Oct 20, 2017
From Troll Farm to Trump
Assessing the life of Russian troll posing as a far-right American
One of the most influential voices on the American far right in 2016–17 was actually Russian.
Over the course of little more than eighteen months, a Twitter account posing as an ultra-conservative American run from the notorious “troll factory” in St. Petersburg, Russia, was repeatedly quoted by the mainstream media, interacted with top officials, and may have fed disinformation to the Trump campaign.
The account was exposed thanks to a whistle-blower in Russia. There is no indication that any of the accounts with which it engaged knew its true origin. Thus, it would be wrong to point to it as evidence of any conscious collusion between the Trump campaign and Russia. What its brief, but spectacular, life exposes is the ease with which genuine Trump supporters, the American media, and the administration itself, were fooled by an impersonator.
The case also underlines Russian operatives’ skill in achieving an impact at the highest levels — and evading detection for so long.
The account
The account known as @TEN_GOP claimed to be the “unofficial Twitter of Tennessee Republicans.” It has now been suspended, but archives of its profile remain, showing that it had 129,000 followers as of July 2017.
The account was both outspokenly pro-Trump and extremely well-connected. According to research by the Daily Beast, senior members of the Trump campaign including Kellyanne Conway and Donald J. Trump Jr. amplified its posts. As reported by Think Progress, Trump himself thanked its backup account, @10_gop, in a tweet on September 20.
In May 2017, @TEN_GOP repeatedly tweeted a link to an online petition on the White House’s We The People platform calling for the appointment of a special prosecutor to investigate the murder of DNC staffer Seth Rich. According to residual traces online, its posts were shared over 500 times.
The petition was attributed to a user called “JF”; no further personal information was available online. The We The People petitions website does not require any personal information to register an account, making it unclear whether “JF” was an American.
It gathered just short of 70,000 signatures before the 30-day time limit expired — just under the 100,000 signatures required to trigger a response from the White House, but a significant number nonetheless. Kremlin supporters have regularly alleged that Rich leaked DNC emails in summer 2016, thus exculpating Russian hackers.
In fact, @TEN_GOP repeatedly insisted on the importance of such an investigation, as the below archived tweet shows.
Thus, @TEN_GOP was an active and aggressive member of the American far-right community, not only commenting on political issues, but steering internet users towards political action through the petitions page.
However, according to an investigation by Russian news outlet RBC published on October 17, based on information from a whistle-blower, @TEN_GOP was set up by the “troll factory” in St. Petersburg in order to comment on “political questions.”
The revelation is remarkable. @TEN_GOP managed to masquerade as an American and unofficial organ of a major political party for over eighteen months, despite the fact that, according to Buzzfeed, the genuine Tennessee Republican party repeatedly complained about it. In that time, it built a powerful online following, interacted with senior Trump supporters and was widely quoted in the media.
Mainstream outlets including the Huffington Post and Washington Post quoted it as a conservative voice. Kremlin outlet RT quoted it on a range of issues, including denial of the claim that Russia interfered in the election, the Barcelona terror attack, a Trump threat against Toyota, and an attack on Clinton’s health.
Far-right American site InfoWars, itself known for spreading and amplifying false information, quoted the account on race trouble in Sweden, race relations in the United States, and, again, on its denial of the claim of Russian election interference. Breitbart and Fox News also quoted it repeatedly. Far-right activist Jack Posobiec complained when it was suspended and welcomed its successor, @ELEVEN_GOP.
It is unlikely that any of these sites were aware that @TEN_GOP was a Russian disinformation agent; little about the account’s behavior suggested its origin. What these citations show is the effectiveness with which the account managed to pose as a genuine voice on the American far right, and to fool far-right activists online.
Clinton, Blumenthal, and Benghazi
Much of @TEN_GOP’s commentary can be viewed as provocation or “triggering”, making aggressive comments in an apparent attempt to increase general divisions. Some was more active, such as its promotion of the petition.
On at least one occasion the account helped to spread specific disinformation about Clinton, which Trump ended up quoting just a few hours later.
On October 10, 2016, Wikileaks published the second in a batch of emails hacked from Clinton campaign manager John Podesta. The entire U.S. intelligence community concluded that the hacks were conducted by Russian intelligence.
One email was sent by Clinton advisor Sidney Blumenthal, and quoted a Newsweek article by Kurt Eichenwald on the death of four American diplomats in Benghazi which included the sentence:
“One important point has been universally acknowledged by the nine previous reports about Benghazi. The attack was almost certainly preventable. Clinton was in charge of the State Department, and it failed to protect the United States personnel and an American consulate in Libya. If the GOP wants to raise that as a talking point against her, it is legitimate.”
