Networks of Illusion: how Russia acts through the Internet and social networks, and how to fight this - Vitaliy Moroz

High-tech Western democracy countries created the Internet and social networks later. However, non-democratic regimes learned to use the weaknesses of technologies to achieve their political goals.

At first, non-democratic regimes learned to restrict access to the Internet for their own citizens — as exemplified by Iran, China, Vietnam, North Korea, and Saudi Arabia. Subsequently, these regimes began to use technologies to “hack” the accounts of protesters in social networks, as was the case during the “Arab Spring” protests in Tunisia in 2011. Now social networks have become information channels, through which authoritarian regimes, such as Russia, are exporting the “hybrid war” to democratic countries.

In an era of cluttered information space, the user is subjected to a flood of thousands of messages, and his or her ability to perceive information critically is deteriorating sharply. Under these circumstances, undemocratic regimes use a whole range of means to mislead the user even more. Such tools include special information operations, dissemination of propaganda, the creation of fake news and manipulative messages.

Russia is widely using the Internet and social media under conditions of the “hybrid war,” and Ukraine has received the utmost “attention.”

The Kremlin laid the ground for a “hybrid war” back in the mid-2000s. Russia exercised its first visible information sabotage during the re-establishment of the “Bronze Soldier” monument in Tallinn in 2007 and the war with Georgia in 2008. The full range of means was applied during the annexation of Ukraine’s Crimea and the occupation of part of Donbas in 2014. Subsequently, there were various interventions from Russia’s side during the Brexit vote in the UK, the US presidential election in 2016 and the so-called “referendum” on Catalonia’s independence in October 2017.

How the Kremlin has encaged the Russian Internet

Russia’s ability to use the Internet for propaganda purposes reflects the chronology of how the Kremlin has taken complete control of Russia’s Internet segment.

Popular Russian Internet services like as Mail.ru, Rambler.ru, VKontakte, Odnoklassniki, were launched as independent projects, but subsequently became controlled by the Russian authorities due to loyal oligarchs and the approval of repressive legislation on Internet regulation.

The case of VKontakte, the most popular social network in Russia is quite indicative. Three students from St. Petersburg: Pavel Durov, Lev Liviyev, and Vyacheslav Miralashvili, created it as an analog of American Facebook in autumn 2006. The public figure of VKontakte was Durov, who at the end of 2013 sold his shares in the company and left Russia. Durov explained his emigration by the fact that the FSB demanded the transfer of the data of Ukrainian VKontakte users, moderators of the groups supporting the EuroMaidan protests. Durov refused, went abroad and stated: “There is no turning back for me, especially after I have publicly refused to cooperate with the authorities.” Soon, VKontakte came under the full control of Mail.ru Group, owned by loyal Kremlin oligarch Alisher Usmanov.

In 2014, Pavel Durov created a messenger Telegram in the United States, whose audience in 2017 reached more than 100 million users, including some from Russia. The Russian authorities are demanding disclosure of users’ information and are currently imposing penalties on the service. Telegram will most likely be blocked in Russia soon.

LiveJournal, a blog platform popular in the mid-2000s, , known in the post-Soviet space as “Zhyvoy zhurnal” (Live Journal) can also be a good example of Russia’s Internet control. Founded in 1999 in the United States, LiveJournal was sold to Russian company SUP in 2006, and, according to American law, it remained under US control until 2016. However, in December 2016, LiveJournal servers were relocated to Russia and Russian intelligence services acquired access to user information.

Over the past ten years, the Russian authorities have systematically and purposefully restricted the digital rights of Russian users, increasing the pressure on Internet freedom in Russia. Starting from 2015, the international organization Freedom House states in its report Freedom on the Net, Russia was among countries with a non-free Internet.

Legislation on Internet regulation in Russia is repressive both for companies and for users. In January 2015, Russian lawmakers obliged all technology companies to store user data exclusively in Russia.

