Spread of a Twitter poll on the credibility of UK government accusations against Russia, by UK-focused user @Rachael_Swindon, showing the high proportion of Russian-language and pro-Kremlin retweeters. (Source: Twitter / Sysomos / @DFRLab)

By Ben Nimmo, for DFRLab

Since the British government accused Russia of an “illegal use of force” against the United Kingdom by attempting to poison former spy Sergei Skripal and his daughter Yulia in the English city of Salisbury, Twitter has become a battleground.

Supporters and defenders of the Russian government have clashed over who was to blame, and which side to believe; politicians and diplomats have joined in on both sides.

Much of this invective appears organic, driven by angry users who are convinced that their cause is right; such storms are a regrettable part of everyday life online. Some incidents, however, appear to involve organized activity, including possibly fake accounts masquerading as English users, in the well-known pattern of the “troll factory” in St. Petersburg.

Pushing a poll

On March 17, when an apparently British user called @Rachael_Swindon posted an online poll asking whether the British government’s evidence was adequate to blame Russia. The poll returned a hefty majority in favor of “No.”

The account which posted the poll is a vocal supporter of the UK’s Labour Party, a critic of the ruling Conservatives, and has a substantial following (almost 58,000, as of March 21). The fact that the poll received over 15,000 votes, mostly anti-government, was therefore not, in itself, remarkable.

What was remarkable was the origin of its amplifiers. Many of its most recent retweets — and, it is legitimate to assume, votes — came from accounts which are either Russian-language, or systematically post pro-Kremlin content.

This appeared to be an attempt by pro-Russian users to influence the online poll, and thus to create the appearance of greater hostility towards the UK government than UK users themselves showed.

 

Screenshot of the most recent retweets of the @Rachael_Swindon post, as of March 21, showing two Russian-language accounts among them. (Source: Twitter)

Spread of the @Rachael_Swindon tweet. The original post is marked on the left; each subsequent point indicates a Twitter account, and each column, traveling right, indicates a retweet, or retweet of a retweet. The vertical axis shows elapsed time, with the first retweets at the top. (Source: Twitter / Sysomos / DFRLab.)

To assess the extent to which Russian or pro-Kremlin accounts helped amplify the tweet, we conducted a machine scan of its spread through multiple stages of retweeting, using the Sysomos online tool.

Our scan showed that the early traffic (top half of the image) was generated by UK-centric accounts, but that the later traffic (bottom half) was substantially driven by Russian-language and pro-Kremlin networks, going through multiple retweet iterations as the message spread.

Profiles of @brygse, @lenkyzap, @deuxtwi and @13tucha. All accounts archived on March 23, 2018. (Source: Twitter)

For example, accounts which retweeted the post directly included @13tucha@deuxtwi@lenkyzap, and @brygse, all of which are primarily Russian-language accounts whose focus is Russia, not UK politics.

A key amplifier was the account @malinka1102, a longstanding pro-Kremlin troll. This currently gives its screen name as “Tanya P.”; traditionally, it has given no name, as an archive from July 30, 2015, showed.

Profile of @malinka1102, July 2015 (left) and March 2018 (right, archived on March 23, 2018). (Source: Wayback machine / Twitter / @malinka1102)

This account has long posted pro-Kremlin messaging on themes which have been at the heart of Kremlin disinformation operations, such as the Russian annexation of Crimea and the shooting-down of Malaysian Airlines flight MH17 over Ukraine.

Posts by @malinka1102 on MH17 and Crimea. The shares are from pro-Kremlin site russia-insider.com and Kremlin broadcaster RT. Archived on March 23, 2018. (Source: Twitter / @malinka1102)

It also posted direct attacks on researchers, including the Bellingcat team of investigative journalists, and on those who provide evidence of apparent crimes committed by Russia and its allies, such as the White Helmets rescue movement in Syria.

Posts by @malinka1102 on Bellingcat and the White Helmets. Archived on March 23, 2018. (Source: Twitter / @malinka1102)

@malinka1102’s retweet was then retweeted onwards by Russian-language account @enchanteressse, and further on to a small group of other Russian-language accounts.

