Details on Newly Uncovered GRU Online Personas
Translations:
On Christmas, Ellen Nakashima of the Washington Post published two widely shared reports on GRU (Russian military intelligence) activities in creating fake profiles on social networks, along with “astroturfed” political activist groups.
The first, longer article, entitled “Kremlin trolls burned across the Internet as Washington debated options,” was written by Nakashima along with Greg Jaffe and Adam Entous. This article paints a wide picture of online activities from the GRU and presumably Kremlin-linked individuals, centered on “freelance journalist” Alice Donovan (also known as Sophie Mangal). A central detail in this investigation is an “intercepted Russian military report” from February 2014 that “documented how Moscow created fake personas to spread disinformation on social media to buttress its broader military campaign.”
Ivan Galitsin
In her second article of the day, “Inside a Russian disinformation campaign in Ukraine in 2014,” Nakashima elaborated on this document, with the specific example of “Ivan Galitsin.” This persona was allegedly a specific part of the GRU cyber operations to influence opinion in Ukraine during the uncertainty of the Euromaidan revolution and the ensuing drama in Crimea.
Nakashima provides a few details about “Ivan Galitsin” that allow us to find the digital footprints of the alleged disinformation campaign carried out by the GRU. Specifically, the Post article describes how this online persona left a comment on a “British newspaper” under a February 22, 2014 story about former Ukrainian prime minister Yulia Tymoshenko.
In going through Google results for stories about Tymoshenko from February 22, 2014, a handful of British sites that also have a physical newspaper seem promising, such as the the Guardian and the Daily Mail. Of these results, only a particular Guardian article has a large number of comments.
Sure enough, on the second page, we can find a comment from an “Ivan Galytsin” with the exact words printed in Nakashima’s reporting. Additionally, “Ivan Galytsin” uses a photograph of Konstantin Yaroshenko, as described in the Post article, and created his account (and posted both of his only comments) on February 22, 2014.
We can also find “Ivan Galitsin” on Facebook, using the same avatar of Konstantin Yaroshenko.
According to the Post article, and corresponding to this Facebook profile, “Ivan Galitsin” created his profile on February 22–just as he did on the Guardian website. This “Ivan Galitsin” is supposedly from L’viv, a Ukrainian city in the country’s west.
Vova Kravets
Another online persona created by the GRU in the Post article is “Vova Kravets,” who was posing as a radical Ukrainian and sent death threats to Ukrainian politicians on Facebook.
This persona is also quite easy to find on Facebook, with only one profile currently on Facebook that could be a possible match. This “Vova Kravets” profile was created on January 31, 2014, a few weeks before “Ivan Galitsin,” and ceased posting on March 27, 2014. The persona’s identity is clear–a radical, far-right Ukrainian who is either a fan or member of the ultra-nationalist group Right Sector. Additionally, the profile’s only “friends” are a number of well-known individuals in Ukraine.
Unanswered Questions
Tracking down these two individuals named in the Post article was not especially difficult, but there are still a number of unresolved issues that were either directly raised in the Post‘s reporting or in need of attention.
Firstly, on February 27, 2014, four groups were allegedly created by the GRU on Facebook and Vkontakte (VK). In particular, these groups “encourage[d] Crimeans to support secession from Ukraine.” Furthermore, these groups “used paid ads on Facebook” and “received nearly 200,000 views on Facebook on Feb. 27 alone.” What are these groups? All of the pages liked by “Vova Kravets” and all of the groups he was a part of were in line with the persona that “he” was projecting–a Ukrainian ultranationalist, thus “he” would not have been part of any of these alleged GRU groups created on February 27. “Ivan Galitsin” liked three pages and was a part of one group that fit with the political theme of the GRU pages: Ukrainian Front (group), Ukrainian Front (page), Slavic Shield, and Antimaidan. However, none of these were created on February 27, though it is worth nothing that the Ukrainian Front page (not group) was created on February 22, the same day that “Ivan Galitsin” created “his” account.
Secondly, how effective were these online operations? While the figure of 200,000 views on a Facebook page is impressive, it is unclear if these are page views on the group’s page itself or impressions from its posts. When looking at “Ivan Galytsin” in particular, this online persona hardly made a dent in the online information space, with two comments on the Guardian‘s website and a neglected Facebook profile. Were the other online personas far more active than this virtual nobody?
Lastly, did this GRU operation have any relationship with the infamous St. Petersburg Troll Factory, allegedly run by Yevgeny Prigozhin? From the Post report, this GRU operation seems to have been run in-house, rather than outsourced to Prigozhin as a sort of contractor. However, with additional data points, it may be possible to find links between Prigozhin’s vast network of news (and more often, “news”) sites and army of social network sock puppet accounts.
