Apr 16, 2018
#TrollTracker: 2000% More Russian Trolls on Syria Strikes?
Assessing the Pentagon’s claim on a Russian troll surge around U.S.-led strikes on Syria
On April 14, Pentagon Chief Spokeswoman Dana W. White told journalists that there had been “a 2,000 percent increase in Russian trolls in the last 24 hours.”
@DFRLab analyzed social media traffic around the Syrian air campaign, to verify whether a 2,000 percent increase in Russian troll activity could be identified.
We found that traffic on the Department of Defense (DoD) Twitter and Facebook accounts did surge in the 24-hour period directly after strikes, and that a number of pro-Kremlin or Russian troll accounts were active, but that the evidence does not confirm an overall 2,000 percent increase in Russian troll activity.
Principles
A number of basic principles are important in assessing the presence of “Russian trolls,” in the sense of covert accounts associated with the Kremlin’s information operations, on the pattern of those which targeted the U.S. election in 2016.
First, the standard of evidence needed to identify such accounts is high. Not every hostile comment comes from a troll, and not every troll account is a Russian information operation. @DFRLab has set out the range and type of evidence which can be used here.
Second, it is important to distinguish between pro-Kremlin accounts, Russian-language accounts and accounts which appear to belong to the state-associated effort like at the “troll factory” in St. Petersburg. The phrase “Russian trolls,” which blurs those distinctions, is therefore insufficiently precise.
Traffic surge
To assess the Pentagon claim, we conducted a machine scan of mentions of the DoD’s Twitter handle, @DeptofDefense, and a visual scan of mentions on its Facebook page, DeptofDefense.
The scan of the Twitter feed, using the Sysomos online tool, showed an explosive jump in mentions of the DoD handle just after 9:00 p.m. EST on April 13 — the time at which the U.S. strikes on Syria were confirmed.
Mentions of the handle, including retweets, jumped from roughly 200 tweets an hour at 8:00 p.m. EST to 2,800 tweets an hour by 10:00 p.m. EST. This represents a 1,400-percent increase in traffic.
However, relatively little of the traffic was negative, or could be qualified as trolling, let alone Russian trolling. Of the ten most-retweeted posts to use the @DeptofDefense handle, six were posted by the Department itself; a seventh came from the State Department.
Of the other three, one praised Defense Secretary General Mattis as “the greatest military mind in the history of the world,” while criticizing former president Barack Obama for allegedly firing him. The second appeared unrelated to the Syria strikes.
Only one, from the Russian embassy in the United States, took a negative tone, claiming that the United Kingdom was behind the chemical attack in Syria, which triggered the Western strikes. It was copied to the State and Defense Departments.
Given that this comes from an official embassy account, it hardly qualifies as a covert influence operation. Thus, while the overall traffic on the @DeptofDefense Twitter handle did see a significant surge, this cannot be attributed to “Russian trolls.”
A number of users posted comments to the Pentagon’s Facebook page over the same period, at a higher rate than is usual for the page. However, the majority of comments were positive; again, it would thus be incorrect to attribute this surge to the activity of “Russian trolls.”
#SyriaStrikes
To look for a surge in troll activity elsewhere, we conducted a machine scan of the hashtag #SyriaStrikes from 8:00 a.m. EST on April 13 to 8 a.m. EST on April 14.
This revealed a much higher level of activity, with over 305,000 posts in the 24-hour period across all social platforms, with the great majority on Twitter. This is a high volume of traffic, but by no means exceptional for a breaking subject of broad political interest.
The great majority of posts to use the hashtag were negative ones, but their tone was not uniform. Some of the most-shared posts attacked the UK government for joining the strikes; others attacked President Trump, accusing him of launching strikes to divert attention from his domestic problems.
However, the main drivers of traffic over this period — measured in the number of retweets their posts gained — do not appear to have been Russian trolls. Many of them were verified or well-known accounts which viewed the strikes from the point of view of their own political concerns.
For example, one of the best-performing tweets (6,882 retweets) came from Dr. Eugene Gu, a verified user and healthcare columnist for The Hill, linking the strikes to President Trump’s domestic travails.
Another high-performing tweet (3,766 retweets) came from UK commentator @OwenJones84, a verified user and a long-standing critic of the British government.
