#TrollTracker: From Tags To Trolling

How tweets to a small group precede attacks on critics of the Syrian and Russian regimes

Tweets by @RenieriArts posted between 10:25 and 10:32 am, UK time, on April 20, 2018, apparently calling attention to a tweet by Guardian journalist Heather Stewart. All archived on May 18, 2018. (Source: Twitter / RenieriArts)

A small group of Twitter users appears to have been conducting a campaign of targeted harassment against critics of the Syrian and Russian regimes for at least eighteen months.

Their apparent targets have included journalists, civil society, and open-source researchers. Some of their initial posts, though by no means all, have been followed by sustained online attacks on those targets.

Their method is relatively crude, using public posts to summon attacks. The core group is small: approximately fifty accounts. Nevertheless, some of its attacks have been so effective that they have drowned out other voices, dominating the conversation around the targets’ usernames with hostile tweets.

This post assesses how the group operates by analyzing some of its activities. This is only a sample: more have been attempted. It is important to recognize the methodology, as a first step in understanding the mechanics of online harassment.

Summoning The Group

On April 20, 2018, Guardian political editor Heather Stewart’s Twitter timeline suddenly showed a surge in activity. Mentions of her handle soared tenfold over the previous day, with the majority of posts bitterly hostile.

Part of the traffic was organic, driven by user reactions to an article on Russian disinformation, which she had just published. But analysis by @DFRLab shows that part was orchestrated, and generated by a small group of coordinated users.

Mentions of @GuardianHeather on Twitter, April 18–23, 2018, from a machine scan using Sysomos. The peak at 2pm on April 20 saw 887 mentions in an hour. The small peak at 10am on April 19 saw 81 mentions. (Source: @DFRLab, generated using Sysomos scan of @GuardianHeather on Twitter.)

The incident began overnight on April 19–20, when Stewart published an article headlined “Russia spread fake news via Twitter bots after Salisbury poisoning — analysis,” and promoted it with a tweet.

The article reported a British government claim that Russia had used online trolls and bots to generate a 4,000 percent increase in propaganda since the poisoning of former spy Sergei Skripal on March 4, 2018. The original version, archived here, and based on the government’s analysis, named two Twitter handles as “bots”: @Partisangirl and @Ian56789.

This was a misidentification. As @DFRLab has written (for example here, here and here), @Partisangirl is a prominent pro-Syrian regime activist, while @Ian56879 is a pro-Kremlin user, although not, as we originally suspected, run by a Kremlin influence operation. The Guardian article has since been corrected accordingly.

The two named accounts were quick to respond in their signature styles. @Partisangirl called Stewart a “lemming” and a “robot,” while @Ian56789 demanded a public apology. Mentions of their handles dominated the traffic around Stewart’s account from April 18–23, as this word cloud confirms:

Word cloud for posts mentioning Stewart’s account, April 18–23, 2018. (Source: @DFRLab, generated using Sysomos scan of @GuardianHeather on Twitter)

These reactions were hostile, and were heavily amplified by the two accounts’ followers. However, there is no evidence to suggest that this was a case of targeted harassment.

The Troll Whistlers

By contrast, the traffic which followed on the morning of April 20 appears to have been coordinated among a small group of users, with the apparent purpose of generating online attacks against Stewart.

Starting at 10:25am, UK time, an account called @RenieriArts, screen name “Carmen Renieri,” posted three tweets in quick succession.

Each post quoted Stewart’s initial tweet, called her article “another @Guardian smearpiece,” and tagged many other users — most of them vocal supporters of the Russian and Syrian regimes.

Tweets by @RenieriArts posted between 10:25 and 10:32am, UK time, on April 20, 2018, quoting Stewart’s tweet. All archived on May 18, 2018, (Source: Twitter / RenieriArts)

Tagging other users is, of course, a regular practice on Twitter. It serves to draw their attention to particular posts, usually as a way of asking for amplification or endorsement. However, it is unlikely that Renieri wanted to amplify Stewart’s post, given her criticism of it.

Rather, this appears to be an attempt to draw a large number of other users’ attention, not just to Stewart’s article, but to her tweet.

