such as BBC World (1.5 tweets per user, according to a scan @DFRLab conducted in April).

By contrast, the average score for NewsFront Deutsch measured 5.3 mentions per user, RT Deutsch measured 6, and Sputnik Deutsch measured 7.5.

These figures suggest that traffic around the Kremlin’s accounts is driven by a smaller group of dedicated users, each of whom mentions it repeatedly, rather than a larger group of casual users who only mention occasionally.

This impression is reinforced by a study of the most active followers. According to the machine scan, the ten accounts which mentioned Sputnik Deutsch most often did so 3,467 times — making up 14.9% of all posts. The proportion of tweets from the top-ten accounts mentioning RT (15.4%) and NewsFront (22.9%) was even higher.

In contrast, the ten accounts which mentioned dpa most often accounted for 5.4% of all mentions, while the ten most active tweeters about Die Welt made up just 4.2%.

Again, this suggests that the Twitter traffic around the Kremlin’s German outlets is driven by a small group of dedicated users — significantly more so than the traffic around mainstream German media outlets.

One reason for this is that some of the Kremlin’s most active amplifiers appear to be political bots or cyborgs, which are automated or semi-automated to post at a rapid rate with little to no human intervention. The purpose of such bots is typically to amplify a message or make an account look more popular than it really is.

For the purposes of this study, accounts will be considered bot-like if they are highly active (over 72 tweets or likes per day on average), functionally anonymous (giving no indication of the user behind the account), and act as amplifiers, with more than 90% of their posts being retweets.

For example, one of the most active amplifiers is @AnnaLenaDo. In a scan of tweets mentioning RT and Sputnik over the month to April 26, this account mentioned Sputnik 343 times and RT 408 times.

The account gives no personal information or bio, and its avatar and background image are both photos of the sky. The account was created on December 27, 2016. By June 21, it had posted almost 71,000 tweets and likes, at an average rate of 401 per day, and every one of its 200 most recent posts was a retweet.

This combination of activity, anonymity, and amplification is typical of bots.

Another major amplifier of Sputnik Deutsch in April was @encore_fred, which retweeted the outlet 478 times. @DFRLab has already identified this account as one of the most active amplifiers of RT in French. In April, it posted an average of 392 tweets a day, at a retweet rate of 92%. (It has since been suspended.)

A third amplifier of both RT and Sputnik Deutsch was @kuppp005, which mentioned RT 191 times and Sputnik 207 times during the scan; all but five of the mentions were retweets.

Created in August 2011, this account, which claims to be a PhD holder but gives no verifiable personal information, has posted 195,000 tweets, at an average rate of 91 per day. The great majority of its posts — although not all — are retweets or verbatim shares of headlines from a range of websites. This case is less clear-cut than those above, but its behavior is consistent with a largely automated account, albeit one whose user sometimes posts original content as well.

Some of the Kremlin’s key amplifiers thus appear to be partly or wholly automated. However, these accounts are only part of the amplification network.

Other main amplifiers appear more human, and highly political. Two key trends dominate: support for Russia and its allies, and support for far-right policies and groups, especially the Alternative für Deutschland (AfD) party, which opposes large-scale migration and is vocally anti-Islam.

Pro-Russian amplifiers include @Ollissya, ostensibly the account of a Russian journalist. This account, which has posted an average of 78 engagements a day since it was created in July 2011, has a clear focus on Russia, combining shares of RT and Sputnik with posts from Russian government and cultural events such as the Moscow Ballet Competition.

More aggressively, @changeworld2 shows the flag of the pro-Russian separatists in Ukraine in its avatar picture and regularly shares posts from ideologically-aligned accounts such as RT, Sputnik, al-Masdar News, TeleSur, and SouthFront.

@Markwasha and @ArmOfKremlin share a variety of pro-Russian accounts, while @MarcelSardo describes himself as a “pro-Russia Media-Sniper.”

All these were among the most active mentioners of RT and Sputnik Deutsch in our April scan. They were also among the most active in a separate scan of the same outlets conducted in November 2016. This gives the impression of a long-standing amplification network dedicated, and perhaps created, to amplify Kremlin messaging.

They do not, in general, have many followers: as of June 21, @Markwasha had 72, @Changeworld2 had 910, @ArmOfKremlin had 559 and @Ollissya had 1,326. (The exception is @marcelsardo, with 14,700.) Their activity does not, therefore, appear to translate into impact.

The second main group is the supporters of far-right and anti-Muslim groups, especially the AfD.

