The Tactics & Tropesof the Internet
Research Agency

ANALYSIS BY

Renee DiResta, Dr. Kris Shaffer, Becky Ruppel, David Sullivan,
Robert Matney, Ryan Fox (New Knowledge)
Dr. Jonathan Albright (Tow Center for Digital Journalism,
Columbia University)
Ben Johnson (Canfield Research, LLC)

Table of ContentsDocument Purpose and Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Russian Interference Background and Context. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  4
Key Takeaways. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Themes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  11
Summary Statistics: A Cross-Platform Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Organic Activities. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
IRA Tactics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Tactic: Targeting Americans. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Tactic: Asset Development. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Tactic: Cross-Platform Brand Building . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Tactic: The Media Mirage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Tactic: Memetics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Tactic: Inflecting a Common Message for Different Audiences (Syria). . . . . . . . . . . . . . . . . . . . . . 58
Tactic: Narrative Repetition and Dispersal. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Tactic: Repurposing and Re-Titling Pages and Brands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Tactic: Manipulating Journalism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Tactic: Amplify Conspiratorial Narratives. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Tactic: Sow Literal Division . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Tactic: Dismiss and Redirect . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
Election 2016. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Ongoing Efforts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
In Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

2Document Purpose
and Overview

Upon request by the United States Senate Select Committee on Intelligence (SSCI), New
Knowledge reviewed an expansive data set of social media posts and metadata provided to
SSCI by Facebook, Twitter, and Alphabet, plus a set of related data from additional platforms.
The data sets were provided by the three primary platforms to serve as evidence for aninvestigation into the Internet Research Agency (IRA) influence operations.
The organic post content in this data set has never previously been seen by the public. Our
report quantifies and contextualizes Internet Research Agency (IRA) influence operations
targeting American citizens from 2014 through 2017, and articulates the significanceof this long-running and broad influence operation. It includes an overview of Russian
influence operations, a collection of summary statistics, and a set of key takeaways thatare then discussed in detail later in the document. The document includes links to full datavisualizations, hosted online, that permit the reader to explore facets of the IRA-createdmanipulation ecosystem.
Finally, we share our concluding notes and recommendations. We also provide acomprehensive slide deck accommodating a wide array of selected images directly fromthe data set illustrating our observations, and, as an appendix, a comprehensive summary of
relevant statistics related to the data set.
This publication and its conclusions are in part based on the analysis of social media content that theauthors were provided by the Senate Select Committee on Intelligence under the auspices of the Committee’s Technical Advisory Group, whose members serve to provide substantive technical and expert advice
on topics of importance to ongoing Committee activity and oversight. The findings, interpretations, andconclusions presented herein are those of the authors, and do not necessarily represent the views of the
Senate Select Committee on Intelligence or its Membership.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

3Russian Interference
Background and Context

Data Set Provenance and Analysis Parameters
Broadly, Russian interference in the U.S. Presidential Election of 2016 took three distinct
forms, one of which is within the scope of our analysis:
1. Attempts to hack online voting systems (as detailed by a United States Senate SelectCommittee on Intelligence report)
2. A cyber-attack targeting the Democratic National Committee, executed by the
GRU, which led to a controlled leak via Wikileaks of email data related to the Clinton
Presidential campaign team
3. A sweeping and sustained social influence operation consisting of various
coordinated disinformation tactics aimed directly at US citizens, designed to exert
political influence and exacerbate social divisions in US culture
This last form of interference, a multi-year coordinated disinformation effort conducted by
the Russian state-supported Internet Research Agency (IRA), is the topic of this analysis.
The United States Senate Select Committee on Intelligence (SSCI) began an investigation
into the IRA’s social media activities following the 2016 election around the same time thatinvestigative journalists and third-party researchers became aware that IRA’s campaign had
touched all major platforms in the social network ecosystem. In March 2018, some of thesocial platform companies misused by the IRA (Twitter, Facebook, and Alphabet) provided
the SSCI with data related to IRA influence operations. Facebook’s data submission includes
Facebook Page posts and Instagram account content. Alphabet’s data submission includes

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

4

R u ssian I nt e r f e r e nc e B ac k gr o u n d an d C o nt e x t

Google AdWords and YouTube video and channel data. The data set reveals that Alphabet’s
subsidiaries YouTube, G+, Gmail, and Google Voice were each leveraged to support thecreation and validation of false personas.
Evidence provided by these companies to SSCI ties the IRA operation to widespread activity
on other popular social platforms including Vine, Gab, Meetup, VKontakte, and LiveJournal.
Several complete websites were created to host original written content, and to provide
source material for related social accounts and personas. The breadth of the attack included
games, browser extensions, and music apps created by the IRA and pushed to targetedgroups, including US teenagers. The popular game Pokémon Go was incorporated into theoperation, illustrating the fluid, evolving, and innovative tactical approach the IRA leveraged
to interfere in US politics and culture.
Several platforms that confirmed the presence of IRA interference operations (Reddit,
Tumblr, Pinterest, and Medium) were not part of the formal SSCI investigation or data
requests, and that content was not included in the SSCI data set. They have cooperated withlaw enforcement, and their information has been incorporated into a parallel Departmentof Justice investigation; the Mueller indictment of Russian nationals, Netyksho et al, dated
07/13/18, specifically references Tumblr-based interference operations. In the interest ofthorough analysis, New Knowledge took initiative to also analyze relevant data from Reddit,
Tumblr, and Pinterest in addition to the data set provided by SSCI.
The data set provided to the SSCI for the purposes of this analysis includes extensive
amounts of data previously unknown to the public; it is the first comprehensive analysis byentities other than the social platforms themselves.
None of the platforms (Twitter, Facebook, and Alphabet) appears to have turned overcomplete sets of related data to SSCI. Some of what was turned over was in PDF form; otherdata sets contained extensive duplicates. Each lacked core components that would haveprovided a fuller and more actionable picture. For example:
yy The platforms didn’t include methodology for identifying the accounts; we are assuming
the provenance and attribution is sound for the purposes of this analysis.
yy They didn’t include anonymized user comments, eliminating a key path to gauge impact.
yy They didn’t include any conversion pathway data to elucidate how individuals came tofollow the accounts, eliminating another key path to gauge impact.
yy There was minimal metadata.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

5R u ssian I nt e r f e r e nc e B ac k gr o u n d an d C o nt e x t

yy One data set did not include any user engagement data at all.
Regrettably, it appears that the platforms may have misrepresented or evaded in some of theirstatements to Congress; one platform claimed that no specific groups were targeted (this is
only true if speaking strictly of ads), while another dissembled about whether or not the Internet
Research Agency created content to discourage voting (it did). It is unclear whether theseanswers were the result of faulty or lacking analysis, or a more deliberate evasion.

IRA Background
The IRA began its operations in mid-2013 in St. Petersburg, Russia. Run like a sophisticatedmarketing agency in a centralized office environment, the IRA employed and trained over a
thousand people to engage in round-the-clock influence operations, first targeting Ukrainianand Russian citizens, and then, well before the 2016 US election, Americans. The scale oftheir operation was unprecedented — they reached 126 million people on Facebook, at least
20 million users on Instagram, 1.4 million users on Twitter, and uploaded over 1,000 videos toYouTube. As Department of Justice indictments have recently revealed, this manipulationof American political discourse had a budget that exceeded $25 million USD and continued
well into 2018. IRA documents indicate the 2017 operational budget alone was $12.2 million
US dollars. Independent researchers and social platforms were aware of the IRA as early as
2015, and its activities on Facebook are well-documented and discussed in detail in Adrian
Chen’s “The Agency”. Subsequent glimpses into the operational structure and strategy of the
IRA can be found in the February 2018 indictment of 13 Russian nationals by Special Counsel
Robert Mueller, and the September 28, 2018 criminal complaint of United States of America
v. Elena Alekseevna Khusyaynova.
The September 2018 indictment reveals that “[t]he Conspiracy has sought to conduct what
it called internally ‘information warfare against the United States of America.’” (p.6 of DOJ
Khusyaynova Complaint). The data provided to SSCI clearly illustrates that for approximately
five years, Russia has waged a propaganda war against American citizens, manipulatingsocial media narratives to influence American culture and politics.
We hope that this analysis of the IRA information warfare arsenal – particularly the discussionof the influence operation tactics – helps policymakers and American citizens alike tounderstand the sophistication of the adversary, and to be aware of the ongoing threat toAmerican democracy.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

6Key Takeaways

Statistical Highlights
yy The comprehensive dataset included:





~10.4 million tweets (of which ~6 million were original) across 3841 twitter accounts~1100 YouTube videos across 17 account channels~116,000 Instagram posts across 133 accounts~61,500 unique Facebook posts across 81 Pages

yy There were ~77 million engagements on Facebook, ~187 million engagements on
Instagram, and ~73 million engagements on original content on Twitter. Precise summary
statistics are presented later in this report.

Key Observations
yy The Threat Persists
 Active and ongoing interference operations remain on several platforms.
yy Unpublicized Prominence of Instagram Operations
 Instagram was a significant front in the IRA’s influence operation, something that
Facebook executives appear to have avoided mentioning in Congressional testimony.
 There were 187 million engagements on Instagram. Facebook estimated that this was
across 20 million affected users. There were 76.5 million engagements on Facebook;
Facebook estimated that the Facebook operation reached 126 million people. It is

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

7K e y Ta k e a w ays

possible that the 20 million is not accounting for impact from regrams, which may bedifficult to track because Instagram does not have a native sharing feature.
 In 2017, as media covered their Facebook and Twitter operations, the IRA shiftedmuch of its activity to Instagram.
 Instagram engagement outperformed Facebook, which may indicate its strength as atool in image-centric memetic (meme) warfare. Alternately, it is possible that the IRA’s
Instagram engagement was the result of click farms; a few of the provided accounts
reference what appears to be a live engagement farm.
 Our assessment is that Instagram is likely to be a key battleground on an ongoing basis.
yy Extensive Operations Targeting Black-American Communities The most prolific IRA efforts on Facebook and Instagram specifically targeted Black
American communities and appear to have been focused on developing Blackaudiences and recruiting Black Americans as assets.
 The IRA created an expansive cross-platform media mirage targeting the Black
community, which shared and cross-promoted authentic Black media to create an
immersive influence ecosystem.
 The IRA exploited the trust of their Page audiences to develop human assets, at least
some of whom were not aware of the role they played. This tactic was substantiallymore pronounced on Black-targeted accounts.
 The degree of integration into authentic Black community media was not replicated in
the otherwise Right-leaning or otherwise Left-leaning content.
yy Voter Suppression Operations
 Despite statements from Twitter and Facebook debating whether it was possible
to gauge whether voter suppression content was present, there were three primaryvariants of specific voter suppression narratives spread on Twitter, Facebook,
Instagram, and YouTube.
 Malicious misdirection (Twitter-based text-to-vote scams, tweets designed tocreate confusion about voting rules)
 Candidate support redirection (‘vote for a 3rd party!’) Turnout depression (‘stay home on Election Day, your vote doesn’t matter’)T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

8K e y Ta k e a w ays

yy Sowing Literal Division: Secession
 The IRA sowed both secessionist and insurrectionist sentiments, attempting toexacerbate discord against the government at federal, state, and local levels.
 Content focused on secessionist movements including Texas secession (#texit) andCalifornia (#calexit). These were compared to #Brexit.
yy Pro-Trump Operations Commence During Primaries
 The IRA had a very clear bias for then-candidate Trump’s that spanned from early inthe campaign and throughout the data set.
 A substantial portion of political content articulated pro-Donald Trump sentiments,
beginning with the early primaries.
 Aside from an extremely small set of early posts supporting Rand Paul, thispreference was consistent throughout the Right-leaning IRA-created communities.
 Some of the pages targeting traditionally Left-leaning audiences, such as United
Muslims, very occasionally broached the idea that their members might consider
Trump as well.
yy Comprehensive Anti-Hillary Clinton Operations
 A substantial portion of political content articulated anti-Hillary Clinton sentiments
among both Right and Left-leaning IRA-created communities.
 There was no pro-Clinton content on Facebook or Instagram, aside from a single
United Muslims Facebook Event promoting a rally encouraging Muslims to publicly
demonstrate in support of Clinton’s candidacy. However, the bulk of the content onthat same page was anti-Clinton, and the anti-Clinton motive behind this ostensibly
pro-Clinton post is transparent.
 There were some pro-Clinton Twitter posts (tweets and retweets), however, thedeveloped Left-wing Twitter personas were still largely anti-Clinton and expressed
pro-Bernie Sanders and pro-Jill Stein sentiments.
 These tactics and goals overlapped with the pro-Trump portion of the operation.
yy Operations Targeting Prominent Figures
 IRA operations targeted a wide range of Republican leaders, including Sens. Ted Cruz,
Marco Rubio, Lindsay Graham, John McCain, and Dr. Ben Carson.
 There were significant IRA mentions that aimed to increase or erode support forT H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

9K e y Ta k e a w ays

prominent political figures, including Julian Assange, Robert Mueller, and James
Comey. These mentions were largely an attempt to shape audience perception during
a relevant news cycle.
 Given the recent news regarding a pending indictment of Mr. Assange, it is perhaps
notable that there were a number of posts expressing support for Assange andWikileaks, including several on October 4th, 2016, the day before Roger Stone’s text
message history indicated Mr. Stone believed hacked email data would be madepublic via Wikileaks.
 These tactics and goals overlapped with the pro-Trump portion of the operation.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

10Themes

Based on publicly available open-source research, Twitter’s release of 10 million IRA tweets,
and the United States House of Representatives’ release of the Facebook ad data, there is aprevailing narrative that the Internet Research Agency was focused on dividing Americans,and that the operation’s focus on elections was merely a small subset of that activity. Whileaccurate, this narrative misses nuance and deserves more contextualization in light of theadditional material contained in the Google and YouTube data set, and the collection of thehundreds of thousands of non-ad “organic” memes and posts provided to SSCI.
The IRA had a roster of themes, primarily social issues, that they repeatedly emphasized andreinforced across their Facebook, Instagram, and YouTube content.
yy Black culture, community, Black Lives
Matteryy Blue Lives Matter, pro-police
yy Anti-refugee, pro-immigration reformyy Texas culture, community, and prideyy Southern culture (Confederate history)
yy Separatist movements and secession
yy Muslim culture, community, and pride
yy Christian culture, community, and prideyy LGBT culture, community, and pride
yy Native American culture, community,and pride

yy
yy
yy
yy
yy
yy

Meme and “red pill” culture
Patriotism and Tea Party culture
Liberal and feminist culture
Veteran’s Issues
Gun rights, pro-2nd Amendment
Political Pro-Trump, anti-Clinton
contentyy Pro-Bernie Sanders and Jill Steincontent
yy Syria and ISIS, pro-Assad, anti-U.S.
involvement
yy Trust in media

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

11Themes

These recurring topics were grouped thematically on Facebook Pages and Instagram
accounts designed to reinforce community and culture and to foster feelings of pride. The
material can be classified into three broad groups: Black-targeted, politically Left-targeted,and politically Right-targeted. While other distinct ethnic and religious groups were the focus
of one or two Facebook Pages or Instagram accounts, the Black community was targeted
extensively with dozens; this is why we have elected to assess the messaging directed atBlack Americans as a distinct and significant operation for purposes of this report.
The themes selected by the IRA were deployed to create and reinforce tribalism withineach targeted community; in a majority of the posts created on a given Page or account,the IRA simply reinforced in-group camaraderie. They punctuated cultural-affinity content
with political posts, and content demonizing out-groups. Partisan content was presented totargeted groups in on-brand ways, such as a meme featuring Jesus in a Trump campaign
hat on an account that targeted Christians. A few traditionally hot-button issues, such asabortion, did not get their own dedicated thematic accounts but appeared sporadically
across a few hundred posts on pages that generally focused on other things.

