Russian trolls attacked 2016 election. Clemson researchers have tweets to prove it.

Bristow Marchant | The State

COLUMBIA — When U.S. Sen. Lindsey Graham of South Carolina launched his bid for president in 2015, he was blasted by plenty of Twitter users.

“Lindsey Grahamnesty, Jeb (Bush), (Marco) Rubio, (John) McCain spend more time attacking conservatives than Dems,” tweeted @heyits_toby on July 12 of that year.

“@LindseyGrahamSC You SIR LINDSEY GRAHAM YOUR GOP HAS FAILED THIS COUNTRY! I SUPPORT TRUMP 2016,” was tweeted at the senator by both @Pati_Cooper and @KarenParker93 on July 13.

When Graham ended his campaign on Dec. 21, @Jeblary2016 posted, “#ChristmasWeek has started and we already have a present — @LindseyGrahamSC is out of the race.”

News moves fast. So do we.

Long after the end of the 2016 election, those tweets and roughly 3 million others live on in a Clemson University database of tweets from Twitter accounts identified by U.S. officials as belonging to Russian trolls who attempted to influence U.S. politics.

Compiled by communications professor Darren Linvill and economics professor Patrick Warren, the trove of election-related tweets shines light on how the trolls — Russians with fake social media accounts who tried to stir up unrest — operated. The team’s research already has identified patterns in how the users of more than 3,000 fake accounts tried to influence U.S. voters, according to an academic paper now undergoing peer review.

“We know what and when” they tweeted, Warren said. “Now, we’re digging into the strategy. You think they’re going to do this, but then that’s not what they did.”

After months of studying the Twitter trove, the real work of analyzing the Russian strategy “is only getting started,” Linvill said.

Troll factories and troll widows

The two professors created the database using Clemson University’s Social Media Listening Center, which uses powerful analytics software to monitor online activity across the web.

“It can scrape a huge amount of data off social media platforms — Facebook, Instagram and, lucky for us, Twitter,” Linvill said.

When the U.S. House intelligence committee last November released a list of Twitter accounts identified as being operated by Russia’s Internet Research Agency — a Russian government-run “troll factory” — Linvill and Warren realized Clemson’s media center could pull all of the accounts’ past activity, even after Twitter had deleted the accounts.

Their academic paper tracks Twitter activity from June 2015 to the end of 2017.

Making the database was a labor-intensive process. Clemson’s software only could download 50,000 tweets a day and the researchers had to go through them to exclude people they could identify, via research, as real Americans.

“Real people tweet like real people,” Linvill said. “They talk about their mom, something that happened in class, life events. Trolls won’t do this.”

Reviewing the tweets was time consuming. “I read a lot of tweets,” Linvill said, adding, for months, “our wives were troll widows.”

The researchers’ work is being noticed nationwide. The Washington Post made extensive use of Clemson’s findings in reporting on a burst of activity from Russian troll accounts about a month before the 2016 election. The same chart shows a second spike in August 2017.

“We don’t have a perfect story for that (August) spike, yet, but it is overwhelmingly right (wing) trolls,” Warren said in an email.

‘Fake news’ doesn’t work

Linvill and Warren identified five categories of trolls from their data.

There were right-wing trolls like those that attacked Graham in the GOP primary but also posted nationalistic, anti-immigrant and outright racist content.

There also were many left-wing accounts that seemed to target supporters of Bernie Sanders or Green Party candidate Jill Stein. Some of the left-wing accounts also tweeted at S.C. politicians.

“@LindseyGrahamSC on @realDonaldTrump ‘I’ll Beat His Brains out’ How is it possible if he has no brains?” posted @Jenn_Abrams on Aug. 26, 2015. Meanwhile, on Oct. 12, 2015, @happkendrahappy tweeted about the “GOP’s shameful use of Taxpayer $: @TGowdySC ‘abandoned Benghazi’ to focus on damaging Hillary (Clinton).”

Other accounts were “hashtag gamers” who tried to create or hijack trending hashtags.

Other accounts created “news feeds” that aggregated local news from 38 seemingly random cities.

“They would choose two or three local sites and mirror their content,” Warren said, noting the trolls stuck pretty closely to actual news stories.

“They might put their thumb on violent crime,” Warren said. “But, for instance, they don’t use ‘black’ or ‘Trump’ or ‘Clinton’ more than the sites they mirror.”

“I’ve read speculation that they were waiting for a future date” to introduce more obviously biased content, “but then it never happened,” Linvill said, perhaps because the accounts were identified and suspended before the plan could be activated.

Only a few accounts in the Clemson researchers’ final category — “fearmonger” — spread deliberately “fake news” early on. The researchers say many of these accounts went dark and may have been shut down after spreading a false story about a salmonella outbreak around Thanksgiving 2015.

A ‘normal work day’

In February, the Justice Department announced the indictment of 13 Russian nationals, accused of carrying out a months-long, Kremlin-backed social media campaign, attacking the presidential campaign of Democrat Clinton and boosting Republican Trump. In addition to social media posts, the campaign also involved buying online ads with fakes names and even organizing political rallies.

Some of those indicted presumably were behind the activity in Clemson’s database. Although Linvill and Warren can’t tie the Russian hackers to specific Twitter handles, they feel like they got a sense of the agents’ day-to-day activities.

“You can see they have a normal work day,” Linvill said. “For one hour, they would be a right (wing) troll, then for one hour, they would be a left (left) troll, then a hashtag gamer.”

The professors are quick to point out that troll accounts are run by real people, as opposed to bots that are fully automated.

Both professors expect their current list of troll-run Twitter accounts to continue to grow.

“I hope so because that means they (Twitter) are still shutting down accounts,” forcing the trolls to open up new accounts, Linvill said. “If we don’t get bigger, it’s a problem. (National Intelligence Director) Dan Coats said the Russians believe 2016 was a success and that they are going to continue to do this.”