How a Russian Troll Factory Tried to Influence The Ukrainian Agenda

Editor’s note: The original article was published in Ukrainian and English by VoxUkraine. The article has been edited by Hromadske International for clarity.

VoxUkraine has analyzed over 755 thousand tweets connected with Russia’s Internet Research Agency and uncovered evidence of numerous information attacks. How does this form of Russian propaganda work?

In mid-October Twitter.Inc published a dataset of over 9 million tweets that, according to the social network, are “believed to be connected to the Russian Internet Research Agency”. It is possible that the tech giant’s decision to publish the data is a result of the investigation into the Russian security service’s interference in the 2016 US presidential elections.

The published data contains information on 3667 accounts that are associated with the Russian Internet Research Agency – also known as a troll factory.

We have already written about the influence of Russian twitter-bots on the Brexit referendum: Vox Ukraine co-founders Alexander Talavera and Yuriy Gorodnichenko were the first ones to prove that Russians tried to affect the Brexit results.

We set ourselves the task of investigating whether any of those accounts associated with the  Russian Internet Research Agency made any attempt to influence Ukrainian Twitter-users’ opinions on issues or events in the country. To do this, we found 755 thousand tweets relating to Ukraine using keywords. In this analysis, we have explored the subject matter of the tweets, defined the most popular events covered over the last eight years and found accounts that had been tweeting for almost 33 hours straight.

What was in the 9 million tweets – how we calculated it

In the dataset, 55% of the tweets were in Russian, 37% in English, and 8% in other languages. VoxUkraine decided to analyze how many tweets were directly related to Ukraine. Using keywords, we filtered out 9 million tweets that were very likely to contain messages related to Ukraine. The keywords search helped us to detect almost 755 thousand tweets.

In order to identify theses messages, we searched for tweets on hot Ukrainian topics, personalities (president Petro Poroshenko and ex-president Viktor Yanukovych, for example) and key narratives of Russian propaganda, as well as different variations on the word "Ukraine."

We searched for tweets posted between October 2010 and May 2018

A complete list of marker words translated from Russian:

South East, Donbass, Boeing, IMF, Bandera, banderites, punisher, pro-Russian fighter, fascism, AFU, Kyiv, revolution, Maidan, Crimea, Donetsk, Luhansk, Russia-Ukraine, Poroshenko, Yanukovych, civil war, DPR, LPR, people's republic, State Department, conflict in Ukraine, Ministry of Defence of Ukraine, MH-17, Natural gas transmission system, Tymoshenko, khokhly, resettlers.

Who published the tweets: information about the accounts

For a period of just over eight years, we found 774 957 tweets about Ukraine in troll factory dataset. They were generated by 1369 account, which are now deleted from the social network. Twitter anonymized the accounts that had less than 5,000 subscribers, therefore we can see only 5% of the usernames from the database. We can breakdown these accounts into categories:

• Media pages: Vestnyk Moskvy (Moscow Herald,) Vestnyk Peterburga (Petersburg Herald) and 24 other regional “Vestnyks” in total), as well as Federalnoe agentstvo novostey (Federal news agency) Novyny Kyeva (Kyiv News.)
• Pages with names: Maksym Dement'ev, Maria Mozhayskaya
• Thematic pages: Ramzan Kadyrov, which is described as a parody page of head of Chechen Republic, Myusli Lavrova (Lavrov Thinks), in Russian, Kholodnaya voyna 2.0 (Cold war 2.0.)

The most followed pages were Vestnyk Moskvy, which had 257 thousand subscribers, Vestnyk Peterburga with 149 thousand and Maksym Dement'ev — 134 thousand. 3.4 million users in total followed these 1369 accounts.

Most of the time, the account owners state that they are located in Moscow (26%) and St. Petersburg (16%), which means we do not know their exact location. 17% did not mention their location at all.

When trolls were the most active

The first tweet from the sample is dated January 2010, so we were able to analyze the trolls’ activity before and after the Ukrainian Revolution of Dignity.

Before the start of the Revolution of Dignity in November 2013, and over the three months that followed, the Twitter trolls did not show much interest in Ukraine: the accounts from our sample demonstrated really low activity. In total, by the spring of 2014, all accounts were publishing an average of 10 tweets per day, and the highest number of posts for this period was seen on the day of the Ukrainian parliamentary elections, on October 28, 2012, when a maximum of 90 tweets was reached.

100 tweets per day mark was reached the day after the illegal "referendum" in Crimea, on March 17, 2014. On this day, the accounts posted 116 tweets, and on March 18 — the day of Russia's annexation of the peninsula — 129 tweets.

The accounts connected with the Russian troll factory increased productivity on May 23, 2014 –  two days before the presidential elections in Ukraine, whhen 263 tweets were published. Over the next six months the number of daily tweets was less than 115.

The biggest number of tweets for the eight years was on July 18, 2014 — the next day after MH-17 plane crash. On this day the accounts twitted over 44 thousand messages, and on the next day — over 25 thousand.

An eloquent hashtag

One of the most effective methods to spread a tweet and to make it trend on Twitter is by adding a hashtag. In our selection, we found over 6,200 different hashtags. What do they include?

The most popular hashtags used in tweets relating to Ukraine (translated from Russian) were #KyivProvocation with 22.3 thousand references, #KyivShotDownBoeing with 22.1 thousand and #KyivTellTheTruth with 21.9 thousand. They appeared on first days after the MH-17 catastrophe occurred — on July 18-20. 327 accounts participated in the campaign that promoted these hashtags. Considering these are depersonalized accounts, we tried to figure out their behavior pattern in the period from July 18 to July 20, 2014.

