Troll farms from every direction: six documented operations

Series: How minds are moved · The modern machinery · 1 of 7

By early 2018 Twitter had notified about 1.4 million people that they may have interacted with accounts run from an office building in St Petersburg. Six years later a Reuters investigation found that the US military had run its own fake accounts, posing as Filipinos, to make people afraid of a Chinese vaccine during a pandemic. Both are documented. Neither is a theory. My AI agent and I set out to put six covert account operations side by side, run from or for four states and one private firm, and to read only what the official record and the researchers who took them apart actually say.

Contents · 13 sections

TL;DR #

• Covert account operations are run by many states, not one. The record documents operations by Russia, China, Iran and the US military, and one by an Israeli firm, with state funding reported by the New York Times and denied by the ministry. The sources are courts, Senate committees, platform takedown reports and a news agency investigation.
• They work the same way: invented people, borrowed local identities, coordinated posting, and a message that pretends to come from “people like you”.
• The measured effect on opinions is usually small. Most of these networks struggled to reach real people at all. The bigger cost is that they teach everyone to doubt every voice.
• What you can check: account age, posting rhythm, recycled text, and whether the “local” person has any life outside the cause.

What a covert account operation is #

A covert account operation is simple to describe. Someone who does not want to be seen creates or buys accounts that pretend to be ordinary people, then uses them to push a message, attack a target or make an idea look more popular than it is. Platforms call it “coordinated inauthentic behaviour”. The key word is inauthentic: the problem is not the opinion, it is the lie about who is speaking.

Six cases. For four states the record documents the operator. In the Israeli case it documents a private firm, and the state’s role is a reported claim that the state denies.

Russia: the Internet Research Agency #

The best documented case is the Internet Research Agency (IRA) in St Petersburg. In February 2018 the US Special Counsel indicted 13 Russian nationals and three Russian companies, the IRA among them. The indictment says that by September 2016 the operation had a budget of more than $1.25 million a month. Volume I of the Mueller report, published in April 2019, describes IRA employees posing as American activists, buying ads and even organising real rallies on US streets by messaging real Americans.

The numbers in the Mueller report are carefully hedged. Facebook told Congress that IRA posts may have reached as many as 126 million people, but that is a platform estimate of possible exposure, not of people persuaded. Twitter identified 3,814 IRA-controlled accounts.

The Senate Intelligence Committee’s bipartisan report on Russia’s use of social media (volume 2, October 2019) found that the IRA targeted African Americans more than any other group, and that its activity increased after the 2016 election rather than stopping.

In March 2020 the Justice Department dropped its case against two of the three indicted companies, Concord Management and Consulting and Concord Catering, a month before trial, citing the risk of exposing sensitive evidence. The charges against the individuals remain, but none of them has ever been in US custody.

China: Spamouflage #

In August 2023 Meta removed 7,704 Facebook accounts, 954 Pages, 15 Groups and 15 Instagram accounts tied to a network researchers call Spamouflage. Meta called it the largest known cross-platform covert influence operation in the world, active on more than 50 platforms, and linked it to “individuals associated with Chinese law enforcement”. That ranking is Meta’s own assessment.

What stands out is how poorly it worked. Meta wrote that the operation consistently struggled to reach beyond its own fake echo chamber. Huge volume, very little real engagement.

Iran: Storm-2035 #

In August 2024 Microsoft’s threat intelligence team described an Iranian network it calls Storm-2035: four websites posing as American news outlets, writing for voters at both ends of the political spectrum ahead of the US presidential election. Days later, on 16 August, OpenAI said it had banned ChatGPT accounts the operation used to write long articles and short social media comments about the US campaign, the Gaza war and other topics. OpenAI said it saw no sign the content reached a meaningful audience; most posts drew few or no likes, shares or comments. Meta later confirmed that one linked Instagram account belonged to an Iranian network it had disrupted in December 2022.

An Israeli firm: the STOIC campaign aimed at US lawmakers #

In May 2024 Meta and OpenAI both reported that a political marketing firm in Tel Aviv called STOIC had run fake accounts posing as Americans, such as students and concerned citizens, to push content about the Gaza war at US audiences and lawmakers. OpenAI said the operators used its models to generate comments.

In June 2024 the New York Times reported, citing current and former ministry officials and documents, that Israel’s Ministry of Diaspora Affairs had paid about $2 million for the campaign, and that it targeted members of Congress including Hakeem Jeffries and Raphael Warnock. The ministry denied any involvement and said any link between it and STOIC was baseless. So the takedown by the platforms is documented. The government funding is a reported claim that the government disputes. Meta and OpenAI both said the campaign had little authentic reach.

