Ben Nimmo Profile picture
Apr 15, 2018 18 tweets 8 min read Read on X
Thread: A few thoughts on the Pentagon's claim of a "2000% increase in Russian trolls."

First point: it takes quite a lot of evidence to identify a genuine Kremlin troll. Examples in this post:

medium.com/dfrlab/trolltr…
I had a look at traffic on the @DeptofDefense handle from 0800 ET on April 13 to 0800 ET on April 14, using @Sysomos.

Note the surge around 2100, when the strikes were announced. It's about a 1400% increase in traffic. Image
But most of the traffic was driven by retweets of the Pentagon's own posts. Of the 10 most retweeted posts, 6 were from DoD. Image
Only one of the top 10 came from a Russian account: the Russian embassy in the USA.

It can be troll-like, but it's hardly a covert operation, or a major surge. Image
The DoD Facebook page got a fair amount of traffic, but it was mostly positive. Again, not what you'd call a troll surge. Image
I had a look at traffic on #SyriaStrikes, too. Much higher volumes here: 300k posts, mostly tweets, in 24 hours.

That's not unusual for a breaking topic. "Covfefe" racked up 100k tweets in the first 45 minutes alone. Image
A lot more of the traffic here was negative. Sentiment analyses should always be read with caution, but an eyeball scan confirmed the trend. Image
One stand-out post straight away: this one had 17k retweets, from an account which only has 341 followers.

That's weird, but an initial scan showed human-looking amplifiers, not bots.

Anyone got time for a deep dive? @AAlaphilippe @lmneudert @katestarbird ImageImage
Overall, though, the main drivers of traffic were verified accounts with their own perspectives and their own followings.

Could be some bot amplification in the mix, but these are high-influence users. And not "Russian trolls." Image
There were some genuine pro-Kremlin trolls in the mix, and they were influential, but these are old friends, and this is their business as usual. Not a surge. Image
I took a look at activity around @StateDept, too. This tweet looked like a likely troll magnet. Image
Some of the replies did, indeed, look a bit trollesque.

Note the spelling "desinfo" here. Image
This account shares a lot of Kremlin-style narratives.

Its English is reminiscent of known Russian-language trolls, too.

"For which reason Russia will down a civil plane?" Image
It shares a lot of Russian and Iranian content. Three of these shares are direct copies of tweets from Slutnik, one each from Mehr News and Press TV. Image
Sorry, +Sputnik+. Though the other version could be seen as fitting.

Anyway, it shares the occasional Russian-language content, too. It's definitely pro-Kremlin. Part of an organised campaign, or a soloist? Unclear.

@conspirator0 @propornot Image
This one got annoyed at State, too. It shares a lot of Kremlin-style messaging on some key themes, such as Ukraine, Crimea and the White Helmets. Image
Curiously, it never posted about Turkey until November 2015, when Turkey downed a Russian jet. Then it suddenly became very interested in the Turkey-ISIS-oil trade story.

But NB, it doesn't seem to have posted on MH17 or Skripal. Pro-Kremlin, yes. Kremlin-linked? Questionable. Image
Upsum: There was a lot of activity on #SyriaStrikes, and a surge around the DoD handle.

The usual pro-Kremlin accounts, and some possible extras, in the mix.

But a 2000% increase? Not based on these scans.

"Russian trolls". Use the term with care. / Thread ends.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Ben Nimmo

