russian influence operations on twitter .1 russian influence operations on twitter summary this...
Post on 08-Nov-2018
214 views
Embed Size (px)
TRANSCRIPT
1
Russian Influence Operations on Twitter
Summary
This short paper lays out an attempt to measure how much activity from Russian state-
operated accounts released in the dataset made available by Twitter in October 2018 was
targeted at the United Kingdom. Finding UK-related Tweets is not an easy task. By applying a
combination of geographic inference, keyword analysis and classification by algorithm, we
identified UK-related Tweets sent by these accounts and subjected them to further qualitative
and quantitative analytic techniques.
We find:
There were three phases in Russian influence operations: under-the-radar account
building, minor Brexit vote visibility, and larger-scale visibility during the London terror
attacks.
Russian influence operations linked to the UK were most visible when discussing
Islam. Tweets discussing Islam over the period of terror attacks between March and
June 2017 were retweeted 25 times more often than their other messages.
The most widely-followed and visible troll account, @TEN_GOP, shared 109 Tweets
related to the UK. Of these, 60 percent were related to Islam.
The topology of tweet activity underlines the vulnerability of social media users to
disinformation in the wake of a tragedy or outrage.
Focus on the UK was a minor part of wider influence operations in this data. Of the
nine million Tweets released by Twitter, 3.1 million were in English (34 percent). Of
these 3.1 million, we estimate 83 thousand were in some way linked to the UK (2.7%).
Those Tweets were shared 222 thousand times. It is plausible we are therefore seeing
how the UK was caught up in Russian operations against the US.
Influence operations captured in this data show attempts to falsely amplify other
news sources and to take part in conversations around Islam, and rarely show
attempts to spread fake news or influence at an electoral level.
Background
On 17 October 2018, Twitter released data about 9 million tweets from 3,841 blocked
accounts affiliated with the Internet Research Agency (IRA) a Russian organisation founded
in 2013 and based in St Petersburg, accused of using social media platforms to push pro-
Kremlin propaganda and influence nation states beyond their borders, as well as being tasked
with spreading pro-Kremlin messaging in Russia. It is one of the first major datasets linked to
state-operated accounts engaging in influence operations released by a social media platform.
2
Caveats
The analysis presented here is based on a dataset released by Twitter in October 2018.
Although large, we cannot say with confidence what proportion of Russian state-operated
accounts that were active over the period the data represents. Given the number of users
posting in English is around four thousand, we expect there to be significantly more accounts
that have either not been detected or were not contained in the data released. Although this
is a useful window into Russian influence operations, we cannot be sure it is a representative
one. We are equally dependent on Twitters determination that these are indeed Russian
state-operated accounts.
One of the major questions that this analysis cannot answer is whether this data set reveals
Russian operations against the UK directly, or a small part of a Russian operation against the
USA which happened to include UK-related messaging. It is plausible that the data is limited to
US-focused influence operations, and mentions of the UK are included as collateral and as a
means of influencing public opinion in the US. We cannot therefore discount the possibility
that we are examining US-focused data, and that unreleased data may shed further light on
UK-focused operations.
As part of this research, we rely on probabilistic classification both to locate those Twitter
users mentioned by Russian state-operated accounts to the UK, and to classify the contents of
the messages they sent. We believe the use of natural language processing (NLP) classification
to be an improvement over keyword analytics, but despite our classifiers operating at high
levels of accuracy shown in Appendix 1 they are not perfect. A methodology note is
included.
3
Analysis
Estimate of UK Focus
Analysts looked to estimate the extent to which the accounts in the dataset targeted the
United Kingdom. To do this, three layers of classification were applied.
1. UK Mentions & Retweets: 75,787 Tweets
All users who had been mentioned or retweeted by one of the state-operated accounts was
passed through a geolocation algorithm, using available evidence contained in the data to
determine their likely country. Of the three million or so English-language Tweets sent, 76
thousand mentioned or retweeted an account we estimate to be UK-based. This included
ordinary Twitter users, journalists, MPs and media outlets.
2. UK Replies: 3,106 Tweets
Following the methodology for retweets and mentions above, the process was repeated for
users to whom a Russian-linked state-operated account had replied. Just over three thousand
Tweets were identified in this way.
3. UK Keywords: 16,381 Tweets
Tweets were also checked against a list of keywords tying them to the UK. This included
uniquely British political events (Brexit, UK General Elections), other UK events (terrorist
attacks, television programmes), and UK political figures (MPs, journalists). This process added
16 thousand Tweets.
Tweets could be identified as being linked the UK through overlapping methods. In total,
83,075 unique Tweets were classified as being connected to the UK.
This number is low, given that recent estimates say Twitter users post nearly 500 million
tweets per day in 2018, though we must keep in mind that this dataset likely represents a
fraction of the accounts operated or controlled by Russian state-linked operatives. With two
exceptions, detailed in Tweets over Time below, it is likely that the majority of content
produced by state-operated accounts was not widely read or interacted with.
4
Tweets over Time
Researchers investigated the activity and reception of Tweets sent by Russian state-operated
accounts over time.
Examining activity levels over time shows how state-operated accounts operated and when
their messaging was most likely to have reached the widest audience. The graph below shows
the number of daily Tweets sent by these accounts (in black, left axis) and the number of
shares those Tweets received (in orange, right axis).
Chart 1: Tweets and Retweets over Time
Between 1 January 2015 and 1 January 2016, the Russian state-operated accounts posted 43.5
thousand Tweets linked to the United Kingdom, peaking at 1,345 Tweets sent on 27th July.
That year, the tweets were shared a total of three thousand times, or 0.07 times per Tweet on
average.
By contrast, between 1 January 2017 and 1 January 2018, the accounts posted 16.8 thousand
Tweets. These tweets were shared 178 thousand time, or 10.6 times per Tweet on average,
peaking around the London Bridge terror attacks in June 2017.
This shows a stark difference in the how far state-operated account messaging was likely to
have carried into Twitter users timelines. In 2015, these accounts went largely under the
radar, sharing messaging that was not amplified and did not leave an impression on the
platform. In 2017, the content was significantly more widely shared.
We understand the graph to break into three broad areas of interest.
5
Phase One: Spam and the Process of Building of Credible Accounts Chart 2: Tweets and Retweets over Time
Between late May and late August 2015, English-language Tweets from accounts in the
dataset increased significantly, averaging over 300 Tweets per day over the period,
representing the single highest burst of activity across the timeframe. Engagement, as noted
above, was extremely low. A manual coding of 100 of these Tweets is shown in the table
below.
Table 1: Coding of Tweets over Phase One
Category % Tweets
Fitness & Exercise 59
Chain Tweet/Spam 30
News Sharing 6
Other 5
6
The majority of Tweets were related to fitness and exercise. On examination, Tweets look like
they were procedurally generated, either from a corpus of fitness related sentences or from
other peoples fitness and exercise Tweets. Examples are shown below:
I'm ready to eat healthy and workout. @xhibellamy @William_Stokes
@guru_paul @ThomasAmor1 @jennyc08318 @richtweten
http://t.co/TAZ9Co1QF9
http://t.co/t1wInUwpjd Eat healthy b's exercise @jenannrodrigues
@Embarrasthykids @brawlinbaby @x_Jems_x @RozaPayne4 @BlueEagle212
Chain tweets also appear to be procedurally-generated strings of Twitter users linked together
with the first name of the user, though unlike fitness and exercise Tweets they appear to be
completely nonsensical. These tweets made up 30 percent of the sample. Examples are shown
below.
.@pedrareyes148 pedra @Chloe0354 ASDFGchloeHJKLL? @pulmonxry Yeezus
@Nick281051 Nick @puffylore163 lore http://t.co/ZLpIlrsV33
.@__ilianaromero Iliana @faniiifordaze free @5hljp chris @Anjanet