Russia’s Twitter Campaign: Influencing Perceptions of the Syrian Conflict
In the era of “fake news,” it is becoming increasingly difficult to distinguish falsehoods from reality, a problem that modern technology has only exacerbated. The Syrian conflict has fallen victim to this phenomenon, as a wealth of information has been generated online originating from all sides of the conflict that includes both false information and propaganda. This problem has implications not only for Syrians, but for other countries that have been targeted by disinformation campaigns; in this case, primarily the United States, and for the international community as a whole. The false or distorted narratives pushed by parties to the conflict have serious ramifications for the potential for being able to establish a widely-accepted narrative of the Syrian conflict in the future at the international level. The absence of a shared narrative would prevent the international community from taking a strong role in accountability mechanisms if there are deep disagreements about the occurrence of crimes in Syria and culpability for those crimes.
This short report analyzes a set of tweets from accounts that have been linked to Russia’s Internet Research Agency. The tweets include a combination of information that is blatantly false and information that is true, but shared in a way that promotes xenophobic, anti-refugee sentiments. SJAC recognizes that many parties to the conflict have been engaged in disinformation efforts, and is not attempting to identify Russia as the sole culprit; rather, this dataset of IRA-linked accounts was most easily accessible and represents one facet of a larger problem with online misinformation about Syria. This report begins with an overview of the accounts, including their supposed locations, number of followers, and dates on which they were created. It then identifies the time periods during which the accounts were most active, and attempts to understand the messages spread by the accounts and their potential implications for the way that sentiments about Syrian refugees and the Syrian conflict more broadly are influenced by these online campaigns.
What we know about Twitter’s release of tweets:
On October 17th, Twitter released more than ten million tweets from accounts linked to Russia’s Internet Research Agency (IRA) and to Iran. A vast majority of the tweets, approximately 9 million, were from 3,841 accounts that Twitter identified as directly affiliated with the IRA. The IRA is a Russian company which conducts online operations in support of Russian economic and political goals. The remaining one million tweets came from 770 accounts which were likely originating in Iran, though not directly affiliated with a particular company. The activity period of the accounts ranges from 2009 until September 2018, though the vast majority were active from 2015 to 2017. The accounts have since been suspended, and as a result the tweets have been deleted from Twitter. This analysis includes only tweets from IRA-affiliated accounts, as the IRA dataset provides a clearer link to a single agency, as opposed to the Iran dataset where the entities behind the accounts are less clear.
SJAC downloaded a copy of the tweets, and isolated those that included references to the Syrian conflict in the form of particular words: “Syria,” “Assad,” and the names of Syria’s fourteen governorates (including multiple common spellings of each). SJAC recognizes that this method did not capture every relevant tweet; for example, references to “Syria” in other languages was not included. SJAC analyzed only English-language tweets, as multi-lingual analysis was beyond SJAC’s technical capability. SJAC did complete a basic analysis of the Arabic-language tweets, but they were dwarfed in number by the English-language tweets and largely contained only links to Arabic news sites. SJAC determined that its methodology method was most effective for reducing the number of tweets to a manageable number and capturing the general content of tweets related to the Syrian conflict directed at a Western audience from these accounts. The process resulted in 32,986 tweets from 1,538 IRA-linked accounts.
When were the accounts created?
The IRA-linked accounts that tweeted about Syria were largely created in late 2013 and early 2014, prior to Russia’s military intervention in the Syrian conflict. The spikes in the frequency with which accounts were created in the graph below are seemingly random; an analysis of the tweets published by the accounts on the days with a high frequency of creation shows that the accounts most often did not send their first tweets until months after the account was created, and the most common dates did not seem to correspond to significant events in the Syrian conflict. This may be an effort to avoid detection by Twitter.
Accounts Created Per Day
How many followers did the accounts have?
A vast majority of IRA-linked accounts had fewer than 2,000 followers. Though a few accounts had upwards of 40,000 followers, most accounts had a relatively insignificant following.
Where did the accounts’ users claim to be located?
A majority of the accounts that referenced Syria utilized Twitter’s “Location” feature to share the supposed location of their account. In most cases, accounts specified a city, but some only specified the country. Russian and US locations dominated, with 46 percent of the accounts advertising their location as somewhere in Russia and 35 percent of accounts advertising their location as somewhere in the United States. The remainder of accounts that utilized the Location feature were spread throughout Europe and the Levant. Thirteen percent of IRA-linked accounts that referenced Syria did not list any location. Notably, the tweets from accounts which claimed to be located somewhere inside Syria tweeted almost exclusively in Arabic. This indicates that the accounts were likely aiming to target the Syrian population with their messages, as opposed to Western populations, by embodying the persona of an individual living inside Syria.
What does the distribution of tweets that reference Syria look like over time?
Tweet Timeline
The graph above shows four noticeable spikes in activity, which correspond with major events. It is worth noting that the graph above does not show data prior to 2014, but SJAC’s dataset did include 226 tweets between July 2011 and December 2013, with no significant spikes in frequency during this time period.
October 2015 – December 2015. The period from October 1, 2015 through December 31, 2015 included 5,749 tweets, or 17.4 percent of all tweets referencing Syria. This timeframe aligns with Russia’s intervention in the Syrian conflict, which began on September 30, 2015. This period also encompasses the series of terrorist attacks that occurred across Paris on November 13th, 2015, leaving 137 dead and hundreds more injured. An analysis of the hashtags employed in the tweets during this time period give an indication of the messages the tweets were trying to promote. The following chart shows the most frequently used hashtags during the final quarter of 2015, after excluding hashtags which referenced only locations, actors, and the hashtags “#news,” “#breaking,” and “#world.” The messages here fall into three categories: anti-refugee sentiments, anti-Turkish sentiments, and political sentiments which directly reference American politics. The latter is unsurprising given other reports describing the IRA’s attempts to influence American politics.
