The same morning, “Katherine Fulton” also began promoting DCLeaks in the same awkward English Mr. Redick used. “Hey truth seekers!” she wrote. “Who can tell me who are #DCLeaks? Some kind of Wikileaks? You should visit their website, it contains confidential information about our leaders such as Hillary Clinton, and others <a href=”http://dcleaks.com/.”” rel=”nofollow”>http://dcleaks.com/.”</a>
So did “Alice Donovan,” who pointed to documents from Mr. Soros’s Open Society Foundations that she said showed its pro-American tilt and — in rather formal language for Facebook — “describe eventual means and plans of supporting opposition movements, groups or individuals in various countries.”
Might Mr. Redick, Ms. Fulton, Ms. Donovan and others be real Americans who just happened to notice DCLeaks the same day? No. The Times asked Facebook about these and a half-dozen other accounts that appeared to be Russian creations. The company carried out its standard challenge procedure by asking the users to establish their bona fides. All the suspect accounts failed and were removed from Facebook.
MOBILIZING A ‘BOT’ ARMY
On Twitter, meanwhile, hundreds of accounts were busy posting anti-Clinton messages and promoting the leaked material obtained by Russian hackers. Investigators for FireEye spent months reviewing Twitter accounts associated with certain online personas, posing as activists, that seemed to show the Russian hand: DCLeaks, Guccifer 2.0, Anonymous Poland and several others. FireEye concluded that they were associated with one another and with Russian hacking groups, including APT28 or Fancy Bear, which American intelligence blames for the hacking and leaking of Democratic emails.
Some accounts, the researchers found, showed clear signs of intermittent human control. But most displayed the rote behavior of automated Twitter bots, which send out tweets according to built-in instructions.
The researchers discovered long lists of bot accounts that sent out identical messages within seconds or minutes of one another, firing in alphabetical order. The researchers coined the term “warlist” for them. On Election Day, one such list cited leaks from Anonymous Poland in more than 1,700 tweets. Snippets of them provide a sample of the sequence:
@edanur01 #WarAgainstDemocrats 17:54
@efekinoks #WarAgainstDemocrats 17:54
@elyashayk #WarAgainstDemocrats 17:54
@emrecanbalc #WarAgainstDemocrats 17:55
@emrullahtac #WarAgainstDemocrats 17:55
Lee Foster, who leads the FireEye team examining information operations, said some of the warlist Twitter accounts had previously been used for illicit marketing, suggesting that they may have been purchased on the black market. Some were genuine accounts that had been hijacked. Rachel Usedom, a young American engineer in California, tweeted mostly about her sorority before losing interest in 2014. In November 2016, her account was taken over,
renamed #ClintonCurruption, and used to promote the Russian leaks.
Ms. Usedom had no idea that her account had been commandeered by anti-Clinton propagandists. “I was shocked and slightly confused when I found out,” she said.
Notably, the warlist tweets often included the Twitter handles of users whose attention the senders wanted to catch — news organizations, journalists, government agencies and politicians, including @realDonaldTrump. By targeting such opinion-shapers, Mr. Foster said, the creators of the warlists clearly wanted to stir up conversation about the leaked material.
J. M. Berger, a researcher in Cambridge, Mass., helped build a
public web “dashboard” for the Washington-based Alliance for Securing Democracy to track hundreds of Twitter accounts that were suspected of links to Russia or that spread Russian propaganda. During the campaign, he said, he often saw the accounts post replies to Mr. Trump’s tweets.
Mr. Trump “received more direct replies than anyone else,” Mr. Berger said. “Clearly this was an effort to influence Donald Trump. They know he reads tweets.”
The suspected Russian operators at times lacked sophistication. “They are not always Americanophiles who know every nuance of U.S. politics,” said Mr. Foster, the FireEye researcher.
For instance, last October, hundreds of Anonymous Poland Twitter accounts posted a forged letter on the stationery of the conservative Bradley Foundation, based in Milwaukee, purporting to show that it had donated $150 million to the Clinton campaign. The foundation denied any such contribution, which would have been illegal and, given its political leaning, highly unlikely.
‘A BATTLE OF INFORMATION’
Only a small fraction of all the suspect social media accounts active during the election have been studied by investigators. But there is ample reason to suspect that the Russian meddling may have been far more widespread.
Several activists who ran Facebook pages for Bernie Sanders, for instance, noticed a suspicious flood of hostile comments about Mrs. Clinton after Mr. Sanders had already ended his campaign and endorsed her.
John Mattes, who ran the “San Diego for Bernie Sanders” page, said he saw a shift from familiar local commenters to newcomers, some with Eastern European names — including four different accounts using the name “Oliver Mitov.”
“Those who voted for Bernie, will not vote for corrupt Hillary!” one of the Mitovs wrote on Oct. 7. “The Revolution must continue! #NeverHillary”
While he was concerned about being seen as a “crazy cold warrior,” Mr. Mattes said he came to believe that Russia was the likely source of the anti-Clinton comments. “The magnitude and viciousness of it — I would suggest that their fingerprints were on it and no one else had that agenda,” he said.
Both on the left and the pro-Trump right, though, some skeptics complain that Moscow has become the automatic boogeyman, accused of misdeeds with little proof. Even those who track Russian online activity admit that in the election it was not always easy to sort out who was who.
The New York Times would like to hear from readers who want to share messages and materials with our journalists.
“Yes, the Russians were involved. Yes, there’s a lot of organic support for Trump,” said Andrew Weisburd, an Illinois online researcher who has written frequently about Russian influence on social media. “Trying to disaggregate the two was difficult, to put it mildly.”
Mr. Weisburd said he had labeled some Twitter accounts “Kremlin trolls” based simply on their pro-Russia tweets and with no proof of Russian government ties. The Times contacted several such users, who insisted that they had come by their anti-American, pro-Russian views honestly, without payment or instructions from Moscow.
“Hillary’s a warmonger,” said Marilyn Justice, 66, who lives in Nova Scotia and tweets as
@mkj1951. Of Mr. Putin, she said in an interview, “I think he’s very patient in the face of provocations.”
Ms. Justice said she had first taken an interest in Russia during the 2014 Winter Olympics in Sochi, Russia, while looking for hockey coverage and finding what she considered a snide anti-Russia bias in the Western media. She said she did get a lot of news from Sputnik and RT but laughed at the notion that she could have Kremlin connections.
Another of the so-called Kremlin trolls,
Marcel Sardo, 48, a web producer in Zurich, describes himself bluntly on his Twitter bio as a “Pro-Russia Media-Sniper.” He said he shared notes daily via Skype and Twitter with online acquaintances, including Ms. Justice, on disputes between Russia and the West over who shot down the Malaysian airliner hit by a missile over Ukraine and who used sarin gas in Syria.
“It’s a battle of information, and I and my peers have decided to take sides,” said Mr. Sardo, who constantly cites Russian sources and bashed Mrs. Clinton daily during the campaign. But he denied he had any links to the Russian government.
If that’s so, his prolific posts are a victory for Russia’s information war — that admirers of the Kremlin spread what American officials consider to be Russian disinformation on election hacking, Syria, Ukraine and more.
But if Russian officials are gleeful at their success, in last year’s election and beyond, they rarely let the mask slip. In
an interview with Bloomberg before the election, Mr. Putin suggested that reporters were worrying too much about who exactly stole the material.
“Listen, does it even matter who hacked this data?” he said, in a point that Mr. Trump has sometimes echoed. “The important thing is the content that was given to the public.”
