#TrollTracker: Favorite Russian Troll Farm Sources

Measuring the websites and accounts the Internet Research Agency shared most

Sample of accounts retweeted by the Russian troll farm. (Source: @DFRLab, from Twitter data)

Russia’s Twitter troll operation preferred retweeting American Twitter commentators from the “alt-right,” but shared news sources from all parts of the political spectrum, according to a database of tweets published by Twitter.

The English-language troll operation conducted by the “Internet Research Agency” in St. Petersburg ran from at least 2013 to 2018. It aimed at undermining Democratic presidential candidate Hillary Clinton’s election chances, dividing Americans, and supporting the Kremlin’s policies.

The operation tried to infiltrate and polarize American communities on the right and left. To do so, it regularly retweeted American commentators and shared American news stories.

Trump First

@DFRLab scanned the archive of over nine million Russian troll farm tweets using the glogg application (glog.bonnefon.org), which can handle very large data files. Each search was limited to a text phrase, such as “RT @RealDonaldTrump”. This gave a close approximation of the number of retweets, with a handful of false positives (e.g. a text saying “support Donald Trump” would also show up).

The troll farm’s accounts retweeted Donald Trump 3,970 times, more than any comparable figure. The retweets were especially frequent in the second half of 2016 — the last months of presidential campaigning — and the first months of 2017, as Trump’s presidency began.

Russian troll farm retweets of @RealDonaldTrump. (Source: Twitter)

The great majority of retweets came from a single account, @CovfefeNationUS and covered a wide range of Trump’s interests.

Tweet by @RealDonaldTrump on July 4, 2015. Retweeted by Russian troll account @JohnieBoyCooks on July 5, 2015. (Source: Twitter / @RealDonaldTrump)
Tweet by @RealDonaldTrump on June 12, 2016. Retweeted by Russian troll account @CovfefeNationUS on June 15, 2016. (Source: Twitter / @RealDonaldTrump)
Tweet by @RealDonaldTrump on September 10, 2016. Retweeted by Russian troll account @PaolaKink on September 12, 2016. (Source: Twitter / @RealDonaldTrump)
Tweet by @RealDonaldTrump on June 12, 2016, retweeted by Russian troll account @KateRitterrrr on September 17, 2016. (Source: Twitter / @RealDonaldTrump)

That compares with 196 retweets of Trump’s conservative rival Ted Cruz, and just 13 retweets of early Republican candidate Jeb Bush.

Tweet by @JebBush on September 16, 2016, retweeted by Russian troll account @cassishere. (Source: Twitter / @JebBush)

On the Democratic side, the troll accounts retweeted Senator Bernie Sanders 256 times and Hillary Clinton 250 times.

Russian troll farm retweets of @HillaryClinton. (Source: Twitter)

The retweets of Clinton appear to have been positive, and to have come in two clusters, in early 2015, as she began her campaign, and late 2016, in its later stages.

Tweet by @HillaryClinton, retweeted 32 times by various Russian troll accounts. (Source: Twitter / @HillaryClinton)
Tweet by @HillaryClinton, retweeted 30 times by various Russian troll accounts. (Source: Twitter / @HillaryClinton)
Tweet by @HillaryClinton, retweeted 28 times by Russian troll accounts. (Source: Twitter / @HillaryClinton)

It was unclear why the troll accounts were used to retweet Clinton: it may have been an attempt to establish their bona fides with a group of Clinton supporters.

The Russian accounts paid a similar level of attention to Green leader Jill Stein (@DrJillStein), retweeting her 262 times. Most were during the election campaign, and attacked Clinton, such as the below.

Tweet by @DrJillStein, retweeted by Russian troll account @MissouriNewsUS on June 28, 2016. (Source: Twitter / @DrJillStein)
Tweet by @DrJillStein, retweeted by Russian troll account @AmelieBaldwin on October 16, 2016. (Source: Twitter / @DrJillStein)

Some came after and attacked Trump.

Tweet by @DrJillStein, retweeted by Russian troll account @AmelieBaldwin on February 27, 2017) (Source: Twitter / @DrJillStein)

Most of these posts were in line with the troll operation’s priorities of supporting Trump and attacking Clinton before the election, and deepening America’s political divides after it.

Alt-right Amplification

The troll accounts frequently retweeted voices on the American “alt-right” — significantly more than their left-wing rivals.

Sample of accounts retweeted by the Russian troll farm. (Source: @DFRLab, from Twitter data)

Among a sample of leading partisan and media voices online, top billing went to InfoWars editor Paul Joesph Watson, Twitter handle @PrisonPlanet, whom the troll accounts retweeted 3,215 times.

Tweet by @PrisonPlanet, retweeted by Russian troll account @TheFoundingSon. The article was from Infowars. (Source: Twitter / @PrisonPlanet)

They retweeted alt-right — and self-described “Slav-right” — activist Jack Posobiec 1,396 times, including on one of the occasions when he quoted Russian troll account @TEN_GOP.

