The Russians Who Exposed Russia’s Trolls

A tribute to the Russian journalists who exposed the “troll factory”

Mar 8, 2018 · 13 min read
Headlines from Novaya Gazeta (main picture) and RBC (РБК, inset) exposing the activities of the “troll farm” in St. Petersburg. (Source: Novaya Gazeta,

The reason we know so much about the Russian information operations which targeted the United States from 2014 to 2017 is that some Russian journalists are very good at their jobs.

Special Prosecutor Robert Mueller’s indictment of thirteen Russian citizens for conducting “interference operations targeting the United States” provided a wealth of detail on the workings of the so-called “Internet Research Agency” in St. Petersburg, from which the accused are said to have operated.

Yet many of those details were already known, thanks to the work of Russian investigative journalists. It was Russian journalists who first revealed the existence of the “troll factory” (its Russian nickname) in 2013, and Russian journalists who exposed the identities of its most effective accounts. While we mostly know the activities of the “troll factory” for its work around the 2016 American election, a number of Russian journalists uncovered how it mostly focused on influencing domestic opinion, especially with its early activities.

It was Russian journalists, too, who provided the sharpest insights into the workings of Kremlin propaganda outlets RT and Sputnik, disproving the outlets’ claims to be no more than journalists.

This post delineates the extraordinary work done by independent Russian journalists who provided so much detail on the Russian information operations.

“Where the trolls live”

According to Mueller’s indictment, the Internet Research Agency was registered as a Russian corporate entity “in or around July 2013.”

Mueller’s dating could have been more precise. On September 9, 2013, independent Russian newspaper Novaya Gazeta (Новая газета) published an investigative piece headlined, “Where the trolls live. How internet provocateurs in St Petersburg work, and who pays them.”

“Where the trolls live. How internet provocateurs in St Petersburg work, and who pays them.” Novaya Gazeta headline, September 9, 2013. (Source: Novaya Gazeta)

According to the Novaya article, the Internet Research Agency was registered in the Russian Unified State Register of Legal Entities (ЕГРЮЛ, Единый государственный реестр юридических лиц) on July 26, 2013.

Novaya’s article, bylined by St. Petersburg correspondent Alexandra Garmazhapova, was one of three pieces which exposed the “troll factory” to the world in August-September 2013. The first was a post on social network VK by a woman called Natalya Lvova, describing how she had answered an ad to become an “internet operator” and come across a team whose job was to make political posts online.

Archived on June 11, 2015. (Source: VK / Natalya Lvova)

According to Lvova, each team member had to write around 100 online comments a day, focusing on Russian politics:

Apparently tipped off by Lvova’s post, two journalists posed as job applicants and entered the Internet Research Agency: Novaya’s Garmazhapova, and Andrei Soshnikov, of St. Petersburg local paper Moy Rayon (Мой район), now with the BBC’s Russian Service.

“A trolls’ lair discovered outside St. Petersburg, where they stigmatize Navalny and praise Russian cinema.” Archived on March 5, 2018. (Source: Moy Rayon)

The two journalists described an organization which photocopied applicants’ passports as a matter of course, but then took no steps to verify their identities; an organization which was already divided into dedicated teams for different forms of online activity. As Garmazhapova wrote:

“Social media specialists’ department.” Photograph by Alexandra Garmazhapova, shared with YLE Finland. (Source: YLE Kioski)

Applicants were expected to write a short test to prove their abilities, as Soshnikov described:

The trolls were given specific metrics, posting around 100 times per day, and specific themes on which to write — including the G20 summit in St. Petersburg, held on September 5–6, 2013. Garmazhapova quoted the manager who interviewed her, Aleksey Soskovets:

Garmazhapova’s report made clear that the troll factory’s initial output was in Russian, and focused on Russian politics. Even at this early stage, however, its content attacked America:

The screenshots also immortalized troll attacks on the Russian edition of “Forbes” magazine in May 2013, suggesting that the troll activities had begun before the Internet Research Agency was registered.

Soshnikov provided links to some of the LiveJournal posts which trolls had made, such as the below post, calling Navalny “the Hitler of our time,” when he was running for the mayorship of Moscow.