A second direct retweeter of the @Rachael_Swindon post was @znaetymka, a Russian-language account which posts at bot-like rates. Created in May 2017, it had posted, by March 2018, over 43,000 tweets and 40,000 likes, for an average rate of 285 engagements per day.

Profile of @znaetymka; note the creation date and number of engagements. Archived on March 23, 2018. (Source: Twitter / @znaetymka)

This account primarily posts in Russian, and on Russian-focused themes. It does occasionally use poor (possibly Google-translated) English to troll other users, as the below exchange demonstrated.

Note the final comment, with the mangled syntax and the strange word “ushlopki,” a Russian formation (ушлопки) which could indicate an unsuccessful Google translation. Archived on March 23, 2018. (Source: Twitter / @znaetymka)

It is unequivocally a Russian-focused and pro-Kremlin account. Its decision to retweet @Rachael_Swindon was therefore most likely explained by a desire to amplify a Twitter poll to a Russian audience, which could then respond accordingly.

A third direct retweeter was especially unusual. This is @rixstep, an account which mixes pro-Kremlin content in English and Swedish, often from RT.

Posts from @rixstep in English and Swedish; the shares on the left concern RT. (Source: Twitter / @rixstep)

Like @malinka1102, @rixstep repeats common pro-Kremlin themes, for example by attacking the White Helmets, NATO, and the broader West. It also has frequent conversations with @malinka1102.

Left, posts from @rixstep to @malinka1102; note the shout-out to @ValLisitsa in the second post. Right, posts from @malinka1102 to @rixstep. Archived onMarch 23, 2018. (SourceTwitter)

These two accounts evidently form part of a community; it was likely that they coordinated offline, as troll groups are known to do. This makes it more likely that their retweeting of @Rachael_Swindon was a deliberate attempt to raise the profile of the tweet and its poll.

The most important amplifier was another member of this cluster, the account @ValLisitsa. This appears to be the account of concert pianist Valentina Lisitsa, an ethnic Russian born in Ukraine, who was dropped by the Toronto Symphony Orchestra in 2015 for comments on the Ukrainian conflict deemed to have been “deeply offensive.”

This account also joined one of the Russian troll factory’s recent hashtag campaigns, #StopMorganLie, which we have described elsewhere.

Archived on March 23, 2018. (Source: Twitter / @ValLisitsa)

According to our scan, @ValLisitsa retweeted the @Rachael_Swindon post, not directly, but from @rixstep. The two accounts are certainly connected, as their posting history made clear.

Posts from @rixstep and @vallisitsa, mentioning one another. Archived on March 23, 2018. (Source: Twitter)

From Lisitsa, the retweet cascaded to dozens of other, primarily Russian-language accounts, forming the most substantial cluster of retweets throughout the scan.

None of these Russian accounts has an organic focus on, or interest in, UK politics; their content is dominated by pro-Kremlin messaging, mostly in Russian or English. Their purpose in retweeting the poll therefore seems to have been to spread it to a Russian audience which could be expected to vote against the UK government.

This intervention was small in itself, impacting one poll, from one account. However, the source account was an influential member of a politically vocal UK community; thus, by targeting it, the Russian accounts may have hoped to reinforce their message among UK opposition supporters.

If so, they succeeded. @Rachael_Swindon is not a member of this troll community; it has had no interactions with @malinka1102 or @rixstep, and does not post on hot-button Kremlin topics such as Crimea or MH17.

However, still on March 17, the account had a conversation with @ValLisitsa, at the end of which @Rachael_Swindon claimed, based on its own poll, that the “mood of the British public is starting to shift.”

Post from @ValLisitsa, sharing an image by @Rachael_Swindon, and @Rachael_Swindon’s response. This appears to be their first interaction. Archived on March 23, 2018. (Source: Twitter / @ValLisitsa and @Rachael_Swindon)
Continuation of the conversation. Note how @Rachael_Swindon references its own poll as evidence that the British mood is shifting. Archived on March 23, 2018. (Source: Twitter / @ValLisitsa / @Rachael_Swindon)

The poll did not reflect the “mood of the British people.” It reflected some British sentiment, and a significant injection from pro-Kremlin and Russian-language accounts. Thus, the author of the poll appeared to have been taken in by one of the accounts which spread it most widely to a Russian constituency.