The immediate sequel to the three Renieri tweets was a series of abusive tweets sent to Stewart’s timeline by some of the accounts which Renieri had tagged.

Fifteen minutes after Renieri tagged it, for example, the account @Banjomarla posted a reply directly to Stewart’s tweet:

@Banjomarla’s reply to Stewart’s tweet. Archived on May 23, 2018. (Source: Twitter / @BanjoMarla)

This reply was personal, rather than critical: it accused Stewart of being “lame,” and called her report “the cheapest trick in town.” It was retweeted by Renieri and other accounts which she had tagged, including @wirt_dan and @The_Jag_10.

Retweets of the post by @BanjoMarla, showing @The_Jag_10, @RenieriArts and @wirt_dan. The URL of the original post is visible in the search bar. (Source: Twitter / BanjoMarla)

Other insults followed from other accounts which Renieri tagged. @Bickypeg, tagged at 10:28am, replied to Stewart at 10:51am, calling the Guardian “the thinking man’s Sun,” in reference to one of Britain’s tabloids. Soon after, @JasoneClarke replied to Renieri, but tagged Stewart, saying that he was ashamed of the latter; Renieri, @wirt_dan and @GeorgeSzamuely, another of the accounts tagged by Renieri, retweeted it.

Left: @JasoneClarke’s reply to @RenieriArts, tagging @GuardianHeather. Right: Retweets of the reply. Archived on May 23, 2018. (Source: Twitter)

The posts continued into the afternoon. At 11:27am, @malinka1102 quoted Stewart’s original tweet, calling it “fake news.” She then replied to Renieri’s original post, saying, “Just commented on @guardian @GuardianHeather #fakenews BS.” Renieri replied to confirm that she had retweeted the @malinka1102 post.

The exchange between @malinka1102 and @RenieriArts, archived on May 24, 2018. (Source: Twitter / @malinka1102 / @RenieriArts)

This exchange suggests both a degree of coordination, and that Renieri’s intent in tagging the group was to invite hostile comments against Stewart.

That was certainly the effect. By just after 2:30pm, @FriedemannWo, @AlleyMb (twice), @DanielLMcAdams, and @EvaKBartlett had all joined the conversation, either quoting or replying to Stewart’s original tweet in pejorative terms. Together, the tweets from @RenieriArts and those whom she tagged generated some 350 retweets and comments — roughly one fifth of all mentions of Stewart during that period.

An automatically generated word cloud for posts from 8:00am to 3:00pm that day shows that Renieri gained enough mentions to show up as a distinct, albeit minor, theme. Given that most of the attacks on Stewart from the tagged group did not mention Renieri, this suggests that the group had a significant impact on the conversation.

Word cloud of traffic around @GuardianHeather, 8:00am to 3:00pm, April 20, 2018; note the mentions of RenieriArts, bottom left. Generated by Sysomos. (Source: Sysomos scan of Twitter by @DFRLab)

The vocabulary used was only mildly abusive, using pejoratives including “crap,” “BS,” and “neocon Guardian rag.” Individually, none of these posts would qualify as especially intimidating. However, the coordinated nature of the efforts would have resulted in a large number of angry and insulting posts appearing in Stewart’s personal notifications, without the underlying coordination mechanism being apparent.

As such, Renieri’s tweets served to draw the other users’ attention, and insults, to Stewart’s post. This is similar to the practice known as “raiding,” in which users alert one another to online posts or communities in order to overwhelm the target with negative or controversial comments.

A Long History

The group which Renieri tagged has been active for a long while: as early as September 2016, she tagged many of them while retweeting posts from the BBC’s Panorama program to two journalists, promoting a documentary on the siege of Aleppo.

The first was Julian Roepcke of BILD Zeitung; the second was investigative journalist (and now Atlantic Council Senior Fellow) Eliot Higgins. Both have written extensively on open-source evidence of potential war crimes in Ukraine and Syria, and been attacked by supporters of the Russian and Syrian regimes as a result.