Two themes were disseminated nearly identically across all targeted communities: narratives
to erode trust in mainstream media, and narratives to convey Russian’s state-sanctioned
talking points on the Syrian conflict.
On Twitter, where communities are amorphous, the IRA personas discussed the themes
listed above but also included many others. The activity was driven by local and current

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

12Themes

events; the themes appeared, but the accounts additionally worked in popular culture
references, including emerging conspiracy theories.
While media narratives around the Russian/IRA Twitter activity have often focused on
automation and bots, the agency ran human-operated precision personas that roughly
mapped to the same Black, Left, and Right clusters observed on Facebook and Instagram.
The personas were spontaneous and responsive, engaging with real users (famous
influencers and media as well as regular people), participating in real-time conversations,creating polls, and playing hashtag games. These personas developed relationships with
American citizens. They were designed to influence individuals and to shape narratives; theIRA appears to have attempted to solidify the positioning of well-developed Twitter accounts
as influencers by alluding to them by name or screenshot in their posts on other platforms(i.e., TEN_GOP’s Twitter content shared on the Facebook account Stand for Freedom). The
Twitter personas regularly retweeted content by prominent and influential public figures; they
were occasionally retweeted by influencers in return. The automated accounts were primarily
news-focused, and largely limited to tweeting headlines and retweeting other accounts.
In addition to memetic content and tweets, the IRA pushed narratives with longform blog content.
They created media properties, websites designed to produce stories that would resonate withthose targeted. It appears, based on the data set provided by Alphabet, that the IRA may havealso expanded into think tank-style communiques. One such page, previously unattributed to the
IRA but included in the Alphabet data, was GI Analytics, a geopolitics blog with an international
masthead that included American authors. This page was promoted via AdWords and YouTube
videos; it has strong ties to more traditional Russian propaganda networks, which will be discussed
later in this analysis. GI Analytics wrote articles articulating nuanced academic positions on avariety of sophisticated topics. From the site’s About page:“Our purpose and mission are to provide high-quality analysis at a time when weare faced with a multitude of crises, a collapsing global economy, imperialist wars,
environmental disasters, corporate greed, terrorism, deceit, GMO food, a migration
crisis and a crackdown on small farmers and ranchers.”
And, finally, in service to these themes, the IRA co-opted the names of real groups with existing
reputations serving the targeted communities - including United Muslims of America, Cop Block,Black Guns Matter, and L for Life. This was perhaps an attempt to loosely backstop an identity if acurious individual did a Google Search, or to piggyback on an established brand.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

13Summary Statistics:
A Cross-Platform Operation

Internet Research Agency-attributed domains
yy
yy
yy
yy
yy
yy
yy
yy

blackvswhite.info
dntshoot.com
donotshoot.us
blackmattersusa.com
blackmattersus.com
blacktivist.info
blacktolive.org
blacksoul.us

yy
yy
yy
yy
yy
yy
yy
yy

proudtobeblack.org
black4black.info
patriotsus.com
butthis.com
dudeers.com
imsanbernardino.info
blackfist.pro
reportsecret.com*USAReally.com, another IRA-attributed site, launched during the SSCI investigation

Dates of First Posts
The dates of first posts (see graphs on next page) suggest that the IRA was active on Twitterfor several years prior to their efforts commencing on Facebook and Instagram; however,given that the Senate Select Committee on Intelligence requested data from January 1, 2015
on, it is possible that some IRA content that appeared on Facebook or Instagram was simply
not included in the data provided.
Interestingly, it appears that a majority of the Instagram accounts were created relatively
early in the operation, then increasingly leveraged as the operation continued (Instagram
activity increased over time, including in 2017). Facebook Pages appear to have been createdor leveraged later, with a wave of Pages that began to post leading into Election 2016.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

14

S u mmary S tatistics: A C r o ss-P lat f o rm Op e rati o n

INSTAGRAMFACEBOOKTWITTER

Full summary statistics with charts and graphs highlighting platform activity, domains shared, ad
spend, and more can be found in the accompanying slide deck analysis of the IRA data set.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

15Organic Activities

Organic Activity: YouTube
The IRA appears to have begun making YouTube videos in Sept 2015, producing 1107
videos across 17 channels. A few channels were active until July 2017. Several aggregatedor repurposed Vine content. Two channels were specifically political, focused on the 2016
election. Three channels (30 videos) were devoted to Syria & related Near East conflicts. One
was affiliated with GI Analytics, which also ran AdWords, and the others were both variants of
the name “New Inform” (related to a site of the same name).
By far the most content was related toBlack Lives Matter & police brutality: 1063
videos split across 10 different channels(59% of the channels, 96% of the content).
571 had title keywords related to the policeand focused on police abuses. In light of
this, YouTube’s statement before the first
Senate tech hearing – “These channels’videos were not targeted to the U.S. or toany particular sector of the U.S. population”– is perhaps using ‘target’ in the paid sense,
but appears disingenuous.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

16Organic A cti v iti e s

INTERNET RESEARCH AGENCY YOUTUBE CHANNEL LIST
yy
yy
yy
yy
yy
yy
yy
yy
yy

A Word of Truth (Williams & Kalvin)
Backyard of the White House
Black Matters
BlackToLive
Cop Block US
Don’t ShootGlobal Independent Analytics
GUNS 4LIFE
Hong Zi

yy
yy
yy
yy
yy
yy
yy

New Inform
Newinform NewinformPaul Jefferson
PoliceState
Starling Brown
STOP A.I.
Stop Police Brutality*Backyard of the White House content is still aggregated and accessible online at the link

Across all channels, 25 videos had election-related keywords in the title (candidate names,“vote”/”voting”, “election”, etc). These videos were all anti-Hillary Clinton. One of the politicalchannels, Paul Jefferson, solicited videos for a #PeeOnHillary video challenge (the hashtag
appeared on Twitter and Instagram) and shared submissions that it received. Videos on
the “A Word of Truth” channel – the YouTube channel of Williams & Kalvin Facebook pageand @williams.and.kalvin_ Instagram account – included voter suppression tactics targeting
African-American voters – advocating Black voters stay home, or vote for Jill Stein. Titles
included “The truth about elections”, “HILLARY RECEIVED $20,000 DONATION FROM KKKTOWARDS HER CAMPAIGN”, “A Word Of Truth: Dr. Alveda against fu**in’ Hillary”.
YouTube provided some account metadata to SSCI. Several of the email addresses attachedto the YouTube accounts were affiliated with Google Plus pages; the remainder were Gmail
accounts. Several email addresses confirmed links between accounts, and across platforms.
Addresses williamsjohnsonhiphop@gmail.com and copblock1@gmail.com were bothaffiliated with the “A Word of Truth” channel; copblock1@gmail was also attached to the “CopBlock US” YouTube channel. One of the email addresses linked to the “Don’t Shoot” YouTube
account appears to also have been linked to a Tumblr post that advocated that players ofPokémon Go name their Pokémon with a police brutality victim’s name.
The two “New Inform” channels had Russian-language sites associated with them, andcontent related to Syria, Turkey, and the Middle East. They appear to be related to the site
newinform.com.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

17Organic A cti v iti e s

Organic Activity: Twitter
An extensive amount of writing has been dedicated to the various facets of the IRA’s Twitter
operation as researcher-acquired data sets, such as the one released by Clemson University
and FiveThirtyEight, have emerged since Election 2016. In October 2018, Twitter itself
released a data set of IRA tweets to the public. In light of this, we did a brief analysis of theTwitter data provided to SSCI during this investigation.
The IRA developed a collection of over 3841 persona accounts on Twitter; approximately
1.4 million people engaged with their tweets. They generated 72,801,807 engagements on
their original content (not including retweets that they amplified, but which were written byothers). The tweets from the 3841 persona accounts were delivered to SSCI in two batches;
it appears that a couple of real accounts were misidentified as Russian, while other IRA were
missed and discovered later.
Our investigation into the Twitter accounts corroborates the findings of other researchersand media over the past 18 months, and suggests that the English-language activity appears
to have taken four primary forms:
yy Repurposed accounts from a commercial botnet
yy Newsbots: accounts that tweeted news articles focused on the regions they were
purportedly from (including Russian-language newsbots targeting Russians); this isdiscussed later in this document in the Media Manipulation section
yy “Right-leaning” accounts that participated in conversations or created political content
designed to be resonant with right-of-center individuals on the American political
spectrumyy “Left-leaning” accounts that did the same thing for Left-leaning audiences.
Our perception of the account personas has been confirmed by outside researchers from
Clemson University and Five Thirty Eight, which released a collection of IRA tweets (a subsetof the ones provided to the committee) during the period of this investigation. That coding
can be found in an easily-searchable interface here; by that classification, there were 1280
Russian language accounts, 630 Right-leaning, 233 Left-leaning, 54 Newsfeed. As noted
elsewhere, automation played a role: many of the accounts tweeted at the same time. We
visualized users clustered by similarity in temporal behavior on page 19.
In the course of a similarity analysis we discovered still-active bots that were likely part of acommercially acquired or repurposed botnet.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

18Organic A cti v iti e s

These charts look at Twitter account posting patterns over time. Each row is an individual
Twitter account, green indicates tweets. Concentrated blocks of color in this plot represent
users who posted at exactly the same time, and may indicate the use of automation. Moreextended color blocks indicate more intense coordination over a longer period of time.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

19Organic A cti v iti e s

Based on the metadata provided by Twitter, most of the IRA twitter accounts were registeredthrough various proxy services in the United states and Europe. Accounts intended to passas American were registered from U.S. IP addresses, and accounts intended to pass as
Germans were registered from German IP addresses. A significant number of IRA twitter
accounts however, were registered from either a single IP address in Venezuela or the IRA
building’s real IP address in St. Petersburg.
Our impression of the IRA’s Twitter operation is that it was largely opportunistic real-time
chatter; a collection of accounts, for example, regularly played hashtag games. There
was a substantial amount of retweeting. By contrast, Facebook and Instagram were used
to develop deeper relationships, to create a collection of substantive cultural media
pages dedicated to continual reinforcement of in-group and out-group ideals for targeted
audiences. Twitter was, however, a part of the cross-platform brand building tactic; several of
the Facebook, Instagram, Tumblr, and Reddit pages had associated Twitter accounts.
One interesting facet of the Twitter operation was the IRA site “Report Secret” – dozens of
the IRA Right-wing persona accounts used ReportSecret.com as their bio URL. This site did
not appear in the content for Facebook or Instagram. Looking at the Twitter bio URLs also
revealed personas who linked themselves to Gab.ai, to LiveJournal, and to VKontakte. Someof the accounts in the bios are still active, although dormant.
One additional observation of note is an observation of absence: the data provided by Twitter
did not include accounts, thought by many observers to be Russian, that were discovered
to have engaged in narrative manipulation in 2017. One example of this is @umpire43, which
engaged in spreading disinformation during the Roy Moore campaign; this account does notappear in the SSCI data set. It is still possible that such accounts were Russia-owned, but
operated by a non-IRA entity. Alternately, they may have belonged to a different adversary.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

20Organic A cti v iti e s

Organic Activity: Facebook
The IRA leveraged the majority of Facebook’s features, including Ads, Pages, Events,
Messenger, and even Stickers. Over the past two years, Facebook has undergone asignificant transformation in how it discusses influence operations on the platform, and it
deserves commendation for that evolution in thinking. However, the earliest public comments
by the platform attempted to diminish the IRA operation as just ‘a few hundred thousand
dollars of ads’. This inaccurate assessment has stuck among people who remain skepticalof the IRA operation’s significance; we hope that this report on the reach of the hundreds ofthousands of organic posts puts that to rest.
The Facebook data provided included posts from 81 unique Pages, of which 33 had over1000 followers. Of these 33, fourteen major pages focused on Black audiences, five were
aimed at Left-leaning audiences, one was a travel-focused older page, and thirteen targeted
Right-leaning audiences. Overall, 30 targeted Black audiences and amassed 1,187,810
followers; 25 targeted the Right and amassed 1,446,588 followers, and 7 targeted the Leftand amassed 689,045 followers. The remaining 19 were a sporadic collection of pages withalmost no posts and approximately 2000 followers across them.
As mentioned in the opening section of this report, there were 76.5 million engagements across 3.3
million Page followers. These included 30.4 million shares, 37.6 million likes, 3.3 million comments,and 5.2 million reactions across the content. Since Facebook did not provide data about any
sockpuppet accounts involved in the distribution of the content or the existence of “fake Likes”
from these accounts, we are operating under the assumption that this engagement was from real
people, and that this content was pushed into the Newsfeeds of their Friends as well.
There was a long tail of failed attempts and weak engagement. The Top 20 Pages show
substantially more success across the four types of engagement (likes, shares, comments,
reactions) than the remaining 61. Of the top ten Pages by engagement, 50% focused on
Right-leaning audiences; despite the significant efforts made to target the Black community
on Facebook, only two Black-targeted pages cracked the top 10 by engagement.
The Page with content that garnered the most Likes was Being Patriotic (Right-targeted; 6.3
million Likes). The most comments appeared on Stop All Invaders (Right-targeted, 773,305
comments), most reactions on Blacktivist (Black-targeted, 1.4 million reactions), most sharesfrom Heart of Texas (Right-targeted, 4.8 million shares)

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

21Organic A cti v iti e sEngagement Metrics for IRA Facebook Pages, illustrating the long tail in engagement.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

22Organic A cti v iti e s

Close-up of figure highlighting engagement types across the top 20 accounts

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

23Organic A cti v iti e s

Political content appeared in the IRA accounts on Facebook. The post with the most engagementthat featured Donald Trump emerged after the election, on January 23, 2017. It was a conspiracy
theory about President Barack Obama refusing to ban Sharia Law under the 1952 McCarranWalters Act, encouraging President Trump to take action. It received 312,632 organic shares fromthe Stop All Invaders page. Searching for the meme on Facebook today, in November 2018, reveals
that it was shared into several large Groups and Pages, presumably by authentic accounts, where it
received hundreds of additional shares, comments, and engagements.

