Secret Services United

Secret Services United. Conflict in Ukraine and Russian information on Twitter

“Information confrontation” [“Informatsionnoe protivoborstvo” in Russian] is a crucial concept for understanding Moscow’s setting of cyber warfare. In this expression, the word “information” embraces any online operations.

Western doctrines in the field usually distinguish between cyber operations targeting networks and information operations tackling human perception. Instead, Russia adopts a “holistic approach” (as defined by Daniel Moore in his 2022-book “Offensive Cyber Operations”): network operations are indistinct components within a more extensive information operations framework.

As a consequence, information warfare is considered “a strategic matter that requires the coordination of many government agencies”, according to Ulrik Franke.

In 2015, Franke mentioned some of them: the Federal Security Service (FSB), the Foreign Intelligence Service (SVR), the Armed Forces, the Military Intelligence Service (GRU), the IT and mass media supervision service Roskomnadzor, the Federal Protection Service (FSO), and the Ministry for Foreign Affairs.

The same scholar concluded that “coordination of these agencies must come from the highest political level, i.e. through the Russian National Security Council (which is part of the Presidential Administration)”.

Hence, a Twitter accounts analysis could be a mirror for Russian strategies.

Alexander Alimov on Twitter, a cyber investigation an a Russian official’s account

Twitter

Alexander Alimov is the Russian Deputy Permanent Representative to the United Nations Office in Geneva. He has an active account on Twitter: “@A__Alimov”, with a blue verified badge confirming the authenticity of the profile. In the description, he defines himself as a “Modestly talented diplomat” and specifies: “Views are my own”.

His latest tweets cover the Russian “military operation” in Ukraine, and he takes the side of his country. An investigation of his account can tell a little bit more.

Tinfoleak, the ratio of the tweets

Tinfoleak.com is “a website where you can get detailed info about a Twitter user”. You can query the account name, and you can get via email a report on the source of the tweets, the location from where they are sent and many other details.

Tinfoleak on Alimov’s account

Tinfoleak dossier on Alimov’s account shows the profile creation date (the 23rd of April 2019), the location from where he tweets (Geneva, Switzerland), the number of followers (over 10,000) and the number of tweets (almost 10,000). We can see that the account is dynamic: the ratio of tweets is over 8 per day.

The connections on Twitter

The number of the diplomat’s followers is relatively high, as we can reasonably expect for a public figure like Alimov. He is the catalyst of information campaigns and often retweets videos, images, and news from the Ukrainian warfare front. His account is public: everyone can follow him.

However, a significant parameter is considering the accounts Alimov decided to follow. They are almost 400, and the Russian deputy representative should consider them attractive to his activity.

Botometer, the types of Twitter bots

A helpful tool providing more information on Twitter accounts is “Botometer” (formerly “BotOrNot”), created by Indiana University (USA).

Its primary purpose is to check the activity of an account and give it a score. Higher ratings mean the executed actions are more likely driven by automated programs (bots): these accounts are supposedly fake, not representing an actual person.

The score goes from 0 to 5, where 5 is the highest. The evaluation is based on multiple criteria since there are different types of Twitter bots.

The application identifies six types of them:

“1) Echo-chamber: accounts that engage in follow-back groups and share and delete political content in high volume;
2) Fake followers: bots purchased to increase follower counts;
3) Financial: bots that post using “cashtags” [A cashtag is a hashtag used in the financial field to track stock quotes; instead of a pound symbol (“#”), it’s a dollar sign (“$”)];
4) Self-declared: bots from botwiki.org;
5) Spammer: accounts labelled as spambots from several datasets;
6) Other: miscellaneous other bots obtained from manual annotation, user feedback, etc.”.

The service lists these six distinct categories for every analyzed account, with corresponding evaluations.

In addition, Botometer lets us view the profiles Alimov is following in a detailed list, which you can download. Every account has a score; we can discover more by scanning those with higher outcomes.

The Russian correspondent Medvedev’s account

Medvedev Profile

The account “@0nQIPq0WCONIu0G”, followed by Alimov, scored 4.4 out of 5. It belongs to a Russian war correspondent from Donbas, Ukraine: Voenkor Medvedev, tweeting on the ongoing conflict.

Medvedev counts over 10,000 followers, and he follows only 159 people. Botometer allows us to check the status of these followers. The application labelled a lot of them as “not active”.

Some of Medvedev’s followers

“@sadikova_arafat” follows Medvedev. This account was created in June and has no profile images or descriptions. It is “not active”, according to Botometer.

Another Medvedev follower is “@reti_andrei”, an account created in May. No profile images or descriptions. Neither this one is active, according to Botometer.

