Russian operatives blasted 18,000 tweets ahead of a huge news day during the 2016 presidential campaign. Did they know what was coming?
On the eve of one of the newsiest days of the 2016 presidential election season, a group of Russian operatives fired off tweets at a furious pace, about a dozen each minute. By the time they finished, more than 18,000 had been sent through cyberspace toward unwitting American voters, making it the busiest day by far in a disinformation operation whose aftermath is still roiling U.S. politics.
The reason for this burst of activity on Oct. 6, 2016, documented in a new trove of 3 million Russian tweets collected by Clemson University researchers, is a mystery that has generated intriguing theories but no definitive explanation.
The theories attempt to make sense of how such a heavy flow of Russian disinformation might be related to what came immediately after, on Oct.7.
This was the day when Wikileaks began releasing embarrassing emails that Russian intelligence operatives had stolen from the campaign chairman for Democrat Hillary Clinton, revealing sensitive internal conversations that would stir controversy for weeks.
The Clemson researchers and others familiar with their findings think there likely is a connection between this looming release and the torrent of tweets, which varied widely in content but included a heavy dose of political commentary. “Hillary Clinton and Donald Trump: Which one is worse: Lucifer, Satan or The Devil?” said one tweet from an account called Gwenny which directed readers to a YouTube video.
Complicating this analysis is the number of other noteworthy events on that day, which is best remembered for The Washington Post’s publication of a recording of Republican Donald Trump speaking crudely about women.
Also on that day U.S. intelligence officials first made public their growing concerns about Russian meddling in the presidential election, following reports about the hacking of prominent Americans and intrusions into election systems in several U.S. states.
Could the Russian disinformation teams have gotten advanced notice of the Wikileaks release, sending the operatives into overdrive to shape public reactions to the news? And what do the operatives' actions that day reveal about Russia’s strategy and tactics now that Americans are heading into another crucial election in just a few months?
These questions flow from the work of a pair of Clemson University researchers who have assembled the largest trove of Russian disinformation tweets available so far. The database includes tweets between February 2014 and May 2018, all from accounts that Twitter has identified as part of the disinformation campaign waged by the Internet Research Agency, based in St. Petersburg, Russia and owned by a Putin associate.
Collectively the new data offer yet more evidence of the coordinated nature of Russia’s attempt to manipulate the American election. The Clemson researchers dubbed it “state-sponsored agenda building.”
The tweets overall reveal a highly adaptive operation that interacted tens of millions of times with authentic Twitter users -- many of whom retweeted the Russian accounts -- and frequently shifted tactics in response to public events, such as Hillary Clinton’s stumble at a Sept. 11 memorial.
The researchers also found that the Russians working for the Internet Research Agency -- often called “trolls” for their efforts to secretly manipulate online conversation -- picked up their average pace of tweeting after Trump’s election. This was especially true for the more than 600 accounts targeting the conservative voters who were part of his electoral base, a surge the researchers suspect was an effort to shape the political agenda during the transition period by energizing core supporters.
But for sheer curiosity, nothing in the Clemson dataset rivals Oct. 6. The remarkable combination of news events the following day has several analysts, including the Clemson researchers, suspect there likely was a connection to the coming Wikileaks release. (There is no obvious evidence connecting the tweets to the release of the Trump recording, say the researchers and others familiar with their findings.)
Last week’s indictment of Russian intelligence officers by Special Counsel Robert S. Mueller III made clear that the hack of Clinton campaign chairman John Podesta’s emails and their distribution through Wikileaks was a meticulous operation. Tipping off the Internet Research Agency, the St. Petersburg troll factory owned by an associate of President Vladimir Putin, might have been part of an overarching plan of execution, said several people familiar with the Clemson findings about the activity of the Russian trolls.
“They tend to ramp up when they know something’s coming,” said Clint Watts, a former FBI agent and expert on the Russian troll armies and how they respond to news as well as upcoming events, like debates or candidate appearances.
Though Watts did not participate in the Clemson research, his instincts fit with those of the researchers, Darren L. Linvill and Patrick L. Warren, who point to the odd consistency of the storm of tweets. More than on any other day, the trolls on Oct. 6 focused their energies on a left-leaning audience, with more than 70 percent of the tweets targeting Clinton’s natural constituency of liberals, environmentalists and African Americans.
Linvill and Warren, who have written a paper on their research now undergoing peer review, identified 230 accounts they categorized as “Left Trolls” because they sought to infiltrate left-wing conversation on Twitter.