An influential troll

One other unusual account was especially active on the issue of the Salisbury poisoning on March 19–20: @Ian56789. According to a machine scan of posts mentioning “Skripal” on those two days, this was one of the ten most-retweeted accounts, with posts achieving hundreds of engagements.

Tweets by @Ian56789 on March 19; note that the left-hand post shares RT. Archived on March 23, 2018. (Source: Twitter / @Ian56789)

Several features of this account were questionable. Its name and bio give away no verifiable personal information; its avatar image is a photo of male model David Gandy, as a reverse search revealed.

Comparison of the @Ian56789 account with a picture of David Gandy from a 2009 photo shoot. Archived on March 23, 2018. (Left, Pinterest; right, Twitter / @Ian56789.)

It regularly engaged with @malinka1102 and @ValLisitsa, and with self-declared “pro-Kremlin media sniper” @marcelsardo, marking it as a member of an active pro-Kremlin group.

Posts from @Ian56789 to @Malinka1102 and @ValLisitsa. Archived on March 23, 2018. (SourceTwitter.)

It regularly posted pro-Kremlin messages on issues including MH17, the White Helmets, the U.S. investigation into

Russian interference led by Special Prosecutor Robert MuellerNATO, and Bellingcat.

Posts by @Ian56789 on (clockwise from top left): Mueller, the White HelmetsNATOBellingcat and MH17Archived on March 232018. (Source: Twitter)

As pointed out by U.S.-based researcher @conspirator0, there were problems with the account’s biography: it claimed to vote for Ron Paul in the 2012 U.S. election, but also claimed to be British and to have planned to move to the U.S. in 2013.

We have verified these tweets, which we reproduce here:

Tweets claiming, from top to bottom: 1) to have voted Ron Paul (May 2012); 2) to be British and ignorant of US elections (May 2012); 3) to be shortly moving to America (March 2013). Archived on March 23, 2018. (SourceTwitter / @Ian56789)

The account linked to a Medium page under the same handle, with the same screen name (“Ian 56”) and Gandy profile picture; despite being inactive, it has over 1,000 followers. It also linked to a blogspot page, which featured a variety of anti-Western, pro-Kremlin, and anti-globalization messaging.

Archived on March 23, 2018. (Source: Blogspot / Ian56)

Particularly significant, on February 28, 2015, the day on which Russian opposition leader Boris Nemtsov was murdered, this blog hosted a post which suggested that the CIA may have been behind the killing. We know from Russian sources that the “troll factory” was ordered to post heavily on that subject the day of Nemtsov’s death, blaming anyone except the Kremlin.

Archived on February 28, 2015. (Source: Blogspot / Ian56789)

This was an aggressive and apparently influential account (32,000 followers). Its spread appears to be greater among English-language users than Russian-language ones; in a machine scan of its most popular tweet on Skripal on March 19, its initial amplifiers were pro-Kremlin accounts, but many of its later ones appeared to be British.

It remains unclear whether it is merely a pro-Kremlin troll, linked in an informal network with like-minded accounts, or whether it was part of a more organized effort, such as the “troll factory” in St. Petersburg; the post on Nemtsov suggested the latter. What is clear is that its profile picture was not its own, its biographical claims are inconsistent and its content systematically promoted Russian government narratives.

Conclusion

These incidents are small in themselves, but illustrate larger issues and trends.

The large-scale amplification by Russian accounts of a UK Twitter poll demonstrated the ease with which connected accounts can amplify and, most probably, manipulate online debate, even from far away.

The impact of the @Ian56789 account — one of the most-retweeted accounts on the Skripal case — shows the power which anonymous trolls with demonstrably falsified profiles continue to wield online.

Together, they show the aggression, coordination and impact with which pro-Kremlin accounts, often anonymous and polemic, continue to operate.

By Ben Nimmo, for DFRLab

Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).