a Better Bubble™

Aggregator

Infamous Russian Troll Farm Appears to Be Source of Anti-Ukraine Propaganda

2 years 6 months ago

ProPublica is a nonprofit newsroom that investigates abuses of power. Sign up to receive our biggest stories as soon as they’re published.

Just before 11 a.m. Moscow Standard Time on March 1, after a night of Russian strikes on Kyiv and other Ukrainian cities, a set of Russian-language Twitter accounts spread a lie that Ukraine was fabricating civilian casualties.

One account created last year, @Ne_nu_Che, shared a video of a man standing in front of rows of dark gray body bags that appeared to be filled with corpses. As he spoke to the camera, one of the encased bodies behind him lifted its arms to stop the top of the bag from blowing away. The video was taken from an Austrian TV report about a climate change demonstration held in Vienna in February. But @Ne_nu_Che claimed it was from Ukraine.

Four Russian-language Twitter accounts posted a video that they claimed showed Ukrainian media had faked reports of civilian casualties. It is actually an unrelated clip from an Austrian TV report in February. The accounts were later removed by Twitter for violating its platform manipulation and spam policy. (Screenshots captured by ProPublica)

“Propaganda makes mistakes too, one of the corpses came back to life right as they were counting the deaths of Ukraine’s civilians,” the tweet said.

Eight minutes later, another account, @Enot_Kremle_Bot, tweeted the same video. “I’M SCREAMING! One of the ‘corpses’ came back to life during a segment about civilian deaths in the Ukraine. Information war is reaching a new level,” they said.

Two other accounts created last fall within a few days of @Enot_Kremle_Bot soon shared the same video and accusations of fake civilian casualties. “Ukrainian propaganda does not sleep,” said one.

The Twitter profiles are part of a pro-Putin network of dozens of accounts spread across Twitter, TikTok and Instagram whose behavior, content and coordination are consistent with Russian troll factory the Internet Research Agency, according to Darren Linvill, a Clemson University professor who, along with another professor, Patrick Warren, has spent years studying IRA accounts.

The IRA burst into the American consciousness after its paid trolls used thousands of English-language accounts across social media platforms to influence American voters during the 2016 presidential election. The IRA was at the center of a 2018 Department of Justice criminal indictment for its alleged effort to “interfere with elections and political processes.”

“These accounts express every indicator that we have to suggest they originate with the Internet Research Agency,” Linvill said. “And if they aren’t the IRA, that’s worse, because I don’t know who’s doing it.”

An analysis of the accounts’ activity by the Clemson Media Forensics Hub and ProPublica found they posted at defined times consistent with the IRA workday, were created in the same time frame and posted similar or identical text, photos and videos across accounts and platforms. Posts from Twitter accounts in the network dropped off on weekends and Russian holidays, suggesting the posters had regular work schedules.

Many of the accounts also shared content from facktoria.com, a satirical Russian website that began publishing in February. Its domain registration records are private, and it’s unclear who operates it. Twitter removed its account after being contacted by ProPublica.

Russian Twitter Accounts That Disseminated Propaganda Posted Mostly During Working Days

While Twitter sees relatively constant use throughout the week, these accounts posted mostly during Russian working days.

Note: Data includes posts on Twitter from 28 accounts identified in the Clemson Media Forensics Hub and ProPublica analysis as exhibiting coordinated or bot-like behavior. The accounts were removed by Twitter. Source: Twitter. (Jeff Kao/ProPublica)

The pro-Putin network included roughly 60 Twitter accounts, over 100 on TikTok, and at least seven on Instagram, according to the analysis and removals by the platforms. Linvill and Warren said the Twitter accounts share strong connections with a set of hundreds of accounts they identified a year ago as likely being run by the IRA. Twitter removed nearly all of those accounts. It did not attribute them to the IRA.

The most successful accounts were on TikTok, where a set of roughly a dozen analyzed by Clemson researchers and ProPublica racked up more than 250 million views and over 8 million likes with posts that promoted Russian government statements, mocked President Joe Biden and shared fake Russian fact-checking videos that were revealed by ProPublica and Clemson researchers earlier this week. On Twitter, they attacked jailed Russian opposition leader Alexei Navalny and blamed the West for preventing Russian athletes from competing under the Russian flag in the Olympics.

