Mar 24, 2018
#PutinAtWar: Trolls on Twitter
Battles on Twitter over the Skripal poisoning case
Since the British government accused Russia of an “illegal use of force” against the United Kingdom by attempting to poison former spy Sergei Skripal and his daughter Yulia in the English city of Salisbury, Twitter has become a battleground.
Supporters and defenders of the Russian government have clashed over who was to blame, and which side to believe; politicians and diplomats have joined in on both sides.
Much of this invective appears organic, driven by angry users who are convinced that their cause is right; such storms are a regrettable part of everyday life online. Some incidents, however, appear to involve organized activity, including possibly fake accounts masquerading as English users, in the well-known pattern of the “troll factory” in St. Petersburg.
Pushing a poll
On March 17, when an apparently British user called @Rachael_Swindon posted an online poll asking whether the British government’s evidence was adequate to blame Russia. The poll returned a hefty majority in favor of “No.”
The account which posted the poll is a vocal supporter of the UK’s Labour Party, a critic of the ruling Conservatives, and has a substantial following (almost 58,000, as of March 21). The fact that the poll received over 15,000 votes, mostly anti-government, was therefore not, in itself, remarkable.
What was remarkable was the origin of its amplifiers. Many of its most recent retweets — and, it is legitimate to assume, votes — came from accounts which are either Russian-language, or systematically post pro-Kremlin content.
This appeared to be an attempt by pro-Russian users to influence the online poll, and thus to create the appearance of greater hostility towards the UK government than UK users themselves showed.
To assess the extent to which Russian or pro-Kremlin accounts helped amplify the tweet, we conducted a machine scan of its spread through multiple stages of retweeting, using the Sysomos online tool.
Our scan showed that the early traffic (top half of the image) was generated by UK-centric accounts, but that the later traffic (bottom half) was substantially driven by Russian-language and pro-Kremlin networks, going through multiple retweet iterations as the message spread.
For example, accounts which retweeted the post directly included @13tucha, @deuxtwi, @lenkyzap, and @brygse, all of which are primarily Russian-language accounts whose focus is Russia, not UK politics.
A key amplifier was the account @malinka1102, a longstanding pro-Kremlin troll. This currently gives its screen name as “Tanya P.”; traditionally, it has given no name, as an archive from July 30, 2015, showed.
This account has long posted pro-Kremlin messaging on themes which have been at the heart of Kremlin disinformation operations, such as the Russian annexation of Crimea and the shooting-down of Malaysian Airlines flight MH17 over Ukraine.
It also posted direct attacks on researchers, including the Bellingcat team of investigative journalists, and on those who provide evidence of apparent crimes committed by Russia and its allies, such as the White Helmets rescue movement in Syria.
@malinka1102’s retweet was then retweeted onwards by Russian-language account @enchanteressse, and further on to a small group of other Russian-language accounts.
A second direct retweeter of the @Rachael_Swindon post was @znaetymka, a Russian-language account which posts at bot-like rates. Created in May 2017, it had posted, by March 2018, over 43,000 tweets and 40,000 likes, for an average rate of 285 engagements per day.
This account primarily posts in Russian, and on Russian-focused themes. It does occasionally use poor (possibly Google-translated) English to troll other users, as the below exchange demonstrated.
It is unequivocally a Russian-focused and pro-Kremlin account. Its decision to retweet @Rachael_Swindon was therefore most likely explained by a desire to amplify a Twitter poll to a Russian audience, which could then respond accordingly.
A third direct retweeter was especially unusual. This is @rixstep, an account which mixes pro-Kremlin content in English and Swedish, often from RT.
Like @malinka1102, @rixstep repeats common pro-Kremlin themes, for example by attacking the White Helmets, NATO, and the broader West. It also has frequent conversations with @malinka1102.
These two accounts evidently form part of a community; it was likely that they coordinated offline, as troll groups are known to do. This makes it more likely that their retweeting of @Rachael_Swindon was a deliberate attempt to raise the profile of the tweet and its poll.
The most important amplifier was another member of this cluster, the account @ValLisitsa. This appears to be the account of concert pianist Valentina Lisitsa, an ethnic Russian born in Ukraine, who was dropped by the Toronto Symphony Orchestra in 2015 for comments on the Ukrainian conflict deemed to have been “deeply offensive.”
This account also joined one of the Russian troll factory’s recent hashtag campaigns, #StopMorganLie, which we have described elsewhere.
According to our scan, @ValLisitsa retweeted the @Rachael_Swindon post, not directly, but from @rixstep. The two accounts are certainly connected, as their posting history made clear.
From Lisitsa, the retweet cascaded to dozens of other, primarily Russian-language accounts, forming the most substantial cluster of retweets throughout the scan.