Ben Nimmo Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @benimmo

Sep 27, 2022
🚨BREAKING🚨
@Meta took down two covert influence ops:
Big one from Russia🇷🇺 targeting Europe with spoofed media websites like the Guardian and Spiegel
First one from China 🇨🇳 to focus on both sides of domestic US 🇺🇸 politics and Czech-China relations.
about.fb.com/news/2022/09/r…
@Meta The operations were very different, but both worked on multiple social media platforms and petitions sites.
The Russian op was even on LiveJournal (cute).
List of domains, petitions etc in the report. #OSINT community, happy hunting!
@Meta China: this was the first Chinese network we’ve disrupted that focused on US domestic politics ahead of the midterms and Czech foreign policy toward China and Ukraine.
It was small, we took it down before it built an audience, but that’s a new direction for Chinese IO.
Read 11 tweets
Aug 4, 2022
🚨JUST OUT🚨
Quarterly threat report from @Meta’s investigative teams.
Takedowns from around the world:
Cyber espionage in South Asia;
Harassment in India;
Violating networks in Greece, South Africa, India;
Influence ops from Malaysia & Israel
AND...
about.fb.com/news/2022/08/m…
A deep dive into a Russian troll farm, linked to people with ties to what’s known as the Internet Research Agency.
It used fake accounts across the internet to make it look like there’s support for Russia’s war in Ukraine - and to pretend the troll farm's doing a good job.
The operation called itself “Cyber Front Z”.

We think of it as the Z Team, because it was about as far from being the A Team as you can get.
Read 11 tweets
Apr 7, 2022
🚨JUST OUT🚨
Quarterly threat report from @Meta’s investigative teams.
Much to dig into:
State & non-state actors targeting Ukraine;
Cyber espionage from Iran and Azerbaijan;
Influence ops in Brazil and Costa Rica;
Spammy activity in the Philippines...
about.fb.com/news/2022/04/m…
I’ll focus this thread on Ukraine. For more on the rest, see the great @ngleicher and @DavidAgranovich.
We’ve seen state & non-state ops targeting Ukraine across the internet since the invasion, including attempts from:

🇧🇾 Belarus KGB
👹 A Russian “NGO” w/ some links to past IRA folks
👻 Ghostwriter

We caught these early, before they could build audience or be effective.
Read 15 tweets
Feb 28, 2022
🚨 TAKEDOWN 🚨
This weekend, we took down a relatively small influence operation that had targeted Ukraine across multiple social media platforms and websites. It was run by people in Russia and Ukraine: about.fb.com/news/2022/02/s…
It consisted of approx 40 accounts, Groups and Pages on FB and IG, plus on Twitter, YouTube, VK, OK, Telegram.

It mainly posted links to long-form articles on its websites, without much luck making them engaging. It got very few reactions, and under 4k followers.
It ran a few fake personas posing as authors. They had fake profile pics (likely GAN), and unusually detailed public bios - e.g. former civil aviation engineer, hydrography expert.

The op posted their articles on its websites and social media, & amplified them using more fakes.
Read 6 tweets
Feb 27, 2022
Personal 🧵 based on years of OSINT research into influence operations since 2014.

Looking at the Russian official messaging on “de-nazification” and “genocide”, it’s worth putting them in context of the many different Russian IO that targeted Ukraine over the years.
Way back in 2014, Russian military intel ran a series of fake “hacktivist” personas that targeted Ukraine. Note the “Nazi” theme.

Screenshots from @Graphika_NYC research, based on Facebook takedown.
about.fb.com/news/2020/09/r…
public-assets.graphika.com/reports/graphi… Image
Still in 2014, one of the busiest days the Internet Research Agency had on Twitter was when it falsely accused Ukraine of shooting down flight MH-17 as a “provocation”.
Screenshot from @DFRLab /Twitter archives.
transparency.twitter.com/en/reports/inf…
medium.com/dfrlab/trolltr… Image
Read 10 tweets
Jan 20, 2022
JUST OUT: Report on coordinated inauthentic behaviour takedowns in December, and a look back over the past year & more.

Interesting: 2/3 of all ops we removed since 2017 were wholly or partially focused on domestic audiences.

about.fb.com/news/2022/01/d… Image
We took down three operations last month:

* Iran, targeting the UK, focusing on Scottish independence;
* Mexico, a PR firm targeting audiences across LATAM;
* Turkey, targeting Libya, and linked to the Libyan Justice and Construction Party (affiliated w/Muslim Brotherhood).
It’s not the first time for an Iranian op to pose as supporters of Scottish independence.
In the past, FB found a page that copied and posted political cartoons about independence as far back as 2013.
@Graphika_NYC writeup here (pages 26-27)
graphika.com/reports/irans-…
Read 11 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(