Late last month, the network of accounts shifted to focus almost exclusively on Ukraine, echoing similar narratives and content across accounts and platforms. A popular post by the account @QR_Kod accused the Ukrainian military of using civilians as human shields. Another post by @QR_Kod portrayed Ukraine as provoking Russia at the behest of its NATO masters. Both tweets received hundreds of likes and retweets and were posted on the same day as the body bag video. At least two Twitter accounts in the network also shared fake fact-checking videos.

Twitter accounts such as @QR_Kod shared memes that echo propaganda spread domestically by Russian state media. @QR_Kod was later removed by Twitter for violating its platform manipulation and spam policy. (Screenshots captured by ProPublica)

The findings indicate that professionalized trolling remains a force in domestic Russian propaganda efforts and continues to adapt across platforms, according to Linvill.

“I can’t stress enough the importance of understanding the way that this is a tool for Putin to control narratives among his own people, a way for him to lie to his own people and control the conversation,” Linvill said. “To suggest that the West is blanketly winning this information war is true only in some places. Putin doesn’t have to win the information war, he just has to hold his ground. And these accounts are helping him do that.”

After inquiries from ProPublica, all of the active accounts were removed from TikTok, and nearly all were suspended by Twitter. Meta said it removed one Instagram account for violating its spam policy and that the others did not violate its rules. None of the platforms attribute the accounts to the IRA. Twitter and TikTok said the accounts engaged in coordinated behavior or other activity that violated platform policies.

A TikTok spokesperson said the initial eight accounts shared with it violated its policy against “harmful misinformation.” TikTok removed an additional 98 accounts it determined were part of the same pro-Putin network.

“We continue to respond to the war in Ukraine with increased safety and security resources to detect emerging threats and remove harmful misinformation,” said a statement provided by the company. “We also partner with independent fact-checking organizations to support our efforts to help TikTok remain a safe and authentic place.”

A Twitter spokesperson called the roughly 60 accounts it removed “malicious” and said they violated its platform manipulation and spam policy, but declined to be more specific. They said the company had determined that the active accounts shared by ProPublica had violated its policies prior to being asked about them. Twitter decided to leave the set of 37 accounts online “to make it harder for bad actors to understand our detections,” according to the spokesperson.

The accounts were removed by Twitter within 48 hours of ProPublica contacting the company about them. The week before, Twitter removed 27 accounts that the Clemson researchers also identified as likely IRA accounts.

“Our investigation into these accounts remains ongoing, and we will take further action when necessary,” said a statement from a Twitter spokesperson. “As is standard, when we identify information operation campaigns that we can reliably attribute to state-linked activity, we will disclose this to the public.”

Twitter declined to offer more details on why it left roughly 30 accounts that it identified as violative online to continue spreading propaganda. It also declined to comment on connections between the roughly 60 accounts in this recent network and the hundreds of accounts flagged by Linvill and Warren last spring as possible IRA profiles. Linvill said he identified the recent accounts largely based on their commonality with the previous set of 200.

“I connect these current accounts to the ongoing activity over the course of the past year by carefully tracking accounts’ tactics, techniques and procedures,” he said.

Platforms may be hesitant to attribute activity to the IRA in part because the agency has adapted and made its efforts harder to expose, according to Linvill. But he said social platforms should disclose more information about the networks it removes, even if it can’t say with certainty who is running them.

“In every other area of cybersecurity, dangerous activity from bad actors is disclosed routinely without full confidence in the source of the activity. We name and disclose computer viruses or hacker groups, for instance, because that is in the public interest,” he said. “The platforms should do the same. The Russian people should know that some sophisticated and well-organized group is covertly using social media to encourage support for Putin and the war in Ukraine.”

The Internet Research Agency is a private company owned by Yevgeny Prigozhin, a Russian entrepreneur known as “Putin’s Chef.” Prigozhin is linked to a sprawling empire ranging from catering services to the military mercenary company Wagner Group, which was reportedly tasked with assassinating President Volodymyr Zelenskyy. The IRA launched in St. Petersburg in 2013 by hiring young internet-savvy people to post on blogs, discussion forums and social media to promote Putin’s agenda to a domestic audience. After being exposed for its efforts to influence the 2016 U.S. election, the IRA attempted to outsource some of its English-language operations to Ghana ahead of 2020. Efforts to reach Prigozhin were unsuccessful.

