Social Network Analysis Reveals Full Scale of Kremlin's Twitter Bot Campaign
Profile pictures from a large network of pro-Kremlin Twitter accounts. Image by Lawrence Alexander.
With the aid of open-source tools, Internet researcher Lawrence Alexander gathered and visualised data on nearly 20,500 pro-Kremlin Twitter accounts, revealing the massive scale of information manipulation attempts on the RuNet. In what is the first part of a two-part analysis, he explains how he did it and what he found.
RuNet Echo has previously written about the efforts of the Russian “Troll Army” to inject the social networks and online media websites with pro-Kremlin rhetoric. Twitter is no exception, and multiple users have observed Twitter accounts tweeting similar statements during and around key breaking news and events. Increasingly active throughout Russia's interventions in Ukraine, these “bots” have been designed to look like real Twitter users, complete with avatars.
But the evidence in this two-part analysis points to their role in an extensive program of disinformation.
Alec Luhn, a US journalist reporting on Russian affairs, observed how mere hours after the shooting of Boris Nemtsov on February 27th, a group of Twitter accounts were already attempting to sway the narrative:
Bots spread stories about Nemtsov's death like “Ukrainians killed him…he was stealing one of their girlfriends” pic.twitter.com/CNtNvsTPYI
— Alec Luhn (@ASLuhn) February 28, 2015
Using the open-source NodeXL tool, I collected and imported a complete list of accounts tweeting that exact phrase into a spreadsheet. From that list, I also gathered and imported an extended community of Twitter users, comprised of the friends and followers of each account. It was going to be an interesting test: if the slurs against Nemtsov were just a minor case of rumour-spreading, they probably wouldn't be coming from more than a few dozen users.
But once the software had finished crunching data, the full scale of the network was revealed: a staggering 2,900 accounts. This figure is perhaps understandable: for a fake Twitter account to be credible, it needs plenty of followers—which in turn requires more supporting bots.
Then I used Gephi, another free data analysis tool, to visualize the data as an entity-relationship graph. The coloured circles—called Nodes—represent Twitter accounts, and the intersecting lines—known as Edges—refer to Follow/Follower connections between accounts. The accounts are grouped into colour-coded community clusters based on the Modularity algorithm, which detects tightly interconnected groups. The size of each node is based on the number of connections that account has with others in the network.
Extended network of 2,900 Twitter bots taken from Nemtsov thread sample. Image by Lawrence Alexander.
It is clear from how dense and close to each other the nodes are in the graph that this is a large and highly-connected network. Most of the bots follow many others, giving them each a high follower/followed count. On the periphery, there are a few rings of lesser-connected accounts, perhaps indicating that the “bot” network was still being “grown” at the time of its capture; you could think of it like a tree, with branches spreading outwards.
But there was one crucial question in this analysis: how was it possible to be sure that the network consisted chiefly of bots and not real humans?
NodeXL doesn't just gather information on who follows whom. It also acquires metadata—the publicly-available details of each Twitter account and its behavior. This shows that out of the 2,900-strong network, 87% of profiles had no timezone information and 92% no Twitter favorites. But in a randomized sample of 11,282 average Twitter users (based on accounts that had tweeted the word “and”) only 51% had no timezone and tellingly, only 15% had no favorites (both traits of what could be classified as “human” behavior).
For added comparison, an entity-relationship graph of the randomized Twitter user control network is shown below. In contrast with the bots visualisation, this network has several unconnected and isolated clusters: groups of Twitter users that aren't linked to each other—a perfectly normal occurrence in a random group of users.
Shared use of the word “and” results in unconnected, isolated clusters in a random Twitter user group. Image by Lawrence Alexander.
Having unearthed such a large-scale network from a single source, I decided to take the bot-hunting further. Searching Twitter for phrases such as “Kremlin bots”, “pro-Russian trolls” and “Putin sockpuppets,” I found several users sharing screenshots of alleged bot activity. Some also used the #Kremlinbots (#Кремлеботы) hashtag to report sightings.
