Aug 16, 2018
#TrollTracker: Russian Traces in Facebook Takedown
Part One — Assessing the origins of the “inauthentic” accounts
On July 31, Facebook announced the removal of around 32 pages and accounts on its platform for coordinated and inauthentic behavior.
Facebook shared eight pages with @DFRLab 24 hours before the takedown, and our initial findings were published within that timeframe.
The pattern of behavior by the accounts and on the pages in question make one thing abundantly clear: they sought to promote divisions and set Americans against one another. Their approach, tactics, language, and content were, in some instances, very similar to accounts run by the Russian “troll farm” or Internet Research Agency between 2014 and 2017.
The malign influence operation showed increasing sophistication. Three follow-up aspects to our initial findings include converting online engagement to real world action, shifting tactics to cover tracks, and crossover posting of content from bad actors on different platforms or accounts.
@DFRLab intends to make every aspect of our research broadly available. The effort is part of our #ElectionWatch work and a broader initiative to provide independent and credible research about the role of social media in elections, as well as democracy more generally.
This post investigates how the set of pages Facebook took down on July 31 had a tailored focus on building a mostly static online audience then translating it kinetic political activity in the United States.
The Facebook accounts which promoted divisive issues in America and were shuttered by the platform on July 31, 2018, were most probably run by a successor to the Russian influence operation which targeted the United States from 2014 to 2017, @DFRLab has concluded.
One key question is whether the accounts were run by a successor to the Russian-based “Internet Research Agency” (IRA) which targeted the U.S. in 2014–17. Facebook itself did not draw a firm conclusion, saying that “we can’t say for sure whether this is the IRA with improved capabilities or a separate group.”
A considerable body of evidence provided by Facebook and independent researchers does support the thesis that the latest accounts were either run by, or linked with, the IRA troll farm. This post assesses that evidence.
Internal Evidence From Facebook
The first piece of evidence was presented by Facebook when it announced the takedown.
One of the IRA accounts we disabled in 2017 shared a Facebook Event hosted by the “Resisters” Page. This Page also previously had an IRA account as one of its admins for only seven minutes.
The fact that the “Resisters” page had an administrator from the original troll farm was the most direct link between the recent accounts and earlier troll farm operations. It shows a direct interest in the Resisters page and direct engagement with it.
It is not enough on its own to prove that the Resisters page was itself a troll-farm creation; as Facebook underlined:
“We have also seen examples of authentic political groups interacting with IRA content in the past.”
It does, however, show a direct relationship between the closed accounts and the original troll operation.
The Twitter Connection
A second internal cross-reference comes from Twitter, which shared a list of over 1,000 accounts it attributed to the IRA with U.S. Congress in May. The list included the handles @resistersunion and @aztlan_warriors.
The former had the same screen name, “ReSisters,” as the Facebook account @resisterz. According to a screenshot of one of its posts, preserved by Indian website ndtv.com, it had the same logo as the Facebook page.
The name “reSisters” was written identically, with a capital S as the third character: compare the Twitter handle above with the text from the Facebook page below.
This was unlikely to have been a case of one account pirating the logo of a better-established genuine one. The Facebook page was created on March 21, 2017; according to a Google cache of some of its posts, the Twitter account was created the same month.
The @warriors_aztlan Twitter account bore a very similar name to the Facebook account @warriorsofaztlan. The Facebook account was created on March 21, 2017; according to an article by the Washington Post, the Twitter account was set up the same month, and posted similar comments on white crimes against Native Americans. The Twitter posts were not archived or cached; the Washington Post article was the one source for this claim.
Twitter’s conclusion that the accounts on its platform were run from the troll farm reinforced the likelihood that the Facebook accounts with equivalent names were, too.
Sharing Content
The Facebook and Twitter conclusions were based on internal data, which open source analysis could not replicate. More visibly, @DFRLab previously highlighted how the accounts which Facebook closed shared similar content to former known troll-farm accounts.
