Thread by @benimmo

BREAKING: @TWITTER just published the full dataset of tweets from the Russian and Iranian troll farms.

9 million Russian tweets. 1 million Iranian tweets. #motherlode

They gave @DFRLab a look ahead of time.

Thread on the findings to follow.

blog.twitter.com/official/en_us…

Main takeaways. The troll operations:

- were about the home government first
- had multiple goals
- targeted specific activist communities
- apolitical
- opportunistic
- evolved
- not always high-impact

medium.com/dfrlab/trolltr…

First point: the troll operations started off as defending the home government.

Timeline on 9 million Russian tweets here.

Russian-language posts outnumbered the English ones, and peaked higher and earlier.

Russians were the first targets.

Here are the top ten geopolitical phrases mentioned by the Iranian troll operation, from the archive of 1 million tweets.

This wasn't about interfering in America, it was about promoting Iranian government narratives.

For those who are interested in the Iranian network, the Iranian troll accounts shared links from awdnews.com over 300,000 times.

AWD is part of the Iranian messaging laundromat.

That's 1/3 of +all+ their traffic.

On the Russian side, the troll accounts posted 19,000 times the day before #MH17 was shot down, and 57,000 times the day after.

Main hashtags: #КиевСбилБоинг (“Kiev shot down the Boeing”), #ПровокацияКиева (“Provocation by Kiev”), and #КиевСкажиПравду (“Kiev, tell the truth”).

During the "Manezhka" demonstrations in late 2014 / early 2015, the Russian troll accounts went into overdrive.

Over 2k posts on #АнтиМанежка2, for example.

Fits what we know from @Soshnikoff about how the trolls targeted the Russian opposition.

#KremlinFirst

There was really funny stuff in there, too. This post (not suspended) picked up on a troll farm hashtag wishing Lavrov a happy birthday.

So sweet.

The English-language troll accounts defended Russia when it was needed, too.

Case in point, the 781 posts they made on the Mueller "witch hunt." Part authored, part retweets of sites like Infowars and Zerohedge.

The Iranian operation was always about spreading Iranian state narratives. The Russian one had multiple goals.

One was always, +always+, to stop @HillaryClinton.

Two days after she announced her candidacy, they launched #HillaryNoThnx.

Here go the Russian troll accounts on #CrookedHillary. Almost 2,000 mentions.

They're not the ones who made it, and not the ones who pushed it most, but it shows their intent.

As part of the same thing, we know they targeted Bernie Sanders supporters.

Sucking support away from Hillary.

On the Republican side, they were a lot more nuanced. There were pro-Trump and anti-Trump posts, and pro-Cruz and anti-Cruz ones.

They swung behind Trump big time in the countdown to the election.

This was the legendary @TEN_GOP on election day, claiming voter fraud in favour of Clinton. Again, not the origin of the video or the story, but this one post got over 25,000 retweets.

Impact.

It wasn't just about the election, though. Right from the start, the troll farm targeted racial, ethnic, religious and gender divides.

These are some of the first accounts. 2013 vintage, #BlackLivesMatter bios.

And slightly older, but still vintage, their crop of #BlueLivesMatter bios.

They moved with the times, too. After the Twitter mass suspension in late 2017, the troll farm set up new accounts.

A lot of them masqueraded as the #Resistance.

But they kept on the #MAGA impersonations, too. As experts like @josh_emerson have pointed out, this was "Marlboro Man," their attempt to recreate the success of accounts like @SouthLoneStar.

The Iranian operation seems to have learned from the Russian one. They started shifting their accounts to more community-based identities in July this year (h/t @FireEye and @LeeFosterIntel for the spot).

Thing was, the Iranian operation wasn't very good at personality-based posting. Most of its posts were shares from pro-regime websites.

Even their personal ones didn't get much traction.

The Russian troll accounts were about division. They posted on both sides of the most divisive debates in the US.