The top post featuring Hillary Clinton was a conspiratorial post asserting a myriad ofgrievances related to theoretical voter fraud and alluding to an armed uprising. It was posted
a month before the election.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

24Organic A cti v iti e s

The organic Facebook posts reveal a nuanced and deep knowledge of American culture,
media, and influencers in each community the IRA targeted. For example, Turning Point USA
and Pepe the Frog memes appear among the youthful alt-Right-targeted Memopolis andAngry Eagle Pages but don’t appear on the boomer-conservative focused pages. The IRA
was fluent in American trolling culture.

Right-leaning organic Facebook posts denigrated the U.S. media and intelligence community
as untrustworthy, and diminished longstanding Conservative leaders such as Sen. Lindsay
Graham and Sen. John McCain while elevating Donald Trump. Left-leaning pages similarly
criticized mainstream, established Democratic leaders as corporatists or too close to neocons, and promoted Green Party and Democratic Socialist themes.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

25Organic A cti v iti e s

Organic Activity: Instagram
The Instagram accounts followed similar Group alignments targeting Black, Left, and Rightleaders. Many of the Facebook pages had associated Instagram accounts as part of thecross-platform co-branding strategy described earlier. Instagram was perhaps the mosteffective platform for the Internet Research Agency. Approximately 40% of its accounts
achieved over 10,000 followers (a level colloquially referred to as “micro-influencers” bymarketers); twelve accounts had over 100,000 followers (“influencer” level).

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

26Organic A cti v iti e s

The top Instagram accounts had millions to tens of millions of interactions each.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

27Organic A cti v iti e s

Below, a visualization of engagements for individual posts.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

28Organic A cti v iti e s

One unique account on Instagram that targeted a micro-group that was not segmentedout separately on Facebook was the account @feminism_tag. It was the IRA’s version of anintersectional feminist account, and posted extensively about feminism and social justice.
The @feminism_tag account is unique in that it did not logo-brand its content; instead, itlargely – perhaps entirely – repurposed other accounts’ memes from the #feminism hashtag.
For example, it drew extensively from the Instagram content of an inspirational t-shirt
company, @expression_tees, mentioning it 136 times. The IRA may have co-opted the brandto run its own version of expressiontees as well; there is a dormant Twitter account here:
https://twitter.com/expression_tees with some pro-Trump shares that seem incongruous with
the Instagram account’s content. On the political front, @feminism_tag – although perhaps
the most likely to support Secretary Clinton based simply on the persona demographics– was a staunch supporter of Bernie Sanders, vehemently opposed to Hillary Clinton. The
account actively worked to undermine traditional feminist narratives underpinning support
for Secretary Clinton.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

29Organic A cti v iti e s

Another feature of Instagram platform activity was merchandise. Some of themerchandise promotion appeared to be with the goal of partnership building foraudience growth, particularly in the Black community-targeted accounts. The hashtags#supportblackbusiness and #buyblack appeared frequently. Sometimes the IRA pages
offered coupons in exchange for sharing content.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

30Organic A cti v iti e s

Beyond promoting others’ products, the IRA’s own “merch” sites and products appearedin Instagram profile URLs as well as in their posts. Some of the merch, such as t-shirt sites
for brand promotion, were similar to Facebook. Several of these t-shirt operations featured
contentious political messaging likely designed to spark controversy in the real world.
However, based on the image data provided there appear to have been other offerings
unique to Instagram such as LGBT-positive sex toys and many variants of triptych and5-panel artwork featuring traditionally conservative, patriotic themes.
Merchandise perhaps provided the IRA with a source of revenue – we have no sales data.
Regardless, there are two other reasons to run merch sites: first, transactions enable thegathering of personal information: names, addresses, email address and phone numbers,potentially payment information. Second, time spent shopping on highly partisan sites could
help identify committed audiences for Custom or Lookalike Facebook ad targeting.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

31Organic A cti v iti e sComparative Engagement:
Understanding Facebook vs. Instagram
Summary statistics comparing Facebook and Instagram reveal that although the Facebook
operation received more attention in the mainstream press, more content was created on
Instagram, and overall Instagram engagement exceeded that of Facebook (including on a
per-post basis) despite Facebook offering several additional ways to engage.

First Post

Last Post

Number of Posts

Followers

Facebook

1/10/2015

8/28/2017

61,483

3,334,202

Instagram

1/7/2015

10/26/2017

116,205

3,391,116*

Facebook

Instagram

Total

37,627,085

183,246,348

220,873,433

Likes/Post

612

1,568

Comments

3,339,752

4,017,731

54

34

Reactions5,188,182

N/A

5,188,182

Shares30,350,130

N/A

30,350,130

Total Engagements

76,505,149

187,264,079

263,769,228

Likes

Comments/Post

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

7,447,483

32

Organic A cti v iti e s

The Instagram and Facebook engagement statistics belie the claim that this was a small
operation – it was far more than only $100,000 of Facebook ads, as originally asserted
by Facebook executives. The ad engagements were a minor factor in a much broader,organically-driven influence operation. While a majority of IRA activity was unsuccessful, thetop Facebook and Instagram accounts achieved hundreds of thousands of followers andmillions of engagements. Instagram account @blackstagram_, perhaps their most successfulproperty, was regularly getting upwards of 10,000 Likes on its posts by 2017.
Facebook estimated that the content was seen by 126 million users on Facebook, and20 million Instagram users. This is because Shares on Facebook would have pushed thecontent into the feeds of other users on Facebook, and there is no comparable virality
engine on Instagram. However, as researchers on our team have previously pointed out,
the Instagram number is likely lower than it should be. Additionally, it is worth investigating
whether Instagram users were substantially more likely to engage with the content to better
understand how this material influenced and is likely to influence in the future.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

33

IRA Tactics

The preceding statistics and themes roll up from the various tactics deployed by the IRA.
The tactics vary in sophistication and volume and together manifest a complex effort. Below,
we break out a variety of key tactics, the understanding of which must inform any successfulattempt to remedy interference operations.

Tactic: Targeting Americans
Propagandists need an audience, and paid advertising helped the Internet Research Agency
facilitate audience growth. 73 different IRA-affiliated Pages and Instagram accounts werepart of an ads operation that consisted of 3519 ads (video as well as still images). Ads wereused to drive users to Like Pages, follow Instagram accounts, join Events, and visit websites.
One ad appears to have linked to a music-related browser extension (also shared to Reddit)that may have captured access to browsing behavior and Facebook data.
The Facebook and Instagram ads, which were run by both Right and Left-leaning pages, as well asBlack community-targeted pages, reinforced themes and messages to clearly-defined audiences.
There were 1,852 ads that used interest-based targeting; of those, 808 included geographicaltargeting. The data set included mentions of three custom audiences – named “tr”, “tesy”, and“newtestaudit” – used in 31 ads, as well as Lookalike audiences that were used to find people similar
to audiences who liked United Muslims of America, Defend the 2nd, and Being Patriotic. Most of theinterest-based targeting focused on African American communities and interests.
Geographical targeting split into two strategies: first, targeting communities for local eventsand rallies. Second, targeting them with race- and police-brutality related content timed

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

34

I R A Tactics

following officer-involved shootings.
Some ads incorporated job titles. For example, one ad set in late Sept - early October 2016
geotargeted several regions in Pennsylvania, then added additional interest targeting toreach 18 to 65-year-olds with the interest “Donald Trump for President, Job title: Coal Miner”.
The goal was to galvanize support for then-candidate Trump and to hold a rally for miners. It
secured 1225 impressions and 77 clicks with 876 RUB in spend.

Interest-based Facebook targeting

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

35

I R A Tactics

Of the 1,852 ads that included Interest, 122 were targeted by gender, split into 32 female and 90
male. Women interested in “Black Economic Empowerment” and “Black Enterprise” were targetedwith one set of ads; men in these categories were not targeted. Age was also a component intargeting: men starting at 15 were targeted with meme-related pages, men over 17 interested in the
NRA and AR-15s were targeted with 2nd Amendment and gun rights content. Men over 45 weretargeted specifically with pro-police Pages in support of law enforcement.
The only gender-specific political targeting was also focused on men, aged 18+ interested in“breitbart or conservative daily” and “Donald Trump for President”.

IRA ads targeting standalone, non-social-network domains

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

36

I R A Tactics

The ads cross-promoted IRA Pages – for example, Instagram accounts @_born__black_and Facebook Page Blackluive promoted Black Matters content, likely with the goal ofincreasing the perception of legitimacy and popularity for the media properties, and further
encompassing targeted groups within the IRA’s media mirage.
The ads also directed users to outside sites owned by the IRA. Blackmatters.us, Donotshoot.
us, black4black.info, dudeers.com, hilltendo.com, musicfb.info were IRA-created domains.
Bonfirefunds, another outside site, is a custom t-shirt making platform that was used byBlack Matters. Represent.com sold custom shirts for BM, Black4Black, Fit Black, Nefertiti’sCommunity, Pan-African Roots, Williams & Kalvin, Blacktivist, and Woke Blacks. The
merchandise strategy, discussed in the Instagram section in this report (that is where it wasmost prevalent), enabled fundraising, brand building, and the collection of addresses andpotentially credit card information.
Meetup.com was used to organize black self-defense classes for the Fit Black/Black Fist IRA
accounts.
The vast majority of the ads achieved substantially higher clickthrough rates (CTR) than typical
Facebook ads; according to Wordstream Advertising Benchmarks, the average CTR for Facebook
across all industries in .9% (as of August 2018). Although the IRA ran its ads earlier, from 2015-2017,
1182 of the 1306 unique ads in the dataset provided by Facebook (90%) that had documented
spend achieved a CTR higher than .9%. This suggests that the Internet Research Agency had
well-defined audiences, and reached them with resonant content. This perception is reinforced by
the October 2018 Department of Justice indictment, which highlights the degree to which the IRA
prioritized understanding the interests and communication styles of groups it targeted.

A simple ad for the Back the Badge
page had the highest spend andobtained the most clicks

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

37

I R A Tactics

Despite having high CTRs, however, the overall ad spend was small. Approximately two dozen
Facebook and Instagram accounts achieved audience sizes over 100,000 followers; however,no data was provided to indicate what percentage of followers came from ad conversions,engagement with organic content, or suggestions from the recommendation engine. Backthe Badge, for example, had 110,912 followers per the data provided (and, in Figure 10, we seethat at some point it appears to have had more Likes); it had one successful high-spend ad(Figure 11) but overall only 73,151 clicks across its ad portfolio. It did, however, have 155,514
Shares and an additional 500,392 social engagements across its posts, some of which we
can reasonably assume were served up in the News Feed of those users’ friends.
As a counter-example, Brown Power displayed the opposite: 694,633 clicks across its ads account,
1,300,901 shares and 2,601,004 additional social engagements…but only 204,331 followers on the
Facebook Page per the data provided. High CTRs often indicate effective ad content and targeting,but one metric can’t tell the whole story. Facebook acknowledged that the recommendation engine
had promoted IRA pages, but noted in a response to a Senate inquiry that the recommendationengine was “not the primary way” that people found the pages.

Top ten IRA ads by spend, and associated click-through rates. Using 67.07 RUB = 1
USD (average 2016 exchange rate), that is $1649 USD spent on highest-spend ad.

Alphabet also provided a collection of ads data in the form of 38 folders, each forwhat appears to be an Adwords account number, containing a total of 655 ads. It is
unclear from the data provided how Alphabet made their attribution. Given the shared
management and the proximity of the Internet Research Agency to the Federal News
Agency (FAN), which at the time of the operation was headquartered in the samebuilding at 55 Savushkina, there is a possibility that the ads that promoted long-formsites were actually the purview of FAN’s pro-Kremlin propaganda operation rather thanthe IRA. (This may be a distinction without a difference.) Regardless of whether the IRA

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

38

I R A Tactics

attribution was correct, AdWords accounts were used to promote blogs and news-typesites that offered opinion and analysis pieces in line with Kremlin agenda. The text of theads featured headlines about President Barack Obama’s perceived poor performanceand the media’s purported hiding of it, Russia’s positions on Syria, European migrantconcerns, and crises of democracy (e.g. messages about rethink democracy, anarchy isanother way, etc).

GI Analytics ad

GI Analytics was the most-promoted site, with 199 ads touting their unbiased coverage of civilrights, global security, and regional analysis. OnePoliticalPlaza.com (46), Blackmattersus (31), andRussia-direct.org (15) were the other 3 domains featuring more than 10 ads. The Black Matters adcontent focused on race relations, and Russia-direct.org content included ads on Syria.
The Twitter-provided data set contained text ads for RT (Russia Today), which Twitter has
since barred from advertising on its platform. The data did not indicate spend, nor suggestthat any other IRA Twitter accounts leveraged Promoted Tweets.

Tactic: Asset Development
A few press investigations have alluded to the IRA’s job ads. The extent of the human asset
recruitment strategy is revealed in the organic data set. It is expansive, and was clearly apriority. Posts encouraging Americans to perform various types of tasks for IRA handlers
appeared in Black, Left, and Right-targeted groups, though they were most numerous in theBlack community. They included:
yy
yy
yy
yy
yy
yy
yy

Requests for contact with preachers from Black churches (Black_Baptist_Church)
Offers of free counseling to people with sexual addiction (Army of Jesus)
Soliciting volunteers to hand out fliers
Soliciting volunteers to teach self-defense classes
Offering free self-defense classes (Black Fist/Fit Black)
Requests for followers to attend political rallies
Requests for photographers to document protests

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

39

I R A Tactics

yy
yy
yy
yy
yy
yy
yy
yy
yy

Requests for speakers at protests
Requests to protest the Westborough Baptist Church (LGBT United)
Job offers for designers to help design fliers, sites, Facebook sticker packs
Requests for female followers to send photos for a calendar
Requests for followers to send photos to be shared to the Page (Back the Badge)
Soliciting videos for a YouTube contest called “Pee on Hillary”
Encouraging people to apply to be part of a Black reality TV show
Posting a wide variety of job ads (write for BlackMattersUS and others)
Requests for lawyers to volunteer to assist with immigration cases

Recruiting an asset by exploiting a personal vulnerability – usually a secret that would inspire
shame or cause personal or financial harm if exposed – is a timeless espionage practice. So
is the tactic of infiltrating protest movements. The IRA attempted both, even going so far as
to create help hotlines for people struggling with sexual behavior, creating an opportunity to
blackmail or manipulate these individuals in the future.

