The Pentagon is exaggerating the impact of Russian propaganda trolls, experts say

In a rare joint statement Monday, the U.S. and U.K. intelligence communities warned of "malicious cyber activity" being conducted by Russia. The alert came just days after the Pentagon said there had been “a 2,000 percent increase in Russian trolls” in the immediate aftermath of the U.S. missile strikes on Syria Friday night.

There is little doubt that the same apparatus used by the Kremlin to interfere in the U.S. election in 2016 is now being deployed to amplify Moscow’s preferred narrative around the alleged chemical attack in Douma. But analysts say the cyber warnings from the West risk playing into Russia’s hands by adding to the confusion with exaggerated statistics and ill-defined threats.

“Although tensions with Russia are at an all-time high, the threat of retaliatory cyberattacks is overblown,” Ross Rustici, senior director of intelligence services at cyber security firm Cybereason, told VICE News. “We are likely to see increased disinformation campaigns and some low-level activity by apparently independent groups, but nothing that breaks Russia’s usual plausible deniability.”

Monday’s statement came from Britain’s National Cyber Security Center and the U.S. Department of Homeland Security and Federal Bureau of Investigation. The agencies warned that Russia is using “compromised routers to conduct” espionage and attacks on private and public entities, and provided advice to guard against them.

The rare warning brought on fears of an escalating cyber war between Russia and the West, but analysts said it wouldn’t be so cut and dry.

The threat of cyberattacks from Russia and elsewhere is always present, security researcher Lee Munson said, adding that a specific attack in retaliation to the Syria missile strikes would not typically fit Moscow’s approach.

“The whole point of cyber warfare is to cause damage via subterfuge and secrecy,” Munson told VICE News. “Russia would not want to tie itself to a specific attack for fear of clearly revealing its methods and capabilities.”

This is especially true when it comes to fears surrounding the surge in Russian trolling and disinformation. The U.S. and U.K. intel agencies said Monday’s advisory wasn’t connected to the Pentagon’s earlier warning over Russian trolls, but British sources were still furnishing those figures as of Monday.

During a press briefing Saturday morning, the Pentagon’s chief spokesperson Dana White said that the “Russian disinformation campaign has already begun,” but failed to provide any details of how the 2,000 percent figure was calculated or how the Pentagon was defining “Russian trolls.”

One expert who tracks Russia’s trolling online said the Department of Defense appeared to get its “wires crossed,” and questioned how they arrived at such an extreme number.

“I didn't see what I would consider a 2,000 percent increase in Russian troll activity over that 24-hour period,” Ben Nimmo, a senior fellow at the Atlantic Council’s Digital Forensic Research Lab, told VICE News.

By failing to clarify their findings, Nimmo warned that the U.S. and U.K. risked contributing to the kind of confusion and misinformation Russia seeks to sow, rather than counter it.

"There is a smoke screen out there already,” Nimmo said. “The [Kremlin] is pushing out the smokescreen for all they are worth, [and] if you are using imprecise language the danger is that you are contributing to that same smokescreen.”

Since the suspected attack in Douma on April 7, the Russian government, state news agencies, and online trolls have all worked to spread confusion and doubt about the West’s conclusions. In particular, Russian and Syrian operatives have focused on the White Helmets, the rescue workers who first reported the chemical attack.

Recents stories out of Russia have claimed that the White Helmets staged the chemical attack and faked images of victims with the aim of tricking Western media into covering it without question. In one extreme example, Russian Foreign Minister Sergei Lavrov suggested the U.K-funded Syrian medical group had orchestrated a “false flag” attack with the help of the British government.

Russian trolls have been using the “false flag” term for years to sow confusion, including in reference to the downing of flight MH17 in 2014 and last year’s chemical attack in Khan Sheikhoun.

More recently, trolls have used the term to describe Britain’s allegation that the Kremlin was behind the poisoning of former spy Sergei Skripal and his daughter in Salisbury. Almost in unison, these accounts switched the focus of their attack from Salisbury to Syria, said Nimmo.

And while these “false flag” theories experienced a spike following Trump’s announcement, very little of it came from what is typically classified as Russian troll accounts, according to an analysis from Nimmo’s team at the Digital Forensic Research Lab.

The Department of Homeland Security Press Secretary Tyler Houlton told VICE News that his office had shared information with the Department of Defense about “an increase in online traffic from Russian-linked influence networks promoting or amplifying content intended to discredit or undermine the United States and allied countries” related to U.S. actions and objectives in Syria.

Both the DHS and Pentagon failed to explain how they arrived at the 2,000 figure or what the term “Russian trolls” meant specifically.

“People are being imprecise with their language,” said Nimmo. “If you talk about a 2,000 percent increase in ‘Russian trolls’ define what Russian trolls are. Do you mean the number of accounts? Do you mean hostile posts? Do you mean from Russian language accounts? Do you mean from pro-Kremlin accounts?"

The Pentagon may not be able to publicly point to the data it based its figures on, because it is classified. But if that is the case, then it shouldn’t have shared in the first place as it only adds to the confusion, said Keir Giles, associate fellow of the Russia and Eurasia Program at Chatham House.

“If you are going to put a number on it, you are going to have to back up that number with actual publishable findings," Giles told VICE News. “there are so many different conspiracy theories that are promoted by Russia as alternative explanations of what is going on and for the Pentagon to be adding additional confusion is counterproductive to say the least.”

Cover image: Russian President Vladimir Putin toasts with Defence Minister Sergei Shoigu after a state awards ceremony for military personnel who served in Syria, at the Kremlin in Moscow, Russia December 28, 2017. REUTERS/Kirill Kudryavtsev/Pool