russian influence operations on twitter .1 russian influence operations on twitter summary this...

Download Russian Influence Operations on Twitter .1 Russian Influence Operations on Twitter Summary This short

Post on 08-Nov-2018

215 views

Category:

Documents

0 download

Embed Size (px)

TRANSCRIPT

  • 1

    Russian Influence Operations on Twitter

    Summary

    This short paper lays out an attempt to measure how much activity from Russian state-

    operated accounts released in the dataset made available by Twitter in October 2018 was

    targeted at the United Kingdom. Finding UK-related Tweets is not an easy task. By applying a

    combination of geographic inference, keyword analysis and classification by algorithm, we

    identified UK-related Tweets sent by these accounts and subjected them to further qualitative

    and quantitative analytic techniques.

    We find:

    There were three phases in Russian influence operations: under-the-radar account

    building, minor Brexit vote visibility, and larger-scale visibility during the London terror

    attacks.

    Russian influence operations linked to the UK were most visible when discussing

    Islam. Tweets discussing Islam over the period of terror attacks between March and

    June 2017 were retweeted 25 times more often than their other messages.

    The most widely-followed and visible troll account, @TEN_GOP, shared 109 Tweets

    related to the UK. Of these, 60 percent were related to Islam.

    The topology of tweet activity underlines the vulnerability of social media users to

    disinformation in the wake of a tragedy or outrage.

    Focus on the UK was a minor part of wider influence operations in this data. Of the

    nine million Tweets released by Twitter, 3.1 million were in English (34 percent). Of

    these 3.1 million, we estimate 83 thousand were in some way linked to the UK (2.7%).

    Those Tweets were shared 222 thousand times. It is plausible we are therefore seeing

    how the UK was caught up in Russian operations against the US.

    Influence operations captured in this data show attempts to falsely amplify other

    news sources and to take part in conversations around Islam, and rarely show

    attempts to spread fake news or influence at an electoral level.

    Background

    On 17 October 2018, Twitter released data about 9 million tweets from 3,841 blocked

    accounts affiliated with the Internet Research Agency (IRA) a Russian organisation founded

    in 2013 and based in St Petersburg, accused of using social media platforms to push pro-

    Kremlin propaganda and influence nation states beyond their borders, as well as being tasked

    with spreading pro-Kremlin messaging in Russia. It is one of the first major datasets linked to

    state-operated accounts engaging in influence operations released by a social media platform.

  • 2

    Caveats

    The analysis presented here is based on a dataset released by Twitter in October 2018.

    Although large, we cannot say with confidence what proportion of Russian state-operated

    accounts that were active over the period the data represents. Given the number of users

    posting in English is around four thousand, we expect there to be significantly more accounts

    that have either not been detected or were not contained in the data released. Although this

    is a useful window into Russian influence operations, we cannot be sure it is a representative

    one. We are equally dependent on Twitters determination that these are indeed Russian

    state-operated accounts.

    One of the major questions that this analysis cannot answer is whether this data set reveals

    Russian operations against the UK directly, or a small part of a Russian operation against the

    USA which happened to include UK-related messaging. It is plausible that the data is limited to

    US-focused influence operations, and mentions of the UK are included as collateral and as a

    means of influencing public opinion in the US. We cannot therefore discount the possibility

    that we are examining US-focused data, and that unreleased data may shed further light on

    UK-focused operations.

    As part of this research, we rely on probabilistic classification both to locate those Twitter

    users mentioned by Russian state-operated accounts to the UK, and to classify the contents of

    the messages they sent. We believe the use of natural language processing (NLP) classification

    to be an improvement over keyword analytics, but despite our classifiers operating at high

    levels of accuracy shown in Appendix 1 they are not perfect. A methodology note is

    included.

  • 3

    Analysis

    Estimate of UK Focus

    Analysts looked to estimate the extent to which the accounts in the dataset targeted the

    United Kingdom. To do this, three layers of classification were applied.

    1. UK Mentions & Retweets: 75,787 Tweets

    All users who had been mentioned or retweeted by one of the state-operated accounts was

    passed through a geolocation algorithm, using available evidence contained in the data to

    determine their likely country. Of the three million or so English-language Tweets sent, 76

    thousand mentioned or retweeted an account we estimate to be UK-based. This included

    ordinary Twitter users, journalists, MPs and media outlets.

    2. UK Replies: 3,106 Tweets

    Following the methodology for retweets and mentions above, the process was repeated for

    users to whom a Russian-linked state-operated account had replied. Just over three thousand

    Tweets were identified in this way.

    3. UK Keywords: 16,381 Tweets

    Tweets were also checked against a list of keywords tying them to the UK. This included

    uniquely British political events (Brexit, UK General Elections), other UK events (terrorist

    attacks, television programmes), and UK political figures (MPs, journalists). This process added

    16 thousand Tweets.

    Tweets could be identified as being linked the UK through overlapping methods. In total,

    83,075 unique Tweets were classified as being connected to the UK.

    This number is low, given that recent estimates say Twitter users post nearly 500 million

    tweets per day in 2018, though we must keep in mind that this dataset likely represents a

    fraction of the accounts operated or controlled by Russian state-linked operatives. With two

    exceptions, detailed in Tweets over Time below, it is likely that the majority of content

    produced by state-operated accounts was not widely read or interacted with.

  • 4

    Tweets over Time

    Researchers investigated the activity and reception of Tweets sent by Russian state-operated

    accounts over time.

    Examining activity levels over time shows how state-operated accounts operated and when

    their messaging was most likely to have reached the widest audience. The graph below shows

    the number of daily Tweets sent by these accounts (in black, left axis) and the number of

    shares those Tweets received (in orange, right axis).

    Chart 1: Tweets and Retweets over Time

    Between 1 January 2015 and 1 January 2016, the Russian state-operated accounts posted 43.5

    thousand Tweets linked to the United Kingdom, peaking at 1,345 Tweets sent on 27th July.

    That year, the tweets were shared a total of three thousand times, or 0.07 times per Tweet on

    average.

    By contrast, between 1 January 2017 and 1 January 2018, the accounts posted 16.8 thousand

    Tweets. These tweets were shared 178 thousand time, or 10.6 times per Tweet on average,

    peaking around the London Bridge terror attacks in June 2017.

    This shows a stark difference in the how far state-operated account messaging was likely to

    have carried into Twitter users timelines. In 2015, these accounts went largely under the

    radar, sharing messaging that was not amplified and did not leave an impression on the

    platform. In 2017, the content was significantly more widely shared.

    We understand the graph to break into three broad areas of interest.

  • 5

    Phase One: Spam and the Process of Building of Credible Accounts Chart 2: Tweets and Retweets over Time

    Between late May and late August 2015, English-language Tweets from accounts in the

    dataset increased significantly, averaging over 300 Tweets per day over the period,

    representing the single highest burst of activity across the timeframe. Engagement, as noted

    above, was extremely low. A manual coding of 100 of these Tweets is shown in the table

    below.

    Table 1: Coding of Tweets over Phase One

    Category % Tweets

    Fitness & Exercise 59

    Chain Tweet/Spam 30

    News Sharing 6

    Other 5

  • 6

    The majority of Tweets were related to fitness and exercise. On examination, Tweets look like

    they were procedurally generated, either from a corpus of fitness related sentences or from

    other peoples fitness and exercise Tweets. Examples are shown below:

    I'm ready to eat healthy and workout. @xhibellamy @William_Stokes

    @guru_paul @ThomasAmor1 @jennyc08318 @richtweten

    http://t.co/TAZ9Co1QF9

    http://t.co/t1wInUwpjd Eat healthy b's exercise @jenannrodrigues

    @Embarrasthykids @brawlinbaby @x_Jems_x @RozaPayne4 @BlueEagle212

    Chain tweets also appear to be procedurally-generated strings of Twitter users linked together

    with the first name of the user, though unlike fitness and exercise Tweets they appear to be

    completely nonsensical. These tweets made up 30 percent of the sample. Examples are shown

    below.

    .@pedrareyes148 pedra @Chloe0354 ASDFGchloeHJKLL? @pulmonxry Yeezus

    @Nick281051 Nick @puffylore163 lore http://t.co/ZLpIlrsV33

    .@__ilianaromero Iliana @faniiifordaze free @5hljp chris @Anjanet