Russia was actively engaged in amplifying Leave messaging and targeting both undecided and Remain voters during the critical hours of the 23rd of June 2016.
The volume of social media traffic is significantly higher than claimed so far and would have reached the entire voting population of England, Wales, Scotland, and Northern Ireland.
Earlier this year, academic researcher Marco Bastos released a critical piece of work on the Brexit Botnet, identifying thousands of accounts which vanished after the vote.
Published in Social Science Computer Review, Bastos first outlines the definition of a ‘sock puppet’ – what we commonly refer to as bots or trolls.
“A sock puppet account is a false online identity used to voice opinions and manipulate public opinion while pretending to be another person. The term draws from the manipulation of hand puppets using a sock and refers to the remote management of online identities to spread misinformation, promote the work of one individual, endorse a given opinion, target individuals, and challenge a community of users.”
Starting with an analysis of almost 800,000 users who had tweeted on either side of the Brexit debate before the vote, the researchers managed to identify location data in only 60% of cases.
Of the 482,000 accounts they could successfully geo-locate, only 30,122 users were identified as based in the UK, with the researchers noting it was: “a smaller population than the set of 40,031 accounts that have been deactivated, removed, blocked, set to private, or whose username was altered after the referendum.”
Breaking the group of 40,031 down, they identified 26,358 accounts had changed their identity after the vote and 13,493 had been deleted altogether.
They did, however, note a clear relationship between the repurposed and deleted accounts in the way they had amplified each other, and specifically recorded that a much higher proportion (37%) of their content showed “notable support for the Leave campaign.”
Of course, Bastos is not alone in his research and more research is coming from Universities almost daily across the globe. But
Using my own background as an intelligence officer and data analyst at Scotland Yard, combined with the skills of group of technical data analysts, security specialists, and a citizen journalist, Byline has forensically pieced together the true scale of Russian interference in Brexit.
“Of the 482,000 accounts they could geo-locate, only 30,122 users were identified as based in the UK
, noting that it was: “a smaller population than the set of 40,031
accounts that have been deactivated, removed, blocked, set to private,
or whose username was altered after the referendum.”
“
We already know that bots and trolls – sock puppets – are tasked to run disinformation campaigns and influence or sway media reporting by amplifying fake news. We also know this is directly linked to Russia and a perfect example can be found in Uranium One.
Identifying human managed sock puppets is also an excruciating process and, ultimately, most of us just have to make judgment calls on the balance of probabilities, based on the finite amount of information you can glean from an anonymous internet user. There is no app for it.
We also know the balance of how a particular topic is reported – whether that be politics, foreign affairs, or something more commercial – is, in fact, a valuable commodity.
Earlier this year, the underground propaganda market which sells the services of Russian sock puppets featured in a Trend Microsystems report which said: “The views on [that] topic can be changed. This can be done either with inaccurate facts or with accurate ones twisted to favor a particular view or side.” Effectively, fake news posts are crafted to appeal to a target readers’ psychological desires, bias confirmation playing a heavy role.
This utilises a combination of network centrality, organic reach, and paid reach, to enhance the spread of a message. The topic of a special investigation completed last week.
Most, if not all, of this activity centres around Russia’s state or intelligence machinery and extends to include hacking and leaking operations. One arm of the operation is APT28, Russian military intelligence.
In a further report on cyber espionage, Trend explained: “The group’s cyber propaganda methods—using electronic means to influence opinion —creates problems on multiple levels. Aside from manipulating the public, their operations also discredit political figures and disrupt the established media. The proliferation of fake news and fake news accusations in 2017 can in part be attributed to constant information leaks and manipulations by malicious actors.”
These activities have even revealed occasions upon which Russia has masqueraded as ISIS – for example, when they hacked TVMONDE5 under the guise of the Cyber Calpihate. Russia has been active everywhere, from the US, to the Middle East, Syria to Ukraine, to France and Germany. And yes: in the UK, during Brexit.
As Theresa May, the UK Prime Minister, confirmed: we know what they’ve been doing across the world.
Yet, only now is Britian starting to realise what happened, despite the Alternative War having been right under our noses all along.