Figure on the left posted 3x by Army of Jesus on Facebook, and 3x on Instagram,with slightly different visuals, in March and April of 2017. Received 5436 Likes
and 284 comments. Figure on the right in LGBT United.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

40I R A Tactics

Investigative reporting and Department of Justice indictments show that the IRA had somesuccess with several of these human-activation attempts. The comment and engagement
numbers in the data indicate that people did respond to these posts, and shared the posts totheir networks as well. We have no information beyond the numbers, though; there’s no text toclarify the direction the comments went. It’s unclear if investigative agencies or the platforms
themselves reached out to the people who did comment and likely engaged.
This tactic will be increasingly common as platforms make it more difficult to grow pages and buy
ads with fake personas. It will be extremely difficult to detect. The number of organic posts thatreveal attempts to engage with Americans reinforces our conviction that influence operations areunlikely to be managed without information sharing between the public and private sector.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

41

I R A Tactics

Tactic: Cross-Platform Brand Building
The Internet Research Agency operated like a digital marketing agency: develop a brand(both visual and voice), build presences on all channels across the entire social ecosystem,
and grow an audience with paid ads as well as partnerships, influencers, and link-sharing.
They created media mirages: interlinked information ecosystems designed to immerse andsurround targeted audiences. The IRA developed their content using digital marketing bestpractices, even evolving their Facebook Page logos and typography over time. The degreeof these efforts has not previously been understood from the scattered discovery of ads andmemes; this data set of organic content reveals it.
To illustrate the commitment to a social ecosystem-wide presence, consider one of their
midsize efforts, Black Matters.

Black Matters consisted of a website and an extensive network of linked social profiles. The IRA
launched the property on June 8, 2015 with a post on a Facebook Page they initially called “BM”
(facebook.com/blackmatters). Other social presences for Black Matters included:
yy
yy
yy
yy
yy
yy
yy
yy
yy
yy

Google+: Blackmatters
Google Ads: 31 ads for blackmattersus.com
YouTube: 95 videos
Facebook: fb.com/blackmatters as well as fb.com/blackmatters.mvmt
Facebook Ads
Facebook Stickers
Instagram: @blackmattersus, 28,466 followers and 1,929,855 engagements
Twitter: 5841 followers
Soundcloud: “SKWAD 55” podcast
Tumblr: SKWAD55

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

42

I R A Tactics

The Black Matters Facebook Page explored several visual brand identities, moving from aplain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran
the Facebook Page announced the launch of the website, blackmattersus.com, emphasizing
media distrust and a desire to build Black independent media. Black Matters ran ads; somedirected people to follow them on social media, others linked out to the site. On February 12,2016 the admin announced they’d reached 100,000 subscribers to the site. We examined
CrowdTangle data for Black Matters (not included in the provided data set). That data reveals
that influencers with large followings, such as Color of Change, Unapologetically Black, and
YourAnonNews, shared Black Matters articles to their own Facebook Pages. The articles
were also shared into popular subreddits.
The Internet Archive’s oldest capture of blackmattersus.com shows the gothic BM logo, andlinks to an Instagram account: @blackmattersus. The Instagram account amassed 28,466
followers and 1.9 million engagements. The first Instagram post appears to have been in 2016,
based on mentions of the account by a more established and popular IRA Instagram property, @blackstagram_, although the Facebook-provided data set shows a first post date in 2017.
The @blackmatters Twitter account was relatively small, with 5841 followers, but the IRA
leveraged other Twitter accounts, as well as IRA accounts on Reddit and Pinterest, for SEO,
discovery, and audience-growth purposes. The brand maintained presences on all primary social
networks and created multimedia content such as YouTube videos and a Soundcloud podcast.

The blackmattersus.com launch announcement banner

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

43

I R A Tactics

On August 19th, 2016 the original Black Matters Facebook Page ceased posting, and on
August 23rd, 2016 appears to have rebranded and renamed itself again, changing the URL tofacebook.com/blackmatters.mvmt, with a new logo featuring the letters inside the US map.
BM continued to post on the .mvmt Page until June 28, 2017, when it ceased posting for twomonths before switching back to the Black Matters name and resuming posts on August 23,
2017. Press coverage suspecting the Page of being a Russian propaganda operation did not
emerge until October 2017, so it’s unclear why the Page managers made these changes.
Black Matters content focused on building community – and sowing division – in real life aswell as online. Many posts solicited protestors, writers, activists, lawyers, and photographers
to attend the property’s numerous events. They posted job ads for real American writers tocreate content for blackmattersus.com – a clear example supporting the hypothesis that the
IRA engaged in narrative laundering.
The goal of working with real Americans is to eliminate the detection and exposure risk ofinauthentic personas.
Black Matters created numerous posts to push for 1:1 engagements with people who followed
its accounts, looking for everything from designers to immigration lawyers. They asked foruser-submitted photos of Black women, purportedly for a calendar. They posted about thecreation of a reality show on November 17, 2016, looking for contestants: “All that is requiredof you is to send us a video, depicting the problems facing our people.”

Black Matters job ad

Black Matters Facebook
stickers by IRA Facebook
persona “Melanie Panther”,
still available for download

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

44

I R A Tactics

Tactic: The Media Mirage
The case study of Black Matters illustrates the extent to which the Internet Research Agency
built out one inauthentic media property, creating accounts across the social ecosystem
to reinforce its brand and broadly distribute its content. To further contextualize this, Black
Matters was one property among 30 Facebook Pages that targeted the Black community.
Using only the data from the Facebook Page posts and memes, we generated a map of
the cross-linked properties – other accounts that the Pages shared from, or linked to – tohighlight the complex web of IRA-run accounts designed to surround Black audiences.
An individual who followed or liked one of the Black-community-targeted IRA Pages would
have been exposed to content from dozens more, as well as carefully-curated authentic
Black media content that was ideologically or thematically aligned with the Internet Research
Agency messaging.

A “media mirage” of interlinked Facebook Pages and Instagram accounts targeting
Black Americans. Squares are IRA-owned Facebook Pages, parallelograms are IRA-owned
Instagram accounts. Cloud shapes indicate non-IRA-attributed accounts including
authentic Black media. A larger version with easily-readable page names isavailable online at newknowledge.com/IRAfigures

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

45

I R A Tactics

In the diagram on the previous page, IRA Facebook Pages are represented as squares, IRAassociated Instagram accounts are represented as parallelograms, and the arrows pointing
from the squares to other shapes indicate that the Page shared that account’s content.
The ‘cloud’ shapes represent other Black Media accounts that have never been formally
attributed to the Internet Research Agency; they appear in the diagram if they were shared
more than 10 times by known IRA accounts. Many of them appear to be real, authentic BlackMedia properties. However, several of the most interlinked, such as @17thsoulja4, appear
to have been deleted or taken down by Instagram. Significant memetic content overlap
on those accounts (discovered via the Internet Archive, regram services, and Pinterest)suggests that they may have been unacknowledged IRA creations as well.
There is only minimal interlinking among the Facebook Pages targeting the Right and Leftleaning audiences. The diagram on the next page shows the Right-leaning Facebook Pages(squares), their associated Instagram accounts (parallelograms), and one notable Twitter
account (oval) that was leveraged on Facebook. There is far less cross-promotion of IRAcreated media brands, and far less active, attributed sharing of authentic Right-leaning media
content. Turning Point USA was one exception; the IRA shared brand-marked Turning Point
memes. It also took memes that originated on Turning Point and rebranded them with IRA
Facebook Page brand marks.
Ultimately, the purpose of the Black community-targeted media mirage appears twofold:
first, to grow audiences across all of their Black-targeted accounts simultaneously, so thatthat users who followed one of their accounts would follow others and therefore be exposed
to repetitive messaging. Second, to ingratiate their Pages with the authentic Black media
community so that they in turn were promoted by legitimate Black cultural entities; thiswould have helped the IRA increase the perception of their accounts as trusted brands. That
strategy was not replicated in the Left or Right-leaning Facebook Page clusters.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

46

I R A Tactics

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

47

I R A Tactics

We conducted a similar analysis starting from the Instagram accounts, to get a sense of
how users might have been exposed to other IRA narratives and properties after following
one Instagram account. Using the text mentions in the Instagram post copy, we explored
relationships between accounts that regrammed or mentioned each other at least 10
times. Distinctive clusters emerge here as well, including a far deeper commitment tointerlinking Right-targeted accounts than was observed on Facebook. The IRA used terms
such as “partners” in copy on Right-targeted accounts, suggesting that their account’s
followers should follow a broader ring. Occasionally they would include what appear to beauthentic Right-oriented Instagram accounts in these partner rings. It is unclear to what
extent these partners knew what they were participating in. In at least one case, a domestic
Facebook Page related to an Instagram account that was regularly regrammed by the IRA(@unclesamsmisguidedchildren) was taken down for inauthentic distribution; there is no
indication that USGC’s owners knew of their Instagram account’s longstanding history of
being promoted by Russian trolls.

A visualization of the network graph obtained by examining mentions and regrams by IRA Instagram
accounts. Red dots indicate a known, attributed IRA account, blue dots denote accounts mentioned orregrammed more than 10 times.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

48

I R A Tactics

Finally, we conducted a third mapping of the media mirage by analyzing the #hashtag topics
that the IRA Facebook and Instagram Pages mentioned most frequently. The IRA Instagram
accounts deployed hashtags prolifically, beginning with “#followback” appeals when an
account was first created. They frequently used dozens of hashtags per post, a standard
digital marketing tactic to improve discoverability and facilitate audience growth. These
hashtag networks reveal the terms that bridge communities: #jesus linked Black community
content to Right-leaning Army of Jesus, #love was used by both Army of Jesus and Leftleaning Instagram account @feminism_tag. They also show the topics that are clear points ofcontention, as they were keyword links between communities but deployed in opposition toeach other. The Right, Black, and Left-leaning Instagram accounts all used #police and #cop,
for example, with diametrically opposed content.
None of the data sets provided by the Facebook, Twitter, or Google included comments, and it is
impossible to gauge how many followers the pages attracted – or how many disagreements they
provoked – through the strategic use of either interlinking, or divisive hashtags. We still know very
little about what audience acquisition methods were most effective.

A visualization of the network graph obtained by examining hashtags leveraged by IRA Instagram accounts. Red
dots indicate a known, attributed IRA account name, blue dots denote hashtags mentioned at least 1000 times.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

49

I R A Tactics

Tactic: Memetics
The Internet Research Agency’s content relied extensively on memes, a popular format for
the transmission of information – and propaganda – across the social ecosystem. Memes
can take the form of pictures, icons, lyrics, catchphrases; they are a sort of ‘cultural gene’,part of the body of society, transmitted from person to person, often mutating. While many
people think of memes as “cat pictures with words”, the Defense Department and DARPA
have studied them for years as a powerful tool of cultural influence, capable of reinforcing oreven changing values and behavior.
Memes turn big ideas into emotionally-resonant snippets, particularly because they fit
our information consumption infrastructure: big image, not much text, capable of being
understood thoroughly with minimal effort. Memes are the propaganda of the digital age.
The IRA extensively studied its American targets. It both created and appropriated highly
relevant memes for each target audience, sharing from other pages and encouraging its own
audiences to reshare to their personal accounts as well.
Memes are powerful because they can be easily recontextualized and reshared, and act as“in-group” cultural signifiers. In the image on the following page, IRA Facebook Pages Secured
Borders and Stop A.I. shared a meme branded with their own page logo. Image searchtraces the meme as far back as a forum post from 2014 (presumably from a real American
participant). This ease of repurposing makes it harder to identify malign pages; the content
looks – and in fact is – largely identical to content shared by real people who hold a common
point of view. A large part of the 100,000+ pieces of IRA visual content in the data set
provided to SSCI were repurposed popular memes.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

50I R A Tactics

Our research team carried out both textual extraction using OCR as well as clustering ofvisually similar images to understand messaging and identify memetic tactics. We examined
the shift in visual themes weekly across the 2016 Twitter data (helpful for insights into what
topics they were sharing, since many of the t.co links did not properly unroll) and Facebook
Page images. A thorough manual review of the approximately 67,000 Facebook Page memes
and 100,000+ Instagram memes was also conducted.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

51

I R A Tactics
This March 9, 2016,

This Being Patriotic

South United meme

homeless veterans

was the most-sharedmeme on September

post on Facebook and8, 2016 had 723,750

had 986,203 total

total engagements on

engagements, the mostFacebook.

for a single piece ofcontent.

The IRA recycled memes within Pages and accounts, reusing top performers andthematically-relevant content. The Jesus image above was the most-Liked Instagram
content created by the IRA prior to Election 2016. Posted on March 2, 2016 by @army_of_
jesus_, it garnered 87,750 likes. The second most-Liked post is the exact same image fromthe same account – this time with 84,469 likes, shared 3 months later on June 13, 2016. This
Jesus meme also had the greatest number of comments of IRA pre-election Instagram
content, with 1,989 and 2,177 comments, respectively.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

52

I R A Tactics

This meme, originally created as an advertisement for a Black-owned leather goods
company named Kahmune, appears to have been reposted by @blackstagram__ (303,663
followers) with the text “What is your color? @expression_tees @kahmune #blackexcellence#blackpride #blackandproud #blackpower #africanamerican #melanin #ebony #panafrican#blackcommunity #problack #brownskin #unapologeticallyblack #blackgirl #blackgirls#blackwomen #blackwoman”
It had the highest total engagements on Instagram as well as the most likes (254,179) andcomments (6734). It was posted on June 11, 2017, per the Instagram data set; the @kahmune
account posted it as part of what appeared to be a product launch, branded with their own
handle, on June 12, 2017. It is possible that this was a time zone or other issue with the data
set. It is also possible that this was one of what appear to be many examples of the IRA
promoting real businesses that engaged with them. @blackstagram__ went on to mention@kahmune products as an example of Black-owned, pro-Black businesses on three otheroccasions, including the next day (June 12, 2017).