Approval of the so-called Yarova “antiterrorist package” of laws in the summer of 2016 enabled Russian intelligence services to establish full control over users’ correspondence on the Russian Internet. According to the amendments to certain laws, Russia’s law-enforcement agencies received access to all telephone conversations and electronic mail of users on the territory of Russia. Communication and Internet providers have been obliged to keep the content of users’ messages for six months. Besides, with the help of providers, government agencies can decrypt encrypted messages.

In July 2017, Russia passed a law abolishing the right of users to anonymity on the Internet — the law came into force on November 1, 2017. According to the law, anonymizers, VPN-services should be blocked, and search engines (Google, Yandex) should be prohibited to show links to these services in search hits.

A separate institution called Roskomnadzor, which is subordinated to the Ministry of Communications and Mass Media, carries out Internet control in Russia. Since becoming operational in 2008, this federal body has blocked hundreds of thousands of sites, and defenders of the free Internet refer to Roskomnadzor as the censorship body, involved in the curtailment of user rights. Officially, the agency performs the functions of supervision and control in the field of mass media, processing of personal data and organizing the activities of the radio frequency service. However, Roskomnadzor is entirely Kremlin-controlled — in April 2017, on the eve of the long-distance drivers’ protests in Russia, the Zello application, which drivers were using to coordinate their demonstrations, was blocked.

Since 2014, a number of opposition sites have been blocked in Russia — Grani.ru, Kasparov.ru, Ej.ru — because of alleged “calls for illegal activities and participation in mass events.” Articles in Wikipedia and some Western messengers were also blocked. The American business network LinkedIn has been blocked since November 2016 in Russia for refusing to transfer the personal data of users to the territory of Russia. The same fate may await Facebook, at least the head of Roskomnadzor, Aleksander Zharov has already publicly threatened the company with blocking in case of refusal to transfer data to Russia.

The bots were tested in Ukraine. Afterwards, they took on the US

In February 2015 in Ukraine, amid the deterioration of the military situation in Donbas, there were sharp swings in the national currency’s exchange rate — reaching 30 hryvnias for one US dollar. Russian propaganda did not miss this opportunity, and the hashtag #grivnavkotle (hryvnia encircled) was launched on Twitter, imitating the Kremlin’s narrative about the “Debaltsevo trap” — the so-called encirclement of the Ukrainian military near Debaltsevo in the Donbas region.

The number of publications on Twitter with the hashtag #grivnavkotle reached 40,000 a day; bots reinforced the panic, while most of these messages had nothing to do with fluctuations in the hryvnia exchange rate.

Bots are accounts in social networks, created automatically in large quantities and programmed to perform a specific algorithm of actions, first and foremost to –disseminate information messages. Most often, bots are created on Twitter, because on this social network it is easy to bypass the barriers for automatic registration of a large number of accounts.

While in the West, bots were created primarily for the promotion of commercial products, in Russia this was done mainly for the dissemination of propaganda messaging and information manipulation. According to many experts, Russia’s goals with regard to the USA are to deepen the split in the most sensitive issues for American society, such as race, social status, gender, and religion.

In 2009–2012, the Twitter bots that overwhelmed the Ukrainian Internet were easy to identify by the absence of avatars, biographies and false names. However, algorithms for creating bots are becoming more and more advanced — modern bots have all signs of real users.

In summer 2017, NATO analysts from the Stratcom Center in Riga conducted a study, which revealed that 70% of Russian-language tweets about NATO during the three-month period were created automatically, that is, by bots. The ratio of bots for English-language tweets about NATO was lower — 28% of bot-created tweets.

Western governments have started an active investigation into Russia’s influence after the 2016 presidential election in the United States. The American Secret Services have stated that bots had spread fake news and misinformation during the 2016 election campaign. Later, a network of bots also participated in the distribution of memes, videos, and misinformation during the French presidential elections in spring 2017.

