Students for Trump founder appears to be GRU officer's oldest follower. Tweet quoted by officer shows signs of inauthentic boost.
A tweet shared by the GRU officer from RyanAFournier, who appears to be the officer's oldest follower, has 8,513 fewer retweets and 29,419 fewer likes, potentially suggesting an inauthentic boost.
NOTE: This is a descriptive observational report rather than a study drawing conclusions.
Table of Contents
Backstory
On June 16, 2022, Dutch intelligence reported it had stopped a "Russian intelligence officer from gaining access as an intern to the International Criminal Court (ICC) in The Hague" [1,2]. AIVD, the General Intelligence and Security Service of the Netherlands, released a statement and a copy of an unusual four-page cover letter written by the GRU officer.
Bellingcat, an open-source investigation group described by the Russian Federations' spokesperson as "The terror for all things secret" [3], published a report on the GRU officer, including his Twitter account, "VictorKaiserS" [4].
Summary
VictorKaiserS's Twitter history shows a quote tweet of a post from the user RyanAFournier, founder of Students for Trump, who also appears to be the GRU officer's oldest follower. Hoaxlines reviewed the tweet from RyanAFournier to examine whether it showed evidence of data decay, which will be described in more detail below.
While we don't have the data to tell what type of accounts or actions caused the engagement decline, engagement loss can indicate inauthentic activity or platform manipulation [5,6]. These behaviors sometimes reflect attempts to make ideas or specific users appear more popular than they are [7,8].
Following the GRU officer
A notable finding was that RyanAFournier appears to be the oldest follower of the GRU officer [9]. We ascertained this in two ways:
A visual inspection of VictorKaiserS's followers showed RyanAFournier as the account's oldest follower.1
We pulled VictorKaiserS's follower list via Followerwonk to see if the data also showed the same account for the oldest follower. The data show RyanAFournier as the GRU officer's oldest follower.
Twitter documentation currently says of the follower order [10]: "At this time, results are ordered with the most recent following first — however, this ordering is subject to unannounced change and eventual consistency issues."
The follower sequence may support the idea that RyanAFournier's follow dates back to at least 2017. Some users that followed VictorKaiserS more recently than RyanAFournier--assuming the data reflect the true reverse chronological follow order--have been inactive since 2017 and 2018. Still, an account can remain inactive (no tweets, retweets, quote-tweets, likes or replies) while also following new users, so sequence serves as a supportive detail rather than definitive evidence.
That RyanAFournier followed VictorKaiserS could be explained as a byproduct of the I-follow-you-you-follow-me account growth strategy, where Twitter users follow whoever follows them.
The connection between a highly influential partisan figure and Russian intelligence demonstrates the ease with which state-backed actors can engage with influential Americans. Anyone may gather intelligence, target with malware, or influence. Bad actors need no coordination, prior connection, or consent to elevate, boost, and seize upon organic actors and content that serve foreign interests.
Data decay explained
Data decay describes the phenomenon where a tweet's engagements, which include retweets, quote-tweets, replies, and likes, decline over time. Disappearing engagements can come from a few scenarios [5,6,11,12]:
A user returns to undo the retweet, quote-tweet, like, or reply
A user deletes the accounts
Twitter suspends the user.
Over time, tweets that are boosted using fake accounts (also known as amplifier bots) can end up losing their likes, retweets, and replies [7].
Hoaxlines initially assumed that the lost retweets, quote-tweets, likes, or replies came from account suspensions but later found suspensions were not the only outcome that explained disappearing activity [12]. Some retweets and likes disappear because the account owner returns and unretweets or unlikes the tweet [13–15].
In some cases, accounts will change usernames, verifiable by checking the account ID number or voluntarily delete the account altogether [11,16,17]. Platform manipulators may do this to evade detection and removal for violating platform policy, or an account may be "wiped" in preparation for a new identity [5,6,11].
A 2022 study reported that "bad actors can delete content strategically to manipulate the system." They explain [6]:
"...coordinated networks of accounts engage in repetitive likes and unlikes of content that is eventually deleted, which can manipulate ranking algorithms. These kinds of abuse can be exploited to amplify content and inflate popularity, while evading detection."
RyanAFournier's tweet and disappearing engagements
The tweet from RyanAFournier that was quote-tweeted by VictorKaiserS had "18.4K Retweets 1,975 Quote Tweets 68.9K Likes," as of June 19, 2022 [18,19].
Archives show that RyanAFournier's tweet had "28,954 Retweets 98,355 Likes" on August 17, 2018, substantially more than it has today [19,20]. Archives saved before 2020 show counts for quote-tweets and retweets combined, as the platform only started separating them in 2020 [21].
