Feds Say They’ve Unraveled A Russian Bot Network

In early 2022, a senior employee at the Russian state news agency RT pitched his superiors on an idea: could RT create an in-house social media bot farm to reach people outside of its traditional news broadcasts?

Per federal court documents released on Tuesday, RT executives said yes.

The result was a quixotic attempt involving the FSB, the successor agency to the KGB, to use AI to develop a mushrooming series of fake X accounts that parroted Russian propaganda.

In a search warrant affidavit, the FBI said that it had identified 968 accounts after an unnamed “U.S. government agency” tipped it off to the inner workings of RT and its alleged cooperation with an FSB official in setting up the network. Per a statement, X moved to shut down the accounts while the DOJ seized two domain names related to the network.

The affidavit — in which an unnamed FBI agent recounted how federal investigators learned of the bot farm, assessed at least part of its scope, and moved to dismantle it — reads partly like a spy novel, and partly like a skeptical take on the value of Russian disinformation efforts. The impression the affidavit leaves of what the FBI demolished is less that of a devious effort to pour gasoline on nuanced differences within the American public, and more of a scattershot approach: creating as many accounts as possible, and then using them to take the propaganda that Russia trains on its own citizens abroad. In this case, that’s videos of Russian President Vladimir Putin giving long speeches about the history of Eastern Europe.

The affidavit cites only two examples of social media posts generated by the network. For those who have followed Putin’s efforts to legitimate his full-scale invasion of Ukraine, they’re familiar: In one November 2023 instance, an account posted a speech Putin gave contesting the historicity of the current borders of Ukraine, Poland, and Lithuania, calling them “gifts” from Russia. In another, from October 2023, a bot responded to an unnamed candidate for federal office with another Putin video, this time directly justifying the invasion.

In the former case, the bot had 23 followers. The FBI didn’t specify the reach of the latter account, or of the hundreds of others taken down in the sting.

Enter the FSB

That relatively small reach — and focus on the kind of Eastern European historical issues on which President Putin has long obsessed over but which seem likely to elude most American audiences — belies the lengths to which both Russian officials and U.S. law enforcement went to create and then demolish the network.

Per the affidavit, an unnamed U.S. government agency sparked the probe by giving the FBI a tip: executives from RT, the Russian state-run news agency, had moved to create a “social media bot farm” which RT could then use to spread information on a broad scale.

The tip focused on two RT employees. One, the chief of RT’s “Directorate of Digital Journalism,” formulated the idea for the bot farm, while another RT employee implemented it, starting in April 2022.

The next year, the tip said, the FSB took notice. An officer from the KGB successor recruited the two RT employees to work for an unnamed “private intelligence organization” that he had created. The group’s purpose, the FBI said, was to advance Russian government goals, including by using fake social media accounts to broadcast Russian propaganda. Per the tip, the Kremlin approved the group’s creation.

From there, the affidavit says, the unnamed U.S. government agency determined that the intelligence organization began to provide “investigative services” to RT last year, effectively acting as a cover within the Russian state organization for what was really going on: the FSB was using RT to “conduct influence operations against foreign adversaries in coordination with the Kremlin,” including via the bot farm.

It’s an extremely convoluted way of demonstrating the mechanics of something that’s long been known: RT frequently parrots and amplifies Russian propaganda.

What makes this different are the many layers of deception. Per the affidavit, not only was the FSB’s involvement concealed from RT, but RT then used subterfuge to create the network of fake social media accounts with which to spread FSB messaging.

Per the affidavit, the FBI was able to unravel the scheme in large part by finding ways to corroborate the tip from the unnamed U.S government agency.

The FBI did so by obtaining email addresses for suspect X accounts from the social media company. Many of the addresses were registered to unknown domains; after obtaining information for who bought the domains (they were sold by an Arizona provider), the FBI found that they were registered to a fake person with a VPN in Lithuania.

A search of a Google account associated with the domains, the affidavit says, unearthed another clue: it was created from an IP address that traces back to Russia. It’s then (pardon this inevitable reference) a Russian nesting doll of clues an email accounts: the first email account listed a recovery email address; that recovery email address listed another recovery email address. The third address, the FBI found, had been created in December 2015 — years before the bot network was created.

The FBI found that it listed an associated phone number. That traced back to the beginning: one of the two RT employees that worked on the bot farm.