Russia's manipulation of Twitter was far vaster than believed

Russia's troll farm was found to have considerably more sway than previously thought and might have generated income for some of its phony accounts. | Naira Davlashyan/AP Photo cybersecurity Russia's manipulation of Twitter was far vaster than believed

Russia's infamous troll farm conducted a campaign on Twitter before the 2016 elections that was larger, more coordinated and more effective than previously known, research from cybersecurity firm Symantec out Wednesday concluded.

The Internet Research Agency campaign may not only have had more sway — reaching large numbers of real users — than previously thought, it also demonstrated ample patience and might have generated income for some of the phony accounts, Symantec found.

The company analyzed a massive data set Twitter released in October 2018 on nearly 3,900 accounts and 10 million tweets.

The research discovered that the average lag between account creation and first tweet was 177 days. The most retweeted account garnered 6 million retweets, and less than 2,000 of those came from within the IRA-linked network of accounts. The huge delay points to a lot of patient preparation, and the retweets indicate that a lot of unaffiliated Twitter users were amplifying the IRA's message.

While most of the accounts were automated, they frequently demonstrated evidence of manual manipulation, such as slight wording changes in an apparent bid to dodge detection, according to Symantec.

Morning Cybersecurity A daily briefing on politics and cybersecurity — weekday mornings, in your inbox. Email Sign Up By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time.

"While this propaganda campaign has often been referred to as the work of trolls, the release of the dataset makes it obvious that it was far more than that," the company wrote. "It was planned months in advance and the operators had the resources to create and manage a vast disinformation network."

Some accounts also appeared to generate revenue via URL shorteners, with one account even earning as much as $1 million, although those were apparently rogue accounts operating outside the IRA's main mission.

In a subsequent tweet, Symantec said it was an estimate of max earnings but they’ve also removed it from the initial report while they "investigate some additional data."

The research also found that the accounts played to both sides of the aisle more than previously believed, and that most of them were fakes pretending to be regional news outlets, while a smaller subset amplified those messages.

"The campaign directed propaganda at both sides of the liberal/conservative political divide in the U.S., in particular the more disaffected elements of both camps," Symantec found.

And the company warned in the closing message of its study: "The sheer scale and impact of this propaganda campaign is obviously of deep concern to voters in all countries, who may fear a repeat of what happened in the lead-up to the U.S. presidential election in 2016."

In response to the Symantec research, a Twitter spokesperson said the company's "singular focus is to improve the health of the public conversation on our platform, and protecting the integrity of elections is an important aspect of that mission."

Additionally, the spokesperson said, Twitter has made "significant strides since 2016 to counter manipulation of our service, which includes our releases of additional data in October and January related to previously disclosed activities to enable further independent academic research and investigation."