The St. Petersburg Troll Factory Targets Elections from Germany to the United States

• • The St. Petersburg “troll factory”, also known as the Internet Research Agency (IRA), has become a central part of the Kremlin’s electoral interference playbook.

• • The IRA has been actively exporting the Kremlin’s disinformation tactics abroad since 2013, targeting numerous elections and referenda in Europe and the US.

• • Altogether, the funding for the US operation between January 2016 and June 2018 was approximately 35 million USD.

• • The IRA remains active in its online manipulation efforts, with experts warning that Russian trolls are adapting their strategies to circumvent new protections implemented by social media companies.

Since its inception, the St. Petersburg troll factory has had a specific focus on election influence operations.

In 2014, local elections were scheduled to take place in St. Petersburg, Russia. However, well in advance of election day, some of the city’s residents began receiving unexpected visitors knocking at their doors. The guests presented themselves as journalists from the newspaper Nevskie Novosti and said they were conducting interviews: “Which politicians do you support? What are the biggest problems in your neighbourhood?”

In fact, the “journalists” were anything but – they were analysts from one of several projects established by the Internet Research Agency (IRA): the now-infamous St. Petersburg troll factory, and the newspaper was and is run by it. The objective of the analysts’ canvassing and interview efforts was to collect information that could be used to ensure a win for the ruling party, United Russia, and to assess which candidates would likely need vote count “corrections” by way of election fraud.

While this operation was ongoing, the troll factory was already openly hiring English-speaking specialists.

Heading into the 2019 European elections, our understanding of the troll factory’s operational scope, objectives, and methods is significantly greater than it was just a few years ago. We know that the physical operation has now grown to three times its starting size, occupying 12,000 square meters in the Lakhta business district, although recent reports indicate that one of its company affiliates has allegedly left the office space. The troll factory has successfully created a whole network of popular Russian-language media outlets boasting dozens of millions of readers every month.

The organisation is controlled by the Russian businessman Yevgeny Prigozhin, who runs a number of other ventures on the side, including catering services for Russian schools and the army, as well as private military companies that are currently operating in Ukraine and Syria. Unsurprisingly, given this resumé, Prigozhin has also been linked to violent attacks against bloggers and opposition activists who are critical of the Kremlin.

As several recent election cycles in Europe and the US have shown, the troll factory is highly adept at exporting the Kremlin’s disinformation tactics abroad, conducting complex online influence operations to sway elections and manipulate public opinion. And it shows no signs of slowing down – on the contrary, faced with new protections by social media companies to prevent the spread of disinformation on their platforms, the trolls are beginning to adapt their influence strategies to find ever newer ways of spreading their venom.

IRA Facebook post, posted by the Stop A.I. page in January 2017 (total shares: 312,667)

Attempts to manipulate US voters began in 2013 but escalated rapidly in 2014, starting on Twitter and subsequently spreading to YouTube, Instagram, and Facebook. Just few weeks before the 2016 presidential election, the department dedicated to the US operation already had more than 80 employees and a monthly budget of 1.25 million USD. Between 2013 and 2018, the IRA’s Facebook, Instagram, and Twitter campaigns reached tens of millions of users across the United States.

In the run-up to the 2016 election, the troll factory’s activities were aimed at polarising the US electorate by exploiting existing fault lines and hot-button partisan issues, including race relations, LGBT rights, gun rights, immigration, and more. The trolls produced content encouraging African American voters to boycott elections and follow wrong voting procedures, incited extreme right-wing voters to be more confrontational, and spread disinformation on a wide range of issues to voters on both ends of the political spectrum.

In tandem with the troll factory operation, Russia’s military intelligence service, the GRU, hacked several key Democratic groups and stole caches of emails and documents. Then, creating false online personas and websites – and in cooperation with Wikileaks – the GRU strategically released tens of thousands of these documents at key moments during the campaign in an apparent attempt to maximise damage to Hillary Clinton and, in turn, boost support for Donald Trump.

The troll factory also understood the power of local news: the IRA created a number of Twitter accounts that posted real local news, serving as sleeper accounts aimed at building trust and readership that could be exploited in future influence operations. Twitter suspended the accounts before they were used for disinformation purposes.

IRA Facebook post, posted by the page Being Patriotic on September 8, 2016 (total shares: 640,390)

After the 2016 US election, the troll factory’s engagement efforts increased in both scope and intensity, expanding to target new audiences and to cover a broader range of issues. Younger voters were targeted, along with Mexican American and Hispanic voters, with efforts to increase their distrust in US institutions.

The peak of the troll factory’s advertising volume on Facebook was in April 2017: a period that coincides with the Syrian missile strike, the use of the “Mother of All Bombs” on ISIS tunnels in Afghanistan, and the release of the US tax reform plan.