Tweet by @JackPosobiec commenting on a post by Russian troll account @TEN_GOP, which @TEN_GOP in turn retweeted. Posobiec deleted all comments on @TEN_GOP once it was exposed as a Russian account, but Google cached this tweet, now archived. (Source: Twitter / @JackPosobiec, via Google cache)

Other leading alt-right voices on the trolls’ favorite lists included Mike Cernovich (753 times) and conspiracy theorist Alex Jones (625 times). The anonymous — allegedly American — troll and bot herder known as “Microchip,” whose accounts all began @WDFx2EU, and were suspended for violating Twitter rules at least eight times during the election, was retweeted 383 times.

Conservative Voices

The Russian troll farm accounts also gave significant coverage to conservative voices. They retweeted Fox TV host Sean Hannity 990 times, Fox host Laura Ingraham (@IngrahamAngle) 704 times, Trump advocate Ann Coulter (@AnnCoulter) 652 times, and Trump advisor Kellyanne Conway (@KellyannePolls) 356 times.

Tweet by @SeanHannity retweeted by Russian troll account @AmelieBaldwin. (Source: Twitter / @seanhannity)

These retweets significantly outnumbered retweets of liberal or left-leaning users. The troll accounts retweeted pro-Democratic activists Brian Krassenstein (@Krassenstein) and Ed Krassenstein (@EdKrassen) 33 and 32 times respectively. They retweeted MSNBC host Rachel Maddow (@maddow and @maddowblog) 26 times, and leading “Resistance” account @ProudResister 25 times.

Tweet by @ProudResister, retweeted by @JemiSHaaaZzz. (Source: Twitter / @ProudResister)
Tweet by @maddow, retweeted by Russian troll account @AmelieBaldwin. (Source: Twitter / @maddow)

The Russian troll accounts retweeted CNN anchors and hosts Jim Acosta (@Acosta) 32 times, Jake Tapper (@jaketapper) 164 times, and Anderson Cooper (@andersoncooper) five times. By contrast, they mentioned CNN and its anchors over 1,500 times, chiefly in 541 tweets from @CovfefeNationUS to CNN’s leading voices, calling CNN “fake news.”

Tweets by Russian troll account @CovfefeNationUS addressed to CNN anchors, calling them “fake news.” (Source: Twitter / @CovfefeNationUS)

Sharing Websites

The troll accounts also shared conspiracy theorizing and alt-right websites prolifically. However, they were broadly balanced in this by their shares of genuine news websites.

Sample of websites shared by Russian troll accounts. (Source: @DFRLab, from Twitter data)

Among a sample of prominent sites, Fox News was the most shared: the troll accounts posted links to Fox articles over 3,800 times (sometimes more than one troll posted the same link).

Headline on Fox News shared by Russian troll account @PatriotBlake. The article led to a YouTube video which has since been deleted. (Source: Fox News. Sharing data from Twitter)

Kremlin broadcaster RT’s URL, on.rt.com, came a close second, with 3,654 shares. Conservative pro-Trump site Breitbart was third, some distance behind, on 3,156 shares.

Headline from Breitbart shared by Russian troll account @Pamela_Moore13. (Source: Breitbart. Sharing data from Twitter.)

The Washington Post and arch-conservative site Gateway Pundit were almost neck and neck, with 2,314 and 2,042 shares respectively. Many of the Washington Post shares, however, came from Russian troll account @WashingtonOnline, which masqueraded as a local news site by sharing links from the Washington Post, Washington Times and NBC Washington; the broader troll farm’s interest in Washington Post copy was considerably lower.

Screenshot from a scan of posts by @WashingtOnline, showing the shares of local media outlets. (Source: Twitter)

The Russian troll accounts also gave almost equal billing to the New York Times and Infowars, with Infowars just winning the shares (1,264 against 1,250). Many of the Infowars shares came in the shape of retweets of Jones and Watson, its two leading voices online, showing the troll accounts’ simultaneous amplification of the outlet and its messages.

Screenshot from a scan of Russian troll account posts mentioning Infowars.com; note the retweets of Jones and Watson. (Source: Twitter)

These shares paled beside the massive amount of Russian-language content the troll accounts shared from overt or covert government sites such as russian.rt.com (73,083 shares) and riafan.ru (428,835 times, mostly from the troll factory’s own account, @riafanru). Russians were the trolls’ first targets.

Conclusions

The Russian troll farm accounts were widely read, both on social media and in media.

They showed a marked preference for conservative and alt-right accounts, especially during the 2016 election year; their attention to the left grew after Trump’s election victory.

These choices reflected the operation’s two main goals: preventing Clinton’s election, and promoting divisive content.

As the Posobiec and @TEN_GOP exchange demonstrates, the Russian troll farm accounts both amplified American users. They were also more notably amplified by them. There is no open source evidence to suggest that the American users knew they were working with a foreign influence operation; rather, it shows how carefully the Russian troll accounts crafted their messaging to infiltrate the target communities.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Kanishk Karan is a Digital Forensic Research Assistant at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.