Since Russia’s attempt to polarize American society and interfere in the 2016 election was exposed, and even more since the poisoning of former spy Sergei Skripal in the United Kingdom, accusations of being a “Russian troll” have proliferated online, often with the flimsiest of evidence.

Such accusations do more harm than good, obscuring the ways in which trolls can really be identified and increasing online polarization still further.

In the interests of transparency and reasoned debate, this post lists some of the factors which can be used to identify possible Russian trolls masquerading as citizens of other countries.

These clues are indicative, rather than conclusive. It is seldom possible to say with 100 percent certainty that a given account belongs to a Russian troll operation, rather than merely supporting Russian narratives.

However, these factors do allow for the reliable indication of pro-Kremlin accounts. If an account shares most of the factors, but claims to be a patriotic citizen of another country (especially the United States and United Kingdom), it may well be a covert influence account, like the hundreds which Russian journalists exposed working out of the St. Petersburg “troll factory.”

As with any open source investigation, the combination of multiple factors is key. A single indicator is seldom enough to confirm identification. What is important is the approach: assessing a suspect account from all angles and across as long a timespan as possible.

One small caveat that with the increase in accusations of Russian trolling since October 2016, a number of Western users have claimed to be Russian, in an apparent attempt to “trigger” opponents and discredit researchers. It is therefore important to review the full lifespan of an account, and to exercise caution with more recent posts.

Partisan is not enough

Before examining the factors which reliably indicate a pro-Kremlin troll, it is important to look at one factor which does not. That is hyper-partisan content.

Russia’s information operation against America ranging from 2014–2017 did involve a large number of accounts posing as hyper-partisan Americans on both sides of many divides, notably the #TakeAKnee controversy.

At left, a post from Russian troll account “PanAfricanRootsMove.” At right, a post from Russian troll account “MericanFury.” Both images thanks to the repository created by UsHadrons on Medium. (Source: Facebook)

As a result, the already heated atmosphere of online political debates has been further envenomed by mutual accusations of being “Russian trolls” (or even “Russian bots”).

However, hyper-partisan content is never enough, on its own, to qualify an account as pro-Kremlin or Russian. More evidence is always needed.

A or The?

One of the linguistic signs which is characteristic of many known Russian accounts is the inability to use the grammatical articles — “a” and “the” — appropriately. The Russian language has neither.

This post, for example, was made by Russian troll Instagram account Muslim_Voice in May 2016; note the phrases, “I don’t want my kids to walk on streets with the sign like this,” and “to stop the Islamophobia and Xenophobia.”

Post from @Muslim_Voice, recovered by @UsHadrons. (Source: Instagram / Muslim_Voice)

Russian Twitter troll @USA_Gunslinger appeared to have made the same mistake in this post and claimed that Hillary Clinton will never have “an honor.” In British English, an “honour” is an award from the Queen, but this is unlikely to be the U.S. account’s context; it appears to mean that Clinton will never have honor.

Tweet by @USA_Gunslinger, recovered by @UsHadrons. (Source: Twitter / USA_Gunslinger)

Confirmed Russian Twitter trolls made many similar mistakes in their posts, according to a repository of over 200,000 posts recovered by NBC News.

“We need fight the terrorism to fight the terrorism! But not track phone calls to fight the terrorism.” — @michellearry, June 2015. “I want chaos to be over! We need #GOP president to stop it! #GOPDebateSC” — @heyits_toby, January 2016. “With Hillary in charge, America will burn in flames of a shame. So don’t let this happen!” — @tpartynews, February 2016.

This linguistic telltale is one of the most common indicators of a Russian speaker (although other languages, including Polish and Latvian, also lack the definite article). Being common, it can be faked by those who wish to masquerade as Russian trolls in order to deceive and discredit researchers; however, an account which poses as an English speaker, but consistently makes the same mistake, should be investigated further.

What the question is?

Another common linguistic indicator is the inability to phrase a question. In Russian, the word order for questions does not change, unlike in English, German, and formal French. Many known Russian troll accounts have posted questions which kept the word order of statements.

Post from Russian troll Instagram account Anonymous_News; note the mangled word order in the question, and the addition of other highly-charged terms in the text such as, “NoDAPL” (a reference to the contested Dakota Access Pipeline), “policebrutality” and “amerikkka,” a reference to the Ku Klux Klan. Image recovered by @UsHadrons. (Source: Instagram / Anonymous_News)

Again, other confirmed Russian Twitter trolls made the same error, as these examples from the NBC News archive show:

“Why our government doesn’t send us some help?! Phosphorus leak in Pocatello #phosphorusdisaster” — @ryanmaxwell_1, March 10, 2015. “ Why I need a credit card? What you think this cash for?” — @logan_whatsup, February 2015.

