Skip to content
Naked Security Naked Security

Twitter publishes data on Iranian and Russian troll farms

Over 1m tweets show that we're suckers for funny/sarcastic/edgy, not so much for blah-blah-blah “news” spreaders.

A few weeks ahead of mid-term elections in the US, as social media platforms try to plug leaks that let in waves of meddling and propaganda that soaked the country in 2016, Twitter on Wednesday released all the tweets, images and videos it believes have been planted by “state-backed information operations.”
In other words, Russian and Iranian troll farms.
Researchers can get the massive datasets at Twitter’s Election Integrity hub.
The two datasets comprise more than 10 million public, non-deleted tweets, two million images and videos, and thousands of accounts linked to operatives based in Russia and Iran. Many of the accounts have previously been reported.
The Russia-linked dataset contains accounts created by the Russian government-linked propaganda factory known as the Internet Research Agency (IRA).
It also contains a lot more personality, according to Ben Nimmo, a senior fellow at the Atlantic Council’s Digital Forensic Research Lab (DFRLab) who got a sneak peek at the data before the sets were published.
Both regimes put a huge amount of effort into churning out propaganda: The Iranian troll farm employed 770 users and put out one million tweets, while Russia’s 3,841 accounts posted nine million tweets.
Both campaigns also existed well before the 2016 election, Nimmo told The National. They were initially focused on influencing things at home. For example, analysis of the Iranian trolls shows a focus on discrediting Saudi Arabia… as well as what would become feeble attempts to copy their more adept Russian counterparts.

The Iranian operation was big but it was frankly clumsy. They weren’t very good at what they did. The big difference between the Iranian operation and the Russian one was that the Russian operation was using Twitter and other social media to engage people. The Iranian operation was using social media to message people.

One example of the two regimes’ separate styles was how they targeted highly engaged, highly polarized online communities, especially in the US, Nimmo wrote on Medium.

The Russian operation attempted to infiltrate and polarize them, while the Iranian operation tried to message them.

Recognizing the effectiveness of this tactic should lead us to better fend it off, he said:

Any attempts to increase domestic resilience should prioritize working with such communities.

Nimmo said that about a third of the one million Iranian tweets released by Twitter contained links to a fake Iranian news site that was one of a cluster exposed by FireEye in August. Nimmo refers to AWD News as “part of the Iranian messaging laundromat.”

The datasets Twitter released on Wednesday show that the Iranian troll operation was pretty lackluster in that it was pushing pro-regime narratives without actually engaging people, Nimmo said:

If you compare that with some of the best performing Russia troll accounts, they had real personalities. They were engaging with people, they were funny, they were sarcastic, they were edgy, they appeared to be real people. The Iranian attempt didn’t have personality, they just had content.

For example, Iranian trolls went on and on about Saudi Arabia, Nimmo said. According to his analysis, they mentioned the phrase “Saudi” nearly 90,000 times as they accused the Saudis of committing war crimes.

This was really about promoting Iranian narratives… there were a lot of posts about Yemen and the Syrian conflict.
It was very much ‘the Saudis are bad and they are doing bad things’. It wasn’t a very sophisticated message.

The Russian troll farm had multiple, and evolving, goals, Nimmo said. Meddling in the US election in order to prevent Hillary Clinton’s victory was one of them, but it was also aimed at dividing polarized online communities in the US, unifying support for Russia’s international interests, and breaking down trust in US institutions. But they were nonpartisan when it came to dividing the country. They “tried to inflame everybody, regardless of race, creed, politics, or sexual orientation,” Nimmo said.

On many occasions, they pushed both sides of divisive issues.

IRA tweets illustrate this playing of both sides when it comes to controversial topics such as gun control. These tweets went out after the San Bernardino shootings in 2015:

Mass shooting occurs even in #GunFreeZones so people is the problem not guns #Prayers4California ( @micparrish, December 3, 2015)
mass shooting wont stop until there are #GunFreeZones #Prayers4California (@LazyKStafford, December 3, 2015)
I’m tired of this whole anti gun thing. Saying that Guns cause murders is like saying Steering Wheels cause car wrecks #Prayers4California.

The Russian trolls were opportunists: they promoted anti-Islam hashtags after the Brussels terror attacks, a pro-Leave hashtag on the day of Britain’s Brexit referendum, and leaks targeting French President Emmanuel Macron before his election.
Twitter says it’s clear that troll operations won’t stop. They’ll just adapt and change right along with geopolitical situations evolve and as new technologies emerge.
Twitter will keep “proactively combat[ing] nefarious attempts to undermine its integrity,” it said, and to neutralize such campaigns as “quickly and robustly as technically possible.”


not a fan of either government, but I think the Iranian trolls were right with ‘the Saudis are bad and they are doing bad things’. The Russians were effective with dividing the country – stoking hate every place they could.
I’ve tried to point out to friends that if a meme makes you angry, check it’s source, as most of the time it is exaggerations, half truths, and pure balonium just meant to generate hate and division. Unless it’s promoting (you’re favorite political party) then it must be true, lol


What is not clear is one: can these troll farms actually be correctly traced and second why assume it is a government operation and not paid for by the competing candidates etc?


These trolls could be anyone (spoofs) and paid for by anyone not necessarily their governments?


They could be but in Russia’s case they clearly are. The connections are well established and we even know where the farm is located and who is running it. I could find a zillion links but this one will do. “The Guardian” is not a sensationalist newspaper


who is “we” that know the links? I am not saying the guardian is a sensationalist newspaper, but what I am saying is from this Nerd’s digital view I can look like I am anywhere and anyone….


Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!