Following the publication of @DFRLab’s report, online researcher @UsHadrons pointed out that three posts — one from each of three accounts — shared memes which were not merely similar, but identical. @UsHadrons manages a Medium page, which archives several thousand posts from known Russian troll accounts, reconstituted from Instagram, Facebook, Twitter, and online articles.
The first, posted by Ancestral Wisdom on May 21, shared the same meme as one posted by troll farm account Black Matters.
The second, posted by Resisters on June 16, shared the same meme as confirmed troll Instagram account @feminism.tag.
The third, posted by Aztlan Warriors on June 28, 2018, shared the same meme as a post made by known troll farm Instagram account native_americans_united on July 1, 2017.
In other words, three of the accounts which Facebook found to have been inauthentic posted images identical to those of accounts which were known to have been run by the troll farm in 2014–2017.
There are a number of possible explanations for this. It could be a coincidence. It could be the result of an external actor seeking to copy the troll farm — although in that case, such an actor might have been expected to reproduce its content more often.
It could also indicate that the three accounts were run by the same team in the troll farm as the earlier, known accounts, and that its members recycled some of their earlier content.
Language Clues
A further point, which @DFRLab previously reported, is the suspect accounts’ non-native use of English. A number of basic grammatical errors, especially from the Resisters page, were characteristic of native-Russian speakers.
These included an inability to use the words “the” and “a” appropriately, and an inability to match singular and plural nouns and verbs, as in this post, which argued that “a regular women need clothes too.”
This post began, “Since the beginning of the times,” and claimed that “finally the society realized that.”
Another account, Progressive Nation, made similar gramatical errors, and also struggled with the possessive genitive. This post deriding U.S. President Donald Trump, for example, began, “Whomever said he’s the people president need a reality check.”
This post praised migrant workers as “a needed and important humans.”
Relatively few of these accounts’ posts contained original text; most consisted of memes, or copied content from elsewhere. The number of grammatical errors to creep into so few posts was therefore all the more striking.
Conclusion
The importance of these various features is their cumulative effect. Taken individually, none would be conclusive. Taken together, they build a consistent picture, and each reinforces the others.
Facebook found that the Resisters page was, for a very brief period, administered by an account known to have been run from the troll farm in Russia. The same page made basic grammatical errors which are particularly characteristic of Russian speakers.
The Resisters and Aztlan Warriors pages on Facebook closely resembled Twitter accounts which were traced back to the troll farm, and which were created around the same time.
The Resisters, Aztlan Warriors, and Ancestral Wisdom pages all shared content which earlier troll accounts had posted. More broadly, they posted messaging which was closely aligned with the troll farm’s earlier productions, and which targeted discontent and division in social groups which the troll farm also targeted.
Facebook’s then-head of security, Alex Stamos, wrote that some of the tools, techniques and procedures of the latest accounts were “consistent with those we saw from the IRA in 2016 and 2017,” but that those practices “have been widely discussed and disseminated, including by Facebook, and it’s possible that a separate actor could be copying their techniques.”
While true, this did not explain the overlap with the Twitter accounts, which were created with very similar names, on very similar dates, and with very similar areas of focus, and were traced back to the troll farm.
In summary, the accounts which Facebook closed had connections with earlier troll farm accounts, shared content also posted by earlier troll farm accounts, made linguistic errors characteristic of earlier troll farm accounts, and appeared related to earlier troll farm accounts on Twitter.
We therefore conclude that the balance of probability — although not yet a certainty — is that these latest accounts were run by the troll farm, or a related or successor organization, and represented a continued attempt from within Russia to polarize political debate in the United States.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
@DFRLab is a non-partisan team dedicated to exposing disinformation in all its forms. Follow along for more from the #DigitalSherlocks.
DISCLOSURE: @DFRLab announced that we are partnering with Facebook to expand our #ElectionWatch program to identify, expose, and explain disinformation during elections around the world.
The effort is part of a broader initiative to provide independent and credible research about the role of social media in elections, as well as democracy more generally.
For more information click here.