Archived on May 23–24, 2018. (Source: Twitter / @RenieriArts)

Strikingly, the second of Renieri’s posts did not contain any authored comment, only a quote from Panorama to Higgins, and the account tags. It would be implausible to suggest that Renieri tagged the other accounts because she wanted them to amplify Panorama’s post: again, this looks like an attempt to draw their attention to it.

A few of the members reacted. Users @malinka1102 and @marcelsardo added mocking replies to Renieri’s first post. Both tagged @BBCPanorama (and would therefore have been visible in its timeline); @malinka1102 also tagged Roepcke.

@Syricide quoted a BBC Panorama post about the documentary directly, calling the BBC “infamous” for fakes, and claiming that Aleppo was not under siege at the time. The other accounts tagged do not appear to have reacted.

This was not a major attack. It does, however, show the same methodology. Renieri retweeted the Panorama post, tagging a number of other users. Some of those users then sent hostile posts direct to Panorama.

Same Hits, Different Day

Journalists have not been the group’s only targets. On March 17, 2018, the director of Human Rights Watch, Ken Roth, shared an article in the New Yorker which analyzed the deaths of a number of critics of the Russian regime in the United States.

Fifteen minutes later, Renieri quoted the Roth tweet, and tagged many of the same accounts again. One minute after that, one of the tagged accounts, @2flamesburning1, replied directly to the Roth post which Renieri had tweeted, calling him an “idiot.”

Left, the @RenieriArts post sharing Roth’s tweet and tagging the group; note the time, 11:23 pm. Right, the @2flamesburning1 post, insulting Roth’s tweet; note the time, 11:24 pm. Archived on May 14, 2018. (Source: Twitter / @RenieriArts / @2flamesburning1)

As of May 24, @2flamesburning was not following Roth. The speed with which the account proceeded to attack him, once Renieri tagged it, suggests that the Renieri post was the immediate trigger.

According to a machine scan run with Sysomos, five of the accounts tagged by Renieri retweeted her post in short order: @MarcelSardo, @2flamesburning1, @VanessaBeeley, @Malinka1102, and @SueGrant54321.

Accounts which retweeted the @RenieriArts tweet, from Sysomos machine scan. (Source: Sysomos, annotated by @DFRLab)

Following on from these retweets, a number of accounts which follow the users in question added their own, largely personal, attacks on Roth.

Attacks on Roth by @dragg68, @NoParty2020 and @Nikita_Thierry, all of which follow Renieri and / or one or more of the accounts which retweeted her. Posts archived on May 23, 2018. (Source: Twitter / @dragg68 / @NoParty2020 / @Nikita_Thierry)

These attacks came swiftly. The first was twenty minutes after Renieri’s post, and just five minutes after Beeley’s retweet; the other two followed within ten minutes.

A little over an hour later, another account, @dp1970at43, tweeted a particularly hostile reply. This user follows several of the accounts tagged by Renieri, but does not follow Roth, making it probable that their attention was drawn to the Roth post by one of the retweets of Renieri.

Reply by @dp1970at43 to Ken Roth. Archived on May 23, 2018. (Source: Twitter / @dp1970at43)

The trail here was less clear than in the case discussed above; however, it again appeared that the effect of the Renieri tweet, when retweeted by the users whom she did tag, was to steer a number of other hostile users towards Roth’s post.

A Long Campaign

Renieri appears to have used the technique of tagging other group members most frequently, and most effectively, but other members also used it on occasion.

For example, on December 18, 2017, Guardian reporter Olivia Solon published a feature-length article on the disinformation campaign targeting the White Helmets rescue group, a campaign in which Syrian regime supporters Vanessa Beeley and Eva Bartlett play a leading role.

This article appears to have particularly incensed the Renieri group, as it criticized two of their leading voices. Repeatedly, over the following months, they appear to have drawn one another’s attention to quotes of it — at least once, with an explicit call for harassment.

The action began early. The morning the article appeared, one account often tagged by Renieri, @bodhibrian, shared a post criticizing the Solon article, and tagged several other familiar users, including @VanessaBeeley, @RenieriArts and @Ian56789, alongside RT commentator Neil Clark.

