High-profile Western media outlets repeatedly infiltrated by pro-Kremlin trolls

A major influence operation is systematically manipulating Western media to spread propaganda and disinformation that supports Kremlin interests, a report from Cardiff University concludes.

Researchers from the Crime and Security Research Institute (now known as the Security, Crime, and Intelligence Innovation Institute) have found evidence that 32 prominent media outlets across 16 countries have been targeted via their reader comments sections.

Websites which have been repeatedly subjected to these activities include: The Daily Mail; Daily Express and The Times in the UK; America’s Fox News and Washington Post; Le Figaro in France; Der Spiegel and Die Welt in Germany; and Italy’s La Stampa.

The team identified 242 stories where provocative pro-Russian or anti-Western statements were posted in reaction to articles of relevance to Russia. These comments were then fed back to a range of Russian-language media outlets who used them as the basis of stories about politically controversial events.

They were also reported on by other ‘fringe media’ and websites with track records of spreading disinformation and propaganda, and some that have been linked by Western security services to Russian intelligence agencies.

This influence operation was uncovered as part of research into online activities amid tensions between Ukraine and Russia earlier this year. But researchers believe the use of these tactics has been escalating since 2018.

Director of the Crime and Security Research Institute Professor Martin Innes, who heads the Open Source Communications Analytics Research (OSCAR) programme said: “This influence campaign is especially significant due to its international scale and its sophisticated manipulation of a wide range of media outlets, websites and social media in a co-ordinated way. By hijacking the comments sections of Western media brands, it has been able to present its propaganda as indicative of mainstream opinion.

“The Western media outlets we investigated are especially vulnerable to this kind of manipulation, with no security measures in place to prevent, deter or detect this kind of activity. Trolls have been able to easily switch between personas and identities, which is something the technology actually enables.”

For their analysis, researchers employed data science pattern recognition and detection techniques to reader comments, which illuminated a series of unusual behaviours associated with some accounts posting pro-Kremlin content. These multiple inauthenticity and co-ordination signals, although individually relatively ‘weak’, when aggregated together, suggest that the commenting activity may be orchestrated.

Some of the commenting platforms allow other users to vote on posts. Pro-Kremlin comments repeatedly received an unusually high number and proportion of ‘up-votes’ when compared with typical messages by ‘normal’ users.

Detailed forensic behavioural analysis of account profiles posting pro-Kremlin comments identifies that some of these users are repeatedly changing their personas and locations; one account of interest had 69 location changes and 549 changes of name since its creation in June last year.

The report says there was also evidence of co-ordination between Russian state-owned media and outlets linked to the non-state Patriot Media Group, which were observing and drawing upon these reader comments.

Subsequent articles, using headlines such as “Daily Mail readers say…” and “Readers of Der Spiegel think…” were published to suggest there is extensive support among Western citizens for Russia or President Putin. These Russian-language stories also spread to audiences in Central and Eastern Europe, most prominently in Bulgaria.

Professor Innes said: “As mainstream social media platforms have become more alert to the risks of foreign state influence operations, so disinformation actors and propagandists have been seeking new vulnerabilities in the media ecosystem to exploit. By adopting a ‘full spectrum’ media strategy that blends together information from social and mainstream media outlets, this sophisticated campaign has had the potential to shape the thoughts, emotions and behaviour of several diverse international audiences in relation to high-profile media stories.

“Most importantly, the particular tactics and techniques used to ‘hack’ the comments function in the media ecosystem make it almost impossible to attribute responsibility for the pro-Kremlin trolling behaviour on the basis of publicly available open-source data. It is therefore vital that media companies running participatory websites are more transparent about how they are tackling disinformation and more proactive in preventing it.”

The OSCAR programme at Cardiff University’s Crime and Security Research Institute is a large-scale long-term research programme designed to better understand the causes and consequences of disinformation, which has generated a number of peer-reviewed publications. Part of this work has been funded by UK Government and it was via this support that researchers identified the influence operation processes described in detail in this latest report.