But it never stopped its core work of influencing Russian-speaking audiences. The IRA is part of a sprawling domestic state propaganda operation whose current impact can be seen by the number of Russians who refuse to believe that an invasion has happened, while asserting that Ukrainians are being held hostage by a Nazi coup.

Prior to the invasion, accounts in the network identified by the Clemson Media Forensics Hub and ProPublica celebrated Russian achievements at the Olympics.

“They were deep in the Olympics, tweeting about Russian victories and the Olympics and how the Russians were being robbed by the West and not allowed to compete under their own flag,” Linvill said.

After the invasion began, they moved to unify people behind Putin’s war.

“It was a slow shift,” he said. “And this is something I’ve seen from the IRA before: When a significant world event happens, they don’t always know immediately how to respond to it.”

By late February, the network had found its voice in part by echoing messages from Russian officialdom. The accounts justified the invasion, blamed NATO and the West and seeded doubts about civilian death tolls and Russian military setbacks. When sanctions kicked in and Western companies began pulling out of Russia, they said it was good news because Russian products are better. (Two Twitter accounts in the network shared the same video of a man smashing an old iPad with a hammer.)

Accounts in the network responded to sanctions by posting videos disparaging Western products. (Screenshot captured by ProPublica)

“These accounts were sophisticated, they knew their audience, and they got engagement far surpassing the number of followers that they had,” Linvill said.

Paul Stronski, a senior fellow in the Russia and Eurasia Program at the Carnegie Endowment for Peace, reviewed content shared by more than two dozen of the Twitter accounts prior to their suspension. “A lot of this is the type of stuff I would expect from Russian trolls,” said Stronski, who reads and speaks Russian.

He said many of the accounts adopt an approachable and humorous tone to generate engagement and appear relatable to younger audiences present on social media.

“They’re very critical of prominent Russians who have criticized this war, questioning their patriotism,” Stronski said. “They’re saying in effect that during wartime you shouldn’t be criticizing your own. You should be lining up behind the state.”

When President Biden flubbed the pronunciation of “Ukrainians” during his recent State of the Union address, several of the accounts on Twitter, TikTok and Instagram shared the clip and mocked him. While that clip spread widely outside of the suspected IRA network as well, the accounts often spread more obscure content in coordination. Multiple Twitter accounts, for example, shared a screenshot of a Russian actor’s tweet that he cared more about being able to use Apple Pay than the war in Ukraine. The accounts criticized him, with one warning that “the internet remembers everything.”

Before the account takedowns, the Russian government had begun closing off the country from global social media and information sources. It restricted access to Twitter and blocked Facebook. The Russian legislature passed a law that allows for a 15-year sentence for people who contradict the official government position on the war. As a result, TikTok announced it would pause uploads of new videos in Russia.

Some of the accounts in the network saw the writing on the wall and prepared their audience to move to Telegram, a Russian messaging service.

“Friends! With happiness I'd like to tell you that I decided to make the t.me/enot_kremlebot channel, in which you will see analytics to the fullest extent. Twitter could block us any minute!” tweeted @Enot_Kremle_Bot on March 5. “I really don’t want to lose my treasured and close-to-my-heart audience! Go to this link and subscribe.”

Correction

March 11, 2022: This story originally misstated what TikTok communicated about its actions. The company said that after receiving ProPublica’s questions, it removed any active accounts it had been asked about, along with 98 others that the social media company linked to a pro-Russia network identified by ProPublica; TikTok did not decline to say how many accounts were removed.

by Craig Silverman and Jeff Kao

Raw data: $100,000 adjusted for inflation

2 years 6 months ago
Yesterday's post about college grads pulling in starting salaries of $100,000 has prompted me to produce a chart showing the equivalent of $100,000 over the past century or so. Here it is: If you made $18,000 in 1970, that's the equivalent of making $100,000 today.
Kevin Drum

