Inside Russia’s fake news HQ

Trolls tweeted disinformation long before the US election.

The Kremlin in Moscow. Picture: istock

Alice Norton posted an emergency message on a cooking-website forum on Thanksgiving 2015: Her entire family had severe food poisoning after buying a turkey from Walmart.

“My son Robert got in the hospital and he’s still there,” wrote Norton, who had described herself as a 31-year-old New York City mother of two. “I don’t know what to do!”

Within hours, Twitter users repeated the claim thousands of times, and a news story was published saying 200 people were in critical condition after eating tainted turkey.

The catch? No outbreak of food poisoning matching this description occurred, according to New York City health officials.

A Walmart spokesman said the company had spotted the posts but determined they were a hoax and didn’t investigate their origin further.

Many of the claims came from accounts linked to a pro-Kremlin propaganda agency charged by Special Counsel Robert Mueller’s office last week for meddling in US politics. Security experts now believe the early posts, and others like them, may have been practice for a bigger target: the 2016 US election.

While it is impossible to be sure what was in the minds of Russians tweeting false stories in 2014 and 2015 — which also included tales of contaminated water, terrorist attacks and a chemical-plant explosion — these experts say it is as if the Russians were testing to see how much they could get Americans to believe.

“Well before it was focused on the 2016 election, what Russia was doing was stockpiling capabilities,” said Keir Giles, a specialist in Russian information warfare at the Chatham House think tank in London. “They were doing test runs of ‘what happens if we launch this kind of Twitter attack or attempt to start this kind of panic’. Sit back, refine your results, see what works and what doesn’t.”

Nearly 100 Twitter users who linked to Norton’s Thanksgiving-turkey post were among 2700-plus accounts Twitter deactivated late last year because they were controlled by the Internet Research Agency, the St Petersburg-based outfit the Justice Department says spread Russian propaganda across the internet.

Twitter last month said it deactivated more than 1000 additional such accounts as it and other tech firms continue to grapple with the exploitation of their platforms.

An analysis of 221,641 tweets The Wall Street Journal was able to find from the now-blocked users shows that before their election activity, they attempted to incite chaos, fear and outrage about fictitious events, with success that at times spilled into the real world.

The Journal’s analysis included messages posted by 2170 Russian-controlled accounts. Sometimes they worked alone, spreading news, chatting about politics or popular culture and retweeting others. Other times, dozens of the accounts, even hundreds, flocked around a single message.

Taken together, the activity — much of which has been wiped from the internet — presents a rare perspective on an external effort to manipulate American minds. Those behind the efforts took advantage of an array of social media platforms, broadcasters, fake-news websites, Wikipedia and, in one case, a federal regulator. Many of the users who took part in the early campaigns went on to participate in the US presidential election attack, mostly supporting Donald Trump and Bernie Sanders while disparaging Hillary Clinton and Jeb Bush, as early as the middle of 2015.

Top US intelligence officials said last week they expected Russians to interfere again in the midterm elections. The US charged more than a dozen Russian nationals and organisations last week with engaging in a widespread effort to interfere in US politics. The efforts date to mid-2014, the US government says, just as the disinformation campaign was getting under way. Russia has denied it meddled in the 2016 election.

Some Twitter users who appeared to work in tandem with the now-closed accounts remained active this month, the Journal found.

Meanwhile, although Twitter, Facebook and Google have faced congressional grilling over the misuse of their platforms, some other social media firms and websites have faced no public scrutiny despite having users who also appear to have worked with the Russia-linked accounts shut down by Twitter.

“Each day it just gets bigger and bigger and bigger,” says Clint Watts, a former FBI counter-terrorism expert who studies Russian propaganda at the Foreign Policy Research Institute, a Pennsylvania-based think tank.

A spokeswoman for Twitter referred to recent congressional testimony and blog posts in which the social media firm said it was now blocking more than 500,000 “suspicious log-ins” daily. The spokeswoman declined to make exec­utives available to discuss the incidents described in this article.

Norton, the cooking website user who said her family got food poisoning from a Thanksgiving turkey, didn’t respond to an email sent to the address she used to sign up at the website.

The Journal’s data shows a small number of Russian tweets before 2014, but it was a deadly plane crash that year that brought out the strongest early response.

On July 17, 2014, an anti-aircraft missile shot down Malaysia Airlines Flight 17 over Ukraine, killing all 298 passengers and crew.

While the Obama administration quickly fingered Russian-backed insurgents in eastern Ukraine, the Kremlin suggested it was Ukrainian forces that downed the airliner.

A safety board in The Netherlands, which lost many citizens in the crash, concluded the plane was shot down by a Russian-made missile fired from eastern Ukraine.

Russian-linked Twitter users at first tweeted news of the tragedy, but within hours they were raising questions about who was responsible. By the next morning, they had latched on to a Cyrillic hashtag blaming the Ukrainian government: it translated to “Kiev shot down the airliner”.

In all, the Journal found 78 now-deactivated Twitter accounts that participated in the Malaysian Flight 17 campaign. They tweeted about it for months.

Not long after the airliner disaster, Russian-linked accounts began turning their attention to the US.

