By Jan van Dijk and Robert van der Noordaa, for UkraineWorld
Co-authors: Valentyna Bykova, Yuriy Diachenko, Valeriy Pan’ko, Ivanna Vlasiuk, Tetiana Hyrina
The army of trolls pushing the Russian narrative on MH17 discovered 6 years after the crash.
HOW WAS THE ARMY IDENTIFIED?
When the MH17 trial began at the beginning of March 2020, Trollrensics collected tweets mentioning MH17 and #MH17. We detected an unusually high number of tweets with articles from zen.yandex.ru. When the court case resumed in June, we again observed a spike in MH17 tweets by the same accounts which all contained links to zen.yandex.ru articles.
The names of the people ostensibly behind the accounts were rather unusual, and their handles were similar in a manner suggesting that they were all likely created by one person.
INVESTIGATION
As part of a workshop hosted by UkraineWorld, an investigation was carried out. If it was a troll army — a coordinated group of accounts sharing disinformation — that we were looking at, then only one account would be needed to do the research. We selected the account @budkina275. When visiting its profile, Twitter’s additional following suggestions showed accounts that also shared the same zen.yandex.ru articles.
It becomes more apparent when clicking on the ‘show more’ option. Twitter’s suggested following algorithm works perfectly, and ‘show more’ offers exclusively more trolls from the same army as Budkina.
Using several reverse image search engines shows that the profile pictures are ripped from elsewhere. Budkina’s picture can be found on many different sites. The handles are unusual, and this suggests that the creator of this army wasn’t very creative. For example, we can also see handles like bukina275, balkina275, and zorkina275.
When we look at the dates when the profiles were created, it is also clear that the profiles were created in waves. If we look at a part of the army (26 trolls), eight were created in February 2018, seven in October 2015, one in September 2015 and ten in March 2018.
We made password recovery attempts for several dozen accounts to see what the email accounts behind them looked like. In all cases, the email address is the handle name from Twitter and the mail provider is mail.ru. So for Sveta Budkina, her email address is [email protected] Some other examples:
FOLLOWING/FOLLOWERS
The number of accounts followed and followers is almost identical within each wave of accounts for most of the trolls. The accounts created in October 2015 have a much higher number of followed accounts and followers. It is clear that these following and follower numbers are not random, but were created deliberately.
There was no location indicated on the profile for many of the bots/trolls. Those which had a profile location all listed Moscow or Russia. The trolls with around 400 followers and followed accounts are themselves followed exclusively by trolls. Thus, the size of this troll army is at least several hundred. Only a limited number of trolls retweet the zen.yandex.ru links from the Obninsky chess page.
The fact that all the profiles had pictures ripped from elsewhere, that they were all included in the twitter algorithm’s recommended follower circle, that they all exclusively share zen.yandex.ru articles, and that all the accounts follow each other makes clear that this is a troll army and not just a collection of unrelated accounts.
SO WHO IS BEHIND THE TROLL ARMY?
It is often very difficult to figure out who exactly is behind a troll army, but we were able to do so in this case. The clearest indication is that the trolls/bots exclusively share articles from the ObninskChess page on Zen.yandex.ru
If we look, for instance, at the Twitter likes of @zorkina275, we find that the account has exclusively liked Tweets by the @ObninskchessRU account on Twitter.All of the trolls follow the chess account, and the chess account follows all of them.
The trolls’ tweets rather curiously always use 3 hashtags that are always different. If we look at the Twitter account @ObninskchessRu, we also see that it also uses three hashtags.
The audience indicated on the zen.yandex.ru site is 66,555, but it is not entirely clear what that means. Its subscriber count is 1,369. Obninsk chess indicates on its page that it is interested in politics in addition to chess.
Based on the fact that these trolls only retweet zen.yandex.ru articles from the Obninsk chess page, the fact that that the trolls only like the tweets of the chess account, and the fact that the chess account also uses the three hashtags, we can be confident that we have found the owner of the troll army.
Link to the ObninskChess page on zen.yandex.ru: https://zen.yandex.ru/newsall
WHAT DO THEY TWEET?
Some examples:
Abstract: This article is a very bizarre story about a UFO. It reports that a cigar-shaped UFO appeared in the sky. It may be the result of a clash between two alien military forces and may be connected to the COVID-19 pandemic on Earth.
Abstract: A news piece about a UFO sighting in Brazil, noting that posts about the event were allegedly deleted on Twitter and Reddit. However, the article doubts that the UFO exists.
Abstract: “Roskosmos” has won, and Elon Musk has lost due to his impulsiveness. Musk’s impulsiveness has hurt his businesses and caused a drop in Tesla’s share price on the stock market. Musk also does not care about his son.
Abstract: Facts from the video provided by Russian police contradict the statements of Ivan Golunov, a Russian journalist, who said he was tortured during his arrest. The video shows no use of force against Golunov; he was handcuffed only when he refused to go to the precinct. So why did he lie about torture?
Abstract: Volodymyr Zelensky, Ukraine’s President, betrayed the trust of people who voted for him, Ukraine’s former justice minister Olena Lukash said. According to her, Zelensky lied twice. First, he lied in his “Servant of the People” TV show where he created a positive image for himself. Second, he lied to them as President when he promised too much and did not deliver.
Abstract: This article supports amendments to Russian constitution. According to the author, all the proposed amendments should be voted for.
Abstract: This article mocks the “wrong” decision of Ukraine’s President Volodymyr Zelensky to advance towards a new level of partnership with NATO. The author describes Zelensky as having sold out Ukraine. The article also mentions that Zelensky’s wife was hospitalized due to COVID-19.
Abstract: This article tries to disprove all the proof of Russia shooting down MH17.
WHEN DO THEY TWEET?
Strangely enough, the accounts tweet around the clock. Using Trollrensics software to analyze the tweet times shows the following:
It appears that budkina275 doesn’t even sleep! She seems to tweet around the clock. A similar tweet distribution can be found with the other trolls. It seems likely that this army is automated, but while the trolls tweet the same articles, they do not tweet at the exact same time. If the accounts tweet at automated times, then all the accounts have different behaviour.
Further analysis of the accounts’ behaviour shows that they are highly automated bots.
For example:
USING 3 HASHTAGS
It is unknown how the 3 hashtags are generated. Most of the trolls tweet the same articles, but even if they tweet the same article, the 3 hashtags are different. For example:
WORKINGS OF THE TROLL ARMY
It seems that the trolls are intended to direct visitors to the zen.yandex.ru site of the Obninsk chess page. It is possible that the chess club earns money from advertisements on the of zen.yandex.ru page. It is likely that zen.yandex.ru logs how many people visit the Obninsk page.
What is strange is that the trolls do not like each other’s tweets, since the tweets would get more attention if they did that. There are no comments from any of the trolls, which would also boost the posts’ visibility.
REACTION FROM THE OBNINSK CHESS CLUB
A detailed email about the troll army was sent to the director of the chess club and the admin of the website several days prior to the publication of this article. The email included a deadline for their response. Unfortunately, we received no answer from either the director or the admin.
By Jan van Dijk and Robert van der Noordaa, for UkraineWorld
This article was written within the framework of the project “Sharing Ukrainian experience in building resilience to hybrid warfare” which is being implemented by NGO Internews-Ukraine with financial support from the NATO Information and Documentation Centre in Ukraine. This article is the sole responsibility of its authors and might not reflect the official position of NATO.
