Russian Trolls Target British MPs

Online abuse from pro-Russian, and apparently Russian, accounts

On December 21, the British parliament is to debate Russian interference in the United Kingdom’s democratic processes. Ahead of the debate, it was suggested that Russian internet trolls — anonymous, abusive accounts — may be targeting Members of Parliament (MPs) who criticize Russia and its propaganda.

Tweet from Lucy Fisher of the Times, quoting Chris Bryant MP, Labour chairman of the All-Party Parliamentary Group on Russia. (Source: Twitter / @LOS_Fisher)

@DFRLab looked into several potential cases and found a group of trolls, which not only appear pro-Kremlin, but share many of the characteristics of earlier accounts run from the so-called “troll factory”, a building in St. Petersburg in which Russians are employed to maintain fake social-media accounts and to post pro-Russian or anti-Western propaganda.

Troll factory accounts played a prominent role in the 2016 United States elections, as the most effective accounts built up tens of thousands of followers and interacting with top officials from President Donald Trump’s campaign.

The pro-Kremlin accounts we found account for only a small proportion of the abusive messages sent to MPs, and to journalists who reported on them; the great majority appear to come from genuine, and genuinely disgruntled, British voters. However, these pro-Kremlin, and potentially troll-factory, accounts directly targeted British MPs. Their behavior, therefore, constitutes a targeted attempt to influence British democratic debate as it happened.

Angry Russians

The most obvious pro-Kremlin posts came from apparently Russian-language accounts. For example, on November 10, Conservative MP Damian Collins tweeted an article by Wired magazine, setting out the first evidence of Russian interference in the UK’s Brexit debate.

The post from Damian Collins, MP, which triggered the outburst. (Source: Twitter / Damian Collins)

One of the replies came from a Russian-language user who posted in capitals, and obscenity.

“BE AFRAID OF RUSSIA!!! IF YOU ANNOY (IT), YOUR ISLAND WILL DISAPPEAR INTO NOTHINGNESS AT A SINGLE STROKE!!! THE ENGLISH ALWAYS WERE THE MOST STUPID PEOPLE AND THAT’S HOW THEY’LL REMAIN IN HISTORY!! AND YOU PERSONALLY SUCK PUTIN’S ****!” Archived on December 20, 2017. (Source: Twitter / @khaag65)

This account is clearly a Russian patriotic troll. Its profile page features a background of the Russian leadership in combat uniform on an idealized battlefield; its aggression towards Collins marks it out as a troll.

Profile page for @khaag65. The background features, from left to right, Foreign Minister Sergei Lavrov, Prime Minister Dmitriy Medvedev, President Vladimir Putin, Deputy Prime Minister Dmitriy Rogozin, and Defense Minister Sergei Shoigu. Archived on December 20, 2017. (Source: Twitter / @khaag65)

However, as of December 20, 2017, all its most recent posts were shares of videos, suggesting automated behavior. Some of the posts were patriotic, but others appeared unrelated, such as promoting videos on how to make crab sticks and how to make furniture.

Posts from @khaag65, on Russian patriotism (top left), crab sticks (bottom left) and furniture (right). All posts archived on December 20, 2017. (Source for all posts: Twitter / @khaag65)

The language of these shares was Russian, albeit probably automated. We can therefore conclude that this is a Russian troll account, but not an especially active or effective one; it is likely to be run by a private individual, rather than the troll factory, since we would expect the latter to be much more active.

More questionable is the account @iatetwit. On December 15, Lucy Fisher,a reporter with the Times, tweeted an open letter from MP and Labour chairman of the All-Party Parliamentary Group on Russia Chris Bryant, which warned UK Foreign Secretary Boris Johnson of potential “active measures” against him on a scheduled trip to Moscow.

The tweet from Lucy Fisher. (Source: Twitter / @LOS_Fisher)

This drew the ire of an account called @iatetwit, screen name “dayjuska”, who sent two replies a few minutes apart, attacking both Bryant and the British media. Bryant is one of the leading British MPs to have warned of pro-Russian troll campaigns.

Tweets from @iatetwit, replying to Fisher and attacking Bryant. Archived on December 20, 2017. (Source: Twitter / @iatetwit)

@iatetwit is a new account, created on October 3, 2017. It is not a prolific poster, but it has kept up a slow but steady flow of tweets and retweets.

@ieattwit’s profile page, showing the creation date and number of tweets. Archived on December 20, 2017. (Source: Twitter / @iatetwit)

The account is effectively anonymous. It gives no verifiable name or location details. Its profile picture is taken from the Instagram account of former Russian Olympic figure skater Yulia Lipnitskaya (the Instagram account is restricted, but the images are reproduced here).

