Ukrainian dep’t at Russian troll factory exploded after MH17 crash: analysis of 750,000 tweets

How the tweets were selected

The data published by Twitter contains information on 3,667 accounts associated with the Russian Internet Research Agency. The accounts, since closed, generated a total of over nine million tweets. To determine which tweets are related to Ukraine, VoxCheck used a number of keywords such as "Donbas," “South-East," "Boeing," "Bandera," "fascism," "Kyiv," "revolution," "Maidan,” “Crimea,” “Poroshenko,” “Civil War,” “MH-17” and others. Overall, 774,957 tweets contained these keywords. They were generated by 1,369 accounts. 95% of the smallest accounts remained anonymous due to a decision taken by Twitter. Among the top 5% were both pages of media ("The Bulletin of Moscow," "The Bulletin of St. Petersburg" (a total of 24 regional "Newspapers"), "Federal News Agency," "News of Kyiv") and also private pages and burlesque pages such as “Maxim Dementyev," "Ramzan Kadyrov" (parody page), "Lavrov’s muesli," "Cold War 2.0."

Timeline of activity

The timeframe of the research was from January 2010 to May 2018, though the majority of tweets were tweeted after 2014, particularly in 2014-2015.

Ukraine was of little interest for Twitter trolls before the Euromaidan Revolution. The sample of accounts analyzed by Vox Ukraine showed very low activity before the spring of 2014: all the accounts published 10 tweets per day on average concerning Ukraine. The maximum number for this period (only 90 published) was on 28 October 2012, on the day of the elections to the Ukrainian Parliament. But on the day after the unrecognized "referendum" in Crimea, 17 March 2014, the accounts became much more active, tweeting over 100 tweets daily. On this day, the accounts published 116 tweets each on average, and on March 18, the day of Russia's annexation of the peninsula, 129 tweets. Before the presidential election in Ukraine in 2014, the tweets went into overdrive yet again - 263 tweets were published on 23 May. In the next six months, the number of tweets was no less than 115 per day. But the day the troll factory really went into overdrive was on 18 July 2014, the day after the MH17 plane crash. The accounts tweeted more than a whopping 44,000 messages, and over 25,000 on the following day.

Stakhanovite accounts

It seems that some accounts were inspired by the Soviet half-mythical hero Stakhanov, who exceeded the daily norm of coal mining tenfold. The most active account in the “hot” 18-19 July 2014 performed 296 tweets and retweets. How one person was able to make 296 publications in two days is a mystery: even a very hard-working person who can publish tweets without large breaks for 33 hours would have to post every 6 minutes and 42 seconds. The only break between publications was July 19 from 11:31 to 14:50. As is depicted in the visualization below, 277 similar “Stakhanov accounts" worked the same way and, in two days, posted no fewer than 196 publications each.

The only possible reason for such outstanding activity by 277 accounts is that one account was managed by several people. The way of tweeting proves this statement. Usually, users tweet directly from the Twitter web-page or from the mobile app. Such tweets are marked in the database as Twitter Web Client and Twitter for Android/iOS. The other way of tweeting is by client-services which allow managing several accounts simultaneously and by several people. Twitter allows developers to use their own client-services. Several such services were especially active in July 2014. For example, using a token_app, Twitter users published their messages only from 7 July till 19 July 2014, and using a twisofter — from 16 July till 19 July 2014. With the help of the twisofter during July 18-19 the largest number of publications was made — 19,300 and 11,200 tweets respectively (or 43% and 40% of the total amount in the corresponding day). Token_app kept almost the same pace — 18,100 and 10,400 tweets (also 43% and 40% of the total amount in the corresponding day). No mentions about these services are in the search engines. It is likely that these client services were created only for a specific customer or a specific task and were not promoted to a wide audience.

Hashtags: between MH17 and oligarchs

One of the most effective methods to disseminate a tweet and make it popular on Twitter is a hashtag prescription. In our selection, VoxUkraine found over 6,200 different hashtags. What are they about? The most popular hashtags in tweets related to Ukraine became #ProvocationOfKyiv with 22,300 references, #KyivShotDownBoeing with 22,100, and #KyivTellTheTruth with 21,900. They appeared exactly on the days after the MH17 catastrophe, on 18-20 July. 327 accounts participated in the campaign that promoted these hashtags, attempting to obscur Russia's participation in the crash of the Malaysian airliner on 17 July 2014. Read also:

• The most comprehensive guide ever to MH17 conspiracies
• Four years on, Russian MH17 disinformation campaign still going strong
• Russian media forge more papers to blame Ukraine of downing MH17, make bad grammar mistakes

55% of tweets among the nearly 755,000 total are unique, meaning not retweeted from other accounts. The most retweeted post belongs to the user with a nickname "drBre" (now deleted). In total, content from Russian media was the most widely shared. The state news agency RIA Novosti was in first place with 23,000 retweets, the Federal news agency was in second with 16,000 retweets, and Russia Today took third with 14,000 retweets. The time of publication served as another confirmation that several accounts were managed by one person. 18 out of 19 accounts that shared a RIA Novosti tweet made it simultaneously, at 16:28 on 28 September 2015. The Federal news agency was in the same situation: its most popular tweet with 80 retweets was published by 45 different accounts at 16:34 on 17 July 2014, and by 35 other accounts at 16:43 the same day.

What VoxUkraine proved

VoxUkraine found 774,957 tweets about Ukraine generated by 1,369 accounts from the troll factory over eight years. Before the annexation of Crimea, the twitter bots showed almost no activity. The accounts began to tweet more actively at the end of 2014. The real "twitter storm" happened on 18 July 2014 — the day after the MH17 crash. On this day, the accounts tweeted over 44,000 messages, and on the next day over 25,000. At least 200 accounts were managed centrally. In addition to the fact that Twitter connects all the accounts from the dataset with the Russian Internet Research Agency, there were two confirmations that several accounts belong to one owner. The activity of the token_app and twisofter twitter client services and the simultaneous publication times of dozens of retweets suggest that the accounts were created not for honest journalism and informing, but for the specific purpose of propaganda.

Read also:

• EU disinformation watchdog has collected over 5000 disinformation cases since November 2015
• Defensive disinformation: Moscow tries to frame the Salisbury attack as a comedy
• Five-year-long disinformation campaign didn’t make Crimea Russian
• 1001 pro-Kremlin disinformation messages: Ukraine remains top target
• How Russian propaganda denigrates Ukraine with disinformation