Russian Twitter trolls exploited key election moments

Image: Hacker Illustration
A photo illustration depicts a person typing. Copyright Michael Smith Getty Images
Copyright Michael Smith Getty Images
By Ben Popken with NBC News
Share this articleComments
Share this articleClose Button

Russian trolls chose targeted moments during the presidential election to infiltrate and divide the online conversations of millions of Americans.

Thousands of Russian trolls targeted national events during the 2016 U.S. presidential election to infiltrate the online conversations of millions of Americans, according to a new analysis of a database of recovered troll tweets by NBC News.

The records show how digital communications tools invented by U.S. companies, such as Twitter and Facebook, were instead exploited by the Kremlin-backed agents to promote autocracy and fear.

The recovered data, using the list of Russian troll accounts identified by Twitter and released by Congress, shows that the online actors were adroit at bending those tools of transparent communication to their malign purposes.

NBC News compiled 202,973 tweets from 454 of the 2,752 accounts into its database, making it "one of the largest" known to date, according to Jonathan Albright, research director at Columbia University's Tow Center for Digital Journalism.

Those tweets earned 2.1 million retweets and nearly 1.9 million favorites.

"Thinking about this in a binary of 'did it cause someone to change their vote?' is overly narrow," said Laura Rosenberger, director of the Alliance for Securing Democracy. "It's about influence over time."

NBC News compiled its database by cross-referencing the list of identified accounts against data held by three sources familiar with Twitter's API, an online system that allows software developers to work with the data underlying users' tweets. The sources asked that their names be withheld to avoid being identified as possibly violating Twitter's developer policy.

Coordinated Twitter Attacks

.no-rail .widget { padding-left: 0; padding-right: 0; }

EJ Fox / NBC News

According to the dataset, Russian twitter troll volume increased significantly on July 21, two days after Trump became the official Republican nominee, and continued at the same intensity or higher for the rest of the year.

Throughout 2016, the trolls' tweets and retweets spiked during key campaign events.

The first big spike for the trolls was March 22, 2016, when three suicide bombers killed 32 in Brussels.

Daily troll volume suddenly increased several-fold. They linked the terrorist act claimed by ISIS with a perceived threat posed by Muslim refugees to the U.S.

JeanneMccarthy0: "#IslamKills this is seriously getting out hand! I'm so scared for the future of my children! #PrayForBrussels #StopIslam"

RyanMaxwell_1: "#Brussels Let's close all mosques! #freespeech is overrated! #IslamKills"

Ben Nimmo, a senior fellow at the Atlantic Council, a think tank, told NBC News in an email that the surge of tweets sought to "demonize Muslims, migrants, refugees and anyone who supports them, and to panic real Americans into increasingly extreme views."

But the trolls were just getting warmed up.

Hashtag Hijacking

Americans may have thought they were using hashtags during the election to discuss politics with each other. They didn't know they were also talking to Russians thousands of miles away in a troll factory.

The top hashtags were the generic #politics, followed by #maga, #Trump, #news, and #NeverHillary.

"Some of the trolls participated in trending hashtags by inserting entirely appropriate content, perhaps as a way of getting their screen names in front of other people and gain a following," said David Allen, an analyst at software company Neo4j who assisted NBC News with analyzing the database.

"Others would try to 'hijack' a hashtag," inserting disruptive content into a trending topic, "or draw a non-political hashtag into a discussion of politics," he said.

Troll activity spiked again during the final presidential debate, rehashing conspiracy theories and retweeting divisive content. The trolls alternately said the debate was rigged, or a total win for Trump.

But the trolls did speak in a chorus when it came to one hashtag.

About 9 a.m. on Oct. 19, 2016, the morning of the final debate, the Russian troll account "WorldOfHashtags" kicked off a new online conversation.

"The last presidential #debate starts soon. So let's discuss #RejectedDebateTopics," the troll wrote. Moments earlier they had referred to it as a "hashtag game" that was "hosted" by "GiselleEvns," another of the Russian troll accounts.

Immediately a cluster of the trolls started pumping out tweets with the hashtag, several tweets per minute.

Screenshot of a tweet sent by a Russian troll on the night of the final debates, Oct. 19, 2016. Online archives.