The same error shines through in this YouTube video, part of a package of measures the Russian troll operation put together in September 2014 to allege a fictitious chemical leak in the United States. The short clip consisted of an unseen man with an unclear accent yelling at a television screen which purports to show ISIS claiming responsibility for the blast. His attempt is not quite English:

“Now I wonder, what do you watching, guys?”

(The phrase comes at timestamp 00:16.)

YouTube video alleging that ISIS took responsibility for a non-existent chemical explosion in Centerville, Louisiana, on September 11, 2014. The video was traced to the Russian troll factory by Adrian Chen of the New York Times; the speaker’s non-native English buttresses that identification. (Source: YouTube / New York Times)

Again, an ostensibly English-language account which makes this mistake should be viewed with skepticism.

Searching for narrative clues

There is, of course, a difference between a Russian account and a pro-Kremlin one. Linguistic telltales are, therefore, generally insufficient to expose the troll.

Rather, the linguistic clues should be combined with narrative ones. The Russian government has developed a distinctive narrative on key geopolitical events of the last five years. These events cover different countries and continents, and are separated across time.

An account which repeatedly shares Russian government talking points on most or all of these events can justifiably be considered pro-Kremlin. The next step in identifying a pro-Kremlin account is, therefore, to search its timeline for these narrative telltales.

For example, to search for original posts mentioning Crimea from account a notorious troll account like @TEN_GOP, the formula on Twitter is:

from:TEN_GOP Crimea

To search for posts mentioning the phrase, “Ukrainian Nazi coup,” from @TEN_GOP, the formula on Twitter is:

from:TEN_GOP “Ukrainian Nazi coup”

To search for posts from @TEN_GOP mentioning the word “Crimea” between February 28 and March 18, 2014 — one of the times when the Kremlin propaganda machine as a whole launched a sustained disinformation campaign to justify Russia’s attack on Ukraine — the formula is:

from:TEN_GOP Crimea since:2014–02–28 until:2014–03–18

These searches do not return retweets, only original tweets: as such, they give an indication of what the account has posted itself, but not its entire pattern of behavior. This search technique returns only active accounts, thus @TEN_GOP is only an example, as it has been taken down by Twitter Public Policy.

Key moments and themes to search for include:

The Russian annexation of Crimea, February 28 — March 18, 2014, and especially the narrative that Ukraine was the aggressor, or a Nazi state;

The shooting-down of Malaysian Airlines flight MH17, July 17, 2014, and the subsequent investigations which demonstrated that Russia provided the fatal missile;

The heavy fighting in Ukraine in January-February 2015, and the deployment of Russian tank reinforcements, as exposed by the Atlantic Council’s report, “Hiding in Plain Sight;”

The assassination of opposition leader Boris Nemtsov, February 27, 2015;

Turkey’s shooting down of a Russian Su-24, November 24, 2015;

The siege of Aleppo, December 2016;

In the broader Syrian context, the White Helmets rescue group and Syrian girl Bana Alabed;

The sarin attack on Khan Sheikhoun in April 2017, and the resulting U.S. missile strike.

When assessing a potential troll account, it is important to look at what, if anything, it posted on all these themes. An account which posted on the majority of them, sharing Kremlin narratives, can safely be classified as a pro-Kremlin one.

If the account shares most or all of the Kremlin narratives, makes the characteristic linguistic errors and poses as an American or British user, it may be a Russian-operated troll.

Crimea and MH17, 2014 and onwards

Russian government propaganda focused especially heavily on the annexation of Crimea and the shooting-down of MH17 in 2014. A number of themes characterize Kremlin propaganda of this period, and reliably indicate pro-Kremlin trolls.

For example, Russian government outlets consistently broadcast claims that MH17 was brought down by Ukraine or the CIA, despite the weight of evidence that showed the aircraft was downed with a Buk-M1 missile made in, and brought from, Russia.

Posts on MH17 from RT. (Source: Twitter / RT_com)

Later messaging broadcast attacks on the Joint Investigation Team (JIT), a multinational group which concluded that MH17 was indeed downed with a Russian missile.