Thousands of Russian trolls targeted national events during the 2016 U.S. presidential election to infiltrate the online conversations of millions of Americans, according to a new analysis of a database of recovered troll tweets by NBC News.
The records show how digital communications tools invented by U.S. companies, such as Twitter and Facebook, were instead exploited by the Kremlin-backed agents to promote autocracy and fear.
Twitter has identified 2,752 accounts as being linked to the Kremlin. In November, Congress released the list of account names.
NBC News took those names and cross-referenced it against data held by three sources familiar with Twitter's API, an online system that allows software developers to work user data, generated a database of 202,973 tweets sent by known Russian trolls. The sources asked that their names be withheld to avoid being identified as possibly violating Twitter's developer policy.
The resulting database from 454 of the identified accounts is "one of the largest" known repositories of deleted Russian Twitter troll activity to date, according to Jonathan Albright, research director at Columbia University's Tow Center for Digital Journalism.
Those tweets from accounts impersonating real Americans earned 2.1 million retweets and nearly 1.9 million favorites from their duped followers.
While no single tweet from a fake account threw the race, the matrix of Russian troll activity reveals the shape of a sophisticated, researched and targeted effort by a foreign adversary to subvert the conversations and opinions of Americans as they chose their next president.
"Thinking about this in a binary of 'did it cause someone to change their vote?' is overly narrow," said Laura Rosenberger, director of the Alliance for Securing Democracy. "It's about influence over time."
Coordinated Twitter Attacks
EJ Fox / NBC News
According to the dataset, Russian twitter troll volume increased significantly on July 21, two days after Trump became the official Republican nominee, and continued at the same intensity or higher for the rest of the year.
Throughout 2016, the trolls' tweets and retweets spiked during key campaign events.
Related: Russian troll describes work in the infamous misinformation factory
The trolls manipulated major events, even horrifying ones, to spread their messages. The first big spike in activity was March 22, 2016, when three suicide bombers killed 32 in Brussels.
Daily troll volume suddenly increased several-fold. They linked the terrorist act claimed by ISIS with a perceived threat posed by Muslim refugees to the U.S.
JeanneMccarthy0: "#IslamKills this is seriously getting out hand! I'm so scared for the future of my children! #PrayForBrussels #StopIslam"
RyanMaxwell_1: "#Brussels Let's close all mosques! #freespeech is overrated! #IslamKills"
Ben Nimmo, a senior fellow at the Atlantic Council, a think tank, told NBC News in an email that the surge of tweets sought to "demonize Muslims, migrants, refugees and anyone who supports them, and to panic real Americans into increasingly extreme views."
But the trolls were just getting warmed up.
The following graphic visualizes the number of tweets per day that employed the trolls' most-used hashtags, excluding non-political topics. Width represents the volume of tweets.
Hashtag Hijacking, 2016
EJ Fox / NBC News
Americans may have thought they were using hashtags during the election to discuss politics with each other. They didn't know they were also talking to Russians thousands of miles away in a troll factory.
The top hashtags were the generic #politics, followed by #maga, #Trump, #news, and #NeverHillary.
"Some of the trolls participated in trending hashtags by inserting entirely appropriate content, perhaps as a way of getting their screen names in front of other people and gain a following," said David Allen, an analyst at software company Neo4j who assisted NBC News with analyzing the database.
"Others would try to 'hijack' a hashtag," inserting disruptive content into a trending topic, "or draw a non-political hashtag into a discussion of politics," he said.
Related: Russian trolls duped nearly 40 celebrities
Troll activity spiked again during the final presidential debate, rehashing conspiracy theories and retweeting divisive content. The trolls alternately said the debate was rigged, or a total win for Trump.
But the trolls did speak in a chorus when it came to one hashtag.
About 9 a.m. on Oct. 19, 2016, the morning of the final debate, the Russian troll account "WorldOfHashtags" kicked off a new online conversation.
"The last presidential #debate starts soon. So let's discuss #RejectedDebateTopics," the troll wrote. Moments earlier they had referred to it as a "hashtag game" that was "hosted" by "GiselleEvns," another of the Russian troll accounts.
Immediately a cluster of the trolls started pumping out tweets with the hashtag, several tweets per minute. Some showed preference for Trump, some against, others were just jokes. But the underlying message was "about trying to underscore the view that the system is rigged," said Rosenberger.
Later that day over 600 other Twitter users, who may have included authentic Americans, added hundreds of their own twists to the hashtag.