18,471 retweets PLUS 1,975 quote tweets = 20,441 total
28,954 archived retweets MINUS 20,441 = 8,513 fewer
98,355 archived likes MINUS 68,936 likes = 29,419 fewer
Overall between August 17, 2018, and June 19, 2022, RyanAFournier's tweet lost 8,513 retweets (including quote tweets) and 29,419 likes. The largest decline happened in a nearly two-year stretch from 2018 to 2020. In the five months between August 3, 2020, and January 8, 2021, the tweet lost 4,845 likes and 1,293 retweets [22,23].
27,304 Retweets 90,556 Likes - Dec 23, 2017
28,125 Retweets 93,481 Likes - Jan 8, 2018
28,954 Retweets 98,355 Likes - Aug 17, 2018
24,879 Retweets 87,391 Likes - Jun 15, 2020
24,441 Retweets 86,247 Likes - Aug 3, 2020
23,148 Retweets 81,402 Likes - Jan 8, 2021
The wrap-up
If the data are as Twitter documentation suggests, then the oldest current follower of VictorKaiserS, an account belonging to a GRU officer, is RyanAFournier, the founder of Students for Trump. The data also show that the GRU officer interacted with a tweet authored by RyanAFournier about former President Trump and his first impeachment. RyanAFournier's tweet lost 8,513 retweets (including quote tweets) and 29,419 likes between 2018 and today, suggesting the tweet may have been boosted by inauthentic activity.
Although there are explanations that reflect nothing untoward, one must also consider the well-documented history of interference in American politics and elections by the Russian state [24–30]; the Students for Trump organization's role in spreading false election claims (Sharpiegate)2 [31–35]; conspiracy theories and disinformation likely contributing to the violence on January 6, 2021 [36–40]; and Turning Point described participants in a large-scale platform manipulation campaign that was likened to a "troll farm" that resulted in at least one party getting banned from Facebook as "Students For Trump digital activists" [41–45].
Footnotes
References
1. AVID. Cover identity of Russian intelligence officer. In: The General Intelligence and Security Service of the Netherlands [Internet]. 16 Jun 2022 [cited 20 Jun 2022]. Available: https://english.aivd.nl/publications/publications/2022/06/16/cover-identity-of-russian-intelligence-officer
2. AVID. The AIVD: Who we are. In: General Intelligence and Security Service of the Netherlands [Internet]. 11 Oct 2019 [cited 20 Jun 2022]. Available: https://english.aivd.nl/about-aivd/the-aivd-who-we-are
3. Grozev C. Christo Grozev. In: Twitter [Internet]. 2022 [cited 2022]. Available: https://twitter.com/christogrozev
4. Bellingcat. The Brazilian Candidate: The Studious Cover Identity of an Alleged Russian Spy. In: Bellingcat [Internet]. 16 Jun 2022 [cited 20 Jun 2022]. Available: https://www.bellingcat.com/news/americas/2022/06/16/the-brazilian-candidate-the-studious-cover-identity-of-an-alleged-russian-spy/
5. Elmas T, Overdorf R, Özkalay AF, Aberer K. Ephemeral Astroturfing Attacks: The Case of Fake Twitter Trends. arXiv [cs.CR]. 2019. Available: http://arxiv.org/abs/1910.07783
6. Torres-Lugo C, Pote M, Nwala A, Menczer F. Manipulating Twitter Through Deletions. arXiv [cs.SI]. 2022. Available: http://arxiv.org/abs/2203.13893
7. Wild J, Godart C. Spotting bots, cyborgs and inauthentic activity. In: DataJournalism.com [Internet]. 13 Mar 2020 [cited 20 Jun 2022]. Available: https://datajournalism.com/read/handbook/verification-3/investigating-actors-content/3-spotting-bots-cyborgs-and-inauthentic-activity
8. Anise O, Wright J. Anatomy of Twitter Bots: Amplification Bots. In: Duo Labs [Internet]. 2018 [cited 6 Dec 2021]. Available: https://duo.com/labs/research/anatomy-of-twitter-bots-amplification-bots
9. Hoaxlines. People following Victor Muller F. (@VictorKaiserS) on 2022.06.17. In: Nimbus Capture [Internet]. 2022 [cited 20 Jun 2022]. Available: https://hoaxlines.nimbusweb.me/share/7112322/le4foxuowmr6nh91xhhm
10. Twitter. Follow, search, and get users. In: Twitter Developer Platform [Internet]. 2022 [cited 20 Jun 2022]. Available: https://developer.twitter.com/en/docs/twitter-api/v1/accounts-and-users/follow-search-get-users/api-reference/get-followers-list#:~:text=At%20this%20time%2C%20results%20are%20ordered%20with%20the%20most%20recent%20following%20first%20%E2%80%94%20however%2C%20this%20ordering%20is%20subject%20to%20unannounced%20change%20and%20eventual%20consistency%20issues.
