Identifying State-Run Troll Farms: Key Signs and Digital Forensics

Logically has developed models that can identify behaviors associated with coordinated inauthentic behavior (CIB) at scale. By looking at predefined behaviors, accounts with common patterns of suspicious coordination of messages can be identified. These behaviors include co-reposting, co-hashtags, co-mentions, and co-sharing of the same images or URLs. This was used to determine that disinformation campaigns during Argentina's election were not circulating organically but were coordinated. However, AI can only go so far as these interactions are not always harmful and can be used in fandom communities.

To detect coordinated inauthentic behavior, researchers look at patterns at a large scale. If a small number of accounts are trying to replicate the organic diversity of a large number of accounts, there are different ways they will fail. For example, campaigns may not move like an organic campaign of people just coming online together. Sometimes campaigns with actors who didn't try to hide their identities can be detected through email addresses or IP addresses.

Coordinated Inauthentic Behavior (CIB) is an organized online tactic used to reinforce a message or narrative. Unlike a single fake account, CIB involves many accounts, pages, or groups acting simultaneously to make the spread of an idea seem natural or organic. The goal is to make a narrative appear popular even though it was planned from the beginning. Through CIB attacks, a narrative spreads faster because many accounts simultaneously post, comment, like, or share the same message. The coordinated activity is not necessarily false; it can be partially true, out of context, or true but amplified in an artificial way. Even factual information can be part of information manipulation if the way it is disseminated is planned. Two main types include astroturfing (creating illusion of widespread public support) and sock puppet (one person controlling multiple accounts). These tactics can affect any topic from politics to entertainment. The Department of Migrant Workers confirmed that two Filipino crew members died in the Black Sea amid drone strikes on ships, with eight more injured. The DMW has issued an advisory reminding Filipino seafarers of their rights in warlike areas, including the right to refuse sailing to high-risk zones without discrimination.

Coordinated Inauthentic Behavior (CIB) refers to organized efforts by actors to manipulate information ecosystems through automated means. This includes fake news, bot networks, and coordinated campaigns that exploit open data structures. The problem is particularly severe because it can be monetized through AI, making it cheaper to create inauthentic content than authentic content.

Platforms use a range of data and information to detect coordinated inauthentic behavior, including whether people are controlling particular things from the same device, proprietary data, other behavioral signals, and IP address elements. When all three aspects are identified, platforms publish this information transparently on a month-by-month basis, identifying where networks originated, where they were targeting, the particular narrative involved, the number of accounts and followers involved, and tracking recidivism (networks returning under slightly different guises).

The Internet Research Agency (IRA) was indicted for federal crimes related to interfering with the 2016 presidential election. The IRA was a structured organization with a management group and multiple departments. One department, the Translator Project, focused on the U.S. population with over 80 employees. By July 2016, IRA operatives posed as politically and socially active Americans, established social media pages and groups, and purchased political advertisements. The key legal issue was not the substance of their messages but their conspiracy to defraud by lying about their identity—they were Russians on the payroll of a foreign company, not Americans expressing their own viewpoints.

The Internet Research Agency (IRA), founded by Yevgeny Prigozhin in 2013 with a $1 million monthly budget, employed approximately 300 workers producing 30,000 posts. Employees were paid $900-$1,200 monthly and hired through data entry listings before signing NDAs. They created two-tier account systems: Tier 1 purchased existing accounts; Tier 2 created supporting accounts that followed businesses, joined groups, and posted non-political content every three days. Early work focused on regional issues like Ukrainian annexation propaganda using repetitive association tactics. The IRA aggressively expanded for the 2016 U.S. elections, with documented evidence showing Americans' political memories were partially manipulated by the Russian government.

The Internet Research Agency (IRA) was a Russian troll farm operating between 2014-2016, employing approximately 300 people under Yevgeny Prigozhin. During the 2014 Crimea annexation, Russian trolls exploited institutional weaknesses in Ukraine to create distrust and legitimize intervention. Trolls were paid 40,000 rubles monthly for 12-hour shifts. The IRA later moved to the US, employing English speakers to create the illusion of American patriotism. They created fake pages like Blacktivist, Secured Borders, United Muslims of America, and Army of Jesus, designed to encourage protests and conflicts. The IRA funded local activist groups with $80,000 and generated discussions between pages it created.

