Russia's military invasion of Ukraine has revived pro-Kremlin troll factories that distribute propaganda themes on Western news websites. Among the publications targeted in recent days are Le Figaro, Der Spiegel and the Daily Mail.
These actions are part of the multitude of techniques to influence international and domestic public opinion used in the past also by the famous Russian company Internet Research Agency (IRA) (now Patriot Media Group). It was also known as the "troll factory" of Yevgeny Prigozhin (aka "Vladimir Putin's cook") indicted in the indictment US Attorney Robert Mueller. The document also proves Russian involvement in local and political processes in the US in the context of the 2016 presidential election.
The object of the accusations is the approach of involving Russian government entities (IRA, GRU and SVR) in American political life, using, in particular, special operations of malign influence facilitated by the tools made available by social platforms, hacking activities, manipulation, propaganda, disinformation, spreading hate speech among society, etc.
The IRA created fake online identities or stole online identities of real US citizens, structured into three types: a) fictitious individuals; b) fake organizations; and c) fake local publications.
"IRA operated individualized Twitter accounts similar to the operation of its Facebook accounts, by continuously posting original content to those accounts, while also communicating with US Twitter users directly (through public tweets or private Twitter messages)"
(Mueller Report, 2019, p. 27)
With the help of these accounts, the IRA was soon able to generate news in the American press and popularize its narratives. According to University of Wisconsin-Madison study, from 2015 to September 2017, 33 major US news outlets referenced 100 IRA-created Twitter accounts in their coverage.
The technique aims to create a false "majority" opinion to justify and popularise a disinformation theme, using a rhetorical tool used in grey propaganda. It is synecdoche - a figure of speech that consists of broadening or narrowing the meaning of a word by using the whole instead of the part, or vice versa, where part of a larger entity is used instead of the whole.
Since its formation in August 2013, the IRA has shown a particular interest in the comments section of news websites. It was detected across international online news platforms in 2018, becoming more intense in 2021 as US military forces withdraw from Afghanistan.
Researchers from Cardiff University’s Crime and Security Research Institute detected a Russian-led campaign at the time, identifying patternsof analysis of reader comments and comments by fictitious users with comments containing pro-Kremlin narratives.
These comments were then picked up by the state-controlled Russian press who created news stories using the comments to construct a synecdoche along the lines of "British think X or Y"/"Germans unhappy that X or Y".
This news was created primarily for domestic audiences to suggest widespread support among Western citizens for Russia or President Vladimir Putin, including to promote a particular Kremlin policy.
This news was published in Russia, but also in other European countries (such as Bulgaria) and was amplified on social media platforms, including Telegram channels.
The same tactics of information operations are still being used today in the current context of the Russian military invasion of Ukraine. It is quite significant and intense, and its frequency has increased after 24 February 2022.
For example, the Russian-language news portal "Trud" is part of the RIA Novosti network involved in the "pro-Kremlin trolling" (TPK) information operation by creating the news story entitled «Достал уже». Немцы жестко ответили Зеленскому, обратившемуся к россиянам ("We've had enough already." The Germans replied harshly to Zelensky who had addressed the Russians").
The sources of this news are 5 comments left in the comments section of the German-language publication Der Spiegel. Following the analysis of the section under Article Selenskyj wendet sich an Russen – «Schweigen kommt einer Mitschuld gleich»4 comments were identified from the TPK operation.
All profiles were created in 2020, which indicates a special TPK operation to infiltrate the publication in order to distort the reality of Western public opinion for Russian-speaking audiences in Russia and former Soviet states. The second common element relates to the time of the postings: between 00:32 and 02:00 (GMT+2).
And the third element present in only one comment is the double-spacing characteristic of a script.
Narratives used: 'Zelensky's demands are tiresome' / 'He is wearing the same shirt' / 'Zelensky is responsible for starting the war' / 'The war is caused by the activity of the Azov battalion'.