11. Norteño C. In most cases, these accounts deleted all their old tweets as part of the makeover. Some were not as thorough about it as others, such as @FMAR122 which still has tweets from 2015 advertising it as “YOUR #1 POLE PARTY HEADQUARTERS”. #YouHadOneJob pic.twitter.com/awQ9zeHiiM. In: Twitter [Internet]. 6 Feb 2021 [cited 20 Jun 2022]. Available:
12. Hoaxlines. High-profile “TruckersforFreedom” tweets boosted by accounts that also amplified “Pfizergate.” In: Hoaxlines [Internet]. 14 Feb 2022 [cited 20 Jun 2022]. Available: https://novelscience.substack.com/p/high-profile-supporters-of-truck
13. Norteño C. We observed this network for a few days and noticed something interesting: the replies with the images of the fake Elon Musk watch tweets get deleted after a few days. Over a period of 45 hours, the network tweeted 1634 new replies and deleted 1765 old ones. pic.twitter.com/2AkZlPvXc4. In: Twitter [Internet]. 20 Aug 2021 [cited 20 Jun 2022]. Available:
14. Kausar S, Tahir B, Mehmood MA. Towards Understanding Trends Manipulation in Pakistan Twitter. arXiv [cs.IR]. 2021. Available: http://arxiv.org/abs/2109.14872
15. Elmas T, Llewellyn C, Evkoski B, Zubiaga A, Jones K, Gorrell G. A Longitudinal Dataset of Twitter ISIS Users. In: DeepAI [Internet]. 2 Feb 2022 [cited 20 Jun 2022]. Available: https://deepai.org/publication/a-longitudinal-dataset-of-twitter-isis-users
16. Li ER. Example of bot-like account changing username. In: Gyazo [Internet]. 2021 [cited 20 Jun 2022]. Available: https://gyazo.com/8258b9a3335b9eba9294f459bbeea56a
17. Elmas T, Overdorf R, Akgül ÖF, Aberer K. Misleading Repurposing on Twitter. arXiv [cs.SI]. 2020. Available: http://arxiv.org/abs/2010.10600
18. VictorKaiserS. Victor Muller F. on Twitter: “That`s a strong point . In: archive.ph [Internet]. 19 Jun 2022 [cited 20 Jun 2022]. Available: https://archive.ph/IYLQA
19. RyanAFournier. June 2022 archive of tweet from RyanAFournier. In: Twitter [Internet]. 19 Jun 2022 [cited 20 Jun 2022]. Available: https://archive.ph/FC0BA
20. RyanAFournier. Archive of RyanAFournier tweet from August 2018. In: Twitter [Internet]. 2018 [cited 20 Jun 2022]. Available: https://web.archive.org/web/20180817165035/
21. Hutchinson A. Twitter May Soon Display Retweets and Quote Tweets in Separate Counts. 28 Jul 2020 [cited 20 Jun 2022]. Available: https://www.socialmediatoday.com/news/twitter-may-soon-display-retweets-and-quote-tweets-in-separate-counts/582469/
22. RyanAFournier. August 2020 archive of RyanAFournier tweet. In: Twitter [Internet]. 2020 [cited 20 Jun 2022]. Available: https://web.archive.org/web/20200803145354/
23. RyanAFournier. January 2021 archive of RyanAFournier tweet. In: Twitter [Internet]. 2021 [cited 20 Jun 2022]. Available: https://web.archive.org/web/20210108210909/
24. CIA, FBI, and NSA. Background to “Assessing Russian Activities and Intentions in Recent US Elections”: The Analytic Process and Cyber Incident Attribution. In: DNI [Internet]. 2017 [cited 20 Jun 2022]. Available: https://www.dni.gov/files/documents/ICA_2017_01.pdf
25. House Permanent Select Committee on Intelligence. Exposing Russia’s Effort to Sow Discord Online: The Internet Research Agency and Advertisements. In: House Permanent Select Committee on Intelligence [Internet]. 2017 [cited 20 Jun 2022]. Available: https://intelligence.house.gov/social-media-content/
26. Howard P, Ganesh B, Liotsiou D, Kelly J, Francois C. The IRA, Social Media and Political Polarization in the United States, 2012-2018. 2018. Available: https://demtech.oii.ox.ac.uk/wp-content/uploads/sites/93/2018/12/The-IRA-Social-Media-and-Political-Polarization.pdf
27. François C, Nimmo B, Shawn Eib C. The IRA CopyPasta Campaign. In: Graphika [Internet]. 2019 [cited 20 Jun 2022]. Available: https://graphika.com/copypasta
28. Nimmo B, François C, Shawn Eib C, Ronzaud L. IRA Again: Unlucky Thirteen. In: Graphika [Internet]. 2020 [cited 20 Jun 2022]. Available: https://graphika.com/reports/ira-again-unlucky-thirteen/
29. Al-Rawi A, Rahman A. Manufacturing rage: The Russian Internet Research Agency’s political astroturfing on social media. FMRI Tech Rep. 2020 [cited 20 Jun 2022]. doi:10.5210/fm.v25i9.10801
30. Linvill DL, Warren PL. Troll Factories: Manufacturing Specialized Disinformation on Twitter. Political Communication. 2020;37: 447–467.