One of the most active amplifiers of RT Deutsch and Sputnik Deutsch in both November and April was @bernd471, who shared hundreds of tweets from the two outlets. This appears to be the account of Bernd Luge, an AfD member from the Stade district near Hamburg. His posts largely focus on German issues, and included a retweet of an AfD account dedicated to Russians in Germany:

The most active sharer of Sputnik Deutsch was @Lexx1812 (screen name “Alex Trampert”), which retweeted it 814 times in April (up from 135 times in November). This account regularly shares posts from AfD accounts such as @AfD_Support and AfD leaders including the party’s spokesman, Jörg Meuthen; it has also shared posts from other far-right leaders including Geert Wilders in the Netherlands and alt-right account @TEN_GOP in the United States.

Other amplifiers with a far-right bent included @encore_fred, and @ProBorderNation, whose bio reads, “Islam does not belong to Germany.” Again, their overall focus appears domestic, rather than Russian, but their amplification of RT and Sputnik is significant.

One particular account appears to link NewsFront Deutschland even more closely with far-right circles. This is the user called @convexpolytop, screen name “Mars von Padua,” which has tagged itself to Simferopol in Crimea and shows a Russian fighter jet as its background.

From May 20 to June 19, this account retweeted NewsFront Deutsch 97 times, more than any other user. The focus of the account’s tweets is Russia and its international allies; it is linked to a website called marsvonpadua.com, which largely reports in German on the conflicts in Syria and Ukraine, and has a drop-down menu which includes a link to NewsFront.

This site, in turn, attributes the vast majority of its posts to a site called LennoxPress, which also shares content from NewsFront and controversial UK blogger Graham Phillips. One post in particular was sourced to a German-language article on Phillips’ site, identifying the author as @convexpolytop, and naming him as Christian Lehmann.

The name “Christian Lehmann” has been connected by investigative blog Matrochka to an author also known as Christian Lennox, Christian Lenhart, and Christian Saarländer. The last two names are both linked to German magazine “Contra”, a self-proclaimed “alternative” site seen as pro-AfD; according to the blog, the writer’s LinkedIn profile, now deleted, stated that he writes for Contra, NewsFront, and pro-Kremlin outlet ANNA News. Contra itself lists RT Deutsch among its partners.

Thus @convexpolytop, which amplifies Kremlin propaganda so actively, also appears linked to a leading pro-AfD publication.

While many of these accounts primarily retweet pro-Kremlin and pro-AfD news and views, others are more aggressive. In late May, Julian Röpcke, a journalist for daily Bild, was the focus of a Twitter mobbing around the hashtag #Roepckerausausdeutschland (“Roepcke out of Germany”) after he contributed to an article asking whether the terrorist attack in Manchester was linked to US President Donald Trump’s speech against Islamist extremism in Saudi Arabia.

Röpcke has also written critically on Russia’s military operations, overt and covert, in Ukraine and Syria.

Over the course of four days, the hashtag racked up almost 10,000 tweets, with some accusing him of Nazi or jihadi sympathies (or both).

This behavior is typical of the German group known as “Sifftwitter” (literally “filth-Twitter”), which is notorious for online mobbings. A number of the accounts identified as belonging to the group in September 2016 participated in the mobbing of Röpcke.

However, the account which used the hashtag most often was @ArmOfKremlin, one of the most active amplifiers of RT and Sputnik in both November and April.

Fellow-amplifier @marcelsardo was also significantly involved, posting 51 times; so was another booster of RT and Sputnik, @thomas1969er, which posted 64 times.

The AfD’s Luge tweeted the hashtag twice, as did @convexpolytop; other like-minded accounts which amplify RT and Sputnik were also active, including @____Izanami____ (42 tweets on the hashtag) and @EndeDesKrieges (29).

Thus the storm launched by the “Sifftwitter” group was amplified by accounts whose primary purpose appears to be supporting pro-Kremlin or anti-migrant narratives. Whether coordinated or opportunistic, this reinforces the impression of a close ideological connection, at least, between Kremlin propaganda and the German far right.

Two Twitter communities appear to amplify the Kremlin’s outlets in Germany most actively: supporters of the Russian government and its allies, and supporters of far-right and anti-migrant forces, especially the AfD.

However, there is significant cross-over and ideological alignment between these communities. Primarily pro-Kremlin accounts also amplify anti-migrant messages; anti-migrant accounts also amplify the Kremlin’s geopolitical messages. Members of both communities joined the online attack on Röpcke, sharing the hashtag and amplifying one another’s posts.

This is consistent with the audience which amplifies RT and Sputnik in French; it is also consistent with the Kremlin’s support for far-right, anti-EU and anti-Western political groups in Europe.

At the same time, as in France, it indicates the limitations of the Kremlin’s approach. Russia’s outlets are fringe actors in the German media scene, and so are the accounts which amplify them most aggressively.

The significance of this network is its potential influence, rather than its current impact. The connection between the two online communities represents one channel by which disinformation, or hacked documents, could be inserted into the German information space, and amplified by local actors, ahead of the elections.

For more in-depth analysis from our #DigitalSherlocks follow @DFRLab.