But the Left Trolls did so in a way clearly designed to damage Clinton, who is portrayed as corrupt, in poor health, dishonest and insensitive to the needs of working-class voters and various minority groups. By contrast, the Left Trolls celebrated Vermont Sen. Bernie Sanders and his insurgent primary campaign against Clinton and, in the general election, Green Party candidate Jill Stein.
Less than two weeks before election day, for example, the Left Troll account @Blacktivists tweeted, “NO LIVES MATTER TO HILLARY CLINTON. ONLY VOTES MATTER TO HILLARY CLINTON.”
Ninety-three of the Left Troll accounts were active on Oct. 6 and 7, each with an average following of 1,760 other Twitter accounts. Taken together, their messages could have directly reached Twitter accounts 20 million times on those two days, and reached millions of others through retweets, the Clemson researchers found.
The release of Podesta’s emails made public candid, unflattering comments about Sanders and fueled allegations that Clinton had triumphed over him because of her connections to the Democratic party establishment. The Left Trolls on Oct. 6 appeared to be stirring up conversation among Twitter users potentially interested in such arguments, the Clemson researchers said.
“We think that they were trying to activate and energize the left wing of the Democratic Party, the Bernie wing basically, before the Wikileaks release that implicated Hillary in stealing the Democratic primary,” said Warren, an associate professor of economics.
U.S. officials with knowledge of information that the government has gathered on the Russian operation said they had yet to establish a clear connection between Wikileaks and the troll accounts that would prove they were coordinating around release of campaign emails. The officials spoke on the condition of anonymity to share assessments not approved for official release.
But some clues have emerged that may point to coordination. It now appears that WikiLeaks intended to publish the Podesta emails closer to the election, and that some external event compelled the group to publish sooner than planned, the officials said.
“There is definitely a command and control structure behind the IRA’s use of social media, pushing narratives and leading people towards certain conclusions,” said one of the U.S. officials.
Warren and Linvill, an associate professor of communication, found that Russian disinformation tweets generated significant conversation among other Twitter users. Between September and November 2016, references to the Internet Research Agency accounts showed up in the tweets of others 4.7 million times.
The patterns of tweets also shows how a single team of trolls worked on different types of accounts depending on shifting priorities, one hour playing the part of an immigrant-bashing conservative, the next an African American concerned about police brutality and on the third an avid participant in “hashtag games” in which Twitter users riff on particular questions such as “#WasteAMillionIn3Words.” The answer on July 11, 2015, from IRA account @LoraGreen was, “Donate to #Hillary.”
“Day to day they seem to be operating as a business, just allocating resources,” said Linvill. “It’s definitely one organization. It’s not one fat guy sitting in his house.”
Twitter declined to comment on the Clemson research, which has not yet been published.
Warren and Linvill collected their set of Internet Research Agency tweets using a social media analysis tool called Social Studio that catalogs tweets in a searchable format. The researchers collected all of the available tweets from 3,841 accounts that Twitter has identified as having been controlled by the Internet Research Agency, whose officials and affiliated companies have been charged with several crimes related to the 2016 election. (Representatives for some of those charged have denied the allegations against them.)
The Clemson researchers sorted the Internet Research Agency accounts into five categories, with the largest two being “Right Troll” and “Left Troll.” The others focused on retweeting news stories from around the country, participating in hashtag games or spreading a false news story about a salmonella outbreak in turkeys around the Thanksgiving season of 2015.
The largest and most active group overall were the Right Trolls, which typically had little profile information but featured photos the researchers described as “young, attractive women." They collectively had nearly a million followers, the researchers said.
The Right Trolls pounced on the Sept. 11 stumble by Clinton to tweet at a frenetic pace for several days. They experimented with a variety of related hashtags, such #HillarySickAtGroundZero, #ClintonCollapse and #ZombieHillary before eventually focusing on #HillarysHealth and #SickHillary, tweeting these hundreds of times.
This theme flowed into several more days of intensive tweeting about a series of bombings in the New York area that injured dozens of people, stoking fears of terrorism.
When one group of accounts was tweeting at a rapid pace, others often slacked off or stopped entirely, underscoring the Clemson researchers' conclusion that a single team was taking turns operating various accounts. The trolls also likely used some forms of automation to manage multiple accounts simultaneously and tweet with a speed impractical for humans, the researchers said.
Dan Keating contributed to this report.
No comments:
Post a Comment