Using the same method as with the anti-Nemtsov tweets, I gathered networks of accounts based around the use of some of the reported key phrases that revealed larger communities—or, in some cases, just a list of users shown in the screenshot. These were divided into groups labelled A, B, C and D. (I will elaborate on the reason for this grouping in part two of the analysis.)
@PressRuissa is a parody account (now suspended) spoofing a pro-Russian media, a mix of satire and commentary on disinformation and bias. One of its tweets was the starting source for the Group A network:
The Russian tweeters reveal that “Novaya Gazeta covers up their bots’ activity” in a surprising unison. (via @nokato) pic.twitter.com/DSwcIKWpDg
— Falcon News Intl. (@PressRuissa) March 13, 2015
Group B came from different sources of suspected bot accounts whose behavior seemed to match the previous samples. Some were identified by their tendency to change from Russian language to English with the single error message “RSS in offline mode”—presumably caused by a glitch in their control software.
RSS in offline mode
— Леонид Верхратский (@GCL2BUugsq4n5JL) April 1, 2015
For the remaining sources, a tweet by Devin Ackles, an analyst for think tank CASE Ukraine provided the basis for Group C.
Pro-Russian bots on the offensive following attack on #Mariupol pic.twitter.com/AiH95Dp1wb
— Devin Ackles (@DevinAckles) January 24, 2015
And lastly, Vitaliy Moroz of Internews Ukraine shared a screencap of bot accounts that formed the sample for Group D.
Russian bots have disseminated the message of war: “I think Great War will start!” #RussiainvadedUkraine #russia pic.twitter.com/kCVDioIAGH
— Vitaliy Moroz ENG (@vitaliymoroz) February 13, 2015
All four groups were merged into a single data set, resulting in a total of 17,590 Twitter accounts. As with those producing the anti-Nemtsov tweets, the metadata confirmed that the vast majority were indeed bots. 93% showed no location on their profile, 96% had no time zone information and 97% had no Twitter favorites saved.
Also, despite having produced an average of 2,830 tweets, the accounts almost never interacted with other Twitter users through @replies or @mentions.
The bots broadcast tweets, but don't interact. Image by Lawrence Alexander.
Intriguingly, many of the bots had been given western-sounding names such as barnardgrant, terancebarnaby, terencecoward and duncanstarks.
But an even more surprising result came when I visualized the bot groups’ follow relationships. Even though the samples had been taken from four separate sources, the combined network was found to be intensely interconnected.
All 17,590 accounts from all four sources. Note the tight interconnections and lack of isolated clusters. Image by Lawrence Alexander.
This sharply contrasts with the randomized control sample: the final dataset showed no isolated groups or outliers at all. This strongly supports the idea that the bots were created by a common agency—and the weight of evidence points firmly towards Moscow.
In my next post I will look at the timeline behind the creation of the bots, and see how it correlates with political events in Russia and Ukraine.
This post is part of RuNet Echo, a Global Voices project to interpret the Russian language internet. All Posts · Read more »
229 comments
Ага, спалились кацапские пидорасы.
Thank you for doing this. This is amazing analysis. The mechanic soldiers in the war for minds of Russian citizens
Who controls the US/EU media empires? How free is the information of the “free world”?
Suggestion: Start accepting Bitcoin donations! I would definitely send you some.
why are you not doing that on US preelection twitter storms? afraid of NSA?
That would not be convenient for the greedy uglygarchs that control the US media. Money talks very loudly in the “exceptional” nation and the other countries of the cabal follow in their master’s footsteps.
This is such a nice trick! Who but an uneducated and gullible simpleton would believe that only the boogey boy Putin indulges in these activities. Do the innocent children really believe that the US/EU/NATO cabal don’t do the same? Once upon a time, there was Snow White (US/EU/NATO) and the wicked witch (Putin)…..