“The group’s cyber propaganda methods—using electronic means to
influence opinion —creates problems on multiple levels. Aside from
manipulating the public, their operations also discredit political
figures and disrupt the established media.”
Social media is a wholly unregulated environment. There are very few barriers to access and no identity confirmation procedure which is – or can be – effective.
You could be talking to absolutely anyone, if they are indeed a person at all.
Bots account for a huge portion of Twitter’s users but there is no definitive figure on how high this proportion is. Using a previous crude calculation based upon President Trump’s fake following of millions, the number of fake accounts on Twitter could account for as many as 40% of its monthly users. (That’s 131 million fake accounts in regular use, potentially).
In 2014, Twitter recorded that 44% of its total users were inactive. This equated to 428.5 million user accounts being dormant at the time. Many dormant accounts are sock puppets.
Likewise, Facebook has just confirmed that 270,000,000 users across its network are fake or otherwise illegitimate.
This is a substantial shift in position from their initial repsonse to Russian interference in the Trump election, which saw the company delete only 470 accounts in the United States, then 30,000 in France ahead of the Macron election race with Russian-funded candidate Marine Le Pen.
And it is this grey area which is being used an abused by a co-ordinated network, working together with other Russian affiliated media networks, like Breitbart and Infowars who sit not only at the centre of the US/Russia mess but, surprisingly, at the heart of Brexit too.
Whichever we look at social media, it has become a fact of life, a driver of discourse, and a creator of the news we read and pass on. There is no myth about its effect on society.
https://twitter.com/conspirator0/status/906962210630635521
From the British point of view, it’s become clear Leave.EU is markedly pro-Russia and also deeply tied to the Trump/Russia affair, not least through Cambridge Analytica – themselves most recently engaged in a targeted social media campaign as a Foreign Agent acting in Russia interests around Qatar. But it isn’t just UKIP left exposed to parts of the former USSR’s enhanced intelligence machinery: it’s a cross party issue which sees unrinsed Kremlin money going direct to Parliament.
And the problem only gets worse when Julian Assange is brought into the equation. Wikileaks is now openly a Kremlin asset and hostile actor.
Which brings us to Brexit, Russia, and Social Media.
“Whichever we look at social media, it has been a fact of life, a driver
of discourse, and a creator of the news we read and pass on.”
The US Senate recently published 65 pages of Twitter user names. 2,500 or so accounts being run directly from the Kremlin’s own troll farm: The Internet Research Agency in Olgino.
Probing that list for Byline led directly to Brexit, and deeper still to a more rounded understanding of how difficult to detect sock puppets are, especially when dressed as patriots.
Yet, tracing just one of the US Senate’s confirmed Olgino Trolls to Brexit accounts – discussing Leave and not using pencils – led almost immediately to a huge network.
9,320 UK branded Twitter accounts, cross connected in 10,326 ways – through followings and Twitter activity.
In the top 10 of those thousands of links were the Olgino Troll account itself and David Jones – a pro-Kremlin Brexit Troll exposed by The Times earlier this year.
By dividing the network for analysis we were able to establish that 50% of pro-leave accounts connected to the others had been deleted, while the others were still live and 20% of them dormant – having not tweeted for some time but not having been closed or locked. This is a mutually supported finding from the earlier research, though arrived at very differently.
Immediately, this increases the network size at the time of the Brexit vote to around 18,000 locally branded accounts.
By analysing the times of tweets, we were also able to conclude a number of the accounts were, or had been, operating on Moscow office hours.
These UK-branded accounts lacked any finesse, but this is not uncommon among the sock puppets. The social networks themselves do enough to obfuscate the true source of accounts that a little blatancy goes largely unnoticed when combined with scale.
It creates an illusion of normality for those interacting with these networks.
At this stage, however, we were presented with a new collection of accounts and a new collection of tweets, which had fallen outside of the intial search parameters.
Because the accounts were all based in Germany and had only been active on the topic of Brexit on the 23rd of June 2016.
Under various, quite plausible, and less nationalistic guises, these innocuous German accounts held the key to a much broader range of data estimations surrounding Brexit.
The German accounts are all currently dormant, and haven’t been used in a tasking process for sometime.