None of these Russian accounts has an organic focus on, or interest in, UK politics; their content is dominated by pro-Kremlin messaging, mostly in Russian or English. Their purpose in retweeting the poll therefore seems to have been to spread it to a Russian audience which could be expected to vote against the UK government.
This intervention was small in itself, impacting one poll, from one account. However, the source account was an influential member of a politically vocal UK community; thus, by targeting it, the Russian accounts may have hoped to reinforce their message among UK opposition supporters.
If so, they succeeded. @Rachael_Swindon is not a member of this troll community; it has had no interactions with @malinka1102 or @rixstep, and does not post on hot-button Kremlin topics such as Crimea or MH17.
However, still on March 17, the account had a conversation with @ValLisitsa, at the end of which @Rachael_Swindon claimed, based on its own poll, that the “mood of the British public is starting to shift.”
The poll did not reflect the “mood of the British people.” It reflected some British sentiment, and a significant injection from pro-Kremlin and Russian-language accounts. Thus, the author of the poll appeared to have been taken in by one of the accounts which spread it most widely to a Russian constituency.
An influential troll
One other unusual account was especially active on the issue of the Salisbury poisoning on March 19–20: @Ian56789. According to a machine scan of posts mentioning “Skripal” on those two days, this was one of the ten most-retweeted accounts, with posts achieving hundreds of engagements.
Several features of this account were questionable. Its name and bio give away no verifiable personal information; its avatar image is a photo of male model David Gandy, as a reverse search revealed.
It regularly engaged with @malinka1102 and @ValLisitsa, and with self-declared “pro-Kremlin media sniper” @marcelsardo, marking it as a member of an active pro-Kremlin group.
It regularly posted pro-Kremlin messages on issues including MH17, the White Helmets, the U.S. investigation into Russian interference led by Special Prosecutor Robert Mueller, NATO, and Bellingcat.
As pointed out by U.S.-based researcher @conspirator0, there were problems with the account’s biography: it claimed to vote for Ron Paul in the 2012 U.S. election, but also claimed to be British and to have planned to move to the U.S. in 2013.
We have verified these tweets, which we reproduce here:
The account linked to a Medium page under the same handle, with the same screen name (“Ian 56”) and Gandy profile picture; despite being inactive, it has over 1,000 followers. It also linked to a blogspot page, which featured a variety of anti-Western, pro-Kremlin, and anti-globalization messaging.
Particularly significant, on February 28, 2015, the day on which Russian opposition leader Boris Nemtsov was murdered, this blog hosted a post which suggested that the CIA may have been behind the killing. We know from Russian sources that the “troll factory” was ordered to post heavily on that subject the day of Nemtsov’s death, blaming anyone except the Kremlin.
This was an aggressive and apparently influential account (32,000 followers). Its spread appears to be greater among English-language users than Russian-language ones; in a machine scan of its most popular tweet on Skripal on March 19, its initial amplifiers were pro-Kremlin accounts, but many of its later ones appeared to be British.
It remains unclear whether it is merely a pro-Kremlin troll, linked in an informal network with like-minded accounts, or whether it was part of a more organized effort, such as the “troll factory” in St. Petersburg; the post on Nemtsov suggested the latter. What is clear is that its profile picture was not its own, its biographical claims are inconsistent and its content systematically promoted Russian government narratives.
Conclusion
These incidents are small in themselves, but illustrate larger issues and trends.
The large-scale amplification by Russian accounts of a UK Twitter poll demonstrated the ease with which connected accounts can amplify and, most probably, manipulate online debate, even from far away.
The impact of the @Ian56789 account — one of the most-retweeted accounts on the Skripal case — shows the power which anonymous trolls with demonstrably falsified profiles continue to wield online.
Together, they show the aggression, coordination and impact with which pro-Kremlin accounts, often anonymous and polemic, continue to operate.
This post was updated on March 29 to add a missing ‘_’ to @Rachael_Swindon’s handle, in the attribution of her tweet. Thanks to Twitter user @medialens for noticing the omission, and taking the trouble to point it out to us.
In paragraph 21, we referred to Valentina Lisitsa as “an ethnic Russian born in Ukraine,” as we considered the adjective “Ukrainian” to be insufficiently precise. She has been quoted as calling herself of Russian and Polish descent. In a subsequent tweet, Ms. Lisitsa termed herself “Ukrainian-American,” but added that she considered the term “Russian” a compliment. We therefore leave the paragraph as originally drafted, in compliment to her.
Update: On April 20, 2018, the user behind Twitter account @Ian56789 was named in a blog post on its own site, and interviewed by Sky News. @Ian56789 therefore appears to be a pro-Kremlin account, rather than one directly run by a Kremlin operation.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
