Russian operatives sacrifice followers to stay under cover on Facebook


Efforts by Russian influence campaigns to stay undetected on social media ahead of next year’s US elections are undermining ability to gain followers and spread divisive political messages, a senior Facebook executive told Reuters.

Social media users need to stand out from the crowd to gain traction online, but that behaviour helps Facebook and other platforms identify suspicious activity to analyse for signs of foreign involvement, said Nathaniel Gleicher, Facebook head of cyber security policy.

“If you are very, very loud, if you go viral very, very fast that’s exactly the sort of thing that our automated systems will detect and flag. So when actors have really diligent, deliberate and effective operational security it weakens their ability to build an audience,” he said.

Facebook on Monday suspended a network of Instagram accounts it said targeted US users ahead of next year’s presidential poll and were linked to Russia’s Internet Research Agency (IRA), an organisation Washington says Moscow used to meddle in the 2016 US election.

The latest Russian campaign posted on both sides of sensitive topics such as the environment and sexual equality but struggled to attract followers due to attempts to stop the accounts being caught and disabled, said Gleicher.

These included sharing memes and screenshots of other users’ social media posts instead of producing original content in English, likely to avoid making language errors typical of non-native speakers, according to a report by social media analytics firm Graphika.

This technique “gave each asset less of a discernible personality and therefore may have reduced the campaign’s ability to build audiences,” Graphika said.

The IRA-linked network of 50 Instagram accounts had around 246,000 followers, about 60% of which were in the United States, Facebook said.

That compares with charges by US special counsel Robert Mueller that the IRA previously ran social media accounts with hundreds of thousands of followers each. Facebook says up to 126 million Americans may have seen Russian-linked posts aimed at the 2016 election.

Russian catering tycoon Evgeny Prigozhin, accused by US prosecutors of orchestrating IRA activities through Concord Management and Consulting LLC, did not respond to questions sent by Reuters. Attorneys for Concord Management and Consulting LLC did not respond to a request for comment but previously denied wrongdoing.


Facebook, Twitter and Google vowed to step up the fight against political manipulation of their platforms after facing criticism for failing to counter alleged Russian interference in 2016.

Despite increased scrutiny, US officials repeatedly warned of the threat posed by Russia and other countries such as Iran, who they say may still attempt to sway the result of next year’s vote.

Addressing US lawmakers this week, FBI Deputy Assistant Director Nikki Floris said the bureau’s foreign influence task force was briefing candidates and running public information videos to help safeguard the election.

The Department of Homeland Security did not immediately respond to a request for comment.

Moscow and Tehran repeatedly denied allegations of election interference. The Kremlin and Russia’s foreign ministry did not immediately respond to requests for comment.

Russian efforts to avoid detection by the platforms’ security teams have increased since the IRA’s alleged efforts in 2016 were first exposed, said Ben Nimmo, who helped Facebook analyse influence operations and currently runs investigations at Graphika.

A campaign exposed by the Atlantic Council’s Digital Forensic Research Lab in June, which attempted to seed false narratives online such as a bogus plot to assassinate British Prime Minister Boris Johnson, created a new account for almost every single post.

This made it harder to track connections between accounts, Nimmo said, but also meant the posts only reached a small number of people.

Announcing the takedown of a network in July last year, which it said showed “some connections” to previously-identified IRA accounts Facebook noted “bad actors have been more careful to cover their tracks.”

The company said operators were using virtual private networks and internet phone services to obscure an account user’s location and paying for advertising via third parties.

In contrast, previous campaigns linked to the IRA used Russian phone numbers and IP addresses to register, as well as paying for Facebook adverts in Russian roubles, raising suspicions about Russian involvement.

“The original IRA activity threw operational security to the wind,” Nimmo said.