Alternative War: Unabridged

by J. J. Patrick

  26. According to the CIA, the Kremlin staffs RT and closely supervises RT's coverage, recruiting people who can convey Russian strategic messaging because of their ideological beliefs. "The head of RT's Arabic-language service, Aydar Aganin, was rotated from the diplomatic service to manage RT's Arabic-language expansion, suggesting a close relationship between RT and Russia's foreign policy apparatus," the report states.

  27. "RT's London Bureau is managed by Darya Pushkova, the daughter of Aleksey Pushkov, the current chair of the Duma Russian Foreign Affairs Committee and a former Gorbachev speechwriter," the report also states.

  28. "According to Simonyan, the Russian Government sets rating and viewership requirements for RT and, since RT receives budget from the state, it must complete tasks given by the state," the report adds.

  29. "According to Nikolov, RT news stories are written and edited "to become news" exclusively in RT's Moscow office," the CIA also state.

  30. The Annex concludes that "RT hires or makes contractual agreements with Westerners304 with views that fit its agenda and airs them on RT."

  31. According to the CIA, "Simonyan said on the pro-Kremlin show "Minaev Live" that RT has enough audience and money to be able to choose its hosts, and it chooses the hosts that "think like us," "are interested in working in the anti-mainstream," and defend RT's beliefs on social media."

  32. Interestingly, the report adds that "some hosts and journalists do not present themselves as associated with RT when interviewing people, and many of them have affiliations to other media and activist organizations."

  33. As the US Senate inquiry has continued, RT has been declared a state actor and even Twitter has off-boarded their advertising. The US Department of Justice also requested that RT register under the Foreign Agents Registration Act.

  34. It is known that, through RT, several thousands of pounds of unrinsed Kremlin money has even directly entered UK Parliamentary records and is a cross party issue305.

  35. A number of disinformation channels beyond RT are operating in the UK, including Breitbart, Westmonster, and InfoWars.

  36. It is quite clear that Disinformation forms part of the live hybrid conflict which the UK has become engaged in, and that RT is a state actor within this. Their position, to repeat it, is clear: "RT's goal is "to make an alternative channel that shares information unavailable elsewhere in order to "conquer the audience" and expose it to Russian state messaging.”

  37. The purpose of Fake News, as defined at point 17, is unambiguous and the impact is visible across the globe and extends to other actors – including Julian Assange who has been actively supporting Russian efforts in Spain, focused on Catalonia, where he was the central hub of externally focused disinformation campaigning306

  Recommendation 3:

  2.1 The definition of Fake News is accepted as outlined at point 17 and recognised as being capable of influencing public opinion and discourse.

  2.2 It is accepted as a national position that fake news is recognised as a weaponised element of military doctrine.

  2.3 That fake news is specifically taken into the considerations around and definitions required under recommendation 1.

  2.4 It is specifically recognised that some voices are harnessed within this doctrine without their full understanding of its nature and function and this needs to be addressed.

  2.5 RT and other known disinformation channels must be officially recognised as such, where necessary they must be clearly declared as state actors and, if necessary, their broadcasting and publication rights reviewed. Though it must be understood there will be claims this is an attack on free speech and any such action must be properly and technically exercised under the rules surrounding matters of national security and morals.

  Impact And Scale Of Social Media, Online Platforms, And Fake News In The UK:

  38. Through experiments with Social Media, investigating Network Centrality, organic reach, the use of hashtags, and paid advertising, it has been established than one Twitter account with less than 400 followers has the capability of pushing a carefully designed psychographic message into a specific network of people, achieving a reach of over 16,000 people on a nominal budget of £20.00307

  39. This means, by enhancing the targeting data and using a budget of £100,000 a single twitter account has the potential to reach approximately 85 million people.

  40. Within the same experiment, it was established that an “army” of 30,000 twitter bots (automated accounts) had the potential to reach millions of people308.

  40.1 If we were to hypothesise that Twitter hosts 30,000 co-ordinated troll accounts, each with an Organic Reach of 100 impressions and 5 engagements per tweet, this gives us a total, organic reach of 3,000,000 impressions and 150,000 engagements on each single message they push.

  40.2 Applying a Hamilton Score (an extension of reach by using trending hashtags) to this means a troll army of 30,000 can, in fact, potentially reach 9,000,000 impressions and 450,000 engagements with every single message they tweet.

  40.3. Trolls are not just tweeting once a day, but at least five times an hour. Over twenty-four hours, an army of trolls 30,000 strong could have the capability of reaching across a network and generating 1.08 billion impressions and 54 million engagements per day.

  41. The UK is faced with multifaceted issues relating not only to platforms providing fake news for circulation, but by a complex network309 of domestic and foreign social media accounts, some of which are automated and some of which are operated by real people. These issues include the 13,000 Twitter accounts which posted thousands of messages about Brexit before disappearing after the vote, and pro-Kremlin managed accounts claiming to be British such as David Jones, exposed by The Times.

  42. We also know this complexity is added to by the operation of Troll Farms, such as the Internet Research Agency in St Petersburg, and by the black market of propaganda operations for sale on the internet and the dark web310.