Very quickly, a number of apparently far-right American accounts began tweeting this sentence, but mis-attributing them to Podesta himself in order to claim that Clinton’s own staff blamed her. Most of the accounts involved have since been suspended, but they have left traces. The posts began with @Republic2016, which tweeted the fake news with an image of the text with a very characteristic pattern of highlighting.
Like @TEN_GOP, @Republic2016 was highly active, aggressively anti-Clinton, and effectively anonymous; there is insufficient evidence to conclude whether it was another troll factory product or an American account.
The same image was uploaded to pro-Trump Reddit feed /r/the_donald, which served as one of the main focal points of online trolls.
It was also tweeted by a user nicknamed “Microchip”, a known bot herder and troll, who has been repeatedly suspended from Twitter, but appeared inactive as of October 2017. (Its handle at the time was @WDFx2EU7.) This was the account which was most involved in sending the topic viral, picking up over 2,000 retweets in short order.
A few minutes after Microchip, @TEN_GOP tweeted a very similar message, linking to an image of the same quote.
The link has been deleted, but a Google image search for the shortened URL confirms that it was the same quote, with the same pattern of highlighting.
As further confirmation, the investigative group Bellingcat confirmed the quotation shared by @TEN_GOP was the same as that shared by “Microchip”:
@Republic2016, “Microchip” and @TEN_GOP, who tweeted within a few minutes of one another, drove the Twitter traffic on the misattributed quote, which was then widely shared in far-right circles.
The false story broke into the mainstream a few hours later, when Trump interrupted himself at a rally in Wilkes-Barr, Pennsylvania, to read out the identical text, interspersed with comment, as transcribed by Politfact:
“ ‘The attack was almost certainly preventable’ — Benghazi. ‘Clinton was in charge of the State Department, and it failed to protect the United States personnel and an American consulate in Libya’ — he meant Benghazi. ‘If the GOP wants to raise that as a talking point against her, it is legitimate.’
At the time, Trump was incorrectly accused of taking the lines from Kremlin outlet Sputnik, after it wrote an article using the same quote; the Bellingcat article, cited above, was among the first to point out that Trump could equally have taken the lines from a tweet.
In fact, the Sputnik writer, who lost his job over the incident, subsequently stated that he took the quote from the @TEN_GOP tweet:
According to Politfact and Business Insider, both writing some days after the event, the Trump campaign did not reply when asked what the source for Trump’s misquote was.
Two questions
The identification of @TEN_GOP as run from the “troll factory” raises two questions. The first is: was it the source for Trump’s remarkable, and inaccurate, intervention in Pennsylvania? If so, it would mean the direct transmission of disinformation from the Russian troll factory to a presidential candidate (and future president).
This can only be answered by members of the Trump campaign. The open-source evidence indicates that @TEN_GOP could have been the source. As later events were to show, the account interacted with leading figures in the Trump campaign; it had thousands of followers, making it a significant voice on the far right. Even the Sputnik error singled it out as a source of some importance in the far-right community. All this makes it a plausible candidate.
However, the account is not the only one. The post on Reddit is one possibility; the tweet sent viral by “Microchip” is another. A number of other Twitter feeds on the American far right which picked up on “Microchip” may also have been involved. @TEN_GOP may have been the source, but need not have been.
Open sources cannot answer the question of where the Trump campaign found their quote, but they do provide enough evidence to make the question worth asking. Regardless of distribution chain from online virality to then-candidate Trump’s mouth, there is overwhelming evidence that the Russian troll farm, via @TEN_GOP and other accounts, either sourced the content or helped amplify it to viral status.
The second, and larger, question, is: how many more such accounts are still in operation? @TEN_GOP staved off all attempts to have it shut down over eighteen months, and built a huge following (although how many of those followers were bots is unclear). Moreover, while the account has been shut down, there is no indication that the person (or team) who ran it has. Indeed, backup accounts @10_GOP and @ELEVEN_GOP were reportedly set up, although these, too, are now suspended.
Again, this is not a question which can be answered yet. Anonymity on social media, especially Twitter, is still remarkably easy, and anonymous accounts can still enjoy remarkably high levels of trust. Many lessons need to be learned: by the media who quoted the account too credulously, by social-media users who shared its posts too blindly, and by the platforms themselves, as they consider their response to the challenges, not just of 2016, but of 2017, 2018, and beyond.
The success of @TEN_GOP should not be seen as cause to panic, still less to launch any ill-considered reaction; but it is a warning. A fake account run from Russia managed to pass itself off as an American, take a leading voice in domestic debates and, at least, interact with the president’s close aides. For the health of online debate, and the social-media platforms themselves, intensive work must be done to expose any other such accounts — and to develop policies for identifying and preventing them more effectively.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