Farmers Unions, Right To Repair Coalition Files FTC Complaint Against John Deere

2 years 6 months ago
Not only have corporate efforts to monopolize repair resulted in a flood of proposed state and federal laws, the idea was also included in the Biden Administration’s recent executive order on monopoly power and competition. Said order urged the FTC to tighten up its rules on repair monopolization efforts, whether it’s ham-fisted DRM, or making […]
Karl Bode

Bethalto Police Obtain Warrants For Arrest Of Man In Bethalto Walgreens Burglary

2 years 6 months ago
BETHALTO - The Bethalto Police obtained warrants for the person believed to be the second offender in the February 15, 2022, burglary at the Bethalto Walgreens. Today Felony charges of Burglary and Retail Theft Over $300 were issued by State's Attorney Thomas Haine's Office against: KEVIN D. LACEY M/B AGE 32 SPRINGFIELD, IL. Judge Slemer set Lacey's bond at $50,000. Lacey is actively wanted on this charge and currently being sought by police. "Mr. Lacey, I kept my word that I'd let you know when we got the warrant, now you do the right thing and turn yourself in," Bethalto Police Chief Mike Dixon said. "In the event, you choose not to do that I want you to know that I'll be making the United States Marshall's Service aware of the issuance of this warrant as well. "I'd again warn anyone choosing to commit these kinds of crimes to know the Village of Bethalto is not the place to do it. This police department will do everything within our powers to apprehend and deter offenders

Continue Reading

Mayor Tishaura O. Jones, World Wide Technology Hosted Black Mayors from Across the US for Tech Summit in St. Louis

2 years 6 months ago
ST. LOUIS - On Thursday, May 10, Mayor Tishaura O. Jones and World Wide Technology (WWT) Chairman and Founder Dave Steward welcomed fellow Black mayors at the company’s Global headquarters for a summit focused on tech solutions to the issues faced in every city. Programming during the summit included a presentation by the City of St. Louis’ Interim Public Safety Director Dr. Dan Isom highlighting the city’s alternative response models, after the city saw a decrease in homicides between 2020 and 2021 of more than 25 percent. “Today’s summit brought together leaders from the public and private sectors to hold interactive workshops, share best practices, and learn from each other so we strengthen our respective cities and lift up our communities,” said Mayor Tishaura O. Jones. Founded in 1990, WWT has grown to become a global technology solutions provider with $14.5 billion in annual revenue. Based in St. Louis, WWT has approximately 8,000 employees

Continue Reading

Jesse White Extending Driver's License And ID Card Expiration Dates Until July 31, 2022

2 years 6 months ago
SPRINGFIELD - Illinois Secretary of State Jesse White announced that expiration dates for driver’s licenses, ID cards and learner’s permits are being extended until July 31, 2022. The previous extension was set to end on March 31, 2022. As a result, expired driver’s licenses, ID cards and learner’s permits will remain valid until July 31, 2022, so customers do not need to rush into Driver Services facilities, especially during inclement weather. This extension does not apply to commercial driver’s licenses (CDL) and CDL learner’s permits. White’s office has expanded online renewals for expired driver’s licenses and ID cards and continues to mail letters to eligible customers. The letter provides driver’s license and ID card holders with a unique PIN needed to renew online instead of visiting a facility and waiting in line. Customers may call 217-785-1424 to confirm their eligibility for online renewal or to obtain their PIN. Customers

Continue Reading

An Illinois Route 66 Icon Is Gone: The Windy City Road Warrior

2 years 6 months ago
Ilinois has lost a true giant of Route 66 -- the Windy City Road Warrior, David Clark. Author, historian, tour guide, meticulous researcher, and presenter, he knew his subject, loved to share it, and was known to Route 66 fans around the world. A downtown Chicago resident, David lived in a condo in a former garment factory on Adams Street, across the street from the iconic “Begin Historic Route 66” sign. “Dave,” as his friends knew him, passed away on Tuesday, January 4, at the age of 64. On Thursday evening, January 6, many of his friends and fans were online, ready to enjoy one of Dave's monthly Route 66 programs, presented virtually for many months during Covid. But for those attempting to enter the program, all anyone could access was the message, “waiting for host to begin the meeting.” It was an ominous start to what was anticipated to be an enjoyable evening. Later that night, the news began to spread – Dave had died on Tuesday, after

Continue Reading