Russia’s information war against Ukraine went stealth after Meta crackdown

Initially one of the most prolific purveyors of information operations on Facebook, Russian operatives have during the course of the war in Ukraine found themselves taking a “smash-and-grab” approach to gain influence online, substituting quality with quantity.

The new assessment of Russian influence operations comes from data that Meta, Facebook’s parent company, released Thursday just as the war in Ukraine nears its one-year anniversary. Similarly, data out this week from other social media researchers concludes that Russian state-sponsored media influence operations aren’t as potent as they once were.

Nathaniel Gleicher, head of security policy at Meta, described the newer, more covert operations as a “‘throw the spaghetti against the wall to see what sticks’ approach.” Instead of slowly building up an audience, influence operatives are now flooding the platform with low-quality accounts hoping some evaded Meta’s detection.

Meta highlighted this behavior in two previously announced takedowns. In August, Meta took action against accounts tied to the pro-Russia troll army “Cyber Front Z,” remarking that the operation’s unsophisticated accounts “represented no distinct personas and were essentially fungible” and that the accounts were easily detected by automated systems. Meta followed with another report in September about the takedown of accounts belonging to a slightly more sophisticated and expansive Russia-originated network of more than 60 websites impersonating news organizations across social media platforms. Meta researchers described that campaign as “an unusual combination of sophistication and brute force.” Spoofing the domains of legitimate media organizations took technical sophistication, but once again Meta’s automated systems caught most of the ads and fake accounts the actors used before they could reach users.

Unlike previous Russia-based information operations Meta observed, operatives of both these campaigns are still trying to rebuild their networks with new accounts and spoofed links. “It may well be that one of the reasons they’re making these shifts is they’re seeing is that they invest all this work into these sophisticated campaigns and get caught anyway,” said Gleicher.

Both campaigns were tied to private actors who have been sanctioned by the U.S. government for allegedly running Russian disinformation efforts.

Russia has long been the top source of coordinated inauthentic behavior networks removed by Meta, with Ukraine being the second most targeted country. But the war spurred that activity to new records. The two main Russia-based information campaigns against Ukraine detected by Meta in 2022 involved more than 3,000 accounts and pages, the largest number from any Russia-originated network disrupted by Meta since 2017.

Meta researchers speculate that the high-volume, low-quality nature of the campaigns may be influenced by the wartime nature of operations, which resulted in a hasty response from operators. Russia also may be invested in continuing to fund these operations at a high volume despite a lack of clear success because of a sustained commitment to weakening global support for Ukraine. “This war has written a new chapter in our industry’s collective understanding of influence operations, both overt and covert,” Gleicher said.

Independent researchers have drawn similar conclusions to Meta researchers about the effectiveness of Russia’s wartime information operations. According to a new Atlantic Council report released Wednesday on Russia’s information operations to undermine Ukraine, Russian state media appeared to be caught off-guard by its de-platforming during the war and quickly sought other channels of influence, such as Telegram, a messaging app popular in both Russia and Ukraine.

Meta’s findings feed into a growing body of research that suggests that Russian information operations aren’t as influential as many intelligence officials and politicians once thought. Even more sophisticated operations that involved detailed work such as creating forged documents have failed to gain much traction, especially as social media platforms have become more aggressive about cracking down.

“They spread themselves as far and wide as possible just to build out these ideas and to see where they stick,” said Andy Carvin, a senior fellow and managing editor at the Atlantic Council’s Digital Forensic Research Lab. “The problem with that kind of brute force approach is when you spread yourself really, really thin, it’s hard for any given account to develop credibility in order to go viral.” 

While detecting the impact of Meta’s enforcement against covert behavior can be harder to analyze, its shift toward demoting Russian state-sponsored content has been clearer. In a separate report out Thursday, researchers at the social media monitoring firm Graphika found that by August 2022, Russian state-sponsored media posting volume was down by 43%, and engagement levels had fallen 80% from the year before. The researchers attributed the decline to a combination of Meta’s actions limiting the reach of Russian state-sponsored media and Russia’s decision to limit access to Facebook and Instagram.

Researchers at the Atlantic Council’s Digital Forensic Research Lab and German Marshall Fund’s Alliance for Securing Democracy found similar drops in engagement specifically from Spanish-language Facebook users.

The decline in influence operations on social media doesn’t mean Russia will step away from these tactics, said Meta’s Gleicher. He expects that as war rages on in Ukraine, Russia will continue to adjust its approach. “We would expect them to keep trying to adjust their tactics, try to find a new approach, and to shift away from our platforms as they get caught more and more.”