The same account shared the same post again just over an hour later, this time calling Solon a “scribbler and swindler,” and again tagging Beeley, Clark and others. They do not appear to have responded, and the tweets were not liked or retweeted: these posts are of interest because they show another member of the group apparently trying to draw its attention, albeit without success.

Posts by @bodhibrian tagging other members of the group, December 18, 2017. Archived on May 23–24, 2018. (Source: Twitter / @bodhibrian)

The next morning, @SoniaKatiMota, another account which Renieri has often tagged, posted a pair of tweets about Solon’s piece, tagging Beeley and Bartlett. The latter of these was a direct warning to Bartlett that she was mentioned in the “criminal propaganda sludge;” it also tagged @RenieriArts, @2flamesburning1, and @malinka1102.

Post by @SoniaKatiMota, December 19, 2017. Archived on May 23, 2018. (Source: Twitter / @SoniaKatiMota)

The purpose of the tweet was evidently to alert Bartlett; the inclusion of @RenieriArts, @2flamesburning1, and @malinka1102, who were not mentioned in the Guardian piece, appears to have been an attempt to attract the attention of other members of the network.

On this occasion, @2flamesburning1 did not respond; @malinka1102 and Bartlett had already posted their own comments, mocking the fact that Solon had protected her tweets. This suggests that @SoniaKatiMota’s warning was too late for relevance.

The attacks on Solon continued for some days. On December 20, Clark posted a tweet calling her article a “Russophobic hit piece” and accusing her of cowardice for protecting her tweets. “Russophobia” is a regular RT accusation against Kremlin critics, as @DFRLab has chronicled.

The same day, one of the experts whom Solon had interviewed, Professor Scott Lucas of Birmingham University, shared the Guardian article. A few hours later, another member of the Renieri group, @taigstaigs, replied that “You only add to @guardian’s disrepute”, and attached a photo which tagged, among others, Beeley and Renieri.

Left: Post by @taigstaigs, replying to Scott Lucas; note the accounts tagged beneath the photo. Right: The list of accounts tagged. Archived on May 24, 2018. (Source: Twitter / @taigstaigs)

Only one of those tagged, @JohnDelacour, responded; again, therefore, this post is of interest for the way it shows different members of the group tagging one another in cases in which they are attacking critics.

Solon provoked the group’s ire again on February 6, 2018, when she ran an article on the renewed disinformation campaign against the White Helmets ahead of the Oscars. The previous year, a Netflix documentary about the group had won the Oscar for best short-subject documentary.

This time, Beeley was the first to respond with a mocking tweet. She tagged Solon and a number of other users. Most were pro-Kremlin communicators, such as the Russian Embassy in the UK, RT show host Afshin Rattansi, and Sputnik radio host John Wight; however, Renieri was also mentioned.

Archived on May 24, 2018. (Source: Twitter / @VanessaBeeley)

Renieri first replied to Beeley, then posted her own tweet, tagging Solon, together with Beeley and further members of the group.

Archived on May 24, 2018. (Source: Twitter / RenieriArts)

On this occasion, several of the tagged accounts responded with their own mocking comments which also tagged Solon, and therefore would have appeared in her timeline. @Malinka1102 commented that Solon had protected her tweets again, “just like she did when she & @guardian published previous crap.”

@2flamesburning1 posted direct to Solon, accusing her of “mixing digital fantasy and reality,” and also tagging Harry Potter author J.K. Rowling, who has been a target for this group ever since she interacted with Aleppo girl Bana Alabed during the siege of the rebel part of the city in 2016.

Archived on May 24, 2018. (Source: Twitter / 2flamesburning1)

Some of the attacks were particularly personal, and show that the group had spent some time researching her professional and personal past.

@EvaKBartlett quoted a lifestyle article Solon had written in March 2016, apparently to question her credibility. Group member @KevorkAlmassian shared a blog post (now private) about shoes which Solon had written in 2011, in the same tone. @Bickypeg later called her a “bimbo who writes about shoes.”