In Britain, parliamentarians began to raise critical questions about the role of bots just before the Brexit referendum in summer 2016. Researchers from the City University of London identified a network of 13,000 bots and discovered that the number of tweets in favor of Brexit on the eve of voting was eight times the number of tweets from opponents of the UK’s exit from the EU.

How the West is fighting against Russian bots

In September 2017, the American Fund GMF launched the Alliance for Securing Democracy project. It has started a tracking mechanism for 600 Twitter accounts, which promote Russian narratives or which are directly related to the Russia’s government. In real-time mode, the program monitors and analyzes what topics are brought up in accounts, and summarizes key trends every week. Another resource is the Botometer from Indiana University. It allows determining the percentage of bots among the subscribers of any Twitter account.

Under the pressure of investigation into Russian influences on the US elections in June 2017, Twitter acknowledged Russian intervention and announced the extension of anti-abuse mechanisms.

In September 2017, Twitter makes a new statement, disclosing the data of 201 Twitter accounts that violated the terms and conditions of the service’s policy during the 2016 elections and which were eventually removed. Moreover, Twitter has released data that in 2016 Russia spent 274,100 dollars on advertising through Russia Today’s Twitter accounts. This related to @RT_com, @RT_America and @ActualidADRT accounts. The company also spoke about hundreds of thousands of attempts to misuse the service and announced countermeasures at the level of account registration.

Facebook also has similar problems with Russian influences. On the eve of the 2016 presidential election in the United States, Russia created dozens of large English-speaking groups on Facebook, whose mission was to speculate on America’s sensitive issues of migration, race, religion, etc. One of these groups, called “Being Patriotic,” has reached 4.3 million interactions with users, and the rhetoric of publications in the group can be judged by the use of words like “laws of Sharia”or “illegal aliens. “

Now Western researchers are analyzing the activities of six large groups that have been removed from Facebook, but whose posts had reached millions of US users. As a result of an internal investigation, Facebook has detected at least 470 “unauthentic” profiles and pages on its network, which tried to influence public opinion on the eve of the US elections. All of them were deleted. Moreover, the company acknowledged that Russia spent 100,000 dollars on the purchase of Facebook ads to promote these accounts and pages.

Onslaught of pro-Russian trolls stir up trouble on the Internet

When well-known American actor Morgan Freeman recorded a video announcing that Russia had attacked and has been waging a war against America since the 2016 elections, a campaign was launched on the Internet to discredit the actor. Hundreds of Russian trolls on Twitter began to write with the hashtag #StopMorganLie’s, posting “creative” photos and posters. Unlike automated bots, trolls are real users who start their own online campaign or at the demand of customers. The trolling against Freeman was fueled by the reaction of Putin spokesperson Dmitry Peskov, who began to troll over the “emotional tension” of the actor.

Russian trolls, which attacked ideas, politicians, and the media, are well known in the West. The British publication The Guardian states that already back in 2012 Pro-Kremlin trolls were being noticed as a real and insidious threat to online communities and discussions.

Planning the annexation of Crimea in the spring of 2014, the Kremlin also took care of the Internet. Massive registration of Russian trolls was recorded at the end of February 2014, and a flurry in activity by trolls in Western media was seen during the initiation of the armed conflict in the Donbas region. The Guardian’s editors provide examples of three editorial articles, which described events in Ukraine from April 27, 2014. The moderators of the publication had to delete 74 of 244, 161 of 2310 and 259 of 2263 comments due to violation of the rules on commenting. At the same time, the publication states that these comments were often written in poor English, although they were posted by users who claimed to be British citizens.

Western journalists have started a detailed investigation into coordination of troll activity. In February 2012, The Guardian published a text about sponsored commentators from the pro-Kremlin movement Nashi, which have attacked at least 168 public figures, naming them “enemies of Russia.”

Subsequently, in 2015, The Guardian published an incriminating investigation about the “headquarters of the Russian troll army” in Olgino, hundreds of employees of which wrote posts in LiveJournal, commented on YouTube and articles on Ukrainian topics in leading Western media.