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

53

I R A Tactics

The IRA pages and Instagram accounts rebranded memetic images for their own uniquePage. Sometimes they also used identical text content in the posts across pages.

It is unclear whether the Pages that repurposed the same base memes were run by thesame IRA employee; file system images from an IRA hack reveal that they had a content
management infrastructure and folders of image files, much as a digital agency would.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

54

I R A Tactics

The Pages also shared each other’s memetic content, particularly from Instagram in the formof regrams, sometimes from Tumblr, to crosslink audiences and increase follower growth.
This was done very regularly on the Pages targeting the Black community (see mentions
network graph earlier in this report).
Pages stuck to themes, incorporating visuals that reinforced in-group dynamics. This is an
example of visual image clustering applied to the Facebook Page “Heart of Texas”. Heart ofTexas visual clusters included a wide swath of shapes of Texas, landscape photos of flowers,
and memes about secession and refugees. Further examination of the memes surfaced acollection of 2nd Amendment and anti-immigration memes.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

55

I R A Tactics

In another example, the more explicitly political Page “Being Patriotic” featured many memes
containing photos of candidates. There was a cluster of Hillary Clinton memes, a cluster ofDonald Trump memes, and other memes related to GOP politicians.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

56

I R A Tactics

Impact: Memetic Spread
When memetic warfare experts examine the success of a meme campaign, they look at
its propagation, persistence, and impact. Propagation is how far it spreads – does thememe move into new communities? Does it spread to new channels, platforms, or forms?
Persistence is how long the meme is part of community conversation – does the meme stickin the popular zeitgeist for a long period of time, or is it short-lived? And finally, impact – does
the meme change hearts and minds?
IRA memes fromBlacktivist (2nd row,right) and Nefertiti’sCommunity (bottom left)
on a non-IRA accountT H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

57

I R A Tactics

When we talk about the “impact” of the Russian influence operation, most conversations
focus on whether the IRA operation swayed voters and swung the Presidential Election in
2016. The answer is, we can’t tell from this data.
But in terms of whether or not the operation was a success: thousands of the memes
propagated far and wide, and they continue to persist in the targeted communities to this day.
The extent to which they changed, rather than merely reinforced, minds is difficult to answer.
Facebook and Instagram have additional data that could help answer that question. They
know how engaged the Page audiences were, what the comments said, and to what extent
user behavior changed after engaging with the content.
Evaluating this operation purely based on whether it definitively swung the election is too
narrow a focus. The operation started prior to 2015 and the explicitly political content was asmall percentage.
These memes do continue to spread within the communities they were targeting, particularly
content by lesser-known or quietly-removed pages. One type of impact that merits further
research is the extent to which these memes continue to shape culture and conversation intargeted communities.

Tactic: Inflecting a Common Message for Different Audiences(Syria)We see with content about Syria a tactic to persuade audiences similarly by tailoring detailsof the messaging to align with disparate and ideologically diverse audiences. Regarding Syria,
everyone got a similar take, but the nuance was tailored for each group.
There were over three thousand posts about Syria in the Instagram and Facebook data sets
alone, beginning in early February 2015 and continuing through the duration of the operation– including, based on our assessment of 2018 election activity, into the present day. The
narratives support Syrian President Bashar al-Assad, and frame Russian operations in the
country as a defense of the legitimate president and a determination to avoid the country
collapsing into the hands of ISIS. The Russian government’s foreign policy talking points on
the Syrian conflict appear in English language content targeting their U.S. audiences; their
Russian-language and Arabic-language accounts, such as the account AsdiqaRussiya,
targeted audiences outside of the U.S. as well. They also amplified aligned personalities; on
YouTube, one of the accounts featured a video from the SyrianGirlPartisan channel.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

58

I R A Tactics

The IRA’s focus on Syria began years ago. Adrian Chen wrote about it in his June 2015
article “The Agency”, describing the narrative as one that was so important that it leapt
from the realm of troll Facebook pages to an IRL photojournalism exhibit called Material
Evidence, promoted with the #MaterialEvidence hashtag. In the collection of pages targeting
Americans, material about Syria was presented to all groups in the ways that would be most
relevant to their other interests. For the Left-leaning accounts, the narratives about Syria
were framed as antiwar opposition, objections to U.S. involvement in another country’s affairs.
The Instagram account @feminism_tag was one of the most prolific pushers of this narrative,running with Syrian stories dozens of time, racking up half a million Likes. The posts focused on a
combination of appealing to the human element – the suffering of Syrian mothers and children –and reinforcing the idea that the cause of the suffering was U.S. government air strikes.

Some of @feminism_tag’s popular images, pulled from other popular accounts

The Black-targeted pages presented very similar narratives, advocatingthat the U.S. stop paying attention to Syria so that it could solve its own
domestic problems. “Who really thinks that American attacks will stop
the use of gas in Syria in the future? It sounds rediculous. In fact, the U.S.
threats increase, rather than reduce, the chances of a new chemical
weapons attack. They bomb the other country for no reason and don’t
pay attention to their own problems, for example, in #Flint.”
Several Black-targeted Instagram accounts shared the same memesof Syrian children as @feminism_tag; they chose to focus on thesimilarities between Black and Syrian children, using the hashtags#blacklivesmatter and #syrianlivesmatter alongside each other.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

59

I R A Tactics

On the Right-leaning pages, the content ranged from false political narratives (Barack
Obama and/or Hillary Clinton founded ISIS) to refugee stories. Citizens of the United Statesshould advocate for the U.S. to get out of Syria, the posts suggested, so that the Syrian
refugee floods would stop. There were also posts advocating for more attention to ISIS andless to Syrian President Bashar al-Assad:

ISIS is our real enemy! Not the legitimate leader of Syria Bashar al-Assad. Not a single Syrian
has ever done any harm to the US. We should fight the real threat - ISIS. It seems someone
just wants Assad to lose power, so Syria gets taken by ISIS and these jihadists become evenstronger than now. There’s a lot of dirty shit going on here! What do you think?
#veteranscomefirst #veterans_us #Veterans #Usveterans #veteransUSA #SupportVeterans#Politics #USA #America #Patriots #Gratitude #HonorVets #thankvets #supportourtroops#semperfi #USMC #USCG #USAF #Navy #Army #military #godblessourmilitary #soldier#holdthegovernmentaccountable #RememberEveryoneDeployed #Usflag #StarsandStripes

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

60

I R A Tactics

When President Donald Trump took office but continued to order air strikes on Syria, the IRA
accounts that were traditionally supportive of the President blamed the offense on General
McMaster and began to darkly hint at a Republican-establishment conspiracy.

Conservative journalist Mike Cernovich says Current National Security Adviser Herbert
Raymond “H. R.” McMaster is manipulating intelligence reports given to President Donald
Trump. McMaster is plotting how to sell a massive ground war in Syria to President Trumpwith the help of disgraced former CIA director and convicted criminal David Petraeus,
who mishandled classified information by sharing documents with his mistress. As NSA,
McMaster’s job is to synthesize intelligence reports from all other agencies. President Trump is
being given an inaccurate picture of the situation in Syria, as McMaster is seeking to involve theU.S. in a full-scale war in Syria. The McMaster-Petraeus plan calls for 150,000 American groundtroops in Syria. General McMaster is a man who worked closely all his life with such odiousfigures as John McCain, Lindsey Graham and David Petraeus. There was a big intrigue at theheadquarters of Donald Trump’s supporters, and now Trump himself is a victim of a large-scaleconspiracy: in the beginning, General Michael Flynn was dismissed, then Steve Bannon wasousted from the National Security Council, then Trump unexpectedly announces that he will
strike Syria with missiles. I’m sure Trump is a victim of cunning and dirty manipulations from thepolitical establishment that wants to draw America into another senseless military campaign.
Trump promised to “drain the swamp”, I hope he himself has not yet drowned in it.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

61

I R A Tactics

Tactic: Narrative Repetition and Dispersal
The repurposing of the same story across accounts in the media mirage was a deliberatetactic, deployed to reinforce key themes and create the perception that certain messages
or opinions were widespread and worthy of attention. This tactic was especially common
in the IRA-created media mirage surrounding the Black community. The posts below show
one example in which the IRA used the real human-interest story of an inspirational young
Black American who made the national news for a device he invented, and his accompanying
GoFundMe. The story was promoted at both the start and completion of the GoFundMe.
The Black community-targeted Facebook pages and Instagram accounts repurposed thestory, each putting a slightly different tone on the content to make it fit their brand (“theseare stories of Black children the media don’t want you to see”, “White people invent tools forkilling, this Black child is inventing a tool for saving lives.”) BM went so far as to create theirown article about it for the blackmattersus website, and Williams & Kalvin made a YouTube
video to tell the story. We have elected not to show the associated memes because these,
like thousands of other images in the data set, feature real Americans unwittingly used as
propaganda collateral in a foreign influence operation. However, we wanted to call attention
to this tactic to illustrate the co-opting of emotionally resonant human-interest stories as wellas the coordinated dispersion of chosen narratives.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

62

I R A Tactics

Tactic: Repurposing and Re-Titling Pages and Brands
One entirely new finding, based on the organic Instagram data set, is that the IRA appears tohave pivoted existing accounts to focus on new topics. One example of this is can be seen in
the data set that Facebook attributed to @army_of_ jesus_, which appears to be one of theearliest Instagram accounts created (first post date January 7, 2015). Based on the content
and dates, it appears that @army_of_ jesus_ was originally created as first a Kermit the Frog,
and then The Simpsons, meme account. The Instagram data set attributed a large collectionof Kermit memes with a brand mark reading “@naughtykermit” to the account @army_of_
jesus_. The @naughtykermit Instagram account no longer exists, and NaughtyKermit was thename of an IRA tumblr account (which at some point was repurposed to be “skullofjustice”).
A large collection of Simpsons images is similarly attributed to @army_of_ jesus; there isa transitional post on August 27, 2015 that reads, “Hey guys! I, Homer Simpson, am taking
Kermit’s page. He was messing with cops too much and finally he got some... punishment,
ke-ke! Okay let’s have some fun! WOO-HOO! #Simpsons #Homer #HomerSimpson#HomerSays #News #FunnyNews #Politics #USA”.
Army of Jesus’ Instagram operator did not find Jesus until 915 posts in: on January 15, 2016
the account rebooted yet again with a collection of posts simply featuring the hashtags“#freedom #love #god #bible #trust #blessed #grateful”; the data for the related Facebook
page indicates a first post date of September 23, 2016. It’s likely that the IRA decided that theaudience engagement on Simpsons and Kermit content just wasn’t there, but didn’t want toabandon the followers it had amassed; the data set did not include follower growth over time,nor comments, so we have no insight into the audience response.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

63

I R A Tactics

It’s possible that the Instagram team that provided the data made an incorrect accountattribution, or that @army_of_ jesus_ was simply repeatedly sharing @naughtykermit content.
However, this happens elsewhere in the data set as well. Another instance is an accountcalled @liberty_rising that spent over a year sharing humor and anti-Clinton meme content
branded with “@dummy_news” and “facebook.com/NewsOfTheStupid” before switching toa very different brand mark with new Ron Paul memes, and a strong Libertarian alignment
reflective of the attributed name.
The early efforts on the @army_of_ jesus_ account, whatever its name was at the time,
provide a glimpse into the use of hashtags for early audience-building. The accounts werealready getting dozens of Likes, so it is also possible that these accounts were older and thedata provided began in early January 2015 because that’s precisely what SSCI asked for andthe platforms didn’t volunteer earlier content.

Another example of what appears to have been an account repurposing is the @_anonymous_news_ Instagram account. This account’s repurposing pattern is of note because
it may indicate that the IRA had yearly reviews or yearly metrics goals. For almost exactly
one year, May 28, 2015 to May 27, 2016, the account posted local news about Jackson,
Mississippi. On May 27, 2016, it went dormant. On November 9, 2016, it respawned as a Black
Guns Matter account; there was an IRA-run Black Guns Matter Facebook page (as well as areal Black American gun rights advocate who currently runs a business with the same brandname), and the data set did not include any other attributed “@blackgunsmatter” Instagram
accounts. The content attributed to @_anonymous_news_ during the period from November
9, 2016 to May 31, 2017 is extremely similar to the Black Guns Matter Facebook content.
On May 31, 2017 the account went dormant again until July 13, 2017, when it appears to have
respawned yet again as a Guy-Fawkes-mask-branded account posting content that included

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

64

I R A Tactics

hashtags such as #truther, #hactivist, and #sheeple. The turnover on the account at nearly
the exact date each year is curious and indicates they may have purchased the account thefirst time, or potentially that it was considered a failure upon annual review and changed up.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

65

I R A Tactics

Tactic: Manipulating Journalism
The IRA impersonated state and local news enterprises on Twitter and Instagram. There
were approximately 109 Twitter accounts masquerading as news organizations. The
44 U.S.-focused Twitter accounts amassed 660,335 followers between them, with anaverage of 15,000 followers each. Many of these accounts were automated and behaved
nearly identically, posting links to articles and local content dozens of times per day. The
incorporation of local news into their strategy was possibly undertaken because Pew andothers have found that Americans have a higher degree of trust in local news.
A look at the metadata associated with the Twitter newsbots reveals that despite their names,
they were created with obviously Russian device information (beeline_russia as the carrier) andwere tweeting from overseas IPs. Several others (not pictured) used Google Voice accounts.

