Thread by @benimmo

Thread: So many apparently American and British users are being accused of being "Russian trolls" (or bots) that the evidence for the real ones is getting buried.

Here's the sort of evidence which +does+ help ID possible troll-factory accounts.

medium.com/dfrlab/trolltr…

First point: trolls aren't bots. Bots are automated; trolls are humans (usually aggressive ones).

Here are some of the ways to spot a bot: medium.com/dfrlab/botspot…

Second point: we know the troll factory posted hyper-partisan content during the US election, taking both sides of the debate.

But just because an account is hyper-partisan, doesn't necessarily mean it's from the troll factory.

Sadly, that still needs saying.

One thing which betrays genuine Russian troll-factory accounts is the language. Look for an inability to use "the" and "a" (Russian is one of the languages which doesn't have them).

"Burn in flames of a shame."

(H/t @NBCNews for their archive of confirmed troll tweets.)

Another telltale is an inability to phrase the word order in questions.

If you see an apparently English-language account posting like this, look more closely.

(Caveat: some genuine US/UK trolls have been known to fake the accent, to trigger the other side).

Beyond the linguistic clues, there are narrative ones. If you wonder about an account, search its timeline for specific themes and dates.

Format for a date-limited search is:

from:username since:2017-12-31 until:2018-03-31

(Username without @)

Various key narratives are particularly characteristic of Kremlin propaganda. Check whether an account posted on them at the time.

Narrative 1: Crimean annexation, Feb 28 - March 18, 2014. Ukraine portrayed as fascist or coup-led; Russian troops called "self-defence forces".

Narrative 2: MH17 was downed by a Ukrainian fighter / Ukrainian BUK / Israeli missile / CIA false flag. Or anyone but Russian / rebel forces.

Especially July - August 2014.

Still on MH17, look for attacks on the Joint Investigation Team, especially in September 2016, and on @Bellingcat.

Kremlin propaganda doesn't like the people who expose it.

For more on the, um, "citizen journalists" who attacked @Bellingcat in that RT tweet, see medium.com/dfrlab/kremlin…

Narrative 3, and especially important, the assassination of Boris Nemtsov on February 27, 2015.

We know from whistle-blowers interviewed by real Russian journalists that the troll factory was ordered to muddy the waters on this one.

More details at medium.com/dfrlab/the-rus…

Thanks to the great @LawrenceA_UK, we know that about 20,000 bots were turned loose on the story as well.

Accounts which posted Nemtsov conspiracy theories on Feb 27-28, 2015, merit particular attention.

Narrative 4: Turkey, after it shot down a Russian Su24 on November 24, 2015. (One of RT's Ofcom violations in 2016 was for its Turkey coverage.)

Criticising Turkey is legitimate, but if a hitherto Ukraine-focused account switched to Turkey right after the downing, be wary.

Narrative 5: the siege of Aleppo, and particularly, attacks on @SyriaCivilDef and @AlabedBana.

Again, Kremlin propaganda doesn't like those who expose it, for example by providing evidence of air strikes on hospitals.

Narrative 6: the sarin attack on Khan Sheikhoun and the US strike in April 2017, when confirmed troll factory accounts turned on Trump.

Caveat: Plenty of real Trump supporters turned on him as well. This point should only be used in combination with multiple others.

Here's a case study in putting the factors together. Meet the late @Iamjohnsmith, who spent a happy November trolling UK MPs like @thomasbrake who criticised Russia.

The "John Smith" account was only created in March 2017, but it still hit quite a few of the narrative spots, like Nazis in Ukraine, sarin "false flag" and attacking Bellingcat.

It shared a lot of RT, especially on Syria, but on other issues too.

Curiously, it interacted with known troll factory accounts like TEN_GOP and Pamela_Moore13, as well.

Any one of these factors alone would not have been enough. Based on the combination, we concluded this was likely to be a troll factory account.

It was shut down soon after.

The list isn't exhaustive, and the approach indicates degrees of likelihood, rather than certainty.

It's always important to look for multiple factors; never rely on a single one.

What counts is the methodology. Look for multiple factors spread out over time and geographic areas.

Loose accusations of being a "Russian troll", made without evidence, only make it easier for the real trolls to hide. Don't do them that favour. / Thread ends.