DISARMframeworks/generated_pages/incidents/I00074.md

Incident I00074: The Tactics & Tropes of the Internet Research Agency

• Summary: “Upon request by the United States Senate Select Committee on Intelligence (SSCI), New Knowledge reviewed an expansive data set of social media posts and metadata provided to SSCI by Facebook, Twitter, and Alphabet, plus a set of related data from additional platforms. The data sets were provided by the three primary platforms to serve as evidence for an investigation into the Internet Research Agency (IRA) influence operations. 
  
  “The organic post content in this data set has never previously been seen by the public. TheOur report quantifies and contextualizes Internet Research Agency (IRA) influence operations targeting American citizens from 2014 through 2017, and articulates the significance of this long-running and broad influence operation. It includes an overview of Russian influence operations, a collection of summary statistics, and a set of key takeaways that are then discussed in detail later in the document. The document includes links to full data visualizations, hosted online, that permit the reader to explore facets of the IRA-created manipulation ecosystem.”

• incident type:

• Year started:

• Countries: ,

• Found via:

• Date added:

Reference	Pub Date	Authors	Org	Archive
https://digitalcommons.unl.edu/cgi/viewcontent.cgi?article=1003&context=senatedocs	2019/10/01	Renee DiResta, Kris Shaffer, Becky Ruppel, David Sullivan, Robert Matney, Ryan Fox, Jonathan Albright, Ben Johnson	New Knowledge	https://web.archive.org/web/20240529025902/https://digitalcommons.unl.edu/cgi/viewcontent.cgi?article=1003&context=senatedocs

Technique	Description given for this incident
T0097.106 Recruiter Persona	IT00000248 “A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included: - Requests for contact with preachers from Black churches (Black_Baptist_Church) - Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus) - Soliciting volunteers to hand out fliers - Soliciting volunteers to teach self-defense classes - Offering free self-defense classes (Black Fist/Fit Black) - Requests for followers to attend political rallies - Requests for photographers to document protests - Requests for speakers at protests - Requests to protest the Westborough Baptist Church (LGBT United) - Job offers for designers to help design fliers, sites, Facebook sticker packs - Requests for female followers to send photos for a calendar - Requests for followers to send photos to be shared to the Page (Back the Badge) - Soliciting videos for a YouTube contest called “Pee on Hillary” - Encouraging people to apply to be part of a Black reality TV show - Posting a wide variety of job ads (write for BlackMattersUS and others) - Requests for lawyers to volunteer to assist with immigration cases” This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend).
T0097.202 News Outlet Persona	IT00000250 “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]” In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona).
T0097.204 Think Tank Persona	IT00000245 “[Russia’s Internet Research Agency, the IRA] pushed narratives with longform blog content. They created media properties, websites designed to produce stories that would resonate with those targeted. It appears, based on the data set provided by Alphabet, that the IRA may have also expanded into think tank-style communiques. One such page, previously unattributed to the IRA but included in the Alphabet data, was GI Analytics, a geopolitics blog with an international masthead that included American authors. This page was promoted via AdWords and YouTube videos; it has strong ties to more traditional Russian propaganda networks, which will be discussed later in this analysis. GI Analytics wrote articles articulating nuanced academic positions on a variety of sophisticated topics. From the site’s About page: ““Our purpose and mission are to provide high-quality analysis at a time when we are faced with a multitude of crises, a collapsing global economy, imperialist wars, environmental disasters, corporate greed, terrorism, deceit, GMO food, a migration crisis and a crackdown on small farmers and ranchers.”” In this example Alphabet’s technical indicators allowed them to assert that GI Analytics, which presented itself as a think tank, was a fabricated institution associated with Russia’s Internet Research Agency (T0097.204: Think Tank Persona, T0143.002: Fabricated Persona).
T0097.208 Social Cause Persona	IT00000251 “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]” In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona).
T0126.001 Call to Action to Attend	IT00000247 “A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included: - Requests for contact with preachers from Black churches (Black_Baptist_Church) - Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus) - Soliciting volunteers to hand out fliers - Soliciting volunteers to teach self-defense classes - Offering free self-defense classes (Black Fist/Fit Black) - Requests for followers to attend political rallies - Requests for photographers to document protests - Requests for speakers at protests - Requests to protest the Westborough Baptist Church (LGBT United) - Job offers for designers to help design fliers, sites, Facebook sticker packs - Requests for female followers to send photos for a calendar - Requests for followers to send photos to be shared to the Page (Back the Badge) - Soliciting videos for a YouTube contest called “Pee on Hillary” - Encouraging people to apply to be part of a Black reality TV show - Posting a wide variety of job ads (write for BlackMattersUS and others) - Requests for lawyers to volunteer to assist with immigration cases” This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend).
T0143.002 Fabricated Persona	IT00000246 “[Russia’s Internet Research Agency, the IRA] pushed narratives with longform blog content. They created media properties, websites designed to produce stories that would resonate with those targeted. It appears, based on the data set provided by Alphabet, that the IRA may have also expanded into think tank-style communiques. One such page, previously unattributed to the IRA but included in the Alphabet data, was GI Analytics, a geopolitics blog with an international masthead that included American authors. This page was promoted via AdWords and YouTube videos; it has strong ties to more traditional Russian propaganda networks, which will be discussed later in this analysis. GI Analytics wrote articles articulating nuanced academic positions on a variety of sophisticated topics. From the site’s About page: ““Our purpose and mission are to provide high-quality analysis at a time when we are faced with a multitude of crises, a collapsing global economy, imperialist wars, environmental disasters, corporate greed, terrorism, deceit, GMO food, a migration crisis and a crackdown on small farmers and ranchers.”” In this example Alphabet’s technical indicators allowed them to assert that GI Analytics, which presented itself as a think tank, was a fabricated institution associated with Russia’s Internet Research Agency (T0097.204: Think Tank Persona, T0143.002: Fabricated Persona).
T0143.002 Fabricated Persona	IT00000249 “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]” In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona).

DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW