How A Russian Troll Fooled America

Reconstructing the life of a covert Kremlin influence account

Few Americans were more patriotic on Twitter than the user known as @TEN_GOP. For almost two years, it lauded President Donald Trump, praised the American military, promoted Brexit and the European far right, and interacted with dozens of leading conservatives, while attacking Trump’s election rival Hillary Clinton, liberals, Muslims and the mainstream media.

Tweet from far-right American commentator Jack Posobiec, now deleted. (Source: BuzzFeed)

@TEN_GOP was a heavyweight voice on the American far right. It had over 130,000 followers; it was retweeted by some of Trump’s aides. When it was suspended, in July 2017, voices across the American far right protested.

To some observers, it seemed too good to be true; in October, they were proven right. Twitter confirmed that @TEN_GOP was a fake, run by a Russian operative connected to the notorious “troll factory” in St. Petersburg.

Tweet from @AltCyberCommand, showing how @TEN_GOP used a Russian backup number (+7 country code), credited to @PropOrNot. (Source: Twitter)

What was the secret of its success? @TEN_GOP’s tweets were deleted when Twitter suspended it, but a number of archives remain. The largest consists of a file of over 3,000 tweets dating back to December 20, 2016, shared with @DFRLab by PropOrNot, a team dedicated to tracking Russian propaganda, which identified the account as Russian at that date.

Others can be found online through services such as tweetsave.com (archived here); still others were shared by supporters on Reddit and a selection of blogs. Google searches also return the shadow of the deleted tweets, although the links are now broken.

Based on these sources, @DFRLab has pieced together the story of how @TEN_GOP fooled so many people for so long.

Un-American patriot

@TEN_GOP masqueraded as an American patriot. To preserve that disguise, it regularly posted “character” tweets, including blessing the U.S. military at Christmas...

@TEN_GOP message, December 25, 2016. (Source: blog.goo.ne.jn.)
Share of a tweet from @TEN_GOP, itself sharing a Christmas post from Vice President-elect Mike Pence, remembering the American troops abroad. (Source: Pinterest.)

… and at other times of the year.

Tweet from @TEN_GOP, May 30, 2017. (Source: blog.goo.ne.jp)

Other tweets were simply sentimental. This post, for example, praised U.S. policemen for bringing a lost toddler home.

Archived tweet from @TEN_GOP, saved in August 2017. (Source: archive.is)

This one flaunted its patriotic leanings with a comment on the flag.

Tweet from @TEN_GOP, May 30, 2017. (Source: blog.goo.ne.jp.)

The account even announced, proudly, and (one would hope) falsely, that it had voted for Trump.

Post by @TEN_GOP, saved to Pinterest. (Source: Pinterest.nz)

Such tweets served to both Americanize and humanize the account, making it appear less like the information operation run from an office building in St. Petersburg, which it truly was.

Uncivil war

In a sign of its working methods, however, even these sentiments were quickly transformed into venomous political attacks.

Tweet by @TEN_GOP, shared to Reddit. Note the “America first” label, added by the user, showing how effectively the account wore a patriot mask. (Source: /r/the_donald)

Americans were @TEN_GOP’s favorite targets, above all Hillary Clinton, who, as many analysts have documented, was the main butt of Russia’s propaganda throughout 2016.

Tweet from @TEN_GOP on June 18, 2016. (Source: Tweetsave.com)

Its posts were overtly political, and included anti-Clinton ads launched by American campaigns. These were also widely shared by genuine American outlets, showing how @TEN_GOP was working to integrate itself into the anti-Clinton information space.

Left, tweet from @TEN_GOP (Source: tweetsave.com). Right, Breitbart article sharing the same ad (Source: Breitbart.com).

According to a saved version of @TEN_GOP’s ad post from the Wayback internet archive, this post achieved over 13,000 retweets, an impressive figure at a critical time just before the election.

Archived version of @TEN_GOP’s tweet. Note the identical wording with the tweet saved by tweetsave.com. (Source: web.archive.org)

A week before the election, @TEN_GOP accused Clinton supporters of fraud, part of a narrative that the Kremlin had built up over the preceding months:

Tweet on voter fraud. (Source: investmentwatchblog.org.)

American media outlets were another favorite target, especially CNN.

Archived tweet from @TEN_GOP, saved in August 2017. (Source: archive.is)
Post from @TEN_GOP shared to Reddit. (Source: /r/the_donald)

The account interlocked with genuine far-right users and activists, joining in a call for a “meme jihad” against CNN and being shared on subreddit /r/the_donald, one of the main hubs of far-right activism.

Post from @TEN_GOP shared to Reddit. (Source: /r/the_donald)

Repeatedly, @TEN_GOP urged its followers to retweet its posts, including when it was asking them to identify people in photographs— a Russian operative setting Americans against one another.

Tweet from @TEN_GOP on August 2, 2017. (Source: Tweetsave.com)

This included spreading the conspiracy theory that former Democrat staffer Seth Rich had been murdered as part of a Clinton plot.

Tweet from @TEN_GOP promoting a video on Seth Rich. The video link was broken when Twitter deactivated the account. (Source: Scoopnest.com)

In 2017, it turned its fire on “Antifa”, an ill-defined term which is used by the far right to designate both violent far-left activists, and other protesters.

Two @TEN_GOP tweets on Antifa, from August. (Source: tweetsave.com)

Using tactics such as these, @TEN_GOP established itself as a fully-fledged member of the aggressive far-right community which supported Trump.

Playing with firebrands

While attacking Trump’s critics, @TEN_GOP systematically supported the far-right commentators who made up such a vocal part of his following. This can be seen as a form of both camouflage and marketing, ingratiating the account with the far right, and making it likelier that they would spread its messages.

For example, @TEN_GOP lobbied for Milo Yiannopoulos, who has been permanently banned from Twitter, reportedly for targeted harassment.

Tweet from @TEN_GOP on February 5, 2017. (Source: Tweetsave.com)

According to the data file shared by PropOrNot, @TEN_GOP repeatedly quoted, praised and defended Yiannopoulos; in return, Yiannopoulos’ website quoted @TEN_GOP when it came to his defense.

Tweet from @TEN_GOP, embedded in Yiannopoulos’ site. (Source: milo.yiannopoulos.net)

A search of the Yiannopoulos site showed seven other articles in which @TEN_GOP was quoted or referenced (on February 23, March 22, April 17, April 23, May 2, May 9 and July 7), showing how effective its technique was.

Similarly, @TEN_GOP amplified Trump activist Ann Coulter, sometimes tagging her in posts to ensure that she was notified. According to the PropOrNot file, @TEN_GOP retweeted or mentioned Coulter 25 times between December 2016 and August 2017; some of its posts have been preserved elsewhere online.

Post to Reddit of @TEN_GOP tweet quoting Coulter; note that it uses her handle. (Source: /r/the_donald)
Post to Reddit of @TEN_GOP tweet naming Coulter, though without the handle. (Source: /r/the_donald)

On several occasions, Coulter returned the compliment, retweeting @TEN_GOP, and re-posting the tweets to her official Facebook page.

Facebook posts from Coulter’s verified page, showing her retweets of @TEN_GOP. (Source left and right: Facebook)

@TEN_GOP engaged similarly with other far-right commentators, and was similarly rewarded. According to an archive of its interactions preserved online at data.world, it was retweeted by leading far-right voices such as Stefan Molyneux, Paul Joseph Watson, and Dinesh D’Souza.

As its reputation grew, it was also retweeted by more mainstream figures, such as Trump’s short-lived National Security Advisor General Michael Flynn — a former U.S. general amplifying a Russian influence account.

Tweet from Flynn, retweeting @TEN_GOP. (Source: Twitter)

The tweet which Flynn shared is deleted, but had this URL: https://twitter.com/TEN_GOP/status/785663973613899776.

This is the URL of the tweet in which @TEN_GOP promoted the anti-Clinton ad described and archived above; Flynn seems to have mistyped it as “add”.

Screenshot of the archived version of the @TEN_GOP tweet; note the URL in the capture bar. (Source: web.archive.org)

Notoriously, @TEN_GOP was also retweeted by Trump’s son, Donald J. Trump Jr., campaign manager Kellyanne Conway, and digital manager Brad Parscale. A detailed analysis by Luke O’Brien of Huffington Post revealed the extent of its interaction with key pro-Trump figures.

Chart of interactions with Trump supporters. (Source: Huffington Post)

There is no reason to suspect that any of these commentators thought the account they were amplifying was a Russian paid troll. It is far more likely that they were simply fooled by its mimicry, as it acted like one of them, sharing their narratives and boosting their posts.

In fact, as the thousands of far-right comments protesting at its eventual suspension show, they took @TEN_GOP as “one of us”.

Share to Reddit, protesting at @TEN_GOP’s suspension. (Source: /r/the_donald)
Share to Reddit, protesting at @TEN_GOP’s suspension. (Source: /r/the_donald)
Share to Reddit, protesting at @TEN_GOP’s suspension. (Source: /r/the_donald)

Into the media

@TEN_GOP’s increasing status among the far right meant, in turn, that mainstream journalists began quoting it as a representative of the American far right as a whole — once again showing how completely the operator behind the account had managed to fool observers.

Glenn Greenwald of the Intercept, for example, sourced a tweet to it.

(Source: Twitter)

Again, the full URL to which Greenwald linked leads to an archived tweet.

The original @TEN_GOP tweet shared by Greenwald. (Source: web.archive.org)

Mainstream outlets quoted it as a conservative voice, including the Washington Post (which has since corrected its article to remove the tweet), LA Times, and Huffington Post (three times, with a later editor’s note in one).

Article with embedded @TEN_GOP tweet. (Source: Huffington Post)
Article with embedded @TEN_GOP tweet. (Source: Huffington Post)
Article with embedded @TEN_GOP tweet. (Source: Huffington Post)

These articles are noteworthy both for the way in which @TEN_GOP was taken as a voice of the American far right, and for the range of subjects it commented on.

The Kremlin’s propaganda agencies amplified @TEN_GOP repeatedly. Sputnik, for example, whose official task is to “report the state policy of the Russian Federation abroad”, quoted it in multiple languages.

Some of the Sputnik articles mentioning @TEN_GOP. (Source: Google search “site:sputniknews.com ten_gop”)

RT America, the Kremlin TV station’s American brand, even retweeted @TEN_GOP, together with a link to an article on Clinton’s health. The RT tweet read that “some” were “outraged” that the “pneumonia-stricken” candidate should have been seen “hugging” a girl.

RT America’s retweet of @TEN_GOP. Archived on November 13, 2017. (Source: Twitter)

Neither the article, nor the accompanying five-minute video, mentioned the word “pneumonia” anywhere.

Screenshot of the RT story to which the RT America tweet linked; note the lack of results of a search for “pneumonia”, top right. Article archived on November 13, 2017. (Source: rt.com)

The tweet from @TEN_GOP, however, did, sharing a photo which did not include a hug.

The @TEN_GOP tweet which RT America shared; note the URL, top left, which is the same as that shared by RT. (Source: web.archive.org)

This appears to be a case in which a Russian propaganda outlet used a Russian troll as the sole source for a claim which undermined Clinton’s campaign.

A Russia apologist

With its bona fides as a far-right American established, @TEN_GOP was able to insert pro-Russian messaging into its posts.

Both RT and Sputnik, for example, quoted it as mocking the claim that Russia had interfered in the election.

Archived RT article, showing the embedded tweet. Archived on December 13, 2017.
Sputnik embed, showing the same tweet. Archived on November 13, 2017.

Unsurprisingly, @TEN_GOP repeatedly attacked the claim that Russian accounts such as itself had attempted to interfere in the election.

@TEN_GOP tweet shared to Reddit. (Source: /r/the_donald)

It attacked the Obama administration’s decision to expel 35 Russian diplomats, as well as financier George Soros, long a target of Kremlin smears, and now adopted as a hate figure of the American far right.

@TEN_GOP tweets shared by TeaParty.org. Archived on November 13, 2017. (Source: TeaParty.org)

It praised the joint Russian and Syrian siege of Aleppo and its aftermath, a campaign which, as @DFRLab and many others have documented, involved massive civilian suffering and a number of apparent war crimes. According to the PropOrNot file, @TEN_GOP returned to this theme repeatedly.

Retweet of one of a number of @TEN_GOP tweets on Aleppo. (Source: polititweet.org.)