Though a small hub of 48 accounts, analysis rapidly expanded their network to a more complete 1,967 users, connected between themselves 2,199 times.
Through a manual check of the accounts, establishing that profile pictures and local geographical photos have actually been lifted from Instgram accounts from Italy to Estonia, a further super-user – based in the Netherlands – was connected to the hub.
“It resembles exactly what it is: Bacteria or a virus. An infection aimed purposefully at humans.”
This expanded this one network to 4,933 accounts, linked together by 5,200 cross-connections.
The super-user was identified through the posting of a Russian meme relating to Chess and the collapse of the EU.
The interesting nature of the German hub, which is – with the exception of the super-user – fully automated, is how it looks when you visualise it using a combination of filters on software package GEPHI.
It resembles exactly what it is: Bacteria or a virus. An infection aimed purposefully at humans.
While the accounts in the original, small hub are dormant, they are still open to full scrutiny.
In the lead up to Brexit they were talking about Turkey and Syria, then afterwards they shifted to other issues before going offline at the end of 2016 – presumably shelved for future use as other accounts got shut down.
Suddenly, however, on the 23rd of June 2016 all of these accounts were activated and churned out 630 tweets at a rate of up to 8 tweets a minute.
Their focus on the day of the vote is undeniable even when analysed in the base form of a word cloud.
It is clear they had been specifically tasked to target undecided voters and wavering Remainers and they did so using the hashtags #BrexitOrNot and #RemainInEU, among others.
These fake accounts
– each of them registered in March or April 2016 and seeded to appear real with photographs and data stolen from every corner of the EU – were specifically deployed on the day of Britain’s crucial vote to post meme’s attacking the weakest link in the Remain chain. David Cameron.
After the 23rd of June, every single one of the accounts stood down from Brexit and resumed what they had been doing before – sporadic push messaging at points of interest to Russian activity in the world.
Within the larger network, some of the accounts have remained fully active, though – most recently focusing on Catalonia, which is now a confirmed target of Russian hacking and disinformation, intended to destabilise Spain and the EU.
What is staggering is the breadth of this network beyond this one hub.
On the day they were all activiated, other unconnected network hubs came on line without warning, communicating one or two replies to specific Brexit tweets in English before going to back to dormant status. These were human operators intervening.
These accounts came from everywhere, but the one or two tweets in English would all have been seen by someone in the UK following the hashtags on the day, along with the memes.
Memes during the period were not restricted to Twitter, however. On referendum day even Flickr was busy, in particular around InfoWars linked accounts.
“other unconnected network hubs came on line without warning,
communicating one or two replies to specific Brexit tweets in English
before going to back to dormant status. These were human operators
intervening.”
Other dormant Twitter accounts found within the expanded network, and a new hub uncovered during the analysis, were discovered to be promoting pro-leave hashtags which included #IVotedLeave – something which appears to have been highly visible to voters even before the polls closed and may also have been aimed at undecided voters. Again to create an illusion of a bigger crowd, the psychological effects of which do not need explaining.
Combining the identified hubs with the original analysis, they all led straight back to the original 9,320 accounts and reaffirmed the direct Olgino connection.
This was no coincidence.
Running the Twitter activity through Indiana University’s Truthy tool showed not only how the undecided voters had been hijacked during a very specific time period, but also how this went on to influence conversations around prominent leave MPs in the days following the vote.
A lot of debate over the last year has taken place around the “will of
the people” and social media sentiment has been referred to throughout
by policy makers. This is a broad confirmation of the true scale of the
impact of an effective disinformation campaign on social media.
https://www.youtube.com/watch%3Fv%3DkveNG6tPk1o
Looking at the data in a second visualisation, around connected discussion topics, how effective the hijack of voters timelines by the Russian network becomes even clearer.
https://www.youtube.com/watch%3Fv%3DjQdIQKfKyiA
Using the available data on the extent of the network, married with the data on tweet frequency, it was possible to start to make some estimates about the true extent of Twitter traffic originating from Russian networks on the day of the vote.
Analysis which is further supported by an original analysis which showed botnets transferring from Syria and Ukraine deployments during the ballot.