Some high-performing tweets came from known supporters of the Russian and Syrian regimes. However, these users have long been active in their support; their current activity cannot, therefore, be taken as evidence of a surge in “Russian troll” activity, but rather a continuation of a long-standing pattern.
One account with only 336 followers posted a tweet which scored almost 17,000 retweets, a highly unusual performance. However, an initial scan of its posts did not betray obvious amplification by automated accounts; more analysis is needed on this point.
Overall, this traffic cannot be attributed to a surge in “Russian troll” activity. There were certainly pro-Kremlin accounts in the mix, some of them influential, but their activity was on much the same level as has been observed for months or years. The high volume followed the pattern of many other Twitter surges, in which varying users join the same hashtag to promote their own political stances.
Potential trolls
A few accounts did show more of the signs which we use to classify pro-Kremlin accounts. These were more targeted at the State Department (@StateDept), especially in replies to a State tweet which commented on Russian propaganda efforts.
We analyzed the accounts which replied to this tweet, considering that it was a likely target for troll responses. One of the replies came from an account called @EmpExposed, which accused the State Department itself of propaganda.
This account shows a number of the characteristics of pro-Kremlin trolls. It posts on the downing of Malaysian Airlines flight MH17 in a way, and with a use of language, characteristic of known Russian accounts.
It takes a pro-Kremlin view of relations with the West, accusing them of “poking the bear” and attacking the U.S. and NATO.
It regularly shares material from Kremlin and pro-Kremlin sources, as in these tweets, all posted on November 1, 2017.
This shows an interesting crossover between Russian and Iranian sources; however, the account also shares some content in Russian.
This, therefore, does appear to be a pro-Kremlin troll. Whether it is part of a broader operation, or a lone actor, is unclear from the evidence we have reviewed so far.
Another account which responded angrily to the State Department post was called @Hellerick.
This account is unusual in its behavior pattern. It has no profile picture and gives a location in Russia. Created in 2009, it had only posted 97 times by April 15, 2018. Its two most recent posts were in English and dated to April 2018; before then, the last time it posted, in Russian, was in July 2016. Its posts before then were in a mixture of Russian and English, and mainly concerned cartography, translation, and coding.
Some of its earliest tweets appear to be automated commercial shares of a now-defunct Facebook page.
This is clearly a Russian user, but to accuse it of being a “Russian troll,” in the sense of a part of a coordinated Kremlin operation, would go beyond the evidence.
A third account which replied angrily to the State Department tweet was called @Freedom4all117 (screen name “Love & Happiness”).
This account claimed to be a member of the National Rifle Association, and therefore presumably American. It promotes a number of narratives backed by the Kremlin: for example, that the flight of Ukraine’s then-president Viktor Yanukovych in February 2014 was an “American backed coup d’état,” and that the White Helmets rescue group in Syria are a branch of Al Qaeda.
Strikingly, its tweets show that it never mentioned Turkey until November 25, 2015, the day Turkey shot down a Russian jet. It then repeatedly attacked Turkey for “protecting” ISIS and selling its oil, which was an argument the Russian government repeatedly made after the shooting-down.
These are characteristics of known pro-Kremlin accounts. However, on other issues of importance to the Kremlin — notably the MH17 downing and the poisoning of Sergei Skripal — it was silent. The evidence therefore suggests that it is a pro-Kremlin account, but not necessarily that it is a “Russian troll.”
Overall, the level of response to the State Department tweet did not seem out of the ordinary. While there was some troll activity, there was no evidence of a major surge.
Conclusion
The available evidence does not support the Pentagon’s claim of “a 2,000 percent increase in Russian trolls in the last 24 hours.”
Traffic on the DoD’s own Twitter handle surged, and traffic on #SyriaStrikes was very high over the 24-hour period in question. However, neither traffic flow can plausibly be attributed mainly to “Russian trolls.”
Our scan did reveal a number of Russian and pro-Kremlin accounts which were active on the Syrian strikes. Some are well known, and @DFRLab has reported on them already; others appear here for the first time.
Overall, our review did not show evidence to back up the assertion of a 2,000 percent increase in “Russian trolls.” It may be that the Pentagon was working from its own sources, or looked in locations which our scan did not cover. However, it is much easier to blame activity on “Russian trolls” than to prove their presence. Based on the evidence we have seen so far, the Pentagon’s claim appears incorrect.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