Time and again, it not only tweeted about Russia, but was shared to Reddit, mingling its messaging into the far-right community.

Some of the @TEN_GOP posts shared to Reddit. (Source: /r/the_donald)

Judging by the volume of its tweets in the PropOrNot and other files, only a small proportion of its tweets were overtly pro-Kremlin. Its main task appears to have been to promote far-right American views and attack Clinton; the fact that it was able to carry out all its tasks simultaneously shows how vulnerable the American far right is to foreign influencers.

Foreign policy

One more aspect of @TEN_GOP’s activity merits attention, and that is its foreign policy. It posed as both Islamophobic and pro-Israel, and attempted to interact with far-right leaders across Europe.

Its hostility towards Muslims amplified and validated other far-right voices, repeating its successful technique for infiltrating the online community. This included echoing both American voices…

@TEN_GOP tweet quoting former presidential candidate Ben Carson, shared to Reddit. (Source: /r/the_donald)

… and European ones.

Remains of a tweet from @TEN_GOP quoting a Czech politician calling Islam “criminal”, preserved by Google search. According to PropOrNot’s archive, the full quote ran, “Czech politician: Islam is a ‘criminal’ ideology which deserves to be ranked with Nazism!” The quote was also run by Breitbart.

On occasion, its posts simply trolled Muslims, in very much the style of genuine far-right Americans.

(Source: tweetsave.com)

@TEN_GOP was also lavish in its praise of European heroes of the far right, such as French presidential candidate Marine Le Pen, Dutch politician Geert Wilders, and British anti-EU campaigner and Member of the European Parliament Nigel Farage.

Tweets praising Le Pen and Wilders. (Source: tweetsave.com)
Tweet from @TEN_GOP on Farage. (Source: thefederalistpapers.org)

In turn, it was picked up by a far-right subreddit dedicated to Le Pen (a group which, as @DFRLab has shown, was closely tied to the American far right.)

(Source: /r/Le_Pen)

It also attacked mainstream European politicians. Germany’s Angela Merkel was a particular target, as both a supporter of refugees and a critic of Russia.

Attack on Merkel, shared on Reddit. (Source: /r/the_donald)

French presidential candidate (now President) Emmanuel Macron was another.

Post from @TEN_GOP on Macron. (Source: theguysfromtheeast.uk)

@TEN_GOP particularly focused on the leak of emails hacked from Macron’s campaign — a leak launched just before the final round of voting, in an apparent attempt to undermine Macron’s momentum.

Tweet from @TEN_GOP, shared on an online forum. (Source: theconservativetreehouse.com)

In moments such as these, @TEN_GOP reinforced the messages carried by other elements of the Russian propaganda establishment, reinforcing the Russian government’s supporters abroad, and attacking its critics.

Conclusion

@TEN_GOP was a masterpiece of disinformation and disguise: a Russian account which masqueraded as an American for over eighteen months, fooling both friends and foes of President Donald Trump in the media, on social media, and even in the Trump campaign.

Its success came from its stepwise approach. First, it imitated genuine far-right commentators by posting hyper-partisan tweets, and attracted their attention by mentioning and praising them. Their responses gave it an appearance of legitimacy which allowed it to interact with higher-profile figures, including in the campaign, and to be quoted by genuine media outlets.

Throughout, it maintained its chosen character, posting tweets that made it out to be an American patriot, a supporter of Trump and the far right, an enemy of Islam and a critic of liberalism. A number of analysts suspected, and eventually proved, that it was Russian in origin; but their comments were not enough to stop it posting.

@TEN_GOP’s brief, but spectacular, career, shows how open America remains to foreign influence efforts. It was an anonymous account with no connection to the Republican party it linked itself to, yet it gained immense credence, first on the far right, and then in the main stream, entirely because of its partisan posts. Far-right commentators supported it; mainstream outlets and politicians quoted it; liberals attacked it; all were fooled by it.

As long as social-media users continue to blindly accept and share anonymous, hyper-partisan accounts, they will remain open to whatever successor accounts the operators behind @TEN_GOP are running now — and to any other disinformation actors with sufficient skill at camouflage.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.

One clap, two clap, three clap, forty?

By clapping more or less, you can signal to us which stories really stand out.