  43. However, before the Olgino list was published by the US Senate, by shifting analysis away from simple mentions and retweets and looking at what other topics were being pushed in tandem with Brexit Leave messages - what's called co-concurrence – network analysis shows a vote-centred conspiracy theory about using pens was being pushed by accounts which were also driving the tags #Ukraine, #Syria, #Aleppo, #IIS, and #VoteLeave. The story gained such traction it had to be covered by the BBC and other outlets. An initial analysis showed how the trolls and bots were specifically redeployed from regular Russian focus areas Ukraine, Syria, ISIS, and Aleppo to not only #UsePens but #VoteLeave too, with a huge push around referendum day, dwarfing all other bot traffic and after which the majority simply disappeared. This was the first clear example of fake news and social media operating together, and of Russia being actively involved.

  44. Taking this method of analysis forwards allowed a broader analysis of the interaction between the currently active Russian botnet operating in America and Fake News surrounding Uranium One311.

  45. In turn this led to a surprising finding about the Russian botnets and fake news surrounding both Trump and Brexit: they were operating in Tandem312 and the identified a number of the deleted accounts academics had discovered.

  46. The most startling finding in respect of Fake News and botnet traffic surrounding Brexit was that while domestically it centred around Breitbart and InfoWars, internationally, the bulk of Brexit disinformation was being pushed from the Russian botnet operating in the US around InfoWars – who, in turn, were taking content from RT.

  47. Once the US Senate published the Olgino Troll list, this was dip sampled and cross referenced against the previous anaylsis, and led to the exposure of a significant UK network313 of social media accounts pushing Russian messaging which is still active now314.

  48. In one round of analysis alone, 8,483 accounts were found to be mutually connected on 10,326 points relating to follower and following data. One of the top 10 aliases for incoming links was established Kr
emlin troll David Jones (@DavidJoBrexit). In a further analysis, 2534 links were discovered between 9,320 accounts, with both David Jones and the Internet Research Agency itself featuring in the top 10 for incoming links. This led into further analysis of freshly identified accounts.

  49. One of the key identifiers across this network of active trolls is their affection towards all things patriotic, including poppies. A simple, visual dupe. And one which was pervasive. There is no silver bullet for the identification of troll accounts on social media. In fact, the process of identifying them and making a decision about what they are is a hugely complex matter. This is a problem, because we aren't just dealing with automated bots. In one case, an article315 outlining the difficulties of identifying trolls became the subject of fake news itself, seized upon by RT and the Russian embassy316 in order to discredit any work done to expose Russia's operation. This sits well within the parameters of established doctrine, which dictates all media should be discredited.

  50. By dividing the network317 for analysis we were able to establish that 50% of pro-leave accounts connected to the others had been deleted, while the others were still live and 20% of them dormant - having not tweeted for some time but not having been closed or locked. This is a mutually supported finding from the earlier research, though arrived at very differently. Immediately, this increases the network size at the time of the Brexit vote to around 18,000 locally branded accounts.

  51. By analysing the times of tweets, we were also able to conclude a number of the accounts were, or had been, operating on Moscow office hours. These UK-branded accounts lacked any real finesse, but this is not uncommon among the sock puppets. The social networks themselves do enough to obfuscate the true source of accounts that a little blatancy goes largely unnoticed when combined with scale. It creates an illusion of normality for those interacting with these networks.

  52. At this stage, however, we were presented with a new collection of accounts and a new collection of tweets, which had fallen outside of the intial search parameters: because the accounts were all based in Germany and had only been active on the topic of Brexit on the 23rd of June 2016.

  53. Under various, quite plausible, and less nationalistic guises, these innocuous German accounts held the key to a much broader range of data estimations surrounding Brexit.

  54. The German accounts are all currently dormant, and haven't been used in a tasking process for sometime. Though a small hub of 48 accounts, analysis rapidly expanded their network to a more complete 1,967 users, connected between themselves 2,199 times.

  55. Through a manual check of the accounts, establishing that profile pictures and local geographical photos have actually been lifted from Instgram accounts from Italy to Estonia, a further super-user - based in the Netherlands - was connected to the hub. This expanded this one network to 4,933 accounts, linked together by 5,200 cross-connections. The super-user was identified through the posting of a Russian meme relating to Chess and the collapse of the EU.

  56. The interesting nature of the German hub, which is - with the exception of the super-user - fully automated, is how it looks when you visualise it using a combination of filters on software package GEPHI. It resembles exactly what it is: Bacteria or a virus. An infection aimed purposefully at humans.

  57. While the accounts in the original, small hub are dormant, they are still open to full scrutiny. In the lead up to Brexit they were talking about Turkey and Syria, then afterwards they shifted to other issues before going offline at the end of 2016 - presumably shelved for future use as other accounts got shut down. Suddenly, however, on the 23rd of June 2016 all of these accounts were activated and churned out 630 tweets at a rate of up to 8 tweets a minute.

  58. Their focus on the day of the vote is undeniable even when analysed in the base form of a word cloud. It is clear they had been specifically tasked to target undecided voters and wavering Remainers and they did so using the hashtags #BrexitOrNot and #RemainInEU, among others.