A handful of Instagram accounts similarly tried to present news and images as if they werelocal U.S. news agencies: @my_baton_rouge and @new_york_live and @baltimore.blackvoicepresented current events and information about the cities and communities they purported
to be from.
This tactic was not limited to U.S. audiences; of the 109 news-related Twitter accounts, 58
were “Novosti” accounts that tweeted news related to regions in Russia. One of the mostpopular was @NovostiCrimea, which had 107,011 followers. In addition, Russian-language
news and propaganda sites such as Sputnik embedded tweets from different IRA-linked
Twitter accounts. This is not unexpected given the IRA’s early mission of propagandizing to
Russian citizens.
Despite their dedication to impersonating media, the IRA simultaneously worked hard toundermine trust in real media across Black, Left, and Right-targeted accounts. This took two
forms. The first tactic was to advocate for the creation of niche community media, which was
positioned in opposition to unrepresentative (across a myriad of axes) mainstream media.
The second approach was to actively undermine trust in journalism.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

66

I R A Tactics

A sub-thread of note was the dozens of posts extolling the virtues of Wikileaks and Julian
Assange that the IRA placed across Black, Left, and Right-leaning audiences on Facebook,
Twitter, and Instagram. The Instagram accounts and Facebook pages produced memes
teasing new Wikileaks drops (such as via IRA account @therepublicandaily, which positioned
itself as a Republican news source) and reinforcing Assange’s reputation as a whistleblower
with a commitment to journalistic freedom. The Twitter accounts joined in as well. There werea small number of Facebook and Instagram posts about Assange, reinforcing his reputation
as a freedom fighter, on October 4th, 2016 – a few days before the major Podesta email dump
occurred. Given the GRU involvement in the DNC hack with Wikileaks, it is possible that the
IRA was tasked with socializing Wikileaks to both Right and Left audiences. Prior to October
4th, the last post about Assange had been in early September 2016. Once the emails werereleased, there were many more tweets and Facebook posts about them.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

67

I R A Tactics

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

68

I R A Tactics

Tactic: Amplify Conspiratorial Narratives
The Internet Research Agency amplified a myriad of conspiracy theories on all platforms theyprioritized. The greatest breadth and repetition of these narratives was on Twitter. Thousands ofconspiratorial tweets were predominantly advanced or amplified by the right-wing personas, andincluded topics such as pseudoscience conspiracies (vaccines, chemtrails), paranormal activity
and aliens, the “globalist” agenda (explicitly anti-Semitic angles were present), and domestic
political conspiracies such as QAnon, Pizzagate, and the murder of Seth Rich.
With the exception of one anti-vaccine Instagram post, Facebook and Instagram had no
pseudoscience conspiracy content, no QAnon, and no Pizzagate. There are, however, dozens
of posts blaming George Soros for a myriad of complaints across dozens of the Right-targeted
Instagram accounts and Facebook Pages; these do not display the degree of explicitly antiSemitic vitriol or harassment that appeared in the tweets. Domestic political conspiracies
were present on Facebook and Instagram – the Seth Rich murder conspiracy was presented
to both Right and Left-leaning audiences. On the Left, it was accompanied by an appeal totrust Julian Assange.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

69

I R A Tactics

The Black-targeted groups were presented with distinct historical conspiracies – ones
intended to reinforce cultural identity as well as create discord. Three that appeared
repeatedly (all debunked on Snopes) were the idea that Wolfgang Amadeus Mozart wasBlack, that Shakespeare’s plays had been written by a Black woman, and that the Statue of
Liberty had originally been made in the likeness of a Black woman that the U.S. government
rejected, prompting France to send the current Lady Liberty as a whiter-looking replacement.
These posts generated enough audience engagement that they were reposted multiple times
by the same accounts across the duration of the operation.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

70

I R A Tactics

Tactic: Sow Literal Division
The Internet Research Agency has been implicated in the promotion of secessionist andinsurrectionist movements in several countries; there is no sowing of division quite so
pronounced as attempting to create a literal territorial split. In Europe, this took the form of
involvement in Brexit and Catalonian independence efforts. In the United States, it was #Texit
and #Calexit, as well as active support for the Bundy ranch and Malheur Reserve standoffs.
The vote in favor of Brexit, which happened on June 23, 2016, was subsequently used by
the IRA to promote its Texas Secession initiatives. Brexit narratives were shared on the
Instagram account @rebeltexas as a justification for #Texit, as well as on @_americafirst_and@mericanfury to encourage American isolationism and a retreat from involvement in global
affairs. The Facebook Page Heart of Texas posted about secession with some regularity, andcoordinated real-world pro-secession demonstrations across the state using Facebook Events.
The #Calexit hashtag was pushed hundreds of times by @mericanfury beginning on Feb 2,2017 – that account’s content was reposted by @wall__up, @_americafirst, @_american.made,and @defend.the.second; the @southern.rebel.pride account used it a few dozen times as well.
The narrative around Calexit was somewhat convoluted; on Twitter it was presented as liberals
trying to leave after the election of Trump; one of the Right-wing twitter personas got involved,
tweeting “Calexit leader discovered to have ties to #Russia - communists attempting to take#California”. The #Calexit presence on Facebook was virtually nonexistent; it consisted of two
posts, both by Angry Eagle, suggesting that California liberals were whiny and should leave. The
second post is an example of the way in which the IRA tied controversial recent news (in thatcase, an anti-Milo Yiannopoulos protest in Berkeley) to the broader narrative:“The fucking lefty scumbags seeded destruction around at UC Berkeley overnight in responseto the planned speech by a right-wing firebrand Milo Yiannopoulos who’s an actual gay! Who’s
intolerant now? They broke windows, set fire, surrounded occasional passersby and beat themwith their ‘antifa’ flags. Fucking animals. Soros wants to spark civil war 2.0. Police are told to stayaway. Cabel news networks cover up what’s going on there. Is this the cost of free speech? Btw
Trump threatens to cut UC Berkeley’s federal funding. I think he’d better completely cut theentire funding of California since they’re so worried about keeping illegals inside. Let them pay
for all that shit themselves, they’re boasting so much about Cali being a donor state, so let’s see
how they can handle all this shit! Or maybe... support #calexit?”

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

71

I R A Tactics

At a local level, the IRA promoted riots and rallies to call attention to a myriad of issues andgrievances. At the state level, the IRA promoted secession (#texit, #calexit) and amplified
regional cultural differences. And at a national level, the IRA promoted armed insurgency,
through exhortations to violence over issues ranging from the Bureau of Land Management
to Black Lives Matter, from protesting Confederate monument removal to threatening riots
over election legitimacy (if Hillary Clinton were to steal the election).
Armed insurrection and the Bundy standoff were talking points on Stand for Freedom,
Defend the 2nd, Heart of Texas and Being Patriotic – all in favor of it. LaVoy Finicum washailed as a hero and martyr in memes following his death; in addition to the Facebook pages
mentioned, Instagram accounts @stop_refugees, @army_of_ jesus_, @_american.made, @stand_for_freedom, @rebeltexas, @_americafirst_, @wall__up, and @defend.the.second
weighed in with the opinion that he had been murdered by the government.
Blacktivist and United Muslims of America, meanwhile, used the Bundy story to point out that
Black or Muslim individuals who had occupied government land would not have been treatedso graciously by Federal officers.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

72

I R A Tactics

Tactic: Dismiss and Redirect
Soon after the November 2016 election, investigative journalism began to uncover evidenceof both the IRA’s social influence and the GRU’s hacking operations. As articles began toemerge about election interference – pointing the finger at Russia – the IRA didn’t shy awayor ignore it. It used derision and disparagement in content targeting the Right-leaning pages,
to create and amplify the narrative that the whole investigation was nonsense, that Comeyand Mueller were corrupt, and that the emerging Russia stories were a “weird conspiracy”
pushed by “liberal crybabies”. As facets of the investigation trickled out over 2017, the Righttargeted accounts justified, dismissed, normalized, and redirected.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

73

I R A Tactics

IRA accounts created dozens of posts throughout 2017, attempting to frame the Russian election interference investigation as a paranoid fantasy of the Establishment
and the Left.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

74

I R A Tactics

I think Donald Trump Jr had every right to meet with a Russian lawyer. First of all, she might
have got really important information about Hillary Clinton. If the information is true I don’t care
where it comes from Russia or China or wherever. If the Russians are able to expose Clinton’slies then let them do it. I want to know the truth. Secondly, Donald Trump Jr published all theemails in order to be transparent and there is nothing outrageous in them. Not like he hasdeleted 33,000 of classified emails of smth. Third, this lawyer is a really suspicious figure who
according to some news sources was spotted at an anti-Trump rally and has connections
with the Democratic Party. Moreover, she has no proven connections with the Russian
government. So the whole story looks like another provocation dedicated to resurrecting thedead Russian collusion story. They tried to defame the president and they lost now they aretrying to use this weak ace in the sleeve against his son. Good luck with that!” #liberal #Trump#MAGA #PresidentTrump #NotMyPresident #USA #theredpill #nothingleft #conservative#republican #libtard #regressiveleft #makeamericagreatagain #DonaldTrump #mypresident#buildthewall #memes #funny #politics #rightwing #blm #snowflakes

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

75

Election 2016

Quantitative
Summary statistics examining mentions of “Trump” and “Clinton” appear to confirm theconsensus across researchers and experts that the Internet Research Agency’s influence
operations were minimally about the candidates. Roughly 6% of tweets, 18% of Instagram
posts, and 7% of Facebook posts mentioned Trump or Clinton by name. Trump was
mentioned roughly twice as often as Clinton on most platforms. The text of the Instagram
posts contained a much higher proportion of insult names like “Shillary” or “Hitlery”.

Facebook

Instagram

Twitter

Total posts

61,483

116,205

10,401,029

Clinton posts

1,777

7,915

198,123% mentioning Clinton

2.9%

6.8%

1.9%

Trump posts

2,563

13,106430,185% mentioning Trump

4.2%

11.3%

4.1%

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

76

El e cti o n 2 0 1 6

There were 1777 political posts on Facebook that mentioned Hillary Clinton (or a nickname).
268 appeared on pages that targeted Left-leaning and Black community pages, generating
49,635 engagements; the remainder, generating 1.7 million engagements, were on Rightleaning pages. They were all negative.
There were 109 posts devoted to creating and amplifying fears of voter fraud; the overwhelming
majority of them targeted right-wing audiences. 71 were created in the month leading up toelection day, and made claims that certain states were helping Sec. Clinton win, that militia
groups were going to polling places to stop fraud (called for volunteers to participate), thatcivil war was preferable to an unfair election or the election of Sec. Clinton, that “illegals” wereoverrepresented in voter rolls in Texas and elsewhere, or were voting multiple times with
Democratic Party assistance. The Being Patriotic page created a 1-800 number hotline for tips
about voter fraud, which prominent accounts such as @March_for_Trump promoted on Twitteras well. The narrative was also disseminated on Twitter via the popular @TEN_GOP account.

The prevalence of this narrative suggests they may not have expected Trump to win;
regardless, they intended to incite violence if he did not.
There was one post alluding to voter fraud targeting a left-wing audience on the page @cop_
block_us; it conveyed a conspiracy theory that someone with evidence that the Democratic
Party primary had been rigged in Hillary’s favor had been found dead.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

77

El e cti o n 2 0 1 6This data set does not include enough information to make a strong assessment about theextent to which the IRA operation had a significant influence on the election. However, theorganic content does offer insights into the extent to which the IRA’s memes and messages
resonated with its target audiences, and the ways in which they evolved their politicalmessages in some ways and remained remarkably consistent in others. As stated earlier,the Internet Research Agency’s operation was not focused entirely on the political, but theelection of 2016 did figure significantly in the content. There were approximately 6.5 million
posts not related to the election, and approximately 686,000 posts that focused on it. In
engagement terms, there were 246 million non-election-related engagements, and 82 million
election-related. Put another way, 11% of the total content was related to the election and 33%of the engagement was related to the election. This indicates that overall the IRA did receive
higher engagement on election-related content. However, this effect was dominated by thevolume of Twitter posts; Facebook and Instagram had similar engagement rates between
election and non-election-related posts. Overall, Instagram’s engagement rates were higher
after the election because of the increase in activity in 2017.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

78

El e cti o n 2 0 1 6

Weekly Post Volume Through Election 2016

Posting patterns for five months leading into the election show increases on Facebook andInstagram, but a drop-off in mid-October on Twitter. By November 2016, journalists werealready writing about the presence of Russian Twitter bots. The drop-off may have been
related to the IRA losing some of its accounts; we do not have account deletion dates in thedata provided.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

79

El e cti o n 2 0 1 6

Qualitative
First, it is our assessment that aside from a handful of early-2015 posts expressing support
for a Rand Paul candidacy, the Right-targeted IRA pages aligned to display a clear andconsistent preference for then-candidate Donald Trump from July 2015 onward. They
actively disparaged Ted Cruz, Marco Rubio, and Jeb Bush on Facebook and Instagram.

Saying that the IRA expressed strong and consistent support for then-candidate Trump does not
imply that there were no negative posts about President Trump; there were negative posts among
the Left-targeting and occasionally Black-targeting Facebook groups. It also makes no claim
about whether the campaign was in communication with the IRA in any way, as any determination
about that topic is outside of the scope of this data set. However, the IRA consistently supported
his candidacy throughout the primary in Right-leaning groups, keeping their memes and content
positive with the exception of a few posts expressing strong disapproval and disappointment that
then-candidate Trump was in favor of a hard line on Edward Snowden.
Kremlin-aligned narratives appeared in a handful of posts, including this one from Dec. 18, 2015that expressed the conviction that Trump was going to have a very sensible Russia policy.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

80

El e cti o n 2 0 1 6(Above left) @stop_refugees #91323 12/18/2015 Trump said that he is honored by Putin had
called him an absolute leader, and expresses his support for Russian president. His dislike for
President Obama - and it’s a mutual thing - is terrible. That’s why you see all the conflict, all the
problems, all the hatred. If we can’t work with Russia, that’s not a good thing, Trump said. Wellto my mind we need Russia on our side, not on the opposite, what’s your point? #usdaily #news#hotnews #newspaper #coffee #reading #local #cnn #foxnews #nbc #nytimes #morning#politics #usa #america #americannews #followme #trump #russia #putin - 314 Likes
Second, it is our assessment that the IRA was similarly strong and consistent in their efforts
to undermine the candidacy of then-candidate Hillary Clinton throughout all of their pages –Black, Left, and Right-targeting. The one purportedly positive Clinton post was an event (andad) promoting a Muslim community march to support Sec. Clinton (above right). It is likelythat the IRA saw a high-profile march by Muslims as a way to create social tension, and as anegative for Sec. Clinton’s candidacy. The remainder of the United Muslims of America page
content actively opposed Sec. Clinton, primarily promoting further-left candidates but at one
point going so far as to broach the idea that Muslims might vote for then-candidate Trump.
In the days leading up to the election, the IRA began to deploy voter suppression tactics on theBlack-community targeted accounts, while simultaneously fearmongering on Right-targeted
accounts about voter fraud and delivering ominous warnings that the election would be stolen andviolence might be necessary. The suppression narratives were targeted almost exclusively at theBlack community on Instagram and Facebook; there appeared to be a concerted effort to keep
the conversation on other topics, such as alienation and violence, and away from politics.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

81El e cti o n 2 0 1 6

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

82

Election Week 2016

Election week at the IRA:
Content analysis, November 5 – November 9, 2016
Based on the data set provided by the social platforms, the IRA made approximately 32,000
posts across Twitter, Facebook, and Instagram between 11/5/2016 and 11/9/2016. We removed
duplicates, revealing 29,040 unique pieces of content. For tweets that included “RT” in thecontent text, Twitter provided the number of retweets, but not favorites. (The number of
replies were not included in the Twitter data set.)
The reason that we isolate this detailed study of the IRAs cross-platform efforts during
election week is to illustrate the distinctive ways in which they attempted to manipulate theBlack, Left-leaning, and Right-leaning groups over the same timeframe. The strategy for
Right-leaning groups appears to have been to generate extreme anger and suspicion, in
hopes that it would motivate people to vote; posts darkly hinted at conspiracy theories, voter
fraud, illegal participation in the election, and stated the need for rebellion should Hillary
Clinton “steal” the election. The Black-targeted content, meanwhile, largely ignored theelection until the last minute, instead continuing to produce posts on themes about societal
alienation and police brutality. As the election became imminent, those themes were thentied into several varieties of voter suppression narratives: don’t vote, stay home, this country
is not for Black people, these candidates don’t care about Black people. Left-targeted
content was somewhat political, with an anti-establishment slant. It focused primarily on
identity and pride for communities such as Native Americans, LGBT+, and Muslims, and thenmore broadly called for voting for candidates other than Hillary Clinton.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

83

El e cti o n W e e k 2 0 1 6

In summary, the goal appears to have been to generate extreme anger and engagement for
those most likely to support then-candidate Donald Trump, and to create disillusionment anddisengagement on the Left-leaning and Black communities.

