Analysis by De Groene Amsterdammer shows that in three days, the Internet Research Agency produced as many as 111,486 tweets. Out of this number, at least 65,000 tweets were blaming Ukraine for downing of the MH17 plane. The MH17 crash was the time of the biggest activity of Russian trolls ever.

Robert van der Noordaa and Coen van de Ven, journalists at De Groene Amsterdammer, analysed tweets posted by accounts linked to the Internet Research Agency (IRA, aka troll factory), which were disclosed by Twitter in October last year. They focused on the ones about the crash of the Malaysian Airlines Flight MH17.

As they found out, the massive disinformation campaign, blaming Ukraine for the shot down, used an unprecedented number of 40,931 tweets posted immediately after the crash, and another 28,844 the next day – all of those were about MH17 crash. All in all, in less than 72 hours, Russian trolls posted almost 111.5 thousand tweets on MH17 and other topics. The accounts were active later on, but they never reached this number of tweets again.

Even though we now know that the Internet Research Agency was interfering in online discussions around the world, from the American presidential campaign to national elections in Germany and EP elections in Greece, the new investigation shows that nowhere were Russian trolls as active as in the first hours and days after the MH17 crash.

The Malaysian Airlines Flight MH17 airplane fell down on the Ukrainian territory on July 17, 2014. All 298 passengers on board died. The Dutch-led Joint Investigation Team concluded that the plane was shot down by a missile of the 9M38 series, launched by a BUK-TELAR, from farmland in the vicinity of Pervomaiskiy (eastern Ukraine). At that time, the area was controlled by Russia-backed armed formations. The BUK-TELAR was brought in from the territory of the Russian Federation and it was taken back there after the shot down. On 24 May 2018, JIT stated that the BUK-TELAR that was used to down MH17 originates from the 53rd Anti-Aircraft Missile brigade, a unit of the Russian army from Kursk in the Russian Federation.

In spite of the evidence and the now concluded investigation, disinformation surrounding the MH17 downing has been promulgated by Russian state-controlled outlets, including competing and contradictory stories, which EUvsDisinfo covered extensively. The pro-Kremlin narratives were focused on blaming Ukraine for shooting down the plane, toppled with contradictory statements, such as: the MH17’s course was deliberately changed to fly over a war zone; it was shot down from the territory controlled by the Ukrainian army, or that a Ukrainian fighter jet was found in the area around the crash. The claims were ‘supported’ with untrustworthy witnesses and doctored images,

The analysis conducted by De Groene Amsterdammer allows us to take a closer look at narratives spread on Twitter in the first hours after the crash, and tactics applied by the troll factory.

Operation Trolling

The first tweets appeared already forty minutes after the crash. Initially, the trolls didn’t seem to know what the pro-Kremlin stance would be – they shared information about the crash and even accused the ”rebels” of taking the airplane down. A clear anti-Ukrainian angle emerged only on the following morning, with claims that Ukrainian authorities ordered shooting down of the plane as a provocation. On that day, over 70 percent of all IRA-linked and coordinated tweets used hashtags (in Russian) saying: kyiv-has-boeing-shot, kyiv-provocation and kyiv-tell-the-truth.

The spike in trolls’ activity stopped as abruptly as it started, on the morning of July 19. However, messages continued to be spread.

Unlike in similar IRA-run operations, the trolls took the trouble of writing messages on their own, in a coordinated manner, instead of retweeting somebody else’s content. Another example of coordinated behaviour is a blog story by Katya Timofeeva about Carlos – the alleged Spanish air traffic controller who claimed to have spotted two fighter jets near the MH17. After it was published on Twitter, it was passed on almost a hundred times in six minutes, despite the fact that Timofeeva’s account had hardly any followers. By the way, the story of Carlos was debunked by Radio Free Europe/Radio Liberty and the RISE project, whereas ‘Carlos’ turned out to be a convicted criminal, claiming to be paid by Russia to pretend to be an air controller.

It’s worth to remember that the troll factory was only a part of the disinformation campaign surrounding the MH17 crash. The campaign in the pro-Kremlin outlets is still going on – only in May 2019 we recorded six new cases in three languages in our database.


Further reading:

MH17: Time is Running Out for Disinformation. EUvsDisinfo.

Defensive disinformation as decoy flare: Skripal and Flight MH17. EUvsDisinfo.

Flight MH17: Why can the Kremlin not tell the truth? EUvsDisinfo.

Flight MH17 three years on: getting the truth out of Eastern Ukraine. EUvsDisinfo.

The St. Petersburg Troll Factory Targets Elections from Germany to the United States. EUvsDisinfo.

The Kremlin’s Shifting, Self-Contradicting Narratives on MH17. Bellingcat.

Охота на «Дельфина». Ключевой фигурант дела о сбитом Боинге MH17 оказался российским генерал-полковником. The Insider.


This article was updated for clarity on 19 June, 2019. The previous version of the article didn’t make a clear distinction between the overall number of tweets coming from IRA accounts and the number of tweets specifically about the downing of MH17. Out of almost 111.5 k tweets, at least 65 k referred specifically to MH17 crash.