How Russia’s “influence operations” targeted the midterms (and how they still do)

Last week, Twitter released data from accounts that had been identified as part of Russian and Iranian influence campaigns, including efforts by Russia to influence the political climate in the United States before, during, and after the 2016 presidential campaign. Hours later, the US Department of Justice announced the indictment of a 44-year-old Russian woman accused of directing ongoing influence campaigns on social media platforms targeting the US midterm congressional elections.

Both Twitter’s data and the indictment are data points in the history of “Project Lakhta,” a wide-ranging campaign to shape the political and cultural discussions in Russia, Ukraine, Western Europe, and the United States. The campaign started began in earnest in 2014, though the Internet Research Agency’s efforts date back even further in Russia. The Internet Research Agency, also known as the IRA, was but one of several organizations enlisted in these efforts; the operation also enlisted a number of media organizations, including the Federal News Agency (FAN). FAN operates the “USA Really” propaganda site, which was launched earlier this year, as well as associated social media accounts that have been leveraged as part of the campaign.

According to the FBI affidavit that led to the indictment of Elena Alekseevna Khusyaynova last week, Khusyanova managed the financing of the organizations under the Project Lakhta umbrella and funneled $35 million to various entities to fund social media and propaganda operations. These activities in the US included covering the expenditures of “activists,” purchasing advertisements on social media platforms with faked US identities, operating proxy servers in the US, and “promoting news postings on social networks.”

The funding was directly tied in the indictment to posts on Twitter that were connected to the IRA. This included posts from accounts created in 2017 that promoted anti-Trump themes—messages that were the most-retweeted individual posts associated with the campaign, based on data from Twitter—and others that promoted donations to Republican candidates and political action committees. The funding also paid for ads on Facebook and recruitment of Americans to manage Facebook pages through accounts with fraudulent identities, including “Helen Christopherson” and “Bertha Malone.”

Ars has performed some analysis of the Twitter data over the past few days, as have a number of other organizations—including the Atlantic Council’s Digital Forensic Research Lab. The data reveals that the campaign spent years building a capability to engage and exploit social media, testing theories out on a domestic audience before slowly exploring, and weaponizing US divisions. The campaign focused on opposite sides of identity, cultural, and divisive policy issues, amplified voices on both sides, and created the illusion of consensus through the sheer mass of its tweets.

Early campaigns focused on a domestic audience as well as the Ukraine—particularly as Russia occupied and then annexed Crimea. IRA tweets spiked during that period, including tweets from accounts purporting to be Crimean citizens celebrating the annexation vote. Other accounts provided “bulletins” from Damascus and eastern Ukraine’s “breakaway” Donbass region, mostly for domestic consumption. One account, @ComradZampolit, was tied to the “public organization” AgitPolk, a social media activist group that protests “anti-Russian hysteria in the information field.”

Starting in 2012

While IRA posted some content in German starting in 2012—initially from Russian-language accounts—there was little in the way of engagement on German politics by fake German accounts. But by 2016, that had changed with more engagement from opponents of German chancellor Angela Merkel, including Green party supporters. Fake German accounts started promoting #WäreIchMerkel (essentially “If I was Merkel”) and asking Germans to “support our flash mob.” Merkel was mentioned in about 4,000 tweets, taking positions from different sides of issues but largely anti-Merkel—some of them anti-refugee and anti-Turkish.

The campaign in the US, which ramped up in 2015, was much more significant in scope and effort. By 2015, more than 35 percent of IRA’s tweets were in English and focused on the US; by the next three years, US-focused tweets would make up more than half (peaking at 57 percent during the 2016 presidential campaign).

Through social media accounts, the IRA followed, retweeted, and interacted with Donald Trump thousands of times—retweeting his posts over 3,800 times. The IRA operatives also heavily retweeted Paul Joseph Watson aka @PrisonPlanet (3213 times), Jack Posobiec, Sean Hannity, Mike Cernovich, Laura Ingraham, Ann Coulter, and Alex Jones.

The resulting engagement with Trump supporters gained some of their accounts significant followings, including @TEN_GOP (and several alternative accounts run under the guise of the “Unofficial Tennessee Republican” news feed) and @CovfefeNationUS—an account that had its original name hashed in the Twitter dump, but which changed its name in November 2017. (The account’s original profile description was “No more #HappyHolidays Shit!” with a sprinkling of pro-Trump hashtags.)

@CovfefeNationUS, which had 2748 followers, was created in June 2016 and tweeted over 160,000 times—the account tweeted an average of 295 times a day over a period of 543 days. In 2017, it started posting many of its tweets using an agent named “POTUSADJT bot” (for “President of the United States of America Donald J. Trump”). The account did not rake in retweets or likes itself very often—its top post in that department had 13 retweets and 15 likes (“Melania Trump serves food to Coast Guard on Thanksgiving https://t.co/ivlN8QORjk via @Femail”). But the account’s constant engagement with and retweeting of Trump, Hannity (retweeted over 950 times by @CovfefeNationUS, and mentioned by Twitter handle over 1,000 times), and other prominent pro-Trump accounts—as well as retweets by other bot accounts—resulted in an impact much larger than each of the accounts’ followers count.

The influence accounts were also aided by some very popular fake conservative personas that leveraged blogs and other social media to extend their reach. In addition to the popular @TEN_GOP account, IRA ran the personas “Jenn Abrams,” “Pamela Moore,” and “Gunslinger Girl” (allegedly from “Wisconsin,” with 25,858 followers). These accounts were well-researched, content-heavy, and designed to appeal to people who would align with Trump. Later, they would follow the same path with accounts purporting to be black women—”Luisa Haynes” (@wokeluisa), “Crystal Johnson”(@Crystal1Johnson), and “Kanisha J” (@KaniJJackson)—used to post anti-Trump and pro-liberal content.

The indictment of Khusyaynova and the shutdown of fake Facebook and Twitter accounts will undoubtedly do little to end this sort of activity. If anything, it’s more likely that Russian influence operation will expand to other social media platforms beyond the core Facebook and Twitter (and VK in Russia, naturally). The influence operation will continue to find new ways to agitate all sides through this election and the next. Even if it doesn’t succeed spectacularly, it works well enough to cause lingering distrust outside of particular demographic tribes. And the disinformation will live on—there are still people who believe the lie created by a 1980s Soviet disinformation campaign that the US military invented AIDS.