Similarly, the hashtag #SyrianRefugees falls at the intersection of American politics and the story dominating the news cycle during this time period. Following the Paris terror attacks in November 2015, the IRA-linked accounts focused heavily on the issue of refugees, with a plurality of tweets focused on the topic. To confirm the presence of this pattern, SJAC conducted an in-depth qualitative review of a random sample of 10 percent of the 5,749 tweets that referenced the Syrian conflict during this time period. One-fifth of the tweets analyzed included blatant anti-refugee rhetoric, typically in the context of Syrian refugees in the United States, such as:
“#Syrian Muslim invasion begins in #NewOrleans. Have you seen anything about it on Media?”
“People should #PrayforSyria only in terms of no refugees (aka terrorist) coming from Syria”
“US Governors to Ban #Syrian #Refugees after #Paris #Terror Attacks #BeingPatriotic”
Another fifth of the tweets included news about Syrian refugees, but could not be classified as clearly promoting anti-refugee sentiments, and more than half of the tweets overall related to refugees or the Paris attacks in some way. This focus on refugees is not unexpected; the IRA likely saw the focus on refugees in the news cycle as an opportunity to promote anti-refugee rhetoric in its attempts to bolster the right-wing in many foreign countries that were dealing with the controversy of accepting Syrian refugees. More broadly, the IRA likely identified the dominance of the refugee issue in the news cycle as an opportunity to promote its narrative justifying military intervention in the Syrian conflict in the name of fighting terrorism.
March 22, 2016. The second spike in Twitter activity marked the March 2016 suicide bombings in Brussels, which killed 32 and wounded more than 300 in separate attacks at the airport and in a metro station. 470 tweets referencing Syria were posted on that date by 109 accounts. March 22nd is a lone spike; on March 23rd, the number of tweets referencing Syria dropped to 13, well below the daily average of 29.5 for the period between 2014 and 2018. Of the 470 tweets on March 22, 92 percent included the hashtag #IslamKills, and 89 percent included a reference to “refugees.” Other common hashtags included #RefugeesAreISIS and #NoRefugeesWelcome. The IRA-linked accounts took advantage of the incident to promote anti-Muslim and anti-refugee rhetoric, to relatively great effect; the tweets posted on March 22nd collectively received more than 350 retweets.
September 16th-17th, 2016. September 16th and 17th marked a noteworthy 405 tweets in just two days, which corresponded with two unrelated events that sparked significant activity by the IRA-linked accounts. On September 16th, an ISIS-motivated attacker drove a truck into a crowd in New York City, killing eight people. The tweets on this day and the following day were very similar to those that appeared on March 22nd, indicating that the IRA-linked accounts had a proclivity for responding to terror attacks with anti-refugee and anti-Muslim rhetoric.
April 2017. The third clear spike on the graph above marks the chemical attacks in Khan Sheikhoun on April 4th, 2017, when 2,826 tweets were sent from IRA-linked accounts in the ten-day period following the attack. This spike indicated a clear focus by the IRA-linked accounts not on the actions of the Syrian government, but on the response by the United States. Though dozens of chemical attacks were confirmed in 2014 – 2017, IRA-linked accounts were disproportionately interested in the Khan Sheikhoun event.
Tweets Mentioning Syria in the Aftermath of the Khan Sheikhoun Attacks
The single-day spike did not come until April 7th (shown above) when 895 tweets were sent from IRA-linked accounts, presumably in response to the targeting of Al Shayrat airfield by the United States on the night of April 6th. This pattern is also displayed in the graph below, which shows the pattern of tweets which mentioned either “chemical” or “sarin” or “chlorine” in 2015 – 2017. The most obvious spike in tweet activity is apparent around the Khan Sheikhoun attacks, but the second-highest spike in June 2017 corresponds to US government statements which accused the Syrian government of preparing for another chemical attack and warned that the Syrian government would “pay a heavy price” in the case of another chemical attack.
Tweets Mentioning “Chemical” or “Sarin” or “Chlorine”
Perhaps the most popular hashtag related to the Khan Sheikhoun attack was “#SyriaHoax,” which, in the day after the retaliatory airstrikes on Al Shayrat Airbase, was the number one trending hashtag in many countries, including the United States. In this particular dataset, only 201 instances of “#SyriaHoax” appeared in SJAC’s dataset in the aftermath of the Khan Sheikhoun attacks, 183 of which came from a single account. Though #SyriaHoax is understood to be derived from IRA-linked accounts, its frequency in this particular dataset was too small for SJAC to conduct meaningful analysis on its use.
Conclusions
SJAC remains concerned over the spread of disinformation in the Syrian context, particularly by parties to the conflict, and is discouraged that so much of the information propagated by these accounts includes xenophobic, anti-refugee rhetoric. Though much research has been done on how to identify fake accounts and falsified news, the widespread use of social media makes it difficult to keep such activity in check. Civil society organizations must consider this issue as they explore opportunities to advocate for refugee rights and the safety of Syrian refugees as Russia continues to pressure Syrian refugees to return and influence the narrative of the conflict as a whole.
For more information or to provide feedback, please contact SJAC at [email protected] and follow us on Facebook and Twitter.