Screenshot from website sovsport.ru, showing Lipnitskaya’s Instagram posts. Archived on December 20, 2017. (Source: sovsport.ru)

Early in its life, it posted retweets in Russian and English about sports, especially figure-skating, interspersed with political content in English.

Retweets from @iatetwit. (Source: Twitter / @iatetwit)

Its English appears non-native, with an inability to use the words “a” and “the” often noted in Russian-speakers.

Tweets, one on sports, the other on politics, from @iatetwit. Note the lack of “a” and “the”. Archived on December 20, 2017. (Source: Twitter / @iatetwit)

However, increasingly, it took on English far-right positions, equatded immigration with the destruction of “English” society, and claimed to be English itself.

Posts from @iatetwit on English society and immigration; note the use of “we” in the last post, which is in reply to another UK politician, the Mayor of London. Tweets archived on December 20, 2017. (Source for posts: Twitter / @iatetwit)

Other posts were anti-EU and, especially, anti-Irish, in what appears to be an attempt (copied to a journalist, Sky’s Adam Boulton) to provoke inter-ethnic anger in the UK.

@iatetwit on the Irish, and the Remain campaign. Archived on December 20, 2017. (Source: Twitter / @iatetwit)

Increasingly, it became more troll-like and abusive, progressing deeper into obscenity as it defended Russia against being banned from the Olympics for massive state-sponsored doping by accusing others of the same.

Troll posts from @iatetwit on the Olympics. Tweets archived on December 20, 2017. (Source for posts: Twitter / @iatetwit)

One post returned to an old piece of Kremlin propaganda: the insinuation that Ukraine was responsible for shooting down Malaysian Airlines flight MH17 over Ukraine in July 2014, despite all evidence to the contrary. Another replied to Kremlin propaganda outlet Sputnik, abusing UK Prime Minister Theresa May.

@iatetwit’s MH17 and Sputnik posts. Archived on December 20, 2017. (Source: Twitter / @iatetwit)

All this behavior is characteristic of pro-Kremlin trolls, and, in particular, the accounts known to have been run by the “troll factory”. There are too few data to allow for a firm identification as a probable troll-factory account as yet; however, the indicators point in that direction.

The professionals?

We can be more confident about an account which trolled another MP, Liberal Democrat Tom Brake. The trolls spread their venom across all the mainstream parties. Brake posted a tweet criticizing Foreign Secretary Boris Johnson for apparently belittling the danger of Russian interference in UK debates; an account called @iamjohnsmith retorted by demanding Brake’s resignation.

The post by Tom Brake MP, and the reply from @iamjohnsmith, who is almost certainly not John Smith. Archived on December 20, 2017. (SourceTwitter)

Like @iatetwit, this account is functionally anonymous. Its username gives nothing away; it provides no personal information other than a location, which can easily be faked. It has posted 11,000 tweets since creation in March 2017 and gained a modest 556 followers.

@iamjohnsmith’s profile page. Archived on December 20, 2017. (Source: Twitter / @iamjohnsmith)

The choice of account name — John Smith — and the use of the nouns “tosh” and “tripe”, current in approximately the 1890s, are almost parodically English. However, the account’s behavior is near-identical with that of known troll-factory accounts which Twitter Public Policy closed down in summer 2017. This is certainly a pro-Kremlin troll account, and likely to be a troll-factory one.

@iamjohnsmith repeatedly shares articles by Kremlin broadcaster RT, and tags RT and Sputnik in its posts.

Shares of RT stories by @iamjohnsmith on Syria (right and left) and the EU. Note the time of the right-hand post, 3.43 am UTC, which is an unusual time for a UK user to be online. Tweets archived on December 20, 2017. (Source for posts: Twitter / @iamjohnsmith)

It regularly repeats some main points of Kremlin propaganda, such as accusing U.S. Senator John McCain of supporting Nazis in Ukraine, attacking the Bellingcat group of investigative journalists, and denying the use of sarin gas by the Syrian government, despite all findings to the contrary.

Tweets from @iamjohnsmith on Ukraine, Bellingcat and sarin. Tweets archived on December 20, 2017. (Source for posts: Twitter / @iamjohnsmith)

It trolls politicians on both sides of the Atlantic, including McCain, Nancy Pelosi, Brake and Prime Minister Theresa May — hitting McCain and May in the same tweet.

@iamjohnsmith’s May-McCain double whammy. Archived on December 20, 2017. (Source: Twitter / @iamjohnsmith)

The account’s posts repeatedly tag known pro-Kremlin, anti-Western, and far-right commentators on both sides of the Atlantic. This is a technique known to be used by the troll factory’s accounts, as they try to infiltrate specific user groups, and then use those groups to validate themselves to a wider audience.