The account “@Lightni51531377”, created in May, follows Medvedev, too. Again, there are no images or descriptions. And again, Botometer labels it as “not active”.

These accounts don’t seem managed by real people. The 10,000 Medvedev followers could be overestimated.

Karpushev, a Donetsk citizen

Botometer on Karpushev

Another account followed by Alimov is “@AleksKarpushev”. Alexey Karpushev describes himself as an “indigenous of Gorlovka”, a city of regional significance in the Donetsk Oblast of eastern Ukraine. He also tweets (in Russian) information and points of view on the Ukrainian conflict.

Botometer scores the account 4.4 out of 5. The criterion of fake followers achieves punctuation of 3.6.

Yet, scanning the data, we can see that Karpushev counts over 19,000 followers. Still, at the same time, he is following around 15,000 accounts. The two numbers could be related.

Follerme, following-to-follower ratio

Foller.me is another analytic tool for Twitter. “The application gives you rich insights about any public Twitter profile”, the official website explains. Moreover, it shows a ratio between followers and following accounts.

Indeed, on social media, the users often try to have more followers by following other profiles and getting followed back as an act of kindness.

Karpushev’s following-to-follower ratio

Therefore, the “follower-to-following ratio” should indicate the genuineness of the followers. A high score of this ratio would mean more people follow Karpushev “out of good will, not follow back”. @AleksKarpushev score is relatively low: 1.29 (Alimov instead has a followers ratio of 25.98).

However, this score could be unimportant since it doesn’t check the quality of the followers. Following back could be a simple expression of interest. Yet, reviewing Karpushev’s followers, we can find a known pattern.

Karpushev followers

“@Jerry44257112” follows Karpushev. Its description consists of the only word “Gamer”, and the account (created in June) has a photo of Russian President Vladimir Putin as a profile image. Twitter “limited” this user’s capabilities for suspicious activities as of the 12th of July.

Karpushev Follower

In the list of Karpushev followers is “@GannaL6”. It has no description but a stylized picture of a woman as a profile image. The account, created in June as the previous one, “is not active”, according to Botometer.

The account “@Ekoghofar”, created in May, is a Karpushev follower, too. No description and no image in the profile. Neither this one is “active”, according to Botometer.

The probability they are fake accounts is relatively high.

Other Alimov following accounts

Alimov follows other significant accounts, and every one of them has a story behind it.

The 13-year-old writer

Among these, “@FainaSavenkova” is the private account of a 13-Year-Old Luhansk (Ukraine) child writer. Faina Savenkova is the author of theatre plays, short stories and science fiction novels in Russian.

She became notorious as she was added to the Ukrainian “Myrotvorets” (“Peacemaker” in English) database. This is a public online list of people “whose actions have signs of crimes against the national security of Ukraine”, according to the parent organization.

(The list concerned G7 ambassadors and the EU for its use and the publication of personal data.

In 2016, an inquiry on it by the Ukrainian Parliament Commissioner for Human Rights, Valeria Lutkovska, received a response from the Security Service of Ukraine (SBU): “Currently Ukraine lacks a legislative mechanism for blocking the user access to Internet resources used for posting content”).

The double accounts of a Chilean citizen

Amid Alimov’s following profiles, there are two accounts (“@realGonzaloLira” and “@GonzaloLira1968”) of the same person, Gonzalo Lira, who describes himself as a “Chilean in Kharkiv” (Kharkiv is the second-largest city in Ukraine).

Lira dismissed his first account (@realGonzaloLira) after the Security Service of Ukraine (SBU) allegedly held him in custody for some days. According to what he said, the agents seized his electronic devices during the detention. Therefore, when they released him, he had to open a second account (on the 22nd of April): @GonzaloLira1968.

Both of the accounts have similar tweets fixed, reporting the same (open) list of names, which supposedly reveal “the truth about Zelensky regime”:

A coordination

The accounts followed by Alimov don’t stop here. Among them are also theologians, media and celebrities with thousands of followers.

Indeed, we saw a whole network consisting of authentic and fake accounts and boosting Russian ideas and points of view.

We can mention another influential profile, followed by Alimov. It is “@imerkouri”, the private account of the journalist Ilias Mercury, counting more than 140,000 followers.

The website spisok-putina.org (“Putin’s list” in English), a database of the “Free Russia Forum“, which aims to collect data on crimes in Russia, categorized Mercury as a “propagandist”.

According to this website, “in 2015, hackers leaked his correspondence with the Russian Deputy Head of the Office of Internal Policy of the Presidential Administration, Timur Prokopenko“. The revelations showed that Mercury “received instructions from the authorities on how to ‘correctly’ respond to particular news stories”. Not only. He even coordinated “his tweets with his curator from the Presidential Administration“.