Beginning on September 11, 2014, at least 141 now-blocked accounts falsely claimed a chemical plant in Louisiana had exploded. Many went further, saying it was an attack by Islamic State.

The claims of terrorism continued in their next assault, the Journal’s analysis shows.

On Christmas Eve 2014, hackers calling themselves the CyberCaliphate and claiming Islamic State affiliation defaced an article on the Albuquerque Journal’s website with an ominous message: “You’ll see no mercy infidels. We are already here, we are in your PCs, in each house, in each office. With Allah’s permission we begin with Albuquerque.”

The next day, Russian-oper­ated Twitter accounts sprang into action, spreading and distorting news of the hack, whose perpetrators, intelligence experts now believe, may be connected to the Kremlin.

Some of the accounts treated it as a full-blown terrorist incident. “ISIS terrorists live among us!” two accounts said.

They blamed the US government for not stopping the hackers. “The ISIS hacked Albuquerque Journal website! It’s all Obama’s fault!” a now-suspended user named Andrea Macchaell wrote, using the hashtags #ImmigrationAction and #ISISattacks.

The self-styled CyberCaliphate, which went on to claim credit for hacking other government and media targets, has since been suspected by security researchers of being linked to Fancy Bear, the Russian military intelligence group that US officials say hacked the email accounts of Democratic Party officials and political figures in early 2016 and released the material online.

On March 10, 2015, dozens of Twitter users with accounts since deactivated by Twitter spread word that a phosphorus leak had tainted the water supply near the tiny town of American Falls, Idaho.

That same day, an article posted on CNN’s citizen-journalism website iReport, showing people in biohazard suits, said “nuclear phosphorus wastes” had poisoned the water in a nearby reservoir and described the incident as “the time bomb which exploded”.

A spokesman for the Idaho Department of Environmental Quality said the agency was “very much aware” of the poisoned-water claims, which were “certainly false”.

Many of the 50 Russia-linked Twitter accounts that spread the story used nearly identical language. A constant theme among their tweets: the fault lay with the US government.

Twenty-five other Twitter accounts that talked about the supposed leak haven’t been publicly identified as Russian-linked. Some were still on the platform this month, the Journal found.

“Looks like we are very vulnerable and unprotected!” wrote one of those, a user called Edwin Garret, who posted at least 30 messages about it. “Govt wants to poison native Americans.”

This account last posted a message on July 25, 2015, suggesting a slogan for Trump’s newly announced presidential campaign: “Hillary, you are fired!” This month, after the Journal asked Twitter about the user’s activity, its profile page displayed a new message: “Caution: This account is temporarily restricted … because there has been some unusual activity.”

Meanwhile, the CNN iReport story of tainted Idaho water — on a page showing the platform’s logo and saying the article was “not verified by CNN” — was still accessible this month.

A CNN spokesman said the article received “about two dozen total views” and the company “sunset” the user-generated iReport platform in 2015, partly over concerns about hoaxes. Its articles remain accessible online.

By late 2015, the Russian users had posted more than 2.4 million tweets and retweets, the Journal’s data show, though none are now visible on Twitter.

Late 2015 was when the Russian operators created most of the Twitter personas who went on to accumulate tens of thousands of followers and engage vocally in US politics — and with campaign officials. At least 121 of the now-deactivated accounts posted messages about Republican and Democratic primary debates in November and December 2015.

As that year’s holiday season began, they also embarked on one of their last apparent test runs before the fully fledged US election assault.

The day after Thanksgiving, the US Agriculture Department received a complaint alleging a New Yorker had been hospitalised by tainted turkey.

The complaint couldn’t be investigated because its contact information was invalid, agency records show.

A spokesman for the New York City Department of Health and Mental Hygiene said the agency had no record of any food-poisoning episode matching the details in the accounts.

The manager of the discusscooking.com website described Alice Norton’s account as consistent with what it had seen with scammers in the past and said it had no further posting from the account.

The onslaught of food-poisoning claims was a shock to Brock Stein, an executive of a turkey company the hoaxers said supplied tainted turkey to Walmart. Stein says the company, Pennsylvania-based Koch Turkey Farms, doesn’t sell turkey to Walmart. He says the turkey company investigated the incident and quickly determined it was a fake.

At least 29 of the Twitter users who repeated the food-poisoning claims appeared to remain active on Twitter as of last month.

One of them, calling herself Hailey Wilson and saying she lived in New York, posted 21 messages about the outbreak in 2015. The account posted a scattering of pictures showing a young blonde woman in various poses, including a profile photo in a green field with a dog.

The real person in the photos, the Journal found, is 25-year-old Rebecca James, a project manager living in Washington, DC. Reached by the Journal, James says she believes the five pictures used by the “Hailey Wilson” account were stolen from her Facebook account.

She says the profile photo was taken on an apple-picking trip with her family and dog, a shiba inu named Sushi, adding: “Very clever, the way they’re doing it, taking the public pieces of a Facebook profile.”

After speaking with the Journal, James got in touch with Twitter, which wrote back: “Thank you for contacting us about this issue. We have reviewed the account you reported and have locked it because we found it to be in violation of the Twitter rules.”

The Wall Street Journal