Executive Summary

  • This article will explain the Modus operandi(M.O.) of troll farms. It is based on our detailed research & case-study of two different troll farms, through these two cases you will be able to understand the whole process of operation of a troll farm/troll factory.
  • The organised attacks by these troll farms hamper’s ones ability to think clearly and differenciate between the fake news and actual news, just like Alzheimer’s it clogs your thinking ability and your decision making ability.
  • The first case “The Birth of a troll farm” is about how a troll farm is established- their creation, testing and then handover phases are covered.
  • This upcoming troll farm behavior suggested that it was operated by bot and was developed by some Japanese company.
  • The second case is about an already established troll farm that was trying to project a clean image of Chinese government and establish or narrative of happy and prosperous Uyghurs in the Xinjiang regions.
  • This troll farm was targeting 6 researchers and activists, working for the welfare of Uyghurs, by constantly tagging them in a series of posts. Some 500+ posts with same news link was tweeted at a time, tagging all 6 or 5 or 4 of them.

Case-1: The Birth of a Troll Farm:

First lets understand what is a troll farm:

A troll farm or troll factory is an institutionalized group of internet trolls that seeks to interfere in political opinions and decision-making. Normally operated to trend and spread a particular agenda of an individual, a company or even a state.

Recently, We came across a troll farm which was about to start trolling. These accounts were created recently and were looking for a buyer. This would be a great case study to make you understand the journey of a troll farm.
A new troll farm goes through three different phases from origin to the time it gets finally established.

Phase 1: Origination

We have a list of 102 accounts, all of these accounts have their 1st reply to an account AnnaAmaury (In the middle with a white dog), and in Japanese language. 58 of these accounts are created in January and they have 0 followers and maximum following of 4.

Twitter ID of the 102 accounts of this troll farm
Bokeh Plot

All these accounts are replying to the same account (@AnnaAmaury), the central node

From this graph we can see that the maximum follower count is 4, while the max status count goes upto 800 (Colour and bubble size corresponds to status count)

rmtsm_accounts_created_at_timeline

Most of these accounts are created in January, infact 58 of them are created after 15th Jan.Suggesting that most of them were just in the origination phase or testing phase. In the origination and testing phase these accounts only reply and that too to a particular account. All of them reply the same thing, giving a hint that these are bot operated.

  1. All the accounts were replying the same thing to the same account 2.All the replies were in the same language (Japanese)

Phase:2 Testing for survival

These accounts are then tested against the twitter surveillance to suspend suspicious accounts.
In the testing phase, the troll farm is used to defame someone or to make someone famous and get high engagement for their tweets
Some accounts get blocked by the twitter and some get passed the twitter surveillance and survive.

  1. All the accounts replying the exact same thing 2. Group attack to defame OVH 3. The accounts those got suspended by the Twitter

Phase 3: Hand-over

The accounts that survive from twitter and are not suspended are now handed over to their specific buyers. These accounts change their bio and start to tweet & reply in the language of the region they are supposed to be operated from. The language of operation varies from English, Urdu, Hindi, Spanish, etc.

1. Accounts replying in different languages inline with the region of operation

2. Account replying in Japanese in origination phase and after handover the bio and tweets are in Urdu


Case-2: Busting a troll farm

We came across this tweet by @RianThum, where he mentioned he along with the 5 other accounts (@AbduwelA, @adrianzenz, @Mehmetjan5, @AidUyghur, @nuryturkel) was being spammed constantly by an account with 0 followers and 0 following and he believed there were more. So, we decided to help and get some insights for him.

The level of spamming is unbelievable

We did detailed research about the spamming attack they were getting and we found out that there were 491 accounts in total, out of which 187 accounts were of the same pattern, 0 followers and 0 following and were tagging all 6 of them, in more than 500+ tweets. Also the status count of these accounts was very high and all the posts were same giving a clear indication of a troll farm.

There were 29 other accounts which were tagging 5,4 or 3 of them.

There were total 198 accounts that were tagging all of the six in their posts, out of which 187 has 0 followers and 0 following. Most of these accounts were created in between July 2020 and Dec 2020
rianthum_trollfarm_accounts_created_at_timeline

The timeline shows that most of the accounts were created in between July 2020 and Dec 2020. In-fact, 29 of these accounts were created on 15th of November.

rianthumtrollfarm_accounts_info

The above plot shows the number of accounts and their corresponding followers, i.e., there are 187 accounts with 0 followers.

In the above plot the size of bubble & color of bubble shows the status count and the axis on left shows the followers counts. Here, we can see that most of the accounts have 0 follower count but a very high status count.

We also looked into the pattern of news they were spamming these accounts with and these were posts showing development in Xinjiang regions. Prosperity & happiness of #Uyghurs and condemning western media, projecting a clean image of Chinese government. Clearing indication a troll farm to disseminate Chinese propaganda.

The types of post shared by these accounts clearly hint towards Chinese Propaganda

What we learnt and What we can do:

For the 1st case we see how the business of troll farms have grown on a huge level and it shows that this is going to be great concern in the future because once the troll farm become established its really difficult to recognize them, since they have a huge follower bases, initial mistakes are covered up and instead of bots most of them are now human operated.

The 2nd case is an alarm, the attack on 6 prominent personalities suggest a targeted attack to change opinion of the important few because they new that if they can get to any one of these six their work will be done, as these people are Influencers and a lot of people will listen to them.

Troll farms have become a modern day tool to change public opinion on social media and their aim is to cripple our thinking and influence our decision making.
Now, it totally depends on our awareness, consciousness and education to identify these troll farms and be away and keep others away as well, from their hostile and malicious agenda of spreading hatred and false information.