This was already well known, but just to illustrate, here are some of their posts on #TakeTheKnee. (An odd hashtag, perhaps so they could track their impact?)

After the San Bernardino shootings, most of them posted in favour of the Second Amendment, but a few called for gun control.

Mass shooting, followed by trolling. Let that sink in.

After Charlottesville, almost all the Russian troll accounts posted to blame Antifa for starting it.

A few took the other side.

One of their pet hashtags was #SyrianRefugees.

Posts here were uniformly hostile, probably because this was a theme which they could use to turn Americans against the government.

There were targets of opportunity from outside the US, too.

The Russian troll accounts reacted to the Brussels terror attacks, and other terror attacks, by posting on #IslamKills. Thousands of times.

On #Brexit referendum day, the Russian troll accounts posted on #ReasonsToLeaveEU 1,102 times. A mix of retweets of genuine people, and their own posts.

NOT a full-on pro-Leave campaign, but certainly an attempt to make the hashtag trend on voting day.

Important to keep this in perspective: the Russian troll accounts only posted on VoteLeave a few dozen times.

Compare that with the two and a half years they spent attacking Clinton.

Same thing in France. They posted on #MacronLeaks 77 times, after it was launched by the far right in the US, amplified by Wikileaks and picked up by the far right in France.

Not a concerted campaign. Just doing their bit.

But it's interesting to note which accounts posted on #MacronLeaks.

@Jenn_Abrams
@TEN_GOP
@SouthLoneStar

These were the big guns. About 1,900 retweets between them.

One key thing about both operations was that they evolved. The Iranian one tried to become more personality-based.

The Russian one started off trying to create elaborate fakes, even posting stories on #PhosphorusDisaster to @CNN's crowd journalism page.

Here's the Russian troll farm posting on #PhosphorusDisaster.

2,683 posts. An attempt to get an entirely fabricated story to trend.

Attempts like that didn't work. The trolls tried a few time (see @AdrianChen's epic work on #ColumbianChemicals), and turned to amplifying real-world events.

The accounts evolved in terms of personality.

@TEN_GOP started off sharing websites, but the more aggressive it became, the more users reacted.

Using the engagement power of social media for abuse. A hard model to counter, because it's the DNA of the platforms.

One odd thing is that the second wave of Russian troll accounts, after the 2017 mass purge, used automation much more, and personal posting less.

Here's how many times they used @ifttt automation, mostly in 2017-18.

The Russian trolls' posting dropped off sharply after September 2017, too.

The clearout of main accounts evidently had an impact.

One of the Iranian accounts, at least, aimed at personality.

@CritChronicle, apparently UK-based, was pretty edgy. Anti-Trump, anti-May, anti-Israel, anti-Brexit, pro-Corbyn,pro-aid workers.

Almost as if it learned from the Russian ones.

Important note: the traffic I counted on #ReasonsToLeaveEU came from 25 troll accounts, by my count, and was more than half retweets of each other.

Original posts were significantly lower. Getting data now.

Worth noting: most of the troll accounts +didn't+ get much impact, or many followers. TEN_GOP and Jenn Abrams were exceptions.

The second wave of Russian ones had even less impact, although Ann Coulter retweeted one.

Also worth noting: the trolls which did best used the best features of social media (engagement and connection) for the worst reasons.

Those features aren't going to change. Responses need to look to making users more aware.

This is a brains race. The trolls are trying harder to hide. The platforms and researchers are trying harder to find them.

Stay tuned. This is not going away.

Final thoughts: my two favourite tweets of all time from the troll farm.

“Russians indicted today: 13

Illegal immigrants crossing Mexican border indicted today: 0

Anyway, I hope that all those Internet Research Agency f*ckers will be sent to Gitmo.”

(@JohnCopper16, Feb 16)

And this one, for all those of the research community who spotted Russian trolls because they couldn't use "a" and "the".

#ReasonsToLeaveEU the absence of "the"

(@DanaGeezus, 23 June, 2016)

Thread ends.