Clemson researchers crack the Russia troll factory

Over the past several weeks, the biggest cache of new evidence in the Russian investigation hasn’t come from Robert Mueller or President Donald Trump’s smartphone.

No, the freshest information on how Vladimir Putin targeted the 2016 presidential election has its origins just up I-85 at Clemson University.

On that campus is something called the Social Media Listening Center, a kind of interdisciplinary laboratory dedicated to studying internet-based communication on Facebook, Twitter, YouTube, Instagram and the like.

Much of the research is of the mind-numbing marketing variety: how millennials talk about their favorite cars, or words that people use to discuss sports. Darren Linvill, an associate professor of communications, has written a good bit on how students and universities use Twitter.

That has changed. Linville and his partner, economist Patrick Warren, have a new specialty now — national security. “Suddenly, the Senate Intelligence Committee is citing our work,” Linville said. “My life is a very different thing than it was a little while ago.”

This has been a case of academia on the fly.

“It was something of a lark,” Linvill said, encouraged by a few beers and more than a little concern about Russian trespassing.

“I think, in general, there’s been too much focus on Russian interference in the election. It’s much more than that. It’s interference in our society, in our culture, in our political conversation. We both saw it this way,” he said.

In June, the U.S. House Intelligence Committee released a list of 3,841 Twitter handles associated with the Internet Research Agency, an around-the-clock troll factory located in St. Petersburg and run by the Russian government.

Over those beers, Linvill and Warren realized that, through Clemson’s listening center, they had access to something that few others did, including the government: a mostly complete fire hose of Twitter messages, current and deleted.

They found close to 3 million Twitter messages that had been created or somehow massaged in that Russian boiler room between February 2012 and this past May. The Twitter accounts were categorized. Among them were 617 “right troll” handles, 230 “left troll” handles” and 122 “fearmonger” handles.

By July, the duo had turned a quick academic paper that focused on the methodology of the plot. “The IRA is engag- ing in what is not simply political warfare, but industrialized political warfare,” they wrote.

The pair also found that on Oct. 6, 2016, a month before the presidential election, the Russian troll factory reached a crescendo, pumping out 18,000 messages in a single day — about a dozen each minute. The proof isn’t absolute, but Linvill suspects this was a case of “cloud-seeding,” preparing the ground for the next day’s release by WikiLeaks of the first batch of emails hacked from the personal account of John Podesta, the chairman of Hillary Clinton’s presidential campaign.

“You can see the peak times they tweet. You can see that

they shift from hour to hour. One hour, they’ll tweet their left-wing accounts, and the next hour they’ll tweet their right-wing accounts,” Linvill said. “You can see very clearly that it is one organization, and it has applied human capital as is needed, depending on what’s happening politically, what current events are.”

As part of their research, the Clemson academics did something that Twitter itself probably didn’t. They eyeballed many of those 3 million messages. “I think we saw things that Twitter didn’t see,” Linvill said. “They shut all these accounts down by algorithm.”

Warren and Linvill want more eyes on the troll factory’s work product. They have given the statistically oriented website fivethirtyeight.com the entire file of 3 million Twitter messages, to give journalists and other academic researchers the opportunity to run their own searches.

Their own personal inspections allowed the Clemson team to get a handle on how the troll factory worked. Much of the Russian operation was of the “let’s-you-and-him-fight” variety, intended to encourage chaos on both ends of the American political spectrum.

“Right trolls” produced the largest number of tweets, specializing in “nativist and right-leaning populist messages,” Linville and Warren reported. “They rarely broadcast traditionally important Republican themes, such as taxes, abortion, and regulation, but often sent divisive messages about mainstream and moderate Republicans.”

Donald Trump, however, was very much a protected figure in the troll factory operation. U.S. Sens. John McCain, R-Ariz., and Lindsey Graham, R-S.C., were frequently cast as villains, traitorous and unpatriotic.

Leftward trolls had “an overwhelming focus on cultural identity,” whether sexual or religious. Many of the messages mimicked the Black Lives Matter movement. “Just as the right troll handles attacked mainstream Republican politicians, left troll handles attacked mainstream Democratic politicians, particularly Hillary Clinton,” the pair wrote.

“Fearmonger” accounts specialized in disinformation — specifically, a made-up story alleging that “salmonella-contaminated turkeys were produced by Koch Foods, a U.S. poultry producer, near the 2015 Thanksgiving holiday.”

That kind of approach has been left behind, Linville said, as the Russian operation has gotten more sophisticated and subtle. Fewer messages actually originate within the troll factory. English-speaking operators now simply seek out our homegrown extremists and amplify them.

“The Russians know they just need to encourage these conversations. They don’t need to have the conversations themselves. The conversation is going to happen organically,” Linvill said.

Another way the St. Petersburg trolls disguised their handiwork was to piggyback off Twitter messages sent out by legitimate American news sources. The selected sources varied by region.

Two Twitter feeds based in Georgia were used by the Russian troll factory, Linvill told me. One was the main Twitter account for The Atlanta Journal-Constitution. The other was a Twitter account used by Fox 5, the Atlanta TV station.

After we spoke, Linvill passed along the 8,500 Twitter messages from the AJC and Fox 5 that had been retweeted by the Russian troll factory. I passed them to Jennifer Peebles, the AJC’s crack data-cruncher.

She did a quick search on names and phrases contained in those 8,500 Twitter messages — and the remaining 3 million others, too. Two of the most popular phrases offer a clue to the nature of the St. Petersburg operation.

The phrase “Black Lives Matter” appeared 1,905 times, Peebles found. The word “Confederate” drew 2,878 hits.

That’s right. Let’s you and him fight.