Portside

The social media efforts directed by Russia’s quasi-military Internet Research Agency both reached more people, and had a larger impact, than previously reported according to a new report from cybersecurity firm Symantec.  Just one account on Twitter received over 6 million retweets—with less than 0.04% of those retweets coming from other Russian accounts.

Even before the election, Republicans were out to dismiss the impact of Russia’s social media campaign, culminating in Jared Kushner’s claim that there was nothing to it but “a couple of ads on Facebook.” But it’s been clear from the beginning that the effort was extensive, targeted, and informed both by the information that the Russians stole from the DNC and by the polling data provided by the Trump campaign. 

What the Symantec report reveals is a program that was carefully structured, built with confidence and patience, and which worked to send pulses of false information through the social media infrastructure with remarkable effectiveness. It was also one that had a deep understanding of Twitter culture, even starting memes like “#5WordsToRuinADate” to build followers and establish connections that could later be exploited.

To create their digital propaganda tool, Russia put in place core accounts well before the 2016 election cycle. That core group was then used to source fresh content—often in the form of mocked-up articles from a fake regional news site, or a press release from a fake political organization. But before those accounts were turned on for propaganda purposes, they spent an average of six months passing on actual stories, or retweeting others, to give the accounts a “history” that made them appear real to anyone who bothered to check.

These base level accounts themselves were often built as if they represented local papers, radio stations, civic organizations, or other “official” sources. When these first tier sites spoke, a swarm of additional accounts would work to amplify these releases, spreading the news through retweets and automated comments. And for those accounts as well, Russia had a plan.

One example of those first-tier Russian accounts would be “WTOE 5 News” which pretended to be a local television station. Most of the time it passed along information that was genuine and originated with a real-world news source. Except when it didn’t—as in July 2016 when it originated the story that Donald Trump had been endorsed by the Pope.

But the most popular site was TEN_GOP, which claimed to be the account of the Tennessee Republican Party. The account was established in 2015 and appears to have had almost entirely original content. It accumulated 150,000 followers and snagged over 6 million retweets from genuine Twitter accounts. That site specialized not only in regular messages of racism and Islamophobia but in … attacking anyone who believed that Russia was trying to sway the election. Not only did some of the messages spread by that account get wide support at the time, those messages—including claiming that President Obama “planted operatives all over the government to leak sensitive information”—are still major talking points expressed by the Republican Party, including Trump.

Backing up these accounts were second-tier Russian accounts, constructed mostly under the pretense of being individuals. It was these accounts that spread jokes, started memes, and retweeted popular posts, and in general carried on the business of being “regular people” for an extended period. As with the fake news accounts, these accounts were primarily driven by bots, but regularly showed hands-on action from Russian operators. By supplementing their work with automation, individuals in the Russian organization could create and sustain a growing tree of accounts that didn’t just retweet each other, but extended growing roots throughout Twitter.

Several of the accounts at both levels were even used to organize actual, physical political rallies in the United States—with Russian operatives coming into the country to support these operations. The millions of followers for the social media accounts were targeted with information on these rallies.

The regular manual intervention not only injected fresh content, it also meant that systems Twitter put in place to look for accounts that were only retweeting or generating obviously automated messages were fooled by these accounts. Sure, 90% of the content of an account might be retweets with or without an added “Thread!” or “Look at this!” but that’s also true of many actual accounts. Russia knew that.

Much of the messaging wasn’t just directed at building up Trump, but at depressing the Democratic vote. That included messages aimed at African American voters and those disappointed in Hillary Clinton’s primary victory. Depressing black votes wasn’t just a sideline for the Russian effort, it was a primary focus. Those efforts sometimes spanned not just social media, but AM radio and even real-world events. A previous study indicated that black voters were the group most heavily targeted by the Russian effort. It was also an area where the Trump campaign and Russia not only had a common interest, but followed common tactics. Of the ten most popular Twitter accounts created by Russia, fully half are those that supposedly belong to African American individuals promoting Black Lives Matter or other groups. Each of these accounts had between 500,000 and 1,200,000 retweets.

Every element of the Symantec report is staggering. It reflected both extensive knowledge, extensive planning, and a hands-on flexibility that shows adaptation and innovation over the course of the campaign. It also shows that, in an election that turned on just 100,000 votes across a handful of states, Russia’s social media campaign could easily have been a tipping point—especially when helped by incredibly prejudicial actions by James Comey and slanted articles by actual media.

In 2018, Twitter at last released a dataset of 3,836 accounts that were used by Russian trolls in 2016—accounts that had put out nearly 10 million tweets and accumulated 6.4 million followers. That data informed Symantec’s new report.

Mark Sumner is a DailyKos staff writer. He is the author of the nonfiction work "The Evolution of Everything" as well as several novels including "Devil's Tower."