Exclusive: Russia Activated Twitter Sleeper Cells for 2016 Election Day Blitz

As U.S. polling places opened last Nov. 8, Russian trolls in St. Petersburg began a final push on Twitter to elect Donald Trump.

They used a combination of high-profile accounts with large and influential followings, and scores of lurking personas established years earlier with stolen photos and fabricated backgrounds. Those sleeper accounts dished out carefully metered tweets and retweets voicing praise for Trump and contempt for his opponent, from the early morning until the last polls closed in the United States.

“VOTE TRUMP to save ourselves from the New World Order. Time to MAKE AMERICA GREAT AGAIN,” read one. “Last chance to stop the Queen of Darkness! Vote Trump!” urged another.

The Daily Beast analyzed a dataset of 6.5 million tweets containing election keywords like “Hillary” and “Trump” that was collected over 33 hours last Nov. 7-9 by Baltimore-based data scientist Chris Albon.

The data are not comprehensive—only tweets with one of the keywords were collected, and limitations in Twitter’s API prevent a full capture even of those. But they represent a significant sampling of Election Day Twitter.

By filtering for the 2,752 users identified by Twitter as Russian troll accounts—a list the House Permanent Select Committee on Intelligence released last week—we isolated 80 accounts dishing Election Day agitprop and reconstructed the big finish to Russia’s months-long active measures campaign.

The contours of that campaign, allegedly ordered by Russian President Vladimir Putin, have become clearer in the year since the 2016 election, thanks to declassified intelligence findings, congressional hearings, and media reports.

The Kremlin employed hackers in Russia’s military intelligence arm, the GRU, to steal documents and emails from Hillary Clinton’s campaign and the Democratic National Committee, which were leaked with strategic timing via WikiLeaks, as well as to members of the press and directly to the web.

Russian state-run media was enlisted to produce and promote narratives helpful to Trump, and full-time paid internet trolls at the St. Petersburg-based Internet Research Agency worked long hours on social media to amplify criticism of Clinton, spread misinformation, and, as first reported by The Daily Beast, organize real-life demonstrations on American soil.

After months of work, Russia’s hard-fought campaign was drawing to a close in November 2016, and the trolls in St. Petersburg were priming their final push. On election eve an account called “World News Politics,” set up less than three weeks earlier, rolled out scheduled tweets attacking Clinton and the Democratic Party.

“Hillary’s Violent Paid Protesters Attack Trump Supporters in Chicago,” blared one election-eve headline a little after 11 p.m. Eastern. Two seconds later, another tweet hit Clinton on her health: “HILLARY STUMBLES AGAIN! Watch The 15-Second Video That Just Made Trump President.”

The morning of Election Day, another Russia-operated news feed, the Phoenix Daily News, tweeted a story from an Arizona ABC affiliate’s website, “Group to watch for voter fraud on Election Day.” ‏The article was genuine, but the tweet was a glimpse at the theme Russia would develop throughout the day: The election was rigged for Hillary Clinton.

Evidently anticipating a Trump loss, as nearly everyone did, the trolls’ final election mission was to sow doubt about the legitimacy of the vote, “crippling [Clinton’s] presidency from its start,” according to U.S. intelligence findings. “Democrats BUSTED Breaking Election Law on VIDEO in Ohio,” read a tweet from World News Politics. Then, at 11 a.m. Eastern, “BREAKING : Mass Election Fraud, Voting Irregularities and Discrimination Against Trump Voters Reported #VoterFraud.”

Viral Gold

Russia’s most influential troll accounts began signing on at around 7 a.m., but they eased into the stolen election theme cautiously.

TEN_GOP, a fake account purporting to represent Tennessee Republicans, spent most of the morning circulating pro-Trump and anti-Clinton quotes. “Hillary Clinton is the most dishonest candidate for POTUS since Richard Nixon,” read a 9:13 a.m. tweet accurately quoting Mike Pence. The more alt-right flavored account of John “TheFoundingSon” Davis begged voters to remember Benghazi.

Then Russia struck viral gold with a glitchy voting machine in Pennsylvania. A voter had captured cellphone video showing him attempting to change the selection on his electronic ballot from Clinton to Trump, and the machine stubbornly refusing to register his button-press. He tweeted about the incident afterward, noting that the poll workers fixed the issue and he cast his intended Trump vote, but the machine “was on some nut shit at first.”

In the hands of Russia’s propagandists, the Pennsylvania glitch was frothed into clear evidence of a conspiracy to steal the election from Trump.

At 1:14 p.m. the TEN_GOP account, which then had 51,690 followers, tweeted out an election fraud alert complete with a Drudge-style police car revolving light emoji: “BREAKING: Machine Refuses to Allow Vote For Trump in Pennsylvania!! RT [retweet] the hell out of it! #VoterFraud.”

The alert accumulated more than 14,000 retweets by the end of the day and helped make TEN_GOP the seventh most mentioned user on Election Day Twitter, according to data from the George Washington University.

From then on the Russian trolls pushed the election-rigging trope relentlessly.

The fake Texan Pamela_Moore13, with 24,020 followers, aired a video that she said proved the DNC hacked the primaries. “Man PROVES software stole votes in ALL ‘Hillary won’ counties! DNC rigged elections! Voter Fraud is Real!” The account America_1st_ separately alerted its 24,744 followers to “massive” election fraud in Colorado, possible absentee voter fraud in Florida, and a “Van Full Of Illegals” that showed up “To Vote Clinton At SIX Polling Places!”

The account MarchForTrump took things a step further. In the months before the election, Russia successfully organized pro-Trump demonstrations behind the MarchForTrump front and its linked Facebook page, “Being Patriotic.”

Now it unveiled its own Voter Fraud hotline, promoted in a series of overheated tweets. “This election is being rigged! REPORT VOTER FRAUD: 888 486 8102 (Being Patriotic hotline) [...]”

It’s unclear where the phone number went or who answered. Today it’s disconnected.

Second Wave

While the high-profile accounts occupied the front lines of Russia’s information war, at the rear a legion of low-key sleeper personas, with fewer than 5,000 followers each, pushed a steady stream of tweets and retweets praising Trump and condemning Clinton, voiced as the Election Day thoughts of ordinary American voters.

This astroturf portion of Russia’s campaign kicked into high gear just after noon Eastern time. “Only YOU can prevent a Hillary Victory. Get out and vote,” read a typical tweet from “Lara Pretty,” who purports to be an Air Force veteran, an NRA member, a Christian, and a Blue Star mother with a son or daughter on active duty in the military.

“JUSTICE FOR HILLARY -- BRING HER TO HEEL To Lock Her Up --WE MUST-- Lock Her Out,” another account said. An account named “Kelvin Chambers” joined in: “All I ask is please go out and vote today... unless your [sic] voting for Hillary then just stay home your vote isn’t necessary #TrumpForPresident.”

Other accounts peddled misogyny, Benghazi, and alt-right conspiracy theories attempting to link the Clinton campaign to pedophilia and/or Satanism. “I’m a Democrat and would never vote for #SpiritCooking Suoer [sic] Child Predator Scum like #HillaryRottenClinton,” read one such tweet from “John Larsen,” a self-described conservative who believes in “patriotism & optimism.”

The creation dates on those accounts show that Russia began quietly accumulating and maintaining them as early as 2009, with surges in account creation in August 2013 and late 2015.

They churned along largely unnoticed, averaging two or three tweets a day, then perked up on Election Day to contribute five to eight tweets each to America’s political discourse.

It’s a typical pattern for Russia’s trolling operation, which is known to