In 2018, the US operation intensified once again, when the budget was increased to 10 million USD for January to June. Altogether, the funding for the US operation totalled 35 million USD from January 2016 to June 2018.

The troll factory’s activities have not been limited to the US, but have targeted numerous European elections from the Netherlands to Germany. IRA accounts also promoted the data dump from the hack-and-leak operation against French President Emmanuel Macron during his election campaign.

Before the Dutch went to the polls for a referendum on the EU-Ukraine association agreement in 2016, the troll factory spread a fake video about Ukrainian far-right ultra-nationalist Azov battalion fighters, who allegedly threatened to carry out terrorist attacks in the Netherlands should the referendum be rejected and were burning the Dutch flag.

In the UK, the strategy focused on stoking anti-Islamic sentiment ahead of the Brexit vote. The most-retweeted tweet in the six months running up to the referendum was “London: Muslims running a campaign stall for Sharia law! Must be sponsored by @MayorofLondon!”

Prior to Brexit, the troll factory began building its audience base by tweeting about innocuous topics like health and fitness to remain under the radar (similar to what it attempted with local news in the US), and later switched its focus to political messaging. On the day of the referendum, its tweets were generally anti-EU, but also included messages such as: “Algerian illegally in Britain attacked 8 women in ten days! Send the Muslim back to EU!” and, from a fake US account, “I hope UK after #BrexitVote will start to clean their land from muslim invasion!”.

Tweet by an IRA account after the London terror attack in March 2017, which was cited by The Sun and Mail Online. The IRA continued stirring up anti-Islamic sentiment after Brexit.

On a wide range of topics, IRA accounts were cited over 80 times in British media before Twitter identified and removed them.

Not related to Brexit but in general, most of the troll factory’s Twitter activity focused on English and Russian language posts. Less than 100 000 tweets were published in German. Meanwhile, ahead of the German federal elections in September 2017, IRA accounts boosted their German messaging supporting AfD, only to slow down again after election day.

International audiences first learned about the troll factory from Russian investigative journalists who exposed the operation in 2013.

Activist and investigator Lyudmila Savchuk spent two months undercover in the St. Petersburg troll factory in late 2014, and later won a lawsuit against the troll farm in 2016. She has explained the operations of her former employer in numerous publications and served as a witness in another ex-troll’s lawsuit. Further details were provided by other previous trolls.

Since then, three indictments (1, 2, 3) prepared by US Special Counsel Robert Mueller, as part of his investigation into Russian interference in the 2016 election, as well as two extensive reports by the Oxford Project on Computational Propaganda and New Knowledge, based on data provided by tech companies to the US Senate Select Committee on Intelligence (SSCI), have further refined our understanding of the troll factory’s activities and operational model.

Since the enormous fallout from the 2016 US election, Twitter has shut down and released data on nine million IRA tweets. A searchable archive for analysts, journalists, and the general public is available here. Meanwhile, Facebook has taken down the core group of US-related IRA accounts that, in total, had almost 31 million shares, 39 million likes, and 5.4 million emoji reactions.

Most recently, reports have surfaced that the US military conducted its first offensive cyber-operation against the troll factory during the 2018 midterms election and blocked the IRA’s internet access.

The social media companies are also facing pressure from governments and the EU to diminish their role as channels to amplify and spread disinformation. The platforms have committed to the Code of Practise, to increase transparency for political advertising and reduce the number of fake accounts. Follow monthly reporting by social media companies ahead of the European elections 2019 and Commission’s responses here.

However, even though the general public can now understand the scope of Russia’s online election manipulation and the sophistication of its past operations, experts remind us that the data we currently have available only provides a historical account of the IRA’s tactics, but not its future ones.

Indeed, as social media companies like Facebook and Twitter attempt to crack down on inauthentic coordinated behaviour, bad actors – both Kremlin-linked and others – are simultaneously developing innovative ways to circumvent these protections.

New tricks may include shifting strategies from the creation of disinformation to content amplification via phony social media accounts, according to experts. One emerging hacking method, for example, is breaking in to computing devices and using them to open large numbers of social media accounts at once that appear to belong to legitimate users.

“Fuel hysteria, sow discord, spread confusion: Detailed account on manipulation attempts before US elections“. (2018). EUvsDisinfo.

“Military Intelligence, Fake Online Personas, Fake Local News: How Russia Targeted US Elections“. (2018). EUvsDisinfo.

“Commanding the Trolls“. (2018). EUvsDisinfo.

“The IRA and Political Polarization in the United States, 2012-2018“. (2018). Computational Propaganda Research Project, University of Oxford.

“The Disinformation Report“. (2018). New Knowledge.