November 5, 2016
Leading into election week, the IRA Twitter newsbots, notably NBAHawks_Fans, rapidly
tweeted out miscellaneous news headlines; these had very low engagement. Many of the3841 IRA persona twitter accounts appeared to be focused exclusively on retweeting. They
primarily amplified the #SpiritCooking and #RememberWhenTrump hashtags, the latter ofwhich appears to have begun with the goal of bumping up unfavorable moments in Donald
Trump’s campaign and prior public life. According to an archived thread on Reddit from
November 4th, 2016, the two hashtags were part of a battle for attention. Some pro-Trump
online communities had alleged that that Twitter was censoring #SpiritCooking; several IRA
accounts amplified or produced unique pro-Trump #RememberWhenTrump contributions
that incorporated #SpiritCooking, likely with the goal of keeping it trending and redirecting
attention. Of the 60 IRA contributions to the hashtag on 11/5, all but five retweets amplified or
created negative Hillary Clinton-related content; their twenty-three original tweets generated
642 engagements. Other retweeted topics included Pizzagate and pedophilia, Sec. Clinton’s
alleged involvement in funding ISIS, and former President Bill Clinton’s past.
The IRA personas’ online conversations managed to be consistently divisive, and yet nearly
entirely separate across target audiences. Among the Right-wing persona group, multiple
accounts, particularly @GreatKublaiKahn, retweeted @realDonaldTrump and trolled real
Twitter users, occasionally mentioning alt-right activists such as Baked Alaska and Microchip.
Others retweeted @wikileaks’ tweets about Sec. Clinton’s finances, the Clinton Global Initiative,
spirit-cooking emails, the private email server, Benghazi, and sex scandals; amplificationof Wikileaks was observed across all social platforms throughout the campaign. Some IRA
Twitter personas promoted conspiratorial rumors by authentic influential accounts such as@LatestAnonNews, which claimed “Clinton Underground Child Sex Scandal to break in acouple hours. Happy 5th of November!”, and @KimDotCom, who wrote, “FBI now has deleted
Clinton emails.” They amplified misspelled-name hoax and satire accounts such as @HlLLARYCLINT0N (spelled with a zero), which were subsequently shut down by Twitter. They
amplified Donald Trump campaign insiders such as @MichaelCohen212, @DonaldJTrumpJr
and @DiamondandSilk, as well as conservative influencers such as @charliekirk11, @gatewaypundit, and @AmyMek.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

84

El e cti o n W e e k 2 0 1 6

Several “shitposter”-style accounts, including @Based_Plissken, @TheeFash, @GeorgePrescottt, @30PiecesofAG_, @drtywhiteboy68, and @harrykleinfeld, produced
original content, tweeting racist and anti-Semitic political remarks, and harassing regularusers. Account @Chris__Tegner ran a voter suppression strategy, repeatedly @-messaging
individual Twitter users, including several famous influencers, to post “Heads Up: If you voted
for Bernie in the Primaries, the Election Board will NOT let you vote for Hillary on Nov 8.” The
IRA frequently engaged with influencers, presumably an attempt to achieve wider viewershipby appearing in the replies to prominent accounts. Meanwhile, the Texas-secession focusedsocial media accounts on all platforms pushed a #Texit rally.
The accounts that appeared to be targeting and engaging with Black audiences focused on an
entirely different conversation, almost entirely absent any mention of “Trump” or “Clinton”. On
Twitter as well as Facebook, they were talking about Dillard university protesting David Duke,and about police brutality. The highest-engagement tweet by an IRA Black persona account on
November 5th came from @Crystal1Johnson: “St. Louis mother wants answers after ‘hideous’photo of officer posing with her dead son surfaces. https://t.co/I9pO8QhEgz”. It received 2497
retweets and 1365 likes; the copy, although it was presented as original, was pulled verbatim froma KTLA headline. This is a tactic observed many times in IRA content; it likely allowed them tomask language fluency shortcomings. Accounts such as @BLK_Voice talked about men andyouth killed by police. On Instagram, a substantial portion of the content focused on Black culture
with no mention at all of the upcoming election. @BlackToLive asked where black people werementioned in textbooks, @Blacktivist asked where black people were on television. The sparse
political content (~5 posts) included commentary about the Jay Z-Beyonce concert for Hillary.
Overall, 75 unique accounts produced 802 pieces of original content, generating 117,255
engagements spanning the full 24 hours. Instagram account @blackstagram__ secured themost engagement (18,250 likes and comments). Of the original Twitter content, TEN_GOP
dominated in engagement, with 9296 RTs and 8800 favorites across its 12 tweets. The accounttweeted claims that Rand Paul had said Hillary Clinton would go to prison for 5 years, and that
“Hillary is the first candidate in American history to be labeled a threat by American troops”.

November 6, 2016
Once again, a lot of the Twitter content focused on amplification via retweets. The Rightleaning persona accounts retweeted and amplified Wikileaks, #SpiritCooking, and Jill Stein,
as well as Donald Trump and the celebrities and media personalities supporting him (JamesT H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

85

El e cti o n W e e k 2 0 1 6

Woods, Clint Eastwood). The accounts also repeated a myriad of accusatory theories
about the Clinton Foundation funding, who provided it, and what it was used for. The Black
community-targeted accounts retweeted commentaries on black female beauty, and aschool bus bullying incident. Nonpartisan accounts retweeted radio station-related content.
Original content from TEN_GOP repeatedly attacked James Comey’s investigation into
Hillary Clinton’s emails, earning 38,000 engagements across the collection of tweets.
Facebook posts on the Right-targeted Pages focused on allegations that illegal immigrants
were committing voter fraud. Once again, the original content on the left focused nearlyexclusively on themes of Black culture, police brutality, and Black erasure – the election
was barely mentioned. One representative Black-focused Instagram account discussed theelection, with @woke_blacks presenting a range of voter suppression/depression narratives:

I say it as it is. When you decide to choose between two evil, you are somehow condoning towhatever comes afterwards. The excuse that a lost Black vote for Hillary is a Trump win is bs.
It could be late, but y’all might want to support Jill Stein instead. Trust me, for a presidential
candidate to have so much scandals before election and still be the no. 1 candidate should tell you
how things will get more f *cked up after the elections. Should you decide to sit-out the election,
well done for the boycott. However if you decide you are still going to vote, then don’t choose anyof the major ones. I remind us all one more time, anyone who wins can literally change less about
the state of Black people, we are on our own, esp. after Obama. Wise up my people!

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

86El e cti o n W e e k 2 0 1 6

November 7, 2016
There were 2,457 pieces of content put out on Twitter, Facebook, and Instagram on November
7th, not including retweets. The trend from the prior two days continued: the Black and the handfulof Left-leaning persona accounts rarely tweeted about political issues. Instead, they continued
to focus on supporting Black businesses, praising Black beauty, and talking about the challenges
faced by Black boys. @Crystal1Johnson weighed in on twitter 18 times; she contributed to the#ElectionFinalThoughts hashtag with “So we’re screwed either way”. Instagram accounts @woke_
blacks and @afrokingdom_ incorporated election-related hashtags as well as “#boycott” into
content that was focused on black culture and police-brutality related content.
The apolitical content targeting the Left and Black communities may have been intended as a
distraction; there were also more overt suppression narratives. Williams8kalvin, the Williams &Kalvin Facebook Page’s Twitter account, tweeted a link to their YouTube video: “The truth about
elections,” which explained why Black people should not vote. They also posted to Facebook:“Hillary Clinton is a traitor! Hillary Clinton is a liar! Hillary Clinton is insane! I know that many black
people support this old dirty bitch. I don’t know why they do this, still it’s their personal choice andwe are a free country yet. But, listen to my word of truth and don’t let them fool you.”T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

87El e cti o n W e e k 2 0 1 6@afrokingdom_ advocated that Black people not vote: “Students from St. Augustine’s
University and Shaw University, two historically Black colleges, expressed their frustration
with Clinton’s tendency to lie. Almost every student doesn’t believe that Hillary is thebest candidate, but said that they have to “settle” for Clinton! But I say that this is the
BIG mistake! Black people don’t have to vote for Hillary because she is liar! Black people
are smart enough to understand that Hillary doesn’t deserve our votes! DON’T VOTE!
#williamsandkalvin#awordoftruth #PanAfricanism #BlackNationalism #BlackEmpowerment#AfricanEmpowerment #AfricanAndProud #BlackAndProud #BlackPride #BlackPower#BlackLivesMatter #Amerikkka #UnapologeticallyBlack #UnapologeticallyAfrican#BlackInAmerica #BlackIsBeautiful #JusticeOrElse #ProBlack #dontvote #boycottelection#election2016” The post got 453 engagements.
Meanwhile, the Right-leaning collection of accounts continued to amplify political conspiracy
theories (i.e., that Clinton and the Podestas had ties to the Madeline McCann disappearance),and posted inflammatory content about James Comey’s investigation into Hillary Clinton’semails. @TEN_GOP tweeted 22 times, talking about patriotism and arguing that Hillary Clinton
was receiving special treatment on the emails issue, and should not be above the law; thetweets received 12,383 favorites and 16,058 retweets. At one point, Right-targeted persona @TEN_GOP engaged with Black-targeted persona @Crystal1Johnson: “@Crystal1Johnson Wake
up! This will happen if Hillary wins. Stop being slave of Democrat plantation!”
The Right-leaning troll account, @Based_Plissken, tweeted 392 times, largely arguing directlywith real users. Another troll account – one that had several names across its existence but wasreported as @CovfefeNationUS* in the data set – tweeted a poll about the election repeatedly
at influencers, and pushed a narrative that Barack Obama did not trust Hillary Clinton. (@CovfefeNationUS, which used a Gab presence as its profile URL, would go on to become aprominent voice in the #boycottKeurig campaign and a promoter of QAnon conspiracy theories.)
Both Right- and Left-targeted IRA personas participated in the hashtag conversation#2016electionin3words dozens of times, with contributions ranging from “Clinton Spirit
Cooking”, “better stay home”, “Hillary for Prison”, and “Drain the Swamp” to “Fuck Donald
Trump”, “Both equally terrible”, and “America is done”.

* The handle @CovfefeNationUS is an allusion to the term “covfefe” appearing in a tweet from Trump in May
2017. The account likely changed its handle after this tweet occurred.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

88El e cti o n W e e k 2 0 1 6

Right-leaning IRA Facebook and Instagram pages featured dozens of posts about the corruptionof Hillary Clinton and allegations that President Barack Obama was complicit in helping herorchestrate voter fraud by illegal voters. Secured Borders was particularly committed to riling up
its user base, posting that President Barack Obama himself was illegal, and therefore treasonous.
A post to that effect secured 4,891 engagements, including 1,478 shares.

I can’t believe this. Our so-called President, Kenyan illegal bastard Barack Hussein Obamaencourages illegal aliens to vote – because as you know law breaking comes naturally to both
Democrats and Illegal aliens! “This is not a surprise at all to me” - says Obama. What the hell
are you talking about Barry?? This is a CRIME, a VOTER FRAUD! And you just saying thatyou’re not surprised?? Are you encouraging this? You’re illegal. You cannot vote. And thePresident of the United States is saying, ‘Don’t worry, no one will be spying on you, or catchingyou.’ Why President Obama says so? Apparently because he himself is illegal and cares
nothing for this country!! When maybe whether you’re for the president, against the president,
whether you’re pro-immigration reform, anti-immigration reform – you are ignoring the factthat you’ve been questioned about illegal voting, which you can’t do. Why? Because you’re nota citizen of this country! Isn’t that true, Mr. Obama? I cannot stand the level of corruption thatsurrounds this administration. Obama and Hillary have committed treasonous acts against
our country. They both belong behind bars, not in the White House! Do you agree?