Soon, key editorial offices of the Western media, including The New York Times, launched an investigation into the work of Russia’s trolls from Olgino.

How Russia falsified Wikipedia to annoy Ukraine

Since Wikipedia is one of the most quoted resources on the Internet, which has become a handbook for millions of users on any issue, Russian propaganda has not omitted it either.

In April 2014, when the war on Donbas began, the article “Kievan Rus” in the Russian segment of Wikipedia suddenly disappeared. Kievan Rus is the name of the medieval country established in historiography, whose successors are considered to be contemporary Ukraine, Belarus, and Russia. When users searched the term “Kievan Rus” in “Wikipedia,” they were redirected to an article titled “Old Russian State” — a term promoted by Russian historians close to the Kremlin.

This falsification became possible due to the long-lasting and hard work of Wikipedia’s moderators, who have replaced the original sources of the article — to new Russian history textbooks. The term “Old Russian state” is used in these textbooks. Accordingly, adding to Wikipedia the links to dozens of books with the term “Old Russian state,” the moderators of the Russian Wikipedia received “arguments” to remove the name “Kievan Rus.” However, the common sense of most moderators prevailed, and two years later, the term “Kievan Rus” returned to Wikipedia.

Using fake heroes

Russian propaganda creates not only fake characters for television but also fake users of social media, who claim to be experts and serve the purposes of propaganda.

On 2 May, 2014, there were clashes in Odesa, during which pro-Ukrainian and pro-Russian activists perished. The following day, a user profile under the name of Igor Rozovskyi appeared on Facebook. He positioned himself a doctor from Odesa, who allegedly talks about the tragic events near the Trade Union Building as an eyewitness. In his post, the pseudo-doctor blamed the pro-Ukrainian activists for the tragedy.

Russian TV channels began to circulate the post written in Russian and English, and the story of the “doctor from Facebook” filled the information space. However, Ukrainian users discovered that the “doctor” account was fake. It had been created the day before the post was published, and the photograph for the avatar of the “doctor” was stolen from the account of a dentist from Karachay-Cherkessia, Russia, and not from Odesa.

Ukraine’s reaction to Russian influences

Traditionally, Russia has a powerful informational impact on the Ukrainian segment of the Internet since it was formed in common with Russia information space in the 2000s. At that time, Ukrainian users started to register email accounts, use search engines, and later create accounts on social networks. However, at that time, US services such as Google, Gmail, Facebook did not have localized Cyrillic interfaces of their services yet, so millions of users in Ukraine began to use services with Ukrainian or Russian interfaces. Taking into account the higher technological development of the Russian Internet segment, many Ukrainians used the services of Yandex, Mail.ru, Rambler.ru, VKontakte, Odnoklassniki, MoyMir, etc.

Even in the fourth year of the war, in April 2017, three out of the five most popular sites in Ukraine were Russian — VKontakte, Yandex, Odnoklassniki. The Russian services, controlled by FSB since 2016, were widely used by Ukrainian officials, military, teachers, and business. The popularity of Russian services has not dropped since the beginning of Crimea’s occupation and the war on Donbas. Russia, first and foremost, through Russian social networks, conducts special information operations — pages of the so-called “ministries of the DNR and LNR” on VKontakte were registered and there are also large groups that disseminate propaganda and manipulation.

While searching for answers to Russian challenges, the Ukrainian government has chosen the tactics of Internet regulation. There is currently great concern in Ukrainian society about the following: Is the interference of the state in Internet freedom justified by national security interests?

On 15 May, 2017, the President of Ukraine, by his decree №139/2017, implemented the decision of the National Security and Defense Council of April 28, 2017, on the application of personal special economic and other restrictive measures (sanctions). In total, 468 Russian companies and 1,228 individuals were subject to sanctions, imposed from one to three years. The sanctions were primarily directed against the Russian media, as well as a number of companies that own key Russian Internet resources, namely VKontakte, Odnoklassniki, Mail.ru, Yandex.