“Navalny — the Hitler of our time,” troll factory post exposed by Andrei Soshnikov. Archived on March 5, 2018. (Source: LiveJournal / alexmonc)

Even at this stage, however, the “troll factory” seemed to struggle to find dedicated workers who took the job seriously. Soshnikov described a conversation with a fellow applicant:

Already, too, suspicion was rife — apparently inspired by Lvova’s post. Soon after Soshnikov left the building, Soskovets phoned him.

These early reports are remarkable for both their timing and their daring. Russian investigative reporters, inspired by a VK post, exposed the main elements of the troll factory — its management, the fake social media accounts, blog posts and comments, and the attacks on Kremlin critics — within weeks of the Internet Research Agency’s creation. They did so under their own names, and in their own publications. This was journalism of a high order.

The infiltrator

In 2014, the “troll factory” moved from “Olgino” to a new site, a four-story building at 55 Savushkina Street in northern St Petersburg. By this time, the operation’s scale had grown dramatically, and hundreds of employees were working round the clock to keep posts going in both Russian and English.

In February 2015, the agency’s cover was blown: Soshnikov, then still with Moy Rayon, published a new piece from an unnamed whistleblower with photos, videos, and copies of “technical tasks” given to the trolls.

Video of trolls arriving and at work. (Source: Moy Rayon / Andrey Soshnikov)

Most of the tasks concerned Russian politics; the pages on the United States illustrated the themes which the troll factory would attack with such vigor throughout 2015–17.

The article reported that the troll factory had pulled out all the stops after the murder of Russian opposition leader Boris Nemtsov on February 27, 2015.

It also traced the corporate ownership of the “Internet Research Agency” back to the “Concord” holding company, the property of Russian billionaire Yevgeny Prigozhin, who made his fortune through lucrative government contracts, and whose name tops Mueller’s indictment.

The source for these leaks was identified only as “Alexei.” Two months later, a whistleblower was named: activist and investigator Lyudmila Savchuk, who spent two months undercover in the troll factory in late 2014. In April 2015, she revealed her story, describing the working conditions in the factory’s Russian-language branch.

One of Savchuk’s first interviews, April 28, 2015. (Source: YouTube / AFP)

Her account of her actions, given in interviews to outlets including Spiegel and the Washington Post in June 2015, confirms that the troll factory had grown in size and sophistication, but kept a similar style and structure.

The troll factory spread its venom across multiple platforms:

Each unit received instructions on what to write, in different formats.

Crucially, Savchuk confirmed that the troll farm also had an English department, later to become notorious from Mueller’s indictment as the “Translator Project”.

Savchuk went on to sue the Internet Research Agency for employing her without a contract, and won a symbolic one rouble compensation.

Her whistleblowing, and the research by Moy Rayon and Novaya Gazeta, were crucial to our understanding of the troll factory. Three points stand out.

First, the factory’s primary goal was to flood the Russian internet with pro-Kremlin propaganda. Estimates put the total number of trolls at 800–900; according to Mueller’s indictment, over 80 of those focused on the United States. This was a Russian political operation more than a foreign one.

Second, the troll factory’s ownership was clear even in 2015, and led back to Yevgeny Prigozhin, who was both a major government contractor and a friend of President Vladimir Putin.

Third, at the critical moment of Nemtsov’s assassination, the troll factory flooded internet fora with thousands of posts aimed at protecting the Kremlin.

Taken together, these factors all indicate that the troll factory was operating with the Russian government’s blessing. Given the tight control which the Russian government exercises over the Russian media, Prigozhin’s own close links with the Kremlin, and the speed with which the troll factory jumped to defend the government after Nemtsov’s death, it is implausible to suggest that they were operating without the government’s knowledge.

Exposing the accounts

One of the tragedies of 2015–16 was that the troll factory was exposed so brilliantly in Russia, but ignored so utterly in the United States. It only broke on the broader public consciousness in January 2017, after U.S. intelligence agencies named it in their report on Russian interference.

