Since Russia’s stunning influence operations during the 2016 United States presidential race, state and federal officials, researchers, and tech companies have been on high alert for a repeat performance. With the 2020 election now just seven months away, though, newly surfaced social media posts indicate that Russia’s Internet Research Agency is adapting its methods to circumvent those defenses.
In September, University of Wisconsin researcher Young Mie Kim started analyzing posts on Facebook and Instagram from 32 accounts connected to the IRA. Within weeks, Facebook announced page, group, and account takedowns related to Iranian and Russian disinformation efforts in October. And accompanying research from the social media analysis firm Graphika corroborated that 31 of the 32 accounts Kim had been observing were Russia-linked. But Kim’s findings, detailed for the first time today, reveal additional details about how the IRA has evolved its tactics—and how it may be continuing to do so.
“Despite the increased transparency measures by top platforms it looks like the Russians are taking advantage of loopholes to try and circumvent the tech platforms’ defenses,” Kim told WIRED. “They’ve improved their mimicry behaviors and because of their evolving tactics it’s increasingly more difficult to detect these foreign actors. So I think we should be very wary of that.”
Ahead of the 2016 election, the IRA built up pages with massive followings that often invented personas or grassroots organizations—complete with logos and other marketing material. As digital platforms began scanning for international indicators of what Facebook calls “coordinated inauthentic behavior,” though, the IRA seems to have changed gears. The posts Kim analyzed in September were more focused on impersonating real, domestic US organizations or claiming a connection to them, seemingly to borrow legitimacy and hide in plain sight.
One post from a racially charged Instagram account called “iowa.patriot” posted an anti-Elizabeth Warren meme in August that said, “If white privilege existed, why did Elizabeth Warren have to spend decades lying about her ethnicity to get ahead?” Beneath the words was a banner logo taken from a US advocacy group. (Kim redacted references to real people and organizations). In July, the same account also posted a map of the US made of bacon titled “Sharia Free Zone.”
The accounts Kim looked at mainly targeted battleground states like Arizona, Florida, Michigan, Ohio, and Wisconsin.
The IRA focused most of its content on the same divisive issues as 2016, like racial identity, anti-immigration and anti-Muslim sentiment, nationalism, patriotism, religious topics, and gun rights. And similar to 2016, Kim noticed campaigns promoting a range of ideological views. But she also saw evolutions to stay current, like an increase in tailored feminist and anti-feminist content.
For example, an Instagram account called “feminist_agenda_” posted an illustration in September depicting disembodied hands with different skin tones giving the middle finger under the words, “if your feminism doesn’t include queer, black, poor, disabled, trans and muslim women, its not feminism. #womensmarch”
Kim noticed another pivot on commerce pages. In 2016, the IRA set up some accounts that claimed to sell items like t-shirts emblazoned with political lines and slogans. But in September, she instead saw evidence of Russia-owned commerce pages hawking benign, neutral items. Instead of directly conducting influence operations through merchandise, the IRA seemed to be using the commerce pages as a way to legitimize and promote their other accounts and posts.
Facebook’s October takedown initiative indicates that even as the IRA evolves its tactics, the platform can still eventually spot many of its nefarious campaigns. And the company said in October that the most novel thing about the network it took down was an expanded effort to conceal Russian links to the accounts themselves. But Facebook also acknowledged in July 2018 the challenges it faces staying ahead of the curve.
“We’re glad to see researchers do further analysis on our past takedowns,” a Facebook company spokesperson said in a statement. “Last October, we removed this Russia-linked network, which appeared to be in its early stages using tactics we’ve observed before. We will keep evolving our defenses and announcing these foreign influence campaigns, as we did more than 50 times last year.”
As good as the IRA has gotten at avoiding detection, those same steps make it harder for its accounts to stand out and gain followers. Ben Nimmo, director of investigations at Graphika, notes that by making th