“A lot of debate over the last year has taken place around the “will of
the people” and social media sentiment has been referred to throughout
by policy makers. This is a broad confirmation of the true scale of the
impact of an effective disinformation campaign”
While 50% of the accounts were deleted, we can estimate that one network
of 1,967 producing 13 tweets each across the day on the 23rd of June 2016 could
have produced 25,571 tweets.
By reversing the deletion of accounts, we can estimate that one network hub could have produced 51,142 tweets over the course of the day.
We know however we are looking at a network, as a baseline, of some 15,000 accounts. This means that single network – before account deletions – could have easily produced as many as 195,000 tweets aimed at undecided voters on the 23rd of June 2016.
This would take the Russian network traffic up to a fifth of the twitter activity on the key hashtags, and matches the evidence which eventually came out at the US Senate.
This is also supported by new research from Swansea University which identifies potentially 150,000 Russian-based Twitter accounts tweeting tens of thousands of messages on the day of the Brexit vote, having shifted focus from other topics such as Ukraine. Though the research is not yet published, we have seen the draft which was reported in the media today.
This would have generated a sufficient network spread and impression rate to ensure the messages being pushed were seen by hundreds of thousands, if not millions of people in Britain on the day of the vote.
”
that single network – before account deletions – could have easily
produced as many as 195,000 tweets aimed at undecided voters on the 23rd
of June 2016.”
Beyond the numbers, the other crucial key to understanding Russia was involved actively in Brexit is through the collection and retention of memes shared throughout the campaign and voting period – many of which are almost identicial to those Facebook were paid to host and have since been released to the American public.
Adrian Cole has been collating these Russian memes by trawling the networks of Russia’s sock puppets. They are now publicly available together for the first time in a repository hosted by Liberty Stratcom.
Cole contacted Byline with details of the collection and told me: “I saw the odd image via Twitter and FB [Facebook] regarding Brexit 18 months ago, generally ignored them until the US elections. I started seeing the same format yet tailored for the US elections.”
“This then started to make me curious. Other people noticed as well online in the USA. People started to collate and identify Nazi white Power imagery. Bots started to be spotted, an incredible number of bots and fake profiles. These images started appearing in feeds and shared. Twitter and FB flowed back and forth,” he said.
A number of citizen journalists began to investigate the spread of these Russian memes in the US and Cole was watching with growing interest.
“I started to wonder about Brexit and did the same occur? I didn’t see anyone investigating Brexit for these, so started to ask about in the US. A general no, so I began backtracking old threads to see if I could match patterns and methods and apply it for the UK,” he told me.
These images can be discovered in the comments sections pertaining to politicians, or when important issues are featuring heavily in the media – for example, the Election, Referendum, the EU, or divisive news such as immigration.
“A lot are in threads of Blue check mark personas,” Cole said. “The images will appear in the replies, injected into the Twitter threads, seemingly innocuous.”
“As a user, maybe I would click the conversation and go to the profile of the person who supplied the image to the thread merely to see what else they have to say. This then leads on a voyage of discovery,” he added.
The purpose of Russia’s memes is a rudimentary form of psychological warfare which dates back many years.
And very often the memes are tailored to accommodate two sides or more within any given audience – something Cole has picked up on during his time diving through the Russian networks.
“Both sides have these types of images used against them. Say for Brexit, both Leave and Remain images are prevalent. This creates amplification of the cause, designed to polarise and divide society along specific lines. Increase the noise to appear a bigger issue than it really is. Cause agitation, cause divide, provoke. Keep society focused on themselves and their own perceived problems. Subtle changes lead to that change of the whole meaning of a story,” he said.
“The undecided may be swayed in a certain direction, people with set beliefs have them reinforced. Propaganda 101. Disinformation and Provocation. What we miss though, if we let this happen, is the bigger picture. If the West is destabilised with internal strife or divisions in society, NATO, UK and the EU cannot act and function effectively,” he added.
“The undecided may be swayed in a certain direction, people with set beliefs have them reinforced. Propaganda 101.”
Brexit really was a Russian job after all and perhaps, as the reality of this dawns, it isn’t too late for some good to come out of all of this.