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

89

El e cti o n W e e k 2 0 1 6

November 8, 2016
The amount of original content produced by the IRA operation jumped to approximately 4316
posts on Election Day 2016 (this number varies a bit depending on the time zone chosen). The
Right-wing persona Twitter trolls @Based_Plissken, racist_paul, and @jemalhudso12111 produced
the most posts (~100 each), primarily arguing with other users and journalists. @Based_Plissken
mocked the idea of Russian hacking, and a myriad of smaller accounts participated in#HillaryForPrison chatter. @CovefefeNation played in the hashtag #ImVotingBecause, offering
up anti-Clinton reasons. Once again, the highest engagement account was @TEN_GOP, which
also participated in #ImVotingBecause, as well as tweeted inspirational quotes about Donald
Trump (and against Hillary Clinton) by other political figures such as Rudy Giuliani, Marine LePen,
etc. @Ten_GOP earned 65,751 retweets and 56,906 favorites.
On the Left-leaning and Black-targeted account side, @Crystal1Johnson debated whether
Hillary Clinton or Donald Trump was “the lesser evil”, but once again the content targeted atthese groups was far less focused on the Election; @Crystal1Johnson wrote content about
the Black suffragists that “history forgot”.
Several accounts, such as @MikeMikej344, active on both November 7th and 8th, mentioned
pro-Clinton hashtags in their tweets, but primarily tweeted URLs (the Twitter-provided
data set did not unroll the URLs; in the slide deck associated with this report we use theTwitter images to gauge the topics in the links) Others, such as @MRNyc2015, a persona
that pretended to be a liberal gay man, participated in pro-Clinton hashtags with active
voter suppression messages, dropping calls to vote online: “@lauren_koontz @smrtgrls @HillaryClinton SKIP THE LINE #ImWithHer Lets do this! #Gays4Hillary #HillYes #Hillary#StrongerTogether https://t.co/R3806jcKgH”,” @SOMEXlCAN YAAS QUEEN. Everyone
needs to vote ONLINE #ImWithHer #HillYes #Hillary #StrongerTogether https://t.co/
YVotzfS1CO”. He appeared to get little uptake, but tweeted these messages dozens of times.
Curiously, the persona account also participated in anti-Clinton conversations.
On Facebook, the Right-leaning pages posted repeatedly about voter fraud, stolen elections,conspiracies about machines provided by Soros, and rigged votes. One made a slight error,
alleging that a voting machine in PA was not accepting votes for Clinton; it quickly corrected
the post, which went on to receive 983 shares.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

90El e cti o n W e e k 2 0 1 6

Left-leaning Facebook Page Muslims United discussed whether Muslims would be boycotting
elections. The Black-targeted pages discussed Black beauty, unity, women, and culture. On
Instagram, the Black-targeted accounts discussed Eric Garner, pointing out that his daughter
was not voting in the election. They lobbied for votes for Jill Stein, and discussed kneeling,
the National Anthem, and police brutality. And they repeatedly discussed boycotting…as @blackstagram__ put it, “Think twice before you vote. All I wanna say is that they don’t reallycare about us. #Blacktivist #hotnews”

November 8-9th
One data set was in GMT+0, so citing U.S. Election Day content involves two dates.

As voter returns began to come in, the IRA joined millions of Americans in tweeting them out. The
highest engagements were again by @TEN_GOP and @Pamela_Moore13 (who complained about
voter fraud as states reported results). They called out mainstream media as being the real loser
of the night. Prolific troll account @CovefefeNationUS gleefully predicted that Hillary Clinton wasgoing to prison, and accused CNN of being biased (demanded a boycott). The troll account @racist_paul, popped up again, with dozens of tweets harassing a variety of Jewish reporters andother (real) Twitter users with content about how Trump was “warming up an oven” for them.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

91

El e cti o n W e e k 2 0 1 6Black Twitter personas @BleepThePolice and @BlackToLive became far more politicaland wondered how Trump had won. @Crystal1Johnson account immediately called for a#NotMyPresident protest (that the IRA promoted on its Facebook Events). Aside from theincorporation of #NotMyPresident, however, much of the Black-targeted content remained
the same: stories of police brutality and a reiteration that the country was not for Black
people. Some of the accounts merged the two themes: @BlackToLive’s Twitter accountposted “I don’t wanna hear from anyone that this country is not racist. Don’t you even dare.
#PresidentElectTrump”. (@williams.and.kalvin_, interestingly, reposted a religious meme by
IRA Right-targeted Instagram account @army_of_ jesus_)And, of course, the hashtag gamer accounts came out: #CelebrateTrumpWith closed out theevening, with trolls posting pro as well as anti-Trump responses.
Ultimately, the trolls closed out Election Week by extending their election-related politicaloutrage playbook to the Black and Left audiences, as those groups now had a new
grievance to be upset about. However, they kept pushing angry narratives to their Right-wingaudiences…the narratives just evolved.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

92

El e cti o n W e e k 2 0 1 6

Post-Election 2016 Activity: 2017
Instagram Ramp-Up
Following Election Day, the Right-targetingnarratives about how voter fraud would deliver theelection to Hillary Clinton immediately shifted tonarratives claiming that President Trump would
have won the popular vote, too, were it not for voter
fraud. This narrative and related memes appearedon four different Instagram accounts and two
Facebook Pages on November 10th, generating 7,117
engagements; on Nov 28th, the narrative was updated to state that President-elect Trump himself
had tweeted that he would have won the popular vote were it not for illegal voters (this tweet
attracted a substantial amount of controversy in the press at the time because the claim wasmade absent any supporting evidence).
The Left-targeted narratives, meanwhile, immediately called for protests of the concept of
the electoral college. There were extremely immediate posts that attempted to pre-empt
calls for impeachment – an interesting choice, given that the President had not yet been
inaugurated – by framing Vice President Mike Pence as an even worse option. A post byLGBT United on November 10th read, “In case anyone forgot, Mike Pence in the White House
would mean disaster for queer people!! I heavily disagree with his policies regarding churchand state and his lgbtq policy. I see alot of leftist calling for impeachment or assassination on
trump but truely Trump is worlds better than Pence when talking about equal rights for all…”

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

93El e cti o n W e e k 2 0 1 6

And, as investigative journalists began to uncover their operation, the IRA narratives began toactively mock the idea that Russians had interfered in the U.S. election (as described earlier
in this report). Facebook and Instagram accounts targeted James Comey after President
Trump fired him, and targeted the Robert Mueller investigation.

While the evidence of Russian interference was beginning to be made public, Facebook
appears to have begun to moderate at least one of the pages, although it is unclear exactly
why. At least one moderation-related post alludes to a page being accused of a Community
Standards violation. Dissatisfaction about being moderated appears to have led the IRA to
spread the narrative that Facebook was censoring conservative voices as early as March 2017.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

94

El e cti o n W e e k 2 0 1 6

Despite the moderation challenges on Facebook, the IRA ramped up activity on Instagram in 2017.

Posts per week on social platforms, 2016-2018. Facebook is in blue, Instagram in
red, Twitter in green.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

95

Ongoing Efforts

Ongoing Effort: Live Accounts Remain
Although the platforms have been making astronger effort toward uncovering influence
operations, the data sets provided by
Facebook and Twitter led to the discoveryof additional IRA pages.
For example, an Arabic-English bilingual
Facebook Page called “Friends of Russia”
was discovered through the tweets of IRAattributed Twitter account @AsdiqaRussiya(roughly translated as “Friends of Russia”).
AsdiqaRussiya’s tweets had been embedded
in Russian-language propaganda articles – anexample of IRA’s ongoing history of inwardlyfocused propagandizing to the Russian people.
One of these articles linked to a video on the Friends of Russia Facebook page. The page last
updated on May 12, 2018 and had approximately 9,600 Likes.
Similarly, an analysis of the profile URLs in the Twitter data set revealed active profiles on
Gab.ai, VKontakte, and LiveJournal. In addition, some of the IRA accounts appear to havebeen bots that were purchased or repurposed from several different existing botnets. As weT H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

96

Ong o ing E f f o rts

looked back at the account behavior over time, we found tweet histories in 2013 that revealedcommercial spam content. Bots from the same botnets appear to still be active and are
relatively easy to find with the Twitter public API. These accounts, for example, have similar
patterns to bots that are in the provided data:






https://twitter.com/Elsa_Aben - dormant
https://twitter.com/Florrie_Schamel - dormant
https://twitter.com/fitness_craving - active
https://twitter.com/besttattooing - active
https://twitter.com/becca51178 - active

Although these bots are not doing anything malicious now, they are available to be
repurposed for future malicious use.

Ongoing Effort: The Broader Propaganda Ecosystem
If the Alphabet data set was correctly attributed, there are dozens of Russian-linked
propaganda pages promoted by IRA-linked ad accounts; at a minimum, they are promotedby FAN. As noted above in the Ad Targeting section of this report, one of the largest of thesewas GI Analytics. Purportedly a global analysis property with an international masthead,
GI Analytics was active from 2015 until Aug 31, 2016, when editor Joshua Tartakovsky
announced it was “on hold”. The site’s About page positions it as a voice of integrity in
opposition to mainstream media: “We are in a desperate need of truth and of hard-cutting
analysis, especially now, when we are being betrayed by our elected representatives and thecorporate media.”
The site’s content is repurposed on other properties around the web, including Russia News
Now, Russia Insider, The Russophile, and NovoRussia Today. It has links to other known
Russian propaganda sites by way of authors, AdWords accounts, and repurposed content.
The masthead of authors shows several Americans. Several of these USA-affiliated authors,such as Joaquin Flores, have personal blogs or appointments at other Russia-linked thinktanks. Others, such as Stefan Paraber, have almost no social presence aside from theirwriting on the site. It is unclear whether they knew they were writing for an IRA entity. The
Twitter account still exists, dormant but visible. GI Analytics also appears in the YouTube
data set provided to SSCI, with a channel that promoted the account ‘SyrianGirlPartisan’.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

97

Ong o ing E f f o rts

Propaganda and content from IRA-linked think tank GI Analytics remains prevalent on
Facebook’s platform, although the GI Analytics Facebook page itself was taken down while
our investigation was underway; it had approximately 7000 likes and was taken downsometime after May 30, 2018.
It is unclear whether still-active Facebook pages (for example, “Russia Truth”) and Groups
that regularly shared GI Analytics content did so knowingly, or whether those pages havebeen investigated for possible IRA links. Since GI Analytics contributors include Americans, it
is unclear whether they knew who they were writing for. Several individuals on the mastheadwere recently identified as authors for newly-launched IRA propaganda property USAReally;a few contribute to known Russian propaganda outlets and think tanks such as Katehon.

Global Independent
Analytics

USAReally.com

Contributor
Contributor

Joaquin Flores

Alexander Azadgan

WriterJoshua Tartakovsky

Contributor

globalresearch.ca

Contributor

Staff Writer

Director

Contributor
WriterMichael Cossudovsky
Contributor

Contributor
Contributor

Contributor
Director

WriterContributor
Researcher

Contributor

Primary contributor(Along with Leonid
Savin, Dugin, etc.)

Adam
Garriesyncreticstudies.com

Paul Antonopoulos

Contributor
Contributor

Google Analytics

Alexander
Mercouris

IP Address: 104.25.54.34(8 domains hosted)

ID: UA-66421322

Contributor

Contributor

Primary
editorContributor

Contributor

fort-russ.com

Contributor

Oriental
ReviewkatehonRussian IP
address178.250.240.37

eurasianaffairs.net

RussiaInsider

ua-114398561 (used by 1 domain)

Google Adsense ID
Mint PressNews

The Duran

Google Adsense ID

Contributor

Google Adsense ID

Contributor

pub-2498190524881304(rebranded
multipolarity)

Contributor

Google Analytics ID

pub-2498190524881304(used by 1 domain)

geopolitica.ru

Contributor

almasdernews.com

multipolarity.ru± 2 years
later

Leith
Fadel

pub-3443918307802676

The Saker

4pt.suT H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

98

In Conclusion

This investigation of the Internet Research Agency’s activities and tactics highlights complex
technological, social, and cognitive vulnerabilities.
Throughout its multi-year effort, the Internet Research Agency exploited divisions in oursociety by leveraging vulnerabilities in our information ecosystem. They exploited social
unrest and human cognitive biases. The divisive propaganda Russia used to influence
American thought and steer conversations for over three years wasn’t always objectively false.
The content designed to reinforce in-group dynamics would likely have offended outsiders
who saw it, but the vast majority wasn’t hate speech. Much of it wasn’t even particularly
objectionable. But it was absolutely intended to reinforce tribalism, to polarize and divide,and to normalize points of view strategically advantageous to the Russian government on
everything from social issues to political candidates. It was designed to exploit societal
fractures, blur the lines between reality and fiction, erode our trust in media entities and theinformation environment, in government, in each other, and in democracy itself. This campaign
pursued all of those objectives with innovative skill, scope, and precision.
With at least some of the Russian government’s goals achieved in the face of little diplomaticor other pushback, it appears likely that the United States will continue to face Russianinterference for the foreseeable future; as the September 2018 Department of Justiceindictment makes clear, they continued to budget for ongoing operations. The September
2018 DoJ indictment also illustrates that Americans were systematically developed as assets
by the IRA. Most, it appears, were recruited via Facebook Messenger, tapped to perform onbehalf of an entity that misrepresented itself as someone just like them. Now that automation

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

99

I n C o ncl u si o ntechniques (e.g. bots) are better policed, the near future will be a return to the past: we’ll
see increased human-exploitation tradecraft and narrative laundering. We should certainly
expect to see recruitment, manipulation, and influence attempts targeting the 2020 election,
including the inauthentic amplification of otherwise legitimate American narratives, as well asa focus on smaller/secondary platforms and peer-to-peer messaging services.
Over the past five years, disinformation has evolved from a nuisance into high-stakes information
war. Our frameworks for dealing with it, however, remain the same -- we discuss countermessaging and counter-narratives, falling into the trap of treating this as a problem of false stories.
Our deeply-felt national scruples about misidentifying a fake account or inadvertently silencing
someone, however briefly, create a welcoming environment for malign groups who masquerade
as Americans or who game algorithms. Ironically even Internet Research Agency trolls laid claim
to these principles, complaining publicly about being censored when Facebook moderated orbanned them. When tech platforms or regulators strive to take meaningful action to suppress
abuse of their platforms and our American polity, there are waves of outrage over censorship.
We have conversations about whether or not bots have the right to free speech, we respect
the privacy of fake people, and we hold Congressional hearings to debate whether YouTube
personalities have been unfairly downranked. More authoritarian regimes, by contrast, would
simply selectively firewall the internet. It is precisely our commitment to democratic principles
that puts us at an asymmetric disadvantage against an adversary who enthusiastically engages incensorship, manipulation, and suppression internally.

Looking Forward
There remains much to be done. With regard to the Internet Research Agency specifically,further investigation of subscription and engagement pathways is needed; and only theplatforms currently have that data. Understanding the reactions of targeted Americans, andattempting to gauge the impact that the repeated exposure to this propaganda had, is also a
key area for ongoing investigation; only the platforms have the comment data. We hope that
platforms will provide more data that can speak to the impact and uptake among targetedcommunities.
More broadly, we must promote a multi-stakeholder model in which researchers, techplatforms, and government work together to detect foreign influence operations thatT H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

100

I n C o ncl u si o n

attempt to undercut public discourse and democracy. The United States government has
departments with decades of experience managing foreign propaganda and espionage.
But because these influence operations are happening on private social platforms, there
has been minimal information sharing. Robust collaboration between government agencies,
platforms, and private companies is key to combatting this threat.
Finally, we hope that additional sections of this data set will be released to the public for further
research. There are millions of posts, hours of video, and hundreds of thousands of memes, andadditional eyes will undoubtedly continue to provide valuable insights into this operation.
We hope that our work has resulted in a clearer picture for policymakers, platforms, and the
public alike and thank the Senate Select Committee on Intelligence for the opportunity to serve.

T H E TA C T I C S & T R O P E S O F T H E I N T E R N E T R E S E A R C H A G E N C Y

101