Share this page!

Ben Nimmo Profile picture
Twitter logo
23 Jan, 9 tweets, 6 min read
Question for the #OSINT community: can anyone else find TikTok videos about protests for Navalny that become unavailable if you watch via a Russian server?

I’ve got 8 so far on #свободунавальному and #23января2021.

Nearly 2 million likes between them.

#DigitalSherlocks Image
Background: the Russian telecoms authority, Roskomnadzor, said it’s got platforms to take down calls for minors to join the protests.

facebook.com/roskomnadzor.o…
If you check TikTok for key hashtags about Navalny and the protests, some of the most popular videos don’t show up when browsing through a Russian VPN.

Four of the nine most popular on #свободунавальному, for example. Image
Four of the fifteen most popular on #23января2021 go missing, too.

Not seeing the same sort of discrepancy on YT or IG. Image
This video shows a girl taking down Putin’s picture. Text: “being against the authorities doesn’t mean being against the Motherland.” No mention of the protests, just the hashtags #навальный and #свободунавальному.

Unavailable in Russia. Image
There are lots of videos still up on those hashtags. And there doesn’t seem to be the same discrepancy on hashtags like #митинг2021 and #дворецпутина. So whatever’s happening here is not a blanket thing.

Still: #OSINTCurious folks, is anyone else getting similar findings? Image
(The #дворецпутина hashtag refers to "Putin's palace," a bombshell report by the #Navalny team.

The YouTube video exposé has over 66 million views, and is trending at Number 1 in Russia right now - screenshot taken while using Russian VPN.

) Image
Also on YouTube via Russian VPN: Navalny team's livestream of protests in different parts of Russia.

About 156,000 watchers right now.

This keeps showing up in the livestream chat.

"Вова - вор", i.e. "Vova - thief". (Vova = Vladimir.)

In Moscow, protesters shouting "Путин - вор", i.e. "Putin - thief".

Looks like the palace exposé struck a nerve. Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Ben Nimmo

Ben Nimmo Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @benimmo

Ben Nimmo Profile picture
23 Jan
One sidelight on the Russian protests today: #Navalny is probably the single most consistent target of Russian disinfo and influence operations.

He's been a target for at least 8 years, by ops including the Internet Research Agency, Secondary Infektion, and the Kremlin. Image
Way back in September 2013, @Soshnikoff investigated the then newly founded Internet Research Agency, and reported that it had been trolling Navalny when he ran for Mayor of Moscow.

mr-7.ru/articles/90769/
January 2014: op Secondary Infektion set up its most prolific persona, with a pic of Navalny’s face painted blue. It started out by attacking the Russian opposition.

The username, bloger_nasralny, is a toilet pun on his name. Image
Read 11 tweets
Ben Nimmo Profile picture
12 Jan
Just out: @Facebook's latest update on influence op (IO) takedowns. Fourteen new ones in this report, from nine countries. @Graphika_NYC did a write-up on one of them, from separatist-held Ukraine.

Never a dull week on the IO front...

about.fb.com/news/2021/01/d…
Here's the Graphika report.

A cluster of inauthentic assets on FB, boosting a network of fake websites focused on Europe and the former USSR: pro-Kremlin, anti-Ukraine, anti-Navalny, anti-EU.

Also, interestingly, anti-China in Central Asia.

graphika.com/reports/echoes…
H/t @alexejhock and @DanielLaufer for the first reporting on parts of this network, based around a fake outlet called Abendlich Hamburg ("evening Hamburg").

A couple other sites had "evening" in their names, others had "echo of [country]".

welt.de/politik/deutsc…
Read 11 tweets
Ben Nimmo Profile picture
17 Dec 20
Fun read here from @conspirator0 on a botnet that uses clips from Dracula, for that authentic "I'm a human so I write text" look.

Presumably designed to fool algorithms, as it wouldn't fool a human.

At @Graphika_NYC, we call it "Dracula's botnet".

graphika.com/posts/draculas…
We came across part this botnet in the summer, when it was boosting the pro-Chinese network "Spamouflage."

This, from @conspirator0, is a typical profile. Note the broken sentence and word in the bio. No human typed that... at least not on that Twitter account.
Now compare the bio with the version of Dracula that's online at Tallinn Technical University: lap.ttu.ee/erki/failid/ra…

Coincidence?
Read 9 tweets
Ben Nimmo Profile picture
15 Dec 20
BREAKING: @Facebook just took down two foreign influence ops that it discovered going head to head in the Central African Republic, as well as targeting other countries.

More-troll Kombat, you might say.

Report by @Graphika_NYC and @stanfordio: graphika.com/reports/more-t…
There have been other times when multiple foreign ops have targeted the same country.

But this is the first time we’ve had the chance to watch two foreign operations focused on the same country target *each other*.
In the red corner, individuals associated w/ past activity by the Internet Research Agency & previous ops attributed to entities associated w/ Prigozhin.

In the blue corner, individuals associated w/ the French military.

@Facebook report here: about.fb.com/news/2020/12/r…
Read 23 tweets
Ben Nimmo Profile picture
3 Nov 20
ELECTION THREAD: Today and tonight are going to be a wild time online.

Remember: disinformation actors will try to spread anger or fear any way they can, because they know that people who are angry or scared are easier to manipulate.

Today above all, keep calm.
A couple of things in particular. First, watch out for perception hacking: influence ops that claim to be massively viral even if they’re not.

Trolls lie, and it’s much easier to pretend an op was viral than to make a viral op.

Remember 2018? nbcnews.com/tech/tech-news…
There have been huge improvements in our collective defences since 2016. Teams like @Graphika_NYC, @DFRLab and @2020Partnership; takedowns by @Facebook, @Twitter and @YouTube; tip-offs from law enforcement.

Trolls have to spend more effort hiding.
Read 8 tweets
Ben Nimmo Profile picture
1 Oct 20
NEW: A Russian operation posed as a far-right website to target U.S. divisions and the election.

Most active on Gab and Parler.
A few months old.
Looks related to the IRA-linked PeaceData (which targeted progressives).

@Graphika_NYC report: public-assets.graphika.com/reports/graphi…
Credit to @jc_stubbs of @Reuters, who tipped us off to this.

A legend in his own byline.

reuters.com/article/us-usa…
This op was based on a website called the Newsroom for American and European Based Citizens, NAEBC.

@Alexey__Kovalev might enjoy this name: it’s close to the Russian swear word “наёбка”.

Just like PeaceData sounded like the Russian epithet “пиздато.”

There’s a theme there.
Read 30 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @benimmo has new unrolls!

Check out other threads from @benimmo!

Read all threads by @benimmo