Top performing accounts

The first thing that caught our attention is the fact there are a number of tweets from one account. The most active account from the selection for the period from July 18 till July 19 (as there were no publications on July 20) posted 296 tweets and retweets in total. Weirdly enough, there are many of these "overachievers." On July 18-20, 2014, there were 277 accounts working at this rate. They posted 196 and more publications in this period of time.

Why did we stop at 196? Because there is a difference of 155 tweets between user No.277 and user No.278 in the rate. That's why we'll continue analyzing 277 accounts.

How could one person could post 296 times in two days? At the very least, one would need to be an extremely hard worker. This account was tweeting for 33 hours straight without significant breaks. On average, they posted every 6 minutes and 42 seconds, and the largest break between posts was on July 19, only from 11:31 till 14:50. As we can see in the visualization, over 200 accounts were working at this rate of productivity.

We can assume that several people were managing one account. One way of confirming this is by looking at how the tweets were posted. Users usually tweet directly from the Twitter website or from the mobile app, and the tweets are marked as either "Twitter Web Client" or "Twitter for Android/iOS" in the dataset.

The tweets can also be published using a special app — a client service. This is a special service for publication and management of one or several accounts.

One can use already existent client services or create your own for working with several accounts. Twitter allows for developers to publish, edit, delete and make other manipulations without visiting the website, only using API. Several services showed strange activity in July.

For example, by using the client service "token_app", Twitter users published their messages only from July 7 till July 19, 2014, and using a "twisofter" — from July 16 till July 19, 2014. The largest number of posts published on July 18 and 19 —  19,300 and 11,200 thousand tweets respectively, or 43% and 40% of the total amount in the corresponding day — were made with the help of “twisofter” software.

Client service "token_app" kept almost the same pace — 18,100 and 10,400 thousand tweets (also 43% and 40% of the total amount in the corresponding day). There are no mention of  these services in search engines. There is a possibility that these client services were created only for a specific customer, or a specific task, and weren't promoted to the wider audience the same way a new app is, for example.

Content of the tweets

55% of tweets out of almost 755 thousand are unique. It means they are not shared (retweeted) from other accounts.

Unfortunately, 98% of tweets were generated by anonymous accounts, so we can't figure out, who shared the content. But we can analyze the pages and the content that was retweeted the most.

The most retweeted post belongs to a user with the nickname _drBre, which is now deleted. He's the author of the first and the second tweets (632 and 537 retweets, respectively) from our selection that gained a huge number of shares. In third place was “Pysma na front” ( Letter to the frontline, @frontlineletter.)

In total, the most popular sources of shares among 1369 accounts were from Russian media. The first place being RIA Novosti with 23,000 retweets, in the second place — Federalnoe agentstvo novostey (Federal News Agency) with 16,000 retweets, and in third place – Russia Today with 14,000 retweets.

But Russian media did not attract as many shares per single post. For example, the leader in the total number of retweets, RIA Novosti, had a maximum of 19 retweets per post. Federal News Agency had 80 retweets, which is four times more than RIA Novosti. However, we are not only interested in the number of retweets, likes or even content. The time of publishing is another way of confirming that one person managed several accounts.

18 out of 19 accounts that shared the RIA Novosti post did so simultaneously — at 16:28 on September 28, 2015. The same happened to Federal News Agency. Their most popular tweet (with 80 retweets) was published by 45 different accounts at 16:34 on July 17, 2014, and by 35 other accounts at 16:43 the same day.

Conclusion

• For just over 8 years, in the troll factory dataset, we found 774,957 tweets about Ukraine that were generated by 1369 accounts. Before the annexation of the Crimea, twitter bots showed almost no activity: the most posts for the period from 2010 till 2013 were on the day of the Ukrainian parliamentary elections in 2012 (90 tweets). The accounts from the selection began to tweet more actively at the end of 2014: before the presidential elections (May 23) 263 tweets were published. For the next six months, the number of tweets was no less than 115 per day.
• The real Twitter-storm was on July 18, 2014 — the day after the downing of MH-17. On this day, the accounts tweeted over 44,000 messages, and the next day — over 25,000. Over these days, 297 accounts promoted information that Ukraine was responsible for shooting down the Boeing, using the hashtags #KyivProvocation (22,300 references), #KyivShotDownBoeing (22,100) and #KyivTellTheTruth (21,900.)
• Over 200 accounts were managed centrally. In addition to the fact that Twitter connects all the accounts from the dataset with Russian Internet Research Agency, we found two confirmations that several accounts belong to one owner. There was also the strange activity of two client services that were working with Twitter from July. For example, the "twisofter" service was used for tweeting only during July 16-19, 2014. The biggest number of posts were made on July 18 and July 19 — 19,300 and 11,200 tweets (or 43% and 40% of the total amount on the corresponding day). Another service called "token_app" had the same history. There is no mention of these services in the search system. Accordingly, there is a possibility that these services were created only for a specific task.
• The second confirmation is the content. 18 out of 19 accounts that shared the most popular RIA Novosti post over the 8 years were made simultaneously — at 16:28 on September 28, 2015. The same happened with Federal News Agency. Their most popular tweet (80 retweets) was published by 45 different accounts at 16:34 on July 17, 2014, and by 35 other accounts at 16:43 the same day.

/By Oleksandr Nadelnyuk, VoxUkraine Analyst