Pro-Kremlin Trolls Repeatedly Infiltrate
September 6, 2021
major influence operation is systematically manipulating Western media to spread
propaganda and disinformation that supports Kremlin interests, a report from
Cardiff University concludes.
Researchers from the Crime and Security Research Institute have found evidence
that 32 prominent media outlets across 16 countries have been targeted via their
reader comments sections.
Websites which have been repeatedly subjected to these activities include: The
Daily Mail; Daily Express and The Times in the UK; America’s Fox News and
Washington Post; Le Figaro in France; Der Spiegel and Die Welt in Germany; and
Italy’s La Stampa.
The team identified 242 stories where provocative pro-Russian or anti-Western
statements were posted in reaction to articles of relevance to Russia. These
comments were then fed back to a range of Russian-language media outlets who
used them as the basis of stories about politically controversial events.
They were also reported on by other ‘fringe media’ and websites with track
records of spreading disinformation and propaganda, and some that have been
linked by Western security services to Russian intelligence agencies.
This influence operation was uncovered as part of research into online
activities amid tensions between Ukraine and Russia earlier this year. But
researchers believe the use of these tactics has been escalating since 2018.
Director of the Crime and Security Research Institute Professor Martin Innes,
who heads the Open Source Communications Analytics Research (OSCAR) programme
said: “This influence campaign is especially significant due to its
international scale and its sophisticated manipulation of a wide range of media
outlets, websites and social media in a co-ordinated way. By hijacking the
comments sections of Western media brands, it has been able to present its
propaganda as indicative of mainstream opinion.
“The Western media outlets we investigated are especially vulnerable to this
kind of manipulation, with no security measures in place to prevent, deter or
detect this kind of activity. Trolls have been able to easily switch between
personas and identities, which is something the technology actually enables.”
For their analysis, researchers employed data science pattern recognition and
detection techniques to reader comments, which illuminated a series of unusual
behaviours associated with some accounts posting pro-Kremlin content. These
multiple inauthenticity and co-ordination signals, although individually
relatively ‘weak’, when aggregated together, suggest that the commenting
activity may be orchestrated.
Some of the commenting platforms allow other users to vote on posts. Pro-Kremlin
comments repeatedly received an unusually high number and proportion of
‘up-votes’ when compared with typical messages by ‘normal’ users.
Detailed forensic behavioural analysis of account profiles posting pro-Kremlin
comments identifies that some of these users are repeatedly changing their
personas and locations; one account of interest had 69 location changes and 549
changes of name since its creation in June last year.
The report says there was also evidence of co-ordination between Russian
state-owned media and outlets linked to the non-state Patriot Media Group, which
were observing and drawing upon these reader comments.
Subsequent articles, using headlines such as “Daily Mail readers say…” and
“Readers of Der Spiegel think…” were published to suggest there is extensive
support among Western citizens for Russia or President Putin. These
Russian-language stories also spread to audiences in Central and Eastern Europe,
most prominently in Bulgaria.
Innes said: “As mainstream social media platforms have become more alert to the
risks of foreign state influence operations, so disinformation actors and
propagandists have been seeking new vulnerabilities in the media ecosystem to
exploit. By adopting a ‘full spectrum’ media strategy that blends together
information from social and mainstream media outlets, this sophisticated
campaign has had the potential to shape the thoughts, emotions and behaviour of
several diverse international audiences in relation to high-profile media
“Most importantly, the particular tactics and techniques used to ‘hack’ the
comments function in the media ecosystem make it almost impossible to attribute
responsibility for the pro-Kremlin trolling behaviour on the basis of publicly
available open-source data. It is therefore vital that media companies running
participatory websites are more transparent about how they are tackling
disinformation and more proactive in preventing it.”
The OSCAR programme at Cardiff University’s Crime and Security Research
Institute is a large-scale long-term research programme designed to better
understand the causes and consequences of disinformation, which has generated a
number of peer-reviewed publications. Part of this work has been funded by UK
Government and it was via this support that researchers identified the influence
operation processes described in detail in this latest report.