Twitter didn't respond to NBC News requests to confirm whether the hashtag had "trended" for other users and appeared in a box that would have promoted it to new users.
Related: Russian Twitter trolls stoked voter fraud fear before election
When it came to tweets sent in real-time during the debate, popular Tennessee Republican party impostor account @TEN_GOP took charge, sending the majority of the original tweets.
TEN_GOP: "Iran payment wasn't just ransom, it was money laundering. The deal was set up by Hillary when she was sec of state #debate #debatenight"
TEN_GOP: "Donald Trump's ending was perfect! RT if you are also sure that #Trumpwon! #Debate"
Those tweets got thousands of retweets, likes and user comments.The account also directly tweeted compliments to Trump during the debates.
"@realDonaldTrump Can't wait to see you in the WH," tweeted the Russian troll an hour before the debate began. Right as the debated ended, the Russian troll account tweeted to Donald Trump, "We are proud of you!"
Playing all sides
The trolls were organized into three general ideological networks, said Allen, the Neo4j analyst.
Trolls on the "Right" cluster promoted Trump and attacked left-leaning causes and politicians, mainly Clinton.
Trolls in the "Left" cluster generally attacked Trump and his followers, though they didn't express support for Hillary Clinton.
"Black Lives Matter" were pro-black, but not pro-Democrat. Their message was to distrust all authority, especially the police.
During the election, the hyped-up tweets appeared to be just part of the social media noise.
"We saw a lot of questionable accounts and content, but we knew there were underground networks to spread content that would undermine Hillary," said Emmy Bengtson, former deputy social media director for the Clinton campaign. "We just didn’t know who was paying for it."
The banner on the bridge
On November 10th, 2016, two days after the election, an identified Russian troll claimed responsibility for a provocative banner that hung from a bridge that leads to the Pentagon in Washington. The estimated 20 by 25 foot banner of outgoing President Obama read, "Goodbye Murderer."
The troll, who claimed to be a military veteran, said he and fellow "political activists" had hung the banner. The account blamed the president for "numerous bloody wars" and deaths in Libya, Syria, Yemen and Ukraine.
"He doesn’t deserve to be a winner of the Nobel peace prize. His true prize awaits him in the Hague court docks,” tweeted @LeroyLovesUsa, who also tweeted the photos to @realDonaldTrump.
A spokesman for the U.S. Park Police, Sgt. James Dingeldein, confirmed that a park police officer had removed the banner and that it was destroyed this fall. A Freedom of Information request filed with the park police by NBC News wasn't fulfilled before publication.
The Russian troll account appears to have been the first to post the images online. The digital propaganda had suddenly entered the real world.
The photos of the bridge banner were retweeted by other Russian trolls and "Leroy Barton's" tweets got hundreds of likes and retweets. The story spread across social media sites, and the Russian state-owned media organization RT.
A report by the U.S. intelligence community determined that Putin and the Russian Government who ordered the trolls' influence campaign had developed a "clear preference" for Trump.
In the immediate wake of Trump's victory that the trolls had worked toward, was this brazen banner an unfond farewell to the previous administration?
It's unknown what person or persons hung the banner in our nation's capital, who took the photos, and how they got to the troll.
But there is some precedent. In January 2016, a pro-Kremlin art group called Glavplakat claimed responsibility for hanging a Shepard Fairey-style poster of Obama opposite the U.S. Embassy in Moscow with the word "Killer." The group has hung other banners criticizing opponents of the state around the Russian capital tightly controlled by the Putin regime. No links between the group and the government have been proven.
As the intelligence community wrote, "By their nature, Russian influence campaigns are multifaceted and designed to be deniable because they use a mix of agents of influence, cutouts, front organizations, and false-flag operations."
Related: Russian trolls pushed graphic, racist tweets to American voters
So far news organizations that have recovered and published about the deleted tweets have only been able to probe a slice of the overall Russian troll accounts suspended by Twitter.
"There's still some part of the iceberg that's under the water," said Allen.
Experts say that the troll activity fits in with a Cold War-era playbook called "active measures," in which the Russians used disinformation and selective reframing to undermine faith in democracy, exploit political divisions, blur fact and fiction, and promote Russian policy agendas abroad.
"They think that for decades they've been on the defensive, and we've been hurtling at them our messages about markets and democracy and liberalism," said Michael McFaul, who was the U.S. ambassador to Russia from 2012 to 2014 in the Obama administration.
"And they're now on the offensive."