Tuesday, July 5, 2016

Interacting with Russian Trolls Employing активные мероприятия (Active Measures) - Lessons Learned, by @kittenninja42

Vasily Mitrokhin wrote, "the new is no more than a reinvention of the old which has been forgotten." The new, he felt, "flows out of the old and you must know the old to understand the new." Russians use the same techniques over and over across every spectrum. We call it recursion.

Active Measures as applied by Russian trolls from The Agency and various other troll factories in Russia mimic the old state sponsored programs the Soviets used to subvert and undermine western governments, but just using a different medium – social media, particularly Twitter. We see trolls employing disinformation and propaganda, presenting counterfeit documents, maligning character, ridiculing and attempting to twist and co-opt authentic communication. Russian trolls have feigned friendship for the sole purpose of driving wedges between groups, in particular, the community which discusses and shares information about Russia, but in reality, any community can be targeted. Sowing chaos is the name of the game because chaos helps the Kremlin.

Trolls deceive in order to mask their identities, known in Russian tradecraft as maskirovka. They create accounts that are as varied as possible and identify as gamers, grandmothers, patriots, current and former military, highly educated people such as doctors or lawyers, even strangely enough, as Russian agents. If they add a location to their header, it’s generally false. Many have multiple accounts and, amusingly, may hold conversations and fake arguments with themselves, using sock accounts.

Some of the most notorious Russian trolls pose as members of the Alt-right or Neo-Nazis. Yes, there are some white supremacists in the US, but many of these Tweeps are Russian. These can be identified rather easily by their use of “Fash”,“HH”, “88”, “14” (which refers to the “14 words”) “1488”, or any combination of these letters and numbers in their profiles. They may also use Nazi symbols in their headers such as the SS or thunderbolt symbol.

As far as the content of their posts, spelling and grammar may be an issue with the low-level trolls because, frankly, English is generally their second language, or because they use Google Translate. Some use all caps, some all lower case, some frequently use texting shortcuts. Many have trouble with English and tend to mix metaphors. Many plagiarize because they have been directed to use Kremlin talking points and are they're too lazy to rephrase the content. Some of the low-level trolls are actually algorithms; Twitter-bots that tweet out the same message over and over, and a real person will engage only if someone on the receiving end takes the bait.

Coming up against the low-level trolls is almost a game. We can recognize them easily and identify their techniques. They’re paid to do a job, do it with little enthusiasm and often once unmasked, tend to move on.

But then there are the higher level trolls, some of whom are actually highly educated, and English does seem to be their first language. They’ve been trained in psychological warfare techniques and they're quite skilled. The higher level trolls have been more of a challenge, but as Ben Nimmo says, “Never forget, when the trolls use the 4 Ds on you, it shows you're doing a good job.”


The 4 D’s: Dismiss, Distort, Distract, Dismay

Dismiss – otherwise known as “ridicule is a potent weapon”, or “the political abuse of psychiatry in 140 characters or less”, is classic Russia. Accusations of McCarthyism are so common that it’s one of the first signs of a troll. “What a nutcase – this guy sees Russian agents everywhere! You’re off your meds. All I see is someone obsessed with Russia and not looking at the big picture. You’re completely deranged.” It may even be done in a nice way, such as concern over the target’s mental health. For example, we came across a rather despicable troll posing as a veteran with PTSD, who played that he was reaching out to us to give the help we so desperately needed, all the while implying that we were mentally unstable. We let our guard down on this one – but he later revealed himself. Dismissal, comes in other forms too, such as implications that one’s opinions are invalid if one has never lived in Russia.

Distort – twisting words or phrases purposefully to malign the message that you’ve sent. A great example is a recent message sent out by Max Blumenthal about Elie Weisel, where Max distorted Weisel’s life work. And yes, Max is a Russian troll/Agent of Influence. Observing Max’s account is an education in distortion. Like some of our other trolls, you’ll see both racist remarks by him and accusations of racism that don’t fly.



Distract – taking the conversation off topic .Conversations that are sensitive to Russian interests are co-opted, sometimes for hours or days on end. It serves to deflect from authentic communication, especially when the topic is right on target. And it usually ends in the recycling of the conspiracy theories of The Protocols of the Elders of Zion.

Dismay – these can be personal attacks on the target, the target’s family or friends, or attacks on experts who study and understand Russia. Remember that Russia “projects”. Projection is an infantile psychological defense mechanism, but, once understood, can reveal a lot about the troll. Classically, accusations are actually the troll’s own “projections” of themselves and their own personal faults onto the target. Recently I’ve seen false accusations (such as allegations of domestic violence) that were exclusively intended to divide and conquer. Furthermore, any attempt at character assassination of well-known subject matter experts is an immediate red flag. Unabashedly using profanity or aggression in the form of threatening messages or pictures are all intended to incite and manipulate the target through fear. Unsolicited vile sexual comments are too, where the key word is unsolicited, and “vile” is somewhat like porn; “you know it when you see it.” Trolls also create forgeries and present them as authentic pieces of evidence. Most are obvious, laughable fakes, but if the target is unsuspecting, or doesn’t pay attention to detail, he may be thrown off by them - dismayed, if you will.

These are the basics in dealing with trolls, although we’ve recently come across trolls who seem to be far more invested in their tasks. The newer trolls who fear exposure smack of desperation and have revealed some of their capabilities to us. As they are losing their grip (feeling cornered, fearful, or exposed), they turn to more aggressive means. The default setting for these types of trolls is the old adage, “deny, deny, deny, and make counter-accusations”.

First off, Russian trolls can and do read private, direct messages. They will use any information that they obtain in those messages against their target in order to control and manipulate through intimidation, especially things of a personal nature. This includes threatening harm to underage children.

Trolls can and will dox, meaning they will seek out any and all information about their target in order to expose the private information of a person who may prefer to remain anonymous on Twitter. This includes posting personal photos, places of employment, addresses, phone numbers, names of family members, pets, etc. We’ve seen them create fake accounts using the personal information and pictures of family and friends who were not even involved in a twitter exchange.

Russia wants control. “Silent decomposition” ensures that Russia maintains control over friendships and conversations between people. If they can interfere with friendships, they will. They can and do try to isolate one person from a group conversation, by removing names of other members of the conversation in a twitter exchange. This makes it easier for them to divide and conquer. Meanwhile, they stick together as a united community, liking one another's posts, and sticking to a predetermined group narrative regardless of any evidence to the contrary. The only positive to this is that they can be easily baited and observed because they come out of the woodwork to protect their own.

Possibly most dangerous – they will infiltrate a community posing as a friend and then turn people against one another. This is classic provokatsiya, but when people let their guard down and don’t understand Russia’s end goal, it can destroy a group’s cohesiveness.


Sun Tsu said that “the supreme art of war is to subdue the enemy without fighting him”. Russia’s troll campaign is a small but integral part of their hybrid warfare against the west. Knowing that they actually are out there attempting to demoralize us is a first step in understanding how to defend against it. The second step is to understand their techniques. Knowledge is power and simply knowing can give us the armor we need. Stay safe out there.