The other Western publication infiltrated by the TPK operation is Le Figaro. The article entitled Guerre en Ukraine : lors de son entretien avec Macron, Zelensky a appelé à «durcir les sanctions contre la Russie» which refers to the dangerous situation created around the Zaporozhye nuclear power plant and quoted as news in Russian by the same RIA Novosti network with the title Читатели Le Figaro осудили Зеленского за его требования к Макрону ("Readers of Le Figaro criticized Zelenski for his demands to Macron"). All articles refer to 5 or 6 sources-comments following the TPK operation recipe.
The analysis identified several patternsof the comments, namely: a) the time of publication is 13:19-18:30; b) common narratives used in other publications; c) the use of double spacing and the presence of spelling mistakes, uncharacteristic of native French speakers.
These narratives include "Zelenski is responsible for starting the war" / "Zelenski is not credible" / "Zelenski is a clown" / "Zelenski's demands are tiresome".
The misinformative narrative "Zelensky is a clown" was the most widely distributed in the comments section. Four anonymous users with such a narrative were identified.
The third wave of the TPK information operation, grouped around RIA Novosti network, targeted a coordinated attack on Ukrainian refugees in the UK. Article Читатели Daily Mail раскритиковали идею увеличить пособие принимающим беженцев с Украины ("Daily Mail readers criticized the idea of increasing the allowance for refugees from Ukraine") on RIA Novosti quotes 5 sources-commentaries registered under pseudonyms.
It can be seen that 3 of the 5 accounts cited were registered between 2015-2015, indicating a significant age of the TPK information operation targeting the Daily Mail. Note that 2015 coincided with the Russian military intervention in Syria. All 5 comments were posted on the same day - 18.08.2022. The topic of refugees is a sensitive one, and one that can stir up negative emotions among readers especially when it comes to the allocation of additional budgets. The monitoring database can be accessed here (link).
This is confirmed by data from Ipsos poll recently carried out with the think tank British Future. The proportion of Britons who agree with reducing the number of immigrants in the UK is now at its lowest level in seven years, but this view remains prevalent: 42% of respondents said they want the number of immigrants to be reduced, while the percentage of those who agree with increasing the number of immigrants has reached 22% (compared to 10% recorded in February 2015). While 3 in 4 Britons (75%) agree with the statement that "people should be able to take refuge in other countries, including the UK, to escape war or persecution", while only 16% of respondents were against. This social context still remains a favourable one for TPK-type information operations to foster selfishness and internal social cleavages, including by promoting radical anti-system currents.
Among the narratives promoted as part of the TPK information operation are: 'Britain should look after its own citizens, not refugees' / 'Pay members of Government and Parliament, not the population' / 'Increasing support for refugees is a ridiculous idea'.
Most likely this infiltration operation has been a systematic one over the last 3-7 years and aims to automatically post provocative pro-Russian/anti-Western comments in response to Russia-relevant narratives. Most of the time, these are placed at the beginning of the conversational thread to "frame and corner" subsequent interactions on a particular topic.
Designers of the PKT information operation can hide their activity by easily switching between person accounts and fake identities in comment sections, which is facilitated by technology. Penetration testing of reader comment section sign-up processes in several media outlets in various countries revealed a lack of security measures to prevent, deter or detect outside state actors attempting such campaigns.
Significant amplification of PKT commentary is achieved through a "full-spectrum" media approach involving: state media outlets such as RIA Novosti; several Kremlin-controlled propaganda and disinformation media outlets indirectly associated with Patriot Media Group (formerly IRA), owned by Yevgeny Prigozhin; other similar disinformation media sites, including TV, connected to the GRU; including social media accounts and pages on all major platforms.
A central role is played by the search engine Yandex.ru, which systematically distorts Western public opinion "on a large scale" in favour of propaganda fan themes, displaying them among the top search results. This is done by building "reader comment stories" that pivot around PKT comments posted on Western media sites.
Dr. Nicolae Tibrigan, expert coordinator Digital Forensic Team
EN 
RO