United States: the Philippines anti-vaccine campaign #

In June 2024 Reuters published an investigation that found the US military ran a covert campaign, framed internally as a response to Chinese claims that the US had brought the virus to China, from spring 2020 to mid-2021 to undermine trust in China’s Sinovac vaccine in the Philippines, at a time when Sinovac was the first COVID-19 vaccine available there. Reuters identified at least 300 accounts on X that matched descriptions from former military officials. X removed them after Reuters asked.

Reuters reported that the campaign went ahead over objections from US diplomats in Southeast Asia, that it later expanded to Central Asia and the Middle East, and that it was ended under an order from the Biden White House in spring 2021. A Pentagon spokesperson acknowledged that the military had distributed social media content about the safety and efficacy of Sinovac, but said an initial internal review had found that the US military “was not responsible for the troubling social media content” cited by Reuters. In July 2024 Reuters reported a Defense Department document in which the US told the Philippine government it had “made some missteps” in its COVID messaging. So the US side acknowledged part of it and disputed part of it, much as Israel’s ministry denied its reported role. Reuters said it could not measure the health effect.

Pro-Western networks: “Unheard Voice” #

In August 2022 Graphika and the Stanford Internet Observatory published “Unheard Voice”, an analysis of a network that Twitter and Meta had removed for promoting pro-Western narratives in Central Asia and the Middle East. The Twitter dataset alone held about 300,000 tweets from 146 accounts. Meta’s report a few months later counted 39 Facebook accounts, 16 Pages, two Groups and 26 Instagram accounts, and said it found links to “individuals associated with the US military”.

The researchers’ verdict mirrors the Chinese case: most of the assets had small audiences, and only 19% had more than 1,000 followers. Faking voices did not buy influence.

What it feels like from the inside #

You do not experience a troll farm as a troll farm. You experience it as a mood. A thread where everyone seems to agree. A local-sounding account that says what you already suspected, a bit more angrily. The goal is rarely to change your mind about one fact. It is to make one side feel bigger and the other feel tired.

I see the machinery from another angle on my own sites. In the last seven days my web-threat sensors logged 99,945 requests. Of those, my classifier matched 39,881 to a known automated agent (search and AI crawlers, link-preview bots, SEO tools and scripts), and 131 claimed to be a well-known crawler but did not come from that company’s network. Not propaganda, but the same habit at small scale: software pretending to be someone it is not.

What it can and cannot do #

The evidence on persuasion is sobering in both directions. A 2023 study in Nature Communications by Eady and colleagues matched a survey panel to the actual Twitter feeds of the respondents during 2016. It found that 1% of users accounted for 70% of exposure to IRA content, mostly people who already identified strongly as Republicans, and found no measurable link between exposure and changes in attitudes, polarisation or voting. The authors themselves warn that this does not mean the campaign had no effect on the election as a whole.

So these operations are real, cheap and run by many governments, and they mostly fail to change minds directly. What they reliably do is pollute the space. Once people know fake locals exist, any inconvenient voice can be dismissed as “a bot”. That doubt is a product too.

In my library, the RAND study Combating Foreign Disinformation on Social Media notes that in the Philippines former call centres were turned into troll farms for hire. The machinery is for sale, not just for states.

How to notice it #

• The account is young, or was dormant for years and woke up for one cause.
• It posts in bursts, at hours that do not match the place it claims to be from.
• The same sentences, images or hashtags appear across many accounts within minutes.
• The “local” person has no ordinary life on the profile: no friends, no hobbies, no complaints about the weather.
• The message pushes you to feel, share or attack, not to check.
• A topic seems to have huge support in replies but none in the people you actually know.

None of these proves anything alone. Together they are a reason to slow down.

Frequently asked questions #

Do only authoritarian states run troll farms? #

No. The documented record includes Russia, China and Iran; the United States, whose Philippines campaign the Pentagon acknowledged in part and partly disputed, and whose 2022 network Meta attributed to people linked to the US military; and an Israeli firm, with state funding reported by the New York Times and denied by the ministry. Commercial firms sell the same service.

Did the Russian troll farm swing the 2016 US election? #

There is no evidence that it did. The operation is documented; its effect on votes has not been shown, and the best individual-level study found no measurable change in attitudes among those exposed on Twitter.

Why do platforms take these networks down if they barely work? #

Because the rule is about deception, not success. Lying about who you are breaks the platform’s policies whether or not anyone is fooled.

How do researchers attribute a network to a government? #

They combine technical signals from the platform (shared infrastructure, payment data, account creation patterns) with content analysis. Platforms often say “linked to individuals associated with” an institution, which is weaker than saying the institution ordered it. Read that wording carefully.

The lesson #

Every direction does this, and the record says so. The fair test is not “which side runs trolls” but “who is actually speaking”. When you cannot tell, you are allowed to wait before you believe, share or get angry. That pause costs the troll farm more than any takedown.