@KevorkAlmassian also posted an image of Solon at a party, again in an apparent attempt to question her credibility. The practice of using what is obviously a personal photo to attack Solon’s professional credentials further underlines the extent to which this should be considered a harassment group, rather than legitimate criticism of the content of Solon’s article.

Yet another round of attacks began in May 2018, after British Member of Parliament Matt Pennycook shared Solon’s December article and tagged her.

In response, Renieri tweeted a call for a “tsunami” of responses to Pennycook’s tweet, and again tagged members of the group. This can only realistically be viewed as an attempt to invite just such a “tsunami” from them.

Archived on May 24, 2018. (Source: Twitter / RenieriArts)

The tsunami was not forthcoming. Beeley, @bsnews1 and @NeoTipPro had already replied. @Banjomarla replied directly to Pennycook, but merely challenged him to quote facts from the Solon article. The others remained silent.

Right to Reply

Before publication, @DFRLab gave these users the right to reply from our dedicated communications channel on Twitter, @DFRLabComms. In each case, we asked the users what their intentions had been in tagging one another. This was the first post, which typifies the series:

Archived on June 22, 2018. (Source: Twitter / @DFRLabcomms)

Few of the replies we received gave substantial answers or credible alternative explanations for their behavior. Most resorted to abuse and attempted mockery. Renieri again tagged other members of the group.

Archived on June 22, 2018. (Source: Twitter / @RenieriArts)

@Malinka1102 replied to Renieri’s tag. Her post suggested reporting @DFRLab for targeted harassment, without apparent irony.

Archived on June 22, 2018. (Source: Twitter / @malinka1102)

Bartlett accused @DFRLab of “fake news,” without asking what news, exactly, we were reporting. Other users showed their wit and verbal dexterity in a variety of insults.

The attacks quickly became personal, as members of the group expanded their comments from the @DFRLabComms account to members of the @DFRLab team.

Archived on June 22, 2018. (Source: Twitter / @EvaKBartlett)
Archived on June 22, 2018. Source: Twitter / @malinka1102 / @bodhibrian

A few of the answers contained at least an element of substance. One of our posts asked @2flamesburning1 how the user had become aware of Ken Roth’s tweet, to which it replied with the “idiot” comment. The response accepted the right to reply, and justified its comment to Roth, but did not answer our question.

Archived on June 22, 2018. (Source: Twitter / @2flamesburning1)

Renieri justified her call for a “tsunami” of comments to Pennycook by accusing him of insulting hundreds of people. This did not answer our question, which was concerned with the appearance that Renieri was inciting a “tsunami” of hostile comments to Pennycook.

Archived on June 22, 2018. (Source: Twitter / @RenieriArts)

None of these posts answered our main question, which was the users’ intention when they tagged one another. Lacking any arguments to the contrary, we therefore conclude that their intention was, indeed, to incite a wave (or tsunami) insults and abuse against the victims.

Conclusion

This cluster of accounts is active, aggressive, and coordinated. At key moments, and especially when accusations are made against the Syrian and Russian regimes or their supporters, group members share posts from the accusers, and tag one another.

One some occasions, though certainly not all, these tagged posts are followed by direct attacks on the accusers by members of the group, or their followers.

When such cases occur, the effect is to flood the Twitter space — and the target account’s notifications — with hostile, angry, and personal posts.

Anger and critical comment are part and parcel of debate on Twitter. However, these tagged posts go beyond that. They appear to be an attempt to gather a group of vocal users around critics of the Syrian and Russian regimes, to then shout down, humiliate or intimidate those critics.

The approach does, however, have its limitations. Publicly posting in this way betrays the size and composition of the group. By no means all the attempts led to such mobbing; sometimes, members ignored them almost completely.

Finally, it shows how small the group is. Renieri’s three posts on Stewart tagged just under fifty accounts — the largest collection around a single issue. These same accounts feature repeatedly in many of the attacks which journalists, NGOs and analysts who focus on Russia and Syria have suffered over the years.

This is not a massive online movement: it is a small, highly active and partially coordinated one which achieves its impact by clustering around its targets, and attempting to swamp the conversation.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.