Russia flag


Russia country

Date Released

17 November 2018

Twitter Takedowns


Twitter Attribution: Russia

  • Internet Research Agency and Russian state actors

Key Messages & Targets

  • Undermining the NATO alliance among European audiences
  • Exacerbating social tensions in the US and other countries
  • Depicting Ukraine as an unstable or belligerent country with corrupt, untrustworthy leaders
  • Portraying the role of Russia and its allies in Syria in a positive light
  • Undermining election candidates in the US and Europe

Notable Tactics

  • Amplifying content from Russian state-linked media
  • Amplifying content linked to personas on Quora, LiveJournal and Facebook, among other platforms
  • Spammy activity
  • Impersonating media outlets, politicians, government agencies and other organisations
  • Impersonating individuals and activists

Twitter Activity




Accounts in dataset



Active accounts in dataset



Were retweets



Had media



Had links



Used hashtags

Takedown Timeline

Twitter Description

In line with our strong principles of transparency and with the goal of improving understanding of foreign influence and information campaigns, we are releasing the full, comprehensive archives of the Tweets and media that are connected with these two previously disclosed and potentially state-backed operations on our service. We are making this data available with the goal of encouraging open research and investigation of these behaviors from researchers and academics around the world.

Twitter has released seven datasets of networks containing a total of 5,361 accounts that it has associated with Russia. Russian information operations have been attributed to a variety of state or state-linked actors, such as the Internet Research Agency. This ecosystem is supported by state media outlets such as Sputnik and Russia Today, propagating agendas and narratives favourable to the Russian Government that are amplified on social media. The operations have a wide geographical reach, with targets in Europe and the US, often amplifying messages aimed at exacerbating existing social divisions.

While state media may set the tone of some operations and provide narratives to reference, there are signs of strong cross-platform activity in which cultivated personas often maintain a multi-channel presence. Twitter’s disclosures also showed Russia’s deployment of fake news organisations. Fake local news websites often declared left-leaning or right-leaning political allegiances and amplified existing social and political divisions in target countries. Accounts also purported to be research institutes, independent journalists and third-party organisations.

In the takedown datasets, fake personas presented various political persuasions to engage in controversial domestic sociopolitical debate in target states. Tweets were designed to capitalise on existing grievances and exacerbate racial tensions in the US. Accounts purporting to be US-based used immigration-related hashtags such as #BuildTheWall and accused migrants of threatening the American identity or way of life. Multilingual tweets sought to polarise national debates over refugees by conflating Muslim refugees with terrorists.

The campaigns also shared messages aimed at overseas elections and political sentiment. Such activity was observed in Europe and in the run-up to the 2016 elections in the US, and accounts tweeted either fake or biased news attacking presidential candidate Hillary Clinton. In Europe, leaders were targeted with messages capitalising on divisive fears about immigration and terrorism. Accounts reshared and boosted articles from authentic Eurosceptic news outlets and in some instances directly sought engagement by tagging members of anti-EU parties. Several European populist leaders and party members have reshared tweets or even fake news pushed by the Russian disinformation network, boosting its reach and legitimacy among domestic audiences in Europe.

The campaigns also focused on conflict zones central to Russia’s military and foreign policy objectives. Following Russia’s annexation of Crimea in March 2014, disinformation about the growing cooperation between Ukraine and the EU or the US was also propagated.

A significant proportion of the accounts tweeted propaganda and disinformation solely on the Syrian conflict, portraying the role of Russia and its allies in a positive light while discrediting the US, Syrian opposition groups and Turkey. The White Helmets volunteer group, operating mostly in opposition-controlled areas, were subjected to sustained and complex disinformation attacks, which included the dissemination of manipulated and doctored images and videos that aimed to discredit the group and undermine its work.

Some accounts focusing on the Syrian conflict purported to be media outlets or journalists. Twitter profiles included links to their accounts on other social media platforms, such as Facebook and Telegram. Narratives emphasised the role of Russia in providing humanitarian aid and helping Syria fight terrorism. Accounts posted photos that demonised the US and its involvement in Syria, accusing it of murdering civilians and portraying it as an imperialist power colluding with terrorist organisations to destabilise the region. Turkey was also targeted in a similar manner. In contrast, Assad’s government was presented as the secular, reasonable alternative, fighting to defend ordinary Syrians from the brutality of terrorism.

Network activity also sought to portray Russia as a victim of Western plots and hypocrisy. There was a coordinated effort to cultivate President Putin’s ‘strongman’ image and to present him as an effective leader. Accounts shared pro-government news articles and tweeted in praise of Putin’s leadership. Efforts to defend Russia’s prestige could also be observed in relation to the Olympics doping scandal. Several accounts tweeted about the issue, portraying it as a Western fabrication to humiliate Russia. Others shared fake news about American athletes having taken drugs themselves.

There’s also some indication that networks linked to Russia have been outsourced, potentially to influence-for-hire operators. On 13 March 2020, Twitter also announced that it had removed 71 accounts that presented themselves as based in the US. Instead, they appeared to operate out of Ghana and Nigeria, and were linked to Russia. The accounts targeted a range of social issues, presenting as accounts broadly interested in the Black Lives Matter movement and civil rights.

Here is the databroken down.

Tweets Over Time

Account Creation Over Time

Twitter Activity

Top 10 Most Retweeted Accounts

Top 10 Most Used Hashtags

Top 10 Most Mentioned Countries

Top 10 Most Shared Domains


Top 10 Most Used Twitter Clients

Twitter ClientTimes Used

Posting Activity

Recorded posting patterns, captured tweets, and media data.

Understanding behaviour by looking at daily patterns, captured tweets, and the type of media and commentary made by accounts.

Russia Posting Patterns

Download CSV

To reference this pageuse the button below