Later that day over 600 Twitter users, who were not on the list of trolls and may have included authentic Americans, added hundreds of their own twists to #RejectedDebateTopics, like "Which diagnosis fits Donald, sociopath or narcissistic personality disorder," "Good places to hide emails" and "Knock knock... who's there? Interrupting cow."

Twitter didn't respond to NBC News requests to confirm whether the hashtag had "trended" for other users and appeared in a box that would have promoted it to new users.

When it came to tweets sent in real-time during the debate, popular Tennessee Republican party impostor account @TEN_GOP took charge, sending the majority of the original tweets.

TEN_GOP: "Iran payment wasn't just ransom, it was money laundering. The deal was set up by Hillary when she was sec of state #debate #debatenight"

TEN_GOP: "Donald Trump's ending was perfect! RT if you are also sure that #Trumpwon! #Debate"

Those tweets got thousands of retweets, likes and user comments.The account also directly tweeted compliments to Trump during the debates.

"@realDonaldTrump Can't wait to see you in the WH," tweeted the Russian troll an hour before the debate began. Right as the debated ended, the Russian troll account tweeted to Donald Trump, "We are proud of you!"

Playing all sides

The trolls were organized into three general ideological networks, said Allen, the Neo4j analyst.

Trolls on the "Right" cluster promoted Trump and attacked left-leaning causes and politicians, mainly Clinton.

Trolls in the "Left" cluster generally attacked Trump and his followers, though they didn't express support for Hillary Clinton.

"Black Lives Matter" were pro-black, but not pro-Democrat. Their message was to distrust all authority, especially the police.

During the election, the hyped-up tweets appeared to be just part of the social media noise.

"We saw a lot of questionable accounts and content, but we knew there were underground networks to spread content that would undermine Hillary," said Emmy Bengston, former deputy social media director for the Clinton campaign. "We just didn't know who was paying for it."

The banner on the bridge

The online troll games entered the real world two days after the election

On Nov. 10, a banner was removed from the Arlington Memorial Bridge in Washington, U.S. Park Police confirmed to NBC News.

"Goodbye Murderer" read the captioned portrait of President Barack Obama, according to photos recovered from online archives tweeted by an identified Russian troll whose activity appeared in the NBC News database.

Bridge tweet
Screenshot of Russian troll tweets claiming responsibility for hanging the poster of Obama.

The troll said he and fellow "political activists" had hung the banner. "Goodbye to murderer @BarackObama #ThanksObama" tweeted the account, @LeroyLovesUsa, using the hashtag for a popular meme.

The account, which portrayed itself as that of a military veteran turned activist, also tweeted the images to @realDonaldTrump.

Leroy's tweets got hundreds of likes, and retweets and were amplified by other identified Russian trolls.

As they spread across social media sites, the Russian state-owned media organization RT reported on the banner.

Farewell banner
An apparent image file of the poster tweeted by the Russian troll. Online archives

A spokesman for the U.S. Park Police, Sgt. James Dingeldein, confirmed that a park police officer had removed the banner and that it was destroyed this fall. A Freedom of Information request filed with the park police by NBC News wasn't fulfilled before publication.

In January 2016, a pro-Kremlin art group called Glavplakat claimed responsibility for hanging a Shepard Fairey-style poster of Obama opposite the U.S. Embassy in Moscow with the word "Killer." The group has hung other banners criticizing opponents of the state around the Russian capital tightly controlled by the Putin regime.

Who hung the banner in D.C. or took the photo, or what their connection to the Russian troll who tweeted it remains a mystery.

NBC News did not find any records of the images being posted anywhere online else before the account posted them.

So far news organizations that have recovered and published about the deleted tweets have only been able to restore data on a portion of the overall Russian troll accounts suspended by Twitter.

"There's still some part of the iceberg that's under the water," said Allen.

Experts say that the troll activity fits in with a Cold War-era playbook called "active measures," in which the Russians used disinformation and selective reframing to undermine faith in democracy, exploit political divisions, blur fact and fiction, and promote Russian policy agendas abroad.

"They think that for decades they've been on the defensive, and we've been hurtling at them our messages about markets and democracy and liberalism," said Michael McFaul, who was the U.S. ambassador to Russia from 2012 to 2014 in the Obama administration.

"And they're now on the offensive."

Share this articleComments

You might also like

Scale of Russian bots promoting Trump on Twitter revealed