No amount of propaganda will hide the fact that rather than encourage the “interim government of Ukraine” to offer a federal settlement to the Donbass, along the lines of the US states and the Canadian provinces, the “superior and civilised” west preferred to support Kiev’s “Anti Terrorist Operation” against the Donbass people, who needed to be punished for making the obviously “wrong” Russian choice with the use of tanks, artillery and grad missiles. How dare they turn their backs on the “superior and civilised’ west?
Now, perhaps the US/EU/NATO cabal will need to engage some Hollywood movie makers to convince the “plebs” of the world that the sky is really green and the grass is really blue?
And of course, the standard childish name-calling would be made, “Putinbot, Krembot, Russian Troll” etc. It would be funny if 6000+ people had not died as a result of the expansionist US/EU/NATO cabal. The substantive points will not be argued.
> Do the innocent children really believe that the US/EU/NATO cabal don’t do the same?
I do not know. Can you provide proof?
Imagination situation when Kiev will try stop Russian agression in Crimea.
It would also be punitive operation against pro-Russian people?
I would expect no more than the US/EU/NATO cabal to play the same info war game. Please refer to Mr Snowden, who has “spilled so many beans” and “sung like a canary.”
As for Russian “aggression” in Crimea, do you really think that the Crimeans would want to return to Ukraine and be bombed like the Donbass?
Why should Russian speakers accept a second class status for their language as Ukrainian is imposed?
And when did the VOTERS of Yanukovych remove him from office in an ELECTION?
These awkward questions will NOT be answered, as it is much easier on the brain cells to sing “Putinbot, Russian Troll, Krembot”.
Go on, make my day!
> As for Russian “aggression” in Crimea, do you really think that the Crimeans would want to return to Ukraine and be bombed like the Donbass?
Do you belive that they want be with Russia if it was anexion?
> Why should Russian speakers accept a second class status for their language as Ukrainian is imposed?
Because it contradicts with Ukrainian Constitution and Ukraine have very loyal law about local languages.
Just read about this law http://www.pravda.com.ua/rus/columns/2014/03/13/7018654/
Then amend the Ukrainian constitution. Contrary to Kiev propaganda it was not sent down in tablets of stone from Mount Sinai. Have you heard about the bilingual federation of Canada? I suppose the Kiev US/EU stooges would prefer to continue their “Anti Terrorist Operation” against the Donbass people? How very Stalinist! In civilised EU we don’t not send tanks, artillery and grad missiles to subdue fellow citizens.
I gather Crimea wanted to return to Russia since 1991. So, why should the Russian speakers in Crimea accept a second class status for their language when it would be first in the Russian Federation? Are they “subhumans”, as your stooge PM Yats likes to refer to such people?
Is that the rubbish being fed to you by your American, Baltic and Polish advisors? French does not have a second class status in Quebec, Canada, which is a bilingual federation with LESS people than Ukraine. These same Canadians would supply more arms so that Ukrainians can kill Ukrainians. WHY, IHOR???
The Ukrainian constitution must serve the Ukrainian people or it belongs in the bin. If it is not amended to accommodate all the people then Ukraine itself will be dumped in the dustbin of history, AGAIN!
>>> Can you provide proof?
http://www.theguardian.com/technology/2011/mar/17/us-spy-operation-social-networks
https://www.fbo.gov/index?s=opportunity&mode=form&id=6ef12558b44258382452fcf02942396a&tab=core&tabmode=list
http://www.youtube.com/watch?v=pKvEPnTccN4
I will give you a clue about the way the world works from human biology. Putin farts and so the US/EU/NATO/IMF/Kiev leaders. We all do because as humans we have the same workings of the body. That is why God has given us brains. Use yours to think critically and stop believing in fairy stories told by the leaders.
Now answer the point, Ihor.
WHY CAN’T THE DONBASS HAVE THE FEDERAL POWERS OF THE US STATES AND THE BILINGUAL RIGHTS OF THE CANADIAN PROVINCES?