Thread: more analysis on the accounts Facebook took down two weeks ago, including their origins, how they interacted with Americans, and how they tried to cover their tracks.
Three posts. First one here: medium.com/dfrlab/trolltr…
Three posts. First one here: medium.com/dfrlab/trolltr…
We don't have 100% attribution. They hid their tracks better than the original Russian troll farm (more on that later).
Various pieces of evidence point to the probability this was the troll farm / Internet Research Agency again.
newsroom.fb.com/news/2018/07/r…
Various pieces of evidence point to the probability this was the troll farm / Internet Research Agency again.
newsroom.fb.com/news/2018/07/r…
First point, and the most concrete link: FB confirmed that one of the pages, "Resisters," had an admin which was a known Russian troll farm account, for just 7 minutes.
Not conclusive on its own, but an important point.
Not conclusive on its own, but an important point.
Second point: the "Resisters" FB page had the same logo as a Twitter account, @resistersunion.
Twitter reported that to Congress as being run by the troll farm.
Both accounts were created the same month, March 2017.
List online at democrats-intelligence.house.gov/uploadedfiles/…
Twitter reported that to Congress as being run by the troll farm.
Both accounts were created the same month, March 2017.
List online at democrats-intelligence.house.gov/uploadedfiles/…
The FB and Twitter pages weren't just created at the same time: they wrote their names the same way, "reSisters," as this image shows.
Note also the non-native language: "on the wake of," and "we recognize that Trump regime is illegitimate."
Note also the non-native language: "on the wake of," and "we recognize that Trump regime is illegitimate."
There was also a Twitter account called "Warriors of Aztlan," which shared name and creation month with one of the FB pages.
If anyone has any of its content archived, would love to see it.
If anyone has any of its content archived, would love to see it.
On top of that, there were occasions when the latest FB accounts posted exactly the same memes as earlier troll factory accounts.
Compare FB Ancestral Wisdom with troll account Black Matters (h/t @UsHadrons for the invaluable archive).
Compare FB Ancestral Wisdom with troll account Black Matters (h/t @UsHadrons for the invaluable archive).
Compare FB Resisters with troll farm account feminism.tag.
Compare FB Aztlan Warriors with troll farm account native_Americans_united.
That's three of the recent FB accounts, sharing content from three different troll farm accounts.
That's three of the recent FB accounts, sharing content from three different troll farm accounts.
On top of that again, there are the language errors. Inability to use "a" and "the", difficulties with singular / plural and possessive genitive.
Same types of errors as the original troll farm made.
Same types of errors as the original troll farm made.
In sum:
One troll-farm admin;
Identical to known troll-farm Twitter account;
Identical troll-farm content;
Language errors consistent with troll farm.
It's not a smoking gun, but the strong likelihood is that these accounts were run from the troll farm too.
One troll-farm admin;
Identical to known troll-farm Twitter account;
Identical troll-farm content;
Language errors consistent with troll farm.
It's not a smoking gun, but the strong likelihood is that these accounts were run from the troll farm too.
Now let's look at how they behaved (h/t @AricToler for the analysis and the sharp eyes).
Build an audience, then translate it into real-world activity.
medium.com/dfrlab/trolltr…
Build an audience, then translate it into real-world activity.
medium.com/dfrlab/trolltr…
The Resisters page tried hard to get Americans out on the street in protest against the Trump administration.
This wasn't about creating anger where none existed: it was about taking existing, sincerely felt, anger, and turning it to use.
This wasn't about creating anger where none existed: it was about taking existing, sincerely felt, anger, and turning it to use.
Some of the protests flopped, and protesters complained that the organisers didn't show up (more on that shortly).
Not surprising, given that they were probably trying to organise them from the Leningrad Oblast, but it shows the limitation of online agitation.
Not surprising, given that they were probably trying to organise them from the Leningrad Oblast, but it shows the limitation of online agitation.
Sometimes, the reason for the flop was obvious, e.g. organising a demo on New Year's Day.
The most successful events were the ones where they managed to get real Americans directly, and unwittingly, engaged.
These posts homed in on genuine anger, and steered unwitting Americans in the direction of confrontation.
It's an infiltration method, empowered by the easy anonymity and low degree of authentification provided by online interactions.
It's an infiltration method, empowered by the easy anonymity and low degree of authentification provided by online interactions.
The trolls tried harder to preserve their anonymity, too.
They were starting from a low base, because the original troll farm was amateurish. This lot were more professional.
medium.com/dfrlab/trolltr…
They were starting from a low base, because the original troll farm was amateurish. This lot were more professional.
medium.com/dfrlab/trolltr…
Facebook pointed out in its briefing that they used VPNs and internet phones more systematically.
They also tried to keep separate accounts apart; their 7-minute failure on this was one of the first giveaways.
newsroom.fb.com/news/2018/07/r…
They also tried to keep separate accounts apart; their 7-minute failure on this was one of the first giveaways.
newsroom.fb.com/news/2018/07/r…
Using Russian phone numbers was one of the things which tripped up earlier trolls.
Remember this gem, about @TEN_GOP, h/t @AltCyberCommand?
Remember this gem, about @TEN_GOP, h/t @AltCyberCommand?
That said, using internet phones (especially Google Voice) and VPNs is hardly rocket science. Microchip will tell you that.
medium.com/dfrlab/trolltr…
medium.com/dfrlab/trolltr…
They also came up with excuses for not showing up to their own demos.
I think of this one as "The dog ate my demonstrator."
I think of this one as "The dog ate my demonstrator."
This one was just feeble, as the would-be partners noted.
"Not coming to our own party, we found a better one."
"Not coming to our own party, we found a better one."
This was the ultimate effort: hire or otherwise bring onboard real, and unwitting, Americans.
What better way to mask yourself than to hide behind real people?
What better way to mask yourself than to hide behind real people?
It's striking how little original content some of these accounts posted, too. A way to disguise linguistic errors?
They either posted memes only, or plagiarised.
They either posted memes only, or plagiarised.
Upsum:
They were probably, though not definitively, troll farm accounts. They tried to coopt real Americans, and hide their tracks.
The troll operation didn't end in 2017: it looks like it evolved.
Ready for the midterms, and the 2020 election? /
Thread ends
They were probably, though not definitively, troll farm accounts. They tried to coopt real Americans, and hide their tracks.
The troll operation didn't end in 2017: it looks like it evolved.
Ready for the midterms, and the 2020 election? /
Thread ends