Posts from @iamjohnsmith to Jack Posobiec, Katie Hopkins and Nigel Farage, all influential voices among the far right in the UK and US; earlier troll-factory accounts such as @TEN_GOP targeted far-right validators in exactly this way. Tweets archived on December 20, 2017. (Source for posts: Twitter / @iamjohnsmith)

Even more tellingly, it tags known troll-factory accounts in its posts, particularly @Pamela_Moore13 (repeatedly) and @TEN_GOP (twice). Both these accounts posed as far-right Americans, but were exposed and suspended as Russian trolls by Twitter in the summer.

@iamjohnsmith’s tagging of @TEN_GOP (left) and @Pamela_Moore13 (right). Source: Twitter searches, archived on December 20, 2017. (Source: Twitter / @iamjohnsmith)

@iamjohnsmith’s behavior is a near-perfect match with that of @TEN_GOP and @Pamela_Moore13, with which it sought to interact. It is not possible to say definitively, from open sources, whether it is a troll-factory account; but all the evidence suggests that it is.

Other accounts behaved similarly. On November 23, Conservative MP David Gauke tweeted an exchange he had with RT, in which he refused to talk with what he termed a “propaganda station”. He was soon trolled by an account called @FXdestination, which elevated RT above the Western media.

The exchange between David Gauke and @FXdestination. Archived on December 20, 2017. (Source: Twitter / @FXdestination)

This account is a high-volume and functionally anonymous tweeter (despite being created in 2011, it has no profile picture).

@FXdestination’s profile page. Archived on December 20, 2017. (Source: Twitter / @FXdestination)

It regularly shares Kremlin messages on issues including Ukraine, Crimea, the shooting down of MH17, and Turkey’s downing of a Russian aircraft in November 2015 — all hot topics for the troll factory.

Posts by @FXdestination on MH17, Ukraine and Turkey. Searches archived on December 20, 2017. (Source for searches: Twitter / @FXdestination)

In a separate analysis, data expert @conspirator0 highlighted the resemblance between @FXdestination and known troll-factory accounts. The likelihood is that this is a troll-factory user, although open-source evidence does not allow for a definitive decision.

Tweet from thread by @Conspirator0, assessing @FXdestination’s activity. (Source for the full thread: Twitter / @conspirator0)

Like @iamjohnsmith, @FXdestination repeatedly tagged @TEN_GOP and @Pamela_Moore13. It also regularly tagged another account, @ProudPatriot101, which also trolled Gauke after his RT post.

Troll post from @ProudPatriot101. Archived on December 20, 2017. (Source: Twitter / @ProudPatriot1)

Like @iatetwit, @ProudPatriot101 takes an anti-migrant and white supremacist line. Its current screen name is “It’s OK to be white”; its background proclaims it to be “a proud British”, although the noun is missing. Created in 2011, it has posted almost quarter of a million tweets.

@ProudPatriot101’s profile page. Archived on December 20, 2017. (Source: Twitter / @ProudPatriot1)

However, yet again, it regularly tags @TEN_GOP and @Pamela_Moore13 (and also @FXdirection), and shares Kremlin messaging on issues including Ukraine, Turkey, and MH17.

Tweets from @ProudPatriot101 on Turkey, Ukraine and MH17. Note the preponderance of shares from RT. Searches archived on December 20, 2017. (Source for searches: Twitter / @ProudPatriot1)

This behavior is consistent with that of the known troll-factory accounts. It marks @ProudPatriot101 out as a confirmed member of the disinformation community which surrounds the troll factory, and possibly an account run from the factory itself.

Conclusion

Attribution of troll accounts is always challenging, given the easy anonymity which Twitter provides. @khaag65 is a Russian-language account, but seems unlikely to be professionally run; @iatetwit is likely to be Russian-language in origin, and may be a fledgling troll-factory account.

@iamjohnsmith, @FXdirection and @ProudPatriot101 all strongly resemble the known troll-factory accounts. They are anonymous, active, and aggressive; they seek to interact with far-right amplifiers while trolling critics of Russia; and they interact with one another, and with known troll-factory users.

There is a likelihood — though not a certainty — that some or all three of these last accounts are connected with a troll factory. They are certainly active members of the broader pro-Kremlin community which surrounds it.

All have, in the recent past, trolled British MPs directly. Their interactions do not appear to have raised much echo, or to have achieved many retweets; despite their high volumes, only @ProudPatriot101 has a significant number of followers. Neverthless, they represent a direct attempt by pro-Kremlin, and perhaps Kremlin-controlled, accounts to have an impact on UK politicians, and thus on UK politics.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.

Like what you read? Give @DFRLab a round of applause.

From a quick cheer to a standing ovation, clap to show how much you enjoyed this story.