The majority Internet providers and mobile operators have blocked the access of Ukrainian users to Russian sites, although legally the decree did not oblige them to do so. Some international human rights organizations have criticized this decision, whereas NATO has indicated Ukraine’s right to defend itself. At the same time, users can visit sanctioned websites through anonymizers and VPNs, and law-enforcement agencies have not prescribed any punishment for this.

In June 2017, the Ministry of Information Policy of Ukraine sent to the Security Service of Ukraine a list of 20 “separatist” news sites with a recommendation on blocking them. These included Russkaya Vesna, News-Front, Novorossiya. This proposal has also aroused criticism since its implementation could be a precedent for blocking any other websites.

After the signing of the sanction decree and blocking of section of Russian sites in May 2017, the popularity of Russian resources has been hit a little. Traffic to the blocked resources is, due to the use of anonymizers and VPNs, still quite high, though Russian websites have lost their positions. According to Gemius studies, in August 2017 only VKontakte was in the top ten most popular sites.

At the same time, the research results of different companies may vary. Factum Group provides its list of 25 top sites in Ukraine in August 2017, where Russia’s VKontakte is ranked fourth in the ranking, while Yandex 5th. Other studies show that Russian sites fell out of the top ten popular sites.

In general, the results of the study indicate the gradual displacement of Russian sites from the daily life of Ukrainian users. In 2–3 years, it will be clear as to whether or not Russia will ultimately lose its influence on Ukrainian users through social networks.

With the blocking of Russian social networks, the position of American services has strengthened. While as of May 2017 (the month when the sanction decree №133/2017 was signed) the audience of the Ukrainian Facebook segment was up to 6 million users, as of August 2017 it had grown to 8.9 million users, reports the Watcher publication, referring to internal Facebook statistics for advertisers.

Kremlin sees Ukraine as a “firing ground” for cyber attacks, weapons of “hybrid war”

Millions of Ukrainians experienced the results of cyber-attacks for the first time during the EuroMaidan events in the winter of 2013–2014. For some months, Ukrainian users were, from time to time, unable to download the pages of key news sites that were covering the protests in an impartial manner, namely Ukrayinska Pravda, Radio Svoboda, Liga.net, Censor.net. This was the result of DDoS attacks, the external “bombardment” of site addresses by millions of artificial requests, which lead to a temporary slowdown or blocking of sites.

The cyber attacks against Ukraine unfolded fully with the outbreak of war in the Donbas region. On the eve of the presidential election in May 2014, the pro-Russian group of hackers CyberBerkut, which is associated with the Kremlin, “hacked” the site of the Central Election Commission and announced the victory of an ultra-right presidential candidate, Dmytro Yarosh. Administrators restored the site’s work in less than an hour before the announcement of official election results.

In October 2015, the first massive cyber-attack with the spread of the BlackEnergy virus, which is attributed to a hacker group called Sandworm with a “Kremlin trail,” shook Ukraine. For a few hours, the operations of three large energy companies in Ukraine were knocked out and 250,000 residents were left without electricity. Previously, hackers from Sandworm had attacked American energy facilities; however, Ukraine has now experienced a series of their attacks. In December 2016, new attacks were carried out against the Ministry of Finance, Ukrenerho, Ukrzaliznytsia, and a dozen other critical infrastructural facilities.

One of the most powerful cyber attacks took place in June 2017 with the spread of the malware Petya.A, which required a ransom to unlock computers and restore data. Both state and privately-owned companies throughout Ukraine were affected. However, the cyber attack was aimed not at getting money, but rather at inactivating the critical infrastructure of the country.

Ukraine is stepping up measures to protect itself against cyber attacks, but these are just the first steps. In October 2017, in the fourth year of the “hybrid war,” the Verkhovna Rada of Ukraine (Parliament) finally adopted the Law on the Foundations of Cybersecurity, which provides an official definition of threats in cyberspace and describes the policy of counteracting these threats.