  59. These fake accounts - each of them registered in March or April 2016 and seeded to appear real with photographs and data stolen from every corner of the EU - were specifically deployed on the day of Britain's crucial vote to post meme's attacking the weakest link in the Remain chain, David Cameron.

  60. After the 23rd of June, every single one of the accounts stood down from Brexit and resumed what they had been doing before - sporadic push messaging at points of interest to Russian activity in the world.

  61. Within the larger network, some of the accounts have remained fully active, though - most recently focusing on Catalonia, which is now a confirmed target of Russian hacking and disinformation, intended to destabilise Spain and the EU.

  62. What is staggering is the breadth of this network beyond this one hub. On the day they were all activiated, other unconnected network hubs came on line without warning, communicating one or two replies to specific Brexit tweets in English before going to back to dormant status. These were human operators intervening. These accounts came from everywhere, but the one or two tweets in English would all have been seen by someone in the UK following the hashtags on the day, along with the memes.

  63. Memes during the period were not restricted to Twitter, however. On referendum day even Flickr was busy, in particular around InfoWars linked accounts.

  64. Other dormant Twitter accounts found within the expanded network, and a new hub uncovered during the analysis, were discovered to be promoting pro-leave hashtags which included #IVotedLeave - something which appears to have been highly visible to voters even before the polls closed and may also have been aimed at undecided voters. Again to create an illusion of a bigger crowd, the psychological effects of which do not need explaining.

  65. Combining the identified hubs with the original analysis, they all led straight back to the original 9,320 accounts and reaffirmed the direct Olgino connection. This was no coincidence.

  66. Running the Twitter activity through Indiana University's Truthy tool showed not only how the undecided voters had been hijacked during a very specific time period, but also how this went on to influence conversations around prominent leave MPs in the days following the vote. A lot of debate over the last year has taken place around the "will of the people" and social media sentiment has been referred to throughout by policy makers. This is a broad confirmation of the true scale of the impact of an effective disinformation campaign on social media.

  67. Looking at the data in a second visualisation, around connected discussion topics, how effective the hijack of voters timelines by the Russian network becomes even clearer. Using the available data on the extent of the network, married with the data on tweet frequency, it was possible to start to make some estimates about the true extent of Twitter traffic originating from Russian networks on the day of the vote.

  68. While 50% of the accounts were deleted, we can estimate that one network of 1,967 producing 13 tweets each across the day on the 23rd of June 2016 could have produced 25,571 tweets.

  69. By reversing the deletion of accounts, we can estimate that one network hub could have produced 51,142 tweets over the course of the day.

  70. We know however we are looking at a network, as a baseline, of some 15,000 accounts. This means that single network - before account deletions - could have easily produced as many as 195,000 tweets aimed at undecided voters on the 23rd of June 2016. This would take the Russian network traffic up to a fifth of the twitter activity on the key hashtags, and matches the evidence which eventually came out at the US Senate.

  71. However, a growing body of academic research fully supports discoveries made through these journalistic investigations318.

  72. Earlier this year, academic researcher Marco Bastos released a critical piece of work on the Brexit Botnet, identifying thousands of accounts which vanished after the vote. Published in Social Science Computer Review319, Bastos first outlines the definition of a 'sock puppet' - what we commonly refer to as bots or trolls: "A sock puppet account
is a false online identity used to voice opinions and manipulate public opinion while pretending to be another person. The term draws from the manipulation of hand puppets using a sock and refers to the remote management of online identities to spread misinformation, promote the work of one individual, endorse a given opinion, target individuals, and challenge a community of users."

  73. Starting with an analysis of almost 800,000 users who had tweeted on either side of the Brexit debate before the vote, the researchers managed to identify location data in only 60% of cases. Of the 482,000 accounts they could successfully geo-locate, only 30,122 users were identified as based in the UK, with the researchers noting it was: "a smaller population than the set of 40,031 accounts that have been deactivated, removed, blocked, set to private, or whose username was altered after the referendum."

  74. Breaking the group of 40,031 down, they identified 26,358 accounts had changed their identity after the vote and 13,493 had been deleted altogether. They did, however, note a clear relationship between the repurposed and deleted accounts in the way they had amplified each other, and specifically recorded that a much higher proportion (37%) of their content showed "notable support for the Leave campaign."

  75. This is also supported by new research from Swansea University320 which identifies potentially 150,000 Russian-based Twitter accounts tweeting tens of thousands of messages on the day of the Brexit vote, having shifted focus from other topics such as Ukraine.

  76. One of the researchers; Tho Pham from Swansea University spoke to The Times saying: “the main conclusion is that bots were used on purpose and had influence”. The research looked at 156,252 Russian accounts that mentioned #Brexit, including one, Svetal1972 which posted 92 tweets between June 20 and 24, including one calling for Britain to “make June the 23rd our Independence Day”.

  77. The same researchers expanded their parameters and have subsequently found the same botnet sent 400,000 messages relating to Scotland's independence referendum321. News which came out after Russia had tried to discredit the article centred around Scottish trolls pushing Kremlin messaging cited at point 49.