Russia's 2016 Twitter campaign far broader, deeper, and incredibly successful: Symantec

A much larger pool of auxiliary accounts was used to amplify messages pushed out by the main accounts. These usually pretended to be individuals.

The campaign directed propaganda at both sides of the liberal/conservative political divide in the U.S., in particular the more disaffected elements of both camps.

Most accounts were primarily automated, but they would frequently show signs of manual intervention, such as posting original content or slightly changing the wording of reposted contented, presumably in an attempt to make them appear more authentic and reduce the risk of their deletion. Fake news accounts were set up to monitor blog activity and automatically push new blog posts to Twitter. Auxiliary accounts were configured to retweet content pushed out by the main accounts.

The most retweeted account garnered over 6 million retweets. Only a small fraction (1,850) of those retweets came from other accounts within the dataset, meaning many of the retweets could have come from genuine Twitter users.

The Symantec report says:

In October 2018, Twitter released a massive dataset of content posted on its service by the Internet Research Agency (IRA), a Russian company responsible for the largest propaganda campaign directed against the U.S.

The dataset consisted of 3,836 Twitter accounts and nearly 10 million tweets. These accounts had amassed almost 6.4 million followers and were following 3.2 million accounts. The sheer volume of data was enormous, more than 275 GB.

The archive has proven to be a treasure trove of information on how the IRA’s propaganda campaign operated.  For example, prior to the release, many people assumed that its posts were focused on just one side of the political spectrum. Once the data was made public, it quickly became obvious that in order to achieve its goal, the campaign directed propaganda at both sides of the liberal/conservative political divide in the U.S., in particular the more disaffected elements of both camps. The main objective of the campaign instead appeared to be sowing discord by attempting to inflame opinions on both sides. This was not just confined to the online sphere. Several of the accounts were used to organize political rallies in the U.S. and some of the most influential accounts in the dataset were used to promote these events to the largest possible audience.

The report concludes:

While this propaganda campaign has often been referred to as the work of trolls, the release of the [Internet Research Agency] dataset makes it obvious that it was far more than that. It was planned months in advance and the operators had the resources to create and manage a vast disinformation network.

It was a highly professional campaign. Aside from the sheer volume of tweets generated over a period of years, its orchestrators developed a streamlined operation that automated the publication of new content and leveraged a network of auxiliary accounts to amplify its impact.

The sheer scale and impact of this propaganda campaign is obviously of deep concern to voters in all countries, who may fear a repeat of what happened in the lead-up to the U.S. presidential election in 2016.

A growing awareness of the disinformation campaigns may help blunt their impact in future. If you’re concerned about falling victim to similar campaigns, read our blog post How to Spot a Twitter Bot, which can be found on Symantec’s Election Security blog.

“This confirms analysis that social media disinformation of the scale seen in 2016 requires some long work,” Fabrice Pothier, chief strategy officer at Rasmussen Global and senior adviser to the Transatlantic Commission on Election Integrity, told Politico.

Pothier said an earlier analysis of Russian interference, released by Microsoft in February, showed Russian “operatives were seeking to ‘harvest’ personal data of Republican-leaning voters in order to further build their database of individuals to target in future operations.”

“The fact that disinformation operations support individuals/narratives from both sides of the aisle is not new,” said Pothier. But he said the new finding point to the “troubling reality that we lack a full picture of what is really happening in the social media sphere because the main platforms are not fully transparent.”

Conclusions
Symantec’s detailed report, and the report’s conclusions, dovetail with the report prepared by Robert Mueller, and that report’s conclusions.

On 28 May, Robert Mueller made his first and only public statement about his investigation. He said:

Russian intelligence officers, who are part of the Russian military, launched a concerted attack on our political system.

…they used sophisticated cyber-techniques to hack into computers and networks used by the Clinton campaign. They stole private information and then released that information through fake online identities and through the organization WikiLeaks. The releases were designed and timed to interfere with our election and to damage a presidential candidate. And at the same time as the grand jury alleged in a separate indictment, a private Russian entity engaged in a social media operation where Russian citizens posed as Americans in order to influence an election.

Mueller concluded his statement by saying:

And I will close by reiterating the central allegation of our indictments, that there were multiple systemic efforts to interfere in our election.

And that allegation deserves the attention of every American.

The Symantec report similarly warns: “The sheer scale and impact of this propaganda campaign is obviously of deep concern to voters in all countries, who may fear a repeat of what happened in the lead-up to the U.S. presidential election in 2016.”