31. Mayer J. The Big Money Behind the Big Lie. The New Yorker. 30 Jul 2021. Available: https://www.newyorker.com/magazine/2021/08/09/the-big-money-behind-the-big-lie. Accessed 20 Jun 2022.
32. TrumpStudents. Students for Trump Sharpiegate tweet from November 4, 2020. In: Gyazo [Internet]. 2020 [cited 20 Jun 2022]. Available: https://gyazo.com/c8f238625e6232416b70980c8b65cc6a
33. GeneralBrnovich. We have received hundreds of voter complaints regarding Sharpies at polling locations. Accordingly, we sent this letter to Maricopa County election officials. Let’s get some answers. In: Twitter [Internet]. 2022 [cited 20 Jun 2022]. Available:
34. Binder M. #SharpieGate: Debunked conspiracy theory leads to scary situation in Arizona. In: Mashable [Internet]. 5 Nov 2020 [cited 20 Jun 2022]. Available: https://mashable.com/article/sharpiegate-trump-supporters-arizona
35. RyanAFournier. Deleted Sharpiegate tweet from RyanAFournier. In: Twitter [Internet]. 2020 [cited 20 Jun 2022]. Link.
36. Cable J, Garcia-Camargo I, Diresta R, Observatory SI, Graphika Team. A Look Into Viral North Macedonian Content Farms. In: Election Integrity Partnership [Internet]. 13 Oct 2020 [cited 20 Jun 2022]. Available: https://www.eipartnership.net/rapid-response/north-macedonian-content-farms
37. Romero L. Experts say echo chambers from apps like Parler and Gab contributed to attack on Capitol. In: ABC News [Internet]. 2021 [cited 20 Jun 2022]. Available: https://abcnews.go.com/US/experts-echo-chambers-apps-parler-gab-contributed-attack/story?id=75141014
38. Munn L. More than a mob: Parler as preparatory media for the U.S. Capitol storming. First Monday. 2021. doi:10.5210/fm.v26i3.11574
39. Skibinski M. Special Report: 87% of news shared on Parler before Jan. 6th came from misinformation sites. In: NewsGuard [Internet]. 17 Feb 2021 [cited 12 May 2022]. Available: https://www.newsguardtech.com/special-reports/special-report-parler-data/
40. Collinson S. Scenes of sickening violence at the Capitol open January 6 committee’s case against Trump and his insurrectionist conspiracy. CNN. 10 Jun 2022. Available: https://www.cnn.com/2022/06/10/politics/january-6-hearing-donald-trump/index.html. Accessed 20 Jun 2022.
41. Stanley-Becker I. Pro-Trump youth group enlists teens in secretive campaign likened to a “troll farm,” prompting rebuke by Facebook and Twitter. The Washington Post. 15 Sep 2020. Available: https://www.washingtonpost.com/politics/turning-point-teens-disinformation-trump/2020/09/15/c84091ae-f20a-11ea-b796-2dd09962649c_story.html. Accessed 15 Feb 2022.
42. Stanley-Becker I. Facebook bans marketing firm running “troll farm” for pro-Trump youth group. The Washington Post. 8 Oct 2020. Available: https://www.washingtonpost.com/technology/2020/10/08/facebook-bans-media-consultancy-running-troll-farm-pro-trump-youth-group/. Accessed 20 Jun 2022.
43. Overly S. Facebook bans firm behind Turning Point’s election troll farm. In: POLITICO [Internet]. [cited 20 Jun 2022]. Available: https://www.politico.com/news/2020/10/08/facebook-turning-point-election-troll-427985
44. Stanford Internet Observatory. Analysis of an October 2020 Facebook Takedown Linked to U.S. Political Consultancy Rally Forge. In: Stanford Internet Observatory [Internet]. 2020 [cited 20 Jun 2022]. Available: https://cyber.fsi.stanford.edu/news/oct-2020-fb-rally-forge
45. ADL. Turning Point USA. In: ADL [Internet]. 2019 [cited 20 Jun 2022]. Available: https://www.adl.org/resources/backgrounder/turning-point-usa