The Industry

Was the Latest Online Propaganda Campaign Busted by Facebook the Work of Russian Trolls?

Or trolls impersonating Russian trolls?

A Troll doll holding a Russian flag while standing on a keyboard.
Photo illustration by Slate. Photos by scanrail/iStock/Getty Images Plus, ramonageorgescu/iStock/Getty Images Plus, and HStocks/iStock/Getty Images Plus.

On Tuesday night, Facebook disclosed that its gargantuan efforts to stem disinformation on its platform might not have, in fact, stopped the very propaganda shop that’s caused so much trouble for the company over the last two years: Russia’s Internet Research Agency. In a statement, Nathaniel Gleicher, Facebook’s head of cybersecurity policy, said that the company had removed more than 100 Facebook and Instagram accounts “due to concerns that they were linked to” the IRA. He also pointed to a curious online document that had popped up on Tuesday, a website claiming that it represented the IRA and was responsible for the accounts in question. That site contained some particularly brazen taunts:

SOON AFTER NOVEMBER 6, YOU WILL REALIZE THAT YOUR VOTE MEANS NOTHING. WE DECIDE WHO YOU VOTE FOR AND WHAT CANDIDATES WILL WIN OR LOSE.

The self-proclaimed IRA site, usaira.ru, is still up, and it lists dozens of Instagram accounts it says were run by the Internet Research Agency. Of those accounts, at least four were still active as of early Wednesday morning. Notably, Facebook says it did not detect this foreign interference campaign itself, but that law enforcement tipped the company off to the existence of the accounts. Facebook confirmed to NBC News that some of the accounts it removed were the ones listed on the site.

While it’s difficult to confirm if the Instagram accounts listed on the site are indeed products of a Russian political manipulation operation, the website does offers some clues. The domain is registered to a company called Azimut LLC. A company by the same name was mentioned in the February indictment by special counsel Robert Mueller in his investigation into Russia interference in the 2016 election. Azimut, according to that indictment, was a company the Internet Research Agency would sometimes use to mask its dealings. Still, it’s possible to spoof a domain registration. Is this all the work of Russian trolls trying to insist they meddled in our election—or trolls impersonating Russian trolls?

Beyond the list of accounts, the website is primarily a billboard for a declaration from the “Internet Research Agency American Division.” Below a rotating carousel of images of Donald Trump, Hillary Clinton, and Barack Obama, is a block of all-caps text titled, “OFFICIAL STATEMENT OF THE INTERNET RESEARCH AGENCY.”* The statement claims that that, despite hard-fought efforts from Facebook and law enforcement,

WE HAVE THOUSANDS OF ACCOUNTS REGISTERED ON FACEBOOK, TWITTER AND REDDIT SPREADING POLITICAL PROPAGANDA. THESE ACCOUNTS WORK 24 HOURS A DAY, SEVEN DAYS A WEEK TO DISCREDIT ANTI-RUSSIAN CANDIDATES AND SUPPORT POLITICIANS MORE USEFUL FOR US THAN FOR YOU.

Below this statement, the authors share the names of dozens of accounts on Instagram. Almost all of the accounts are now deleted, but a search in Google shows many are still cached, giving a glimpse into just how many users these trolls were able to reach. One account, “colbertepisodes,” had more than 31,000 followers. Another called “its_bardi” had more than 32,000. These aren’t huge numbers for a disinformation-campaign account, but they’re not nothing. There was an account for just about anyone, whether you hate liberals (f.u.libtards, info.warriors), you love Bill Maher (bill.maher.time), you’re a Rihanna fan (riri_one_love), you’re a feminist (feminism_4ever), you hate things (ihatethings), and so on.

One page that was still active Wednesday morning catered to Kanye West fans and appeared to largely consist of Kanye West fan pics. That one featured an Instagram story, meaning it was active at late as Tuesday morning, since stories on Instagram last for 24 hours. Another page that was up Wednesday morning, lgbt_warriors_, posted both celebratory LGBTQ-pride content as well as memes that were obviously intended to stir hostility from homophobes. Based on the names of other accounts, trolls may well have been doing similar things: creating niche communities that would draw some supporters, but could also be used to stoke the prejudices of others.

Though some of the accounts had decent followings, the troll operation doesn’t appear to have had nearly the scale of the IRA effort to infiltrate American online life prior to the 2016 election, when Russian operatives worked to organize rallies, corresponded with activists, and even land some of their social media content in stories of major news organizations.

One big tell that something is off with this current effort is the website’s text, which is unusually direct and brazen for a supposedly shadowy troll farm. But actually, it wouldn’t be the first time the IRA has broken the fourth wall to directly address it targets. In October 2017, after a list of Internet Research Agency ads for its Facebook pages was released by the House Intelligence Committee, the group blacked out the homepages of a few of its websites, like blackmattersus.com and donotshoot.us. Covering the blackmattersus.com was an invitation in a scribbled font that read “AMA Reddit session RUSSIAN TROLLS COMING SOON. MR. Zuckerberg is so scared of Russian trolls that he won’t let you share our link. Check it out and tell your friends.”

And there has been some activity linked to the IRA this election cycle. In April, the social network said that it removed 273 more Facebook and Instagram accounts linked to the troll farm. This is on top of the 470 accounts that were purged in September 2017. This time, however, Facebook didn’t release an archive of the accounts.

But even without seeing most of the accounts in question, we might be able to learn some important lessons here. For starters, if the accounts Facebook shut down did indeed belong to the IRA, the Russian troll operation’s activity may be getting harder to catch, since Facebook’s own internal investigation unit didn’t find them and the law-enforcement tip came just before the election.

And second: Whatever was behind this, a troll operation that doesn’t just operate in secret but also issues public taunts isn’t one that’s simply trying to fool us and cause societal divisions. It wants us to know it’s doing these things so that we mistrust the government agencies and social media platforms that our supposed to keep our elections, information, and lives safe.

Maybe that’s the point. If the trolls weren’t as effective in playing to Americans’ prejudices as they were in 2016, perhaps they hoped that giving the illusion that they’re still powerful at a time when Americans and the media are on high alert for nefarious activity was their next best chance to stir trouble. If that was the play, it appears to have failed.

The bottom of the irausa.ru also displayed a chart of which candidates the trolls asserted would win the midterms, including calling re-election victories for Sens. Heidi Heidkamp and Claire MacCaskill, among other incorrect predictions. All of which makes the part of the declaration at the top that reads, “WHETHER YOU VOTE OR NOT, THERE IS NO DIFFERENCE AS WE CONTROL THE VOTING AND COUNTING SYSTEMS. REMEMBER, YOUR VOTE HAS ZERO VALUE. WE ARE CHOOSING FOR YOU,” come off as laughable, at best. Whether or not this was the IRA, maybe it should have stuck to making Kanye fan accounts.

*Correction, Nov. 8, 2018: An earlier version of this article misspelled Hillary Clinton’s first name.