The Internet Research Agency (IRA) is a Russian organization based in St. Petersburg whose mission was to destabilize the American information space. Rather than promoting specific messages, the IRA created thousands of fake accounts across Facebook, Instagram, Twitter, and YouTube, simultaneously supporting both sides of controversial issues like Black Lives Matter and opposing them. Between 2015-2017, over 30 million Americans actively shared IRA content. The IRA also organized real-world protests by funding opposing demonstrations at the same locations, creating chaos in the physical world as well as the digital one.

The Internet Research Agency (IRA) is a Russian organization founded by Yevgeny Prigozhin, who later founded the Wagner Group. The IRA was a state-sponsored disinformation operation that sent teams to the United States to study American culture and identify polarizing issues such as immigration, race, religion, Black Lives Matter, and gun rights. Workers received instructions to comment on major American media outlets like the New York Times and Washington Post, using inflammatory language to stir controversy. They were trained using House of Cards to understand American political dynamics and received English grammar lessons to sound authentic.

The U.S. government distinguishes between foreign malign influence (which involves deliberate manipulation by foreign actors) and general misinformation. Rather than compelling content moderation (which would make the government arbiters of truth and raise First Amendment concerns), the approach involves inviting collaboration with social media companies. The government shares information with platforms that can then decide based on their own terms of service whether content violates their policies. This framework focuses specifically on reducing the ability of Russia, China, Iran, and others to use platforms for foreign influence campaigns, where there is mutual interest in reducing harmful activity.

Authoritarian regimes invest enormous resources in coordinated campaigns to undermine the United States through anonymous social media accounts, automated bot farms, state-controlled media, and covert influence operations backed by effectively unlimited state resources. China alone spends approximately 40 billion dollars annually on propaganda and influence operations. These campaigns aim to constrain America's ability to confront hostile regimes like Iran by manufacturing the illusion of widespread domestic opposition to national security policies. Foreign influence operations extend into American universities, with hundreds of millions of dollars flowing from sanctioned Chinese nuclear laboratories to institutions like Harvard. United Front networks like the Singham Network and Code Pink drive anti-AI sentiment to discourage American investment in artificial intelligence. Chinese and Iranian influence operations skew toward leftist anti-colonial ideology, while Russia employs a more chaotic approach including both pro-Black Lives Matter and white nationalist posts.

A useful analytical framework for understanding influence operations is the Actor-Content-Behavior (ABC) model: (1) Actor refers to who is behind the activity, whether domestic or foreign, government or non-state actors; (2) Content refers to what is being disseminated, including false information; (3) Behavior refers to the tactics, techniques, and procedures used, such as coordinated inauthentic behavior. This framework helps distinguish between different types of influence operations and informs appropriate responses, avoiding the trap of applying the same solutions to all problems.

Misinformation spreads through psychological mechanisms like the illusion of truth effect, where repeated exposure increases perceived credibility regardless of accuracy. This concept, originating from Nazi propaganda strategies, exploits human cognitive laziness. Modern social media algorithms amplify this by creating echo chambers that continuously reinforce existing beliefs. Foreign influence operations leverage educational connections, such as Koni Bakri's S3 from Tel Aviv University, to establish perceived legitimacy. These operations utilize vendor networks, including production houses, who receive payment from foreign governments to disseminate narratives across social media platforms. Under Indonesia's 1945 Constitution, Article 11 mandates that the President obtain DPR approval before making international agreements, ensuring democratic oversight. International policy decisions must balance diplomatic engagement with strict legal compliance to preserve national sovereignty and international credibility.

The US intelligence community is both critical and restricted in addressing foreign disinformation. The IC consists of 16-17 separate elements, with only a few like the CIA and NSA focusing on foreign disinformation. The CIA is prohibited by statute from domestic operations, and the NSA has an exclusively foreign focus. This creates a gap between uncovering foreign disinformation and taking action. The First Amendment prohibits government from using coercion or force against social media platforms to remove content. Supreme Court cases have established that social media platforms themselves have First Amendment rights to curate, edit, and delete content. Section 230 of the Communications Decency Act immunizes platforms from liability for content they remove in good faith.