Following the hearing at the US Senate in which Twitter gave evidence, a 65 page list of Russian operative accounts were released. Thousands of aliases were influencing public discourse and producing at least a fifth of all messaging during the Trump election. They are still in operation.
It remains, however, the tip of the Iceberg. And the Olgino Trolls – based at the Kremlin funded Internet Research Agency near St Petersburg – are not the whole story.
Social Media in the UK is infested with automated accounts spreading Russian disinformation, managed trolls accounts, and even some home grown extremists who are thriving within these networks.
This UK network runs hundreds of thousands of accounts deep and we are peering into it for the first time with the assistance of some of the world’s most advanced intelligence and forensic investigation software.
Starting with the basic facts, we know that Olgino is in Russia. We also know this is the base of the Internet Research Agency, hence the term The Olgino Trolls.
Referring to the list of confirmed Olgino Trolls provided to the US Senate by Twitter, one name was randomly selected: Williams_Diana_
While the account has long since been suspended by Twitter, every contact leaves a trace applies as a principle as much in the online world as it does at any crime scene.
Subsequently, an advanced search using Twitter’s own engine, could be used to identify whether this account had involved itself in Brexit during the date range February 1st to September 1st 2016.
By adding the keywords, Brexit, Leave, UK, EU, and Farage, Twitter was able to find a list of interactions between these confirmed Russian agent and others, including Axel Bruns, based in Brisbane, MAGA troll Doc Stuart, and English user Suzytoo.
Under the Twitter handle @tt_saw, the account – which features London Bridge and poppies in its biographical information – was discussing the murder of MP Jo Cox with Williams on the 17th of June 2016, saying “They don’t no facts & Farage getting blame” in reply to a now deleted tweet by the Russian operator.
https://twitter.com/tt_saw/status/743849032041259009
One single, random sample from official US list immediately connects the Olgino trolls to Brexit and shows they were operating during the key referendum period in Britain, interacting with British accounts.
Using the publicly available Twitter data and the intelligence software, it was possible to start to piece together a much more detailed picture.
Twitter allocates an allowance of what is referred to as API usage to each user, meaning – with the right tools – the public data on accounts matching alias names, their followers, following, and even what they talk about, can be extracted in bulk for analysis.
The next stage of the analysis was to draw out the list of users the Williams interactor, Suzytoo, follows.
Unlike the permanently suspended Russian operator account, Suzytoo is still active as a user now.
Standing alone, the follower list doesn’t provide a great deal of unexpected information.
In essence, she follows many of the same character pro-Leave voters do, including Rees-Mogg and Farage.
| So, from this, the next step was to extract the detail of who follows her – a much larger dataset.
Using Twitter advanced search results relating to a second UK user, @MaponusR, which had also interacted with the Williams account, the analysis was able to find a much smaller number of accounts common to the networks of both.
At this stage, the links between the Brexit network and the Russian network active in the US became even clearer. The third mutual account from the left is David Jones, the Kremlin troll outed by The Times earlier in 2017.
The analysis, even at an early stage, provided a definite and more than singular connection between confirmed Russian activity in the US and the UK networks which are still operating now. This means Russia was active on UK social media during Brexit, and was at least partially successful in its interactions with other users.
It subsequently became possible to extract more data from Twitter, dip sampling accounts within the network, to assess whether or not they are bots, managed agents, or local trolls. The results are preoccupying.
The very first account examined, “Sam”, featured a use of the underscore which followed the Olgino pattern and was being operated 7 days a week during Moscow office hours – despite claiming to be a Brexit supporter based in China. The timestamp data was clear. Using an Android client for Twitter, the account regularly attacks Muslims, Islam, Jews, and the EU, interacting with UKIP supporters and official party accounts, as well as far-right figures including Tommy Robinson.
The second account in the broad spectrum of accounts sampled was a US time zone manual user active mostly on 4chan and other Alt-Right forums, spreading known Russian memes and ideology.
They were not alone. A number of purportedly UK accounts are being operated with some degree of automation, aligned to either the US Eastern timezone and the Alt-Right, or more directly with Russian office hours. This has become a common feature of ongoing Russian-centric troll activity across the US and, as in the UK, a number of local users have become instrumental in distributing the messaging, having been duped by it. Across scores of accounts, those examined, and those linked to them, the connection between Russian accounts active in the US and those still active in the UK is undeniable and blatant. The operators are not even hiding it.
Every account examined has been reported to Twitter. Suzytoo has not yet responded to requests for comment. Investigations and analysis continue with a vast and expanding dataset. Twitter’s evidence is due to be received by the Media and Culture Committee in the coming weeks. One final curiousity arose from an account under the name @avonandsomer, claiming to be UK based and using the name Rob Boyd – similar to the name of a man imprisoned in early 2016 for bomb hoaxes at Bristol and Birmingham airports.
The user blocked every account we are linked to, despite being unaware of the analysis being carried out. On closer examination, the header picture and profile marry with image and bio style data discovered while investigating prolific Alt-Right account user Microchip. The original investigation was referred to the FBI and NCA and the accounts were shut down. |