That exposure raised the general concept of “Russian trolls” into the public eye, but failed to identify specific accounts. It was not until September 6, 2017, that Facebook confirmed it had identified and deleted 470 “inauthentic” accounts which were “likely operated out of Russia.”

Three weeks later, Twitter confirmed that it had identified and suspended 201 accounts linked to the deleted Facebook ones. Neither network named the accounts involved.

That task was left to another Russian outlet, RBC (РБК), and journalists Polina Rusyayeva and Andrei Zakharov (Полина Русяева, Андрей Захаров). On October 17, they published a detailed analysis of the troll factory, including a leaked list of its most effective accounts.

RBC’s list of trolls, divided by “Race questions,” “Political questions,” “Religious and minority questions” and “other questions.” (Source: RBC)

RBC’s post was a crucial resource for researchers. Twitter shared a list of 2,752 troll factory accounts with the House Intelligence Committee; the Democrats on the Committee published the list. Facebook published some of the troll ads and accounts in its presentation to the Senate Intelligence Committee on November 1. However, RBC remains the most comprehensive multi-platform summary of the troll factory’s activity.

Thus, the backbone of most public open source investigations into the Russian troll factory’s activity — as opposed to company internal ones — is the work of Russian journalists.

Not just the anonymous trolls

Three other Russian journalists deserve particular mention for their role in exposing Russian information warfare. They are Aleksandr Gabuyev, of independent daily Kommersant (Коммерсантъ), and Ilya Azar of news wire, who interviewed RT’s chief editor, Margarita Simonyan, in 2012 and 2013 respectively; and an unnamed reporter for state news wire RIA Novosti, who filmed the wire’s new chief editor, Dmitriy Kiselyov, when the wire was taken over and reformed as state propaganda agency “Rossiya Segodnya” in 2013. Sputnik is Rossiya Segodnya’s export brand.

These genuine journalists have given us the clearest understanding of how the Russian government’s network of pseudo-journalists work. Gabuyev was the first, asking Simonyan in 2012 why he, as a tax-payer, should fund RT.

“Well, for about the same reason as you need the Ministry of Defense,” Simonyan replied. She went on to compare RT with the army and said, “We were waging the information war against the whole Western world” during the Georgian war of 2008.

In one exchange, Gabuyev exposed Simonyan’s perception of her outlet as a weapon of state information warfare.

Azar confirmed Simonyan’s mindset a year later, in an interview in which, again, she referred to RT in military terms:

Simonyan’s statements explicitly mark RT as an “information weapon,” rather than a journalism outlet. This remains evident from the broadcaster’s own behavior, and its long string of convictions for violating broadcasting standards; but it is thanks to real Russian journalists that we have the chief editor’s own confirmation of its purpose.

Much the same applies to Kiselyov, the only Russian broadcaster to be sanctioned by the European Union for his role in propagandizing Russia’s annexation of Crimea. On December 12, he addressed staff at RIA Novosti, a state-funded news wire which had previously won respect for its independence, but which had just been told that it would be dissolved and turned into Rossiya Segodnya.

A RIA Novosti journalist filmed Kiselyov’s opening speech to his new employees, in which he made clear where their loyalties should lie (translation by The Interpreter):

A RIA Novosti journalist asked twice how to separate love for the country from love for the government. Kiselyov replied:


The story of the Russian troll factory is a story of real journalists exposing falsehoods. Russian journalists broke the story of the troll factory, and revealed its early workings. They first identified its ownership, and published its most important accounts. They provided the strongest proof that the Kremlin’s own “journalists” are nothing of the sort, but are, in their own eyes, engaged in an information war against the West.

This is a vital point. The trolls and pseudo-journalists who waged a propaganda campaign against the United States were Russians, but so were the journalists who exposed them.

The events of 2014–17 were not a question of Russians against Americans, or Russia against America: they were a story of Russian government outlets, and a troll factory whose owner had strong links to the government, attacking government critics both inside the country, and outside.

It is thanks to Russian journalists that we know so much of what went on.

Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Aric Toler is the lead digital researcher for Eurasia at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.


@AtlanticCouncil’s Digital Forensic Research Lab.


@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.


Written by


@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.


@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store