russian influence operations on twitter .1 russian influence operations on twitter summary this...

1

Russian Influence Operations on Twitter

Summary

This short paper lays out an attempt to measure how much activity from Russian state-

operated accounts released in the dataset made available by Twitter in October 2018 was

targeted at the United Kingdom. Finding UK-related Tweets is not an easy task. By applying a

combination of geographic inference, keyword analysis and classification by algorithm, we

identified UK-related Tweets sent by these accounts and subjected them to further qualitative

and quantitative analytic techniques.

We find:

There were three phases in Russian influence operations: under-the-radar account

building, minor Brexit vote visibility, and larger-scale visibility during the London terror

attacks.

Russian influence operations linked to the UK were most visible when discussing

Islam. Tweets discussing Islam over the period of terror attacks between March and

June 2017 were retweeted 25 times more often than their other messages.

The most widely-followed and visible troll account, @TEN_GOP, shared 109 Tweets

related to the UK. Of these, 60 percent were related to Islam.

The topology of tweet activity underlines the vulnerability of social media users to

disinformation in the wake of a tragedy or outrage.

Focus on the UK was a minor part of wider influence operations in this data. Of the

nine million Tweets released by Twitter, 3.1 million were in English (34 percent). Of

these 3.1 million, we estimate 83 thousand were in some way linked to the UK (2.7%).

Those Tweets were shared 222 thousand times. It is plausible we are therefore seeing

how the UK was caught up in Russian operations against the US.

Influence operations captured in this data show attempts to falsely amplify other

news sources and to take part in conversations around Islam, and rarely show

attempts to spread fake news or influence at an electoral level.

Background

On 17 October 2018, Twitter released data about 9 million tweets from 3,841 blocked

accounts affiliated with the Internet Research Agency (IRA) a Russian organisation founded

in 2013 and based in St Petersburg, accused of using social media platforms to push pro-

Kremlin propaganda and influence nation states beyond their borders, as well as being tasked

with spreading pro-Kremlin messaging in Russia. It is one of the first major datasets linked to

state-operated accounts engaging in influence operations released by a social media platform.

2

Caveats

The analysis presented here is based on a dataset released by Twitter in October 2018.

Although large, we cannot say with confidence what proportion of Russian state-operated

accounts that were active over the period the data represents. Given the number of users

posting in English is around four thousand, we expect there to be significantly more accounts

that have either not been detected or were not contained in the data released. Although this

is a useful window into Russian influence operations, we cannot be sure it is a representative

one. We are equally dependent on Twitters determination that these are indeed Russian

state-operated accounts.

One of the major questions that this analysis cannot answer is whether this data set reveals

Russian operations against the UK directly, or a small part of a Russian operation against the

USA which happened to include UK-related messaging. It is plausible that the data is limited to

US-focused influence operations, and mentions of the UK are included as collateral and as a

means of influencing public opinion in the US. We cannot therefore discount the possibility

that we are examining US-focused data, and that unreleased data may shed further light on

UK-focused operations.

As part of this research, we rely on probabilistic classification both to locate those Twitter

users mentioned by Russian state-operated accounts to the UK, and to classify the contents of

the messages they sent. We believe the use of natural language processing (NLP) classification

to be an improvement over keyword analytics, but despite our classifiers operating at high

levels of accuracy shown in Appendix 1 they are not perfect. A methodology note is

included.

3

Analysis

Estimate of UK Focus

Analysts looked to estimate the extent to which the accounts in the dataset targeted the

United Kingdom. To do this, three layers of classification were applied.

1. UK Mentions & Retweets: 75,787 Tweets

All users who had been mentioned or retweeted by one of the state-operated accounts was

passed through a geolocation algorithm, using available evidence contained in the data to

determine their likely country. Of the three million or so English-language Tweets sent, 76

thousand mentioned or retweeted an account we estimate to be UK-based. This included

ordinary Twitter users, journalists, MPs and media outlets.

2. UK Replies: 3,106 Tweets

Following the methodology for retweets and mentions above, the process was repeated for

users to whom a Russian-linked state-operated account had replied. Just over three thousand

Tweets were identified in this way.

3. UK Keywords: 16,381 Tweets

Tweets were also checked against a list of keywords tying them to the UK. This included

uniquely British political events (Brexit, UK General Elections), other UK events (terrorist

attacks, television programmes), and UK political figures (MPs, journalists). This process added

16 thousand Tweets.

Tweets could be identified as being linked the UK through overlapping methods. In total,

83,075 unique Tweets were classified as being connected to the UK.

This number is low, given that recent estimates say Twitter users post nearly 500 million

tweets per day in 2018, though we must keep in mind that this dataset likely represents a

fraction of the accounts operated or controlled by Russian state-linked operatives. With two

exceptions, detailed in Tweets over Time below, it is likely that the majority of content

produced by state-operated accounts was not widely read or interacted with.

4

Tweets over Time

Researchers investigated the activity and reception of Tweets sent by Russian state-operated

accounts over time.

Examining activity levels over time shows how state-operated accounts operated and when

their messaging was most likely to have reached the widest audience. The graph below shows

the number of daily Tweets sent by these accounts (in black, left axis) and the number of

shares those Tweets received (in orange, right axis).

Chart 1: Tweets and Retweets over Time

Between 1 January 2015 and 1 January 2016, the Russian state-operated accounts posted 43.5

thousand Tweets linked to the United Kingdom, peaking at 1,345 Tweets sent on 27th July.

That year, the tweets were shared a total of three thousand times, or 0.07 times per Tweet on

average.

By contrast, between 1 January 2017 and 1 January 2018, the accounts posted 16.8 thousand

Tweets. These tweets were shared 178 thousand time, or 10.6 times per Tweet on average,

peaking around the London Bridge terror attacks in June 2017.

This shows a stark difference in the how far state-operated account messaging was likely to

have carried into Twitter users timelines. In 2015, these accounts went largely under the

radar, sharing messaging that was not amplified and did not leave an impression on the

platform. In 2017, the content was significantly more widely shared.

We understand the graph to break into three broad areas of interest.

5

Phase One: Spam and the Process of Building of Credible Accounts Chart 2: Tweets and Retweets over Time

Between late May and late August 2015, English-language Tweets from accounts in the

dataset increased significantly, averaging over 300 Tweets per day over the period,

representing the single highest burst of activity across the timeframe. Engagement, as noted

above, was extremely low. A manual coding of 100 of these Tweets is shown in the table

below.

Table 1: Coding of Tweets over Phase One

Category % Tweets

Fitness & Exercise 59

Chain Tweet/Spam 30

News Sharing 6

Other 5

6

The majority of Tweets were related to fitness and exercise. On examination, Tweets look like

they were procedurally generated, either from a corpus of fitness related sentences or from

other peoples fitness and exercise Tweets. Examples are shown below:

I'm ready to eat healthy and workout. @xhibellamy @William_Stokes

@guru_paul @ThomasAmor1 @jennyc08318 @richtweten

http://t.co/TAZ9Co1QF9

http://t.co/t1wInUwpjd Eat healthy b's exercise @jenannrodrigues

@Embarrasthykids @brawlinbaby @x_Jems_x @RozaPayne4 @BlueEagle212

Chain tweets also appear to be procedurally-generated strings of Twitter users linked together

with the first name of the user, though unlike fitness and exercise Tweets they appear to be

completely nonsensical. These tweets made up 30 percent of the sample. Examples are shown

below.

.@pedrareyes148 pedra @Chloe0354 ASDFGchloeHJKLL? @pulmonxry Yeezus

@Nick281051 Nick @puffylore163 lore http://t.co/ZLpIlrsV33

.@__ilianaromero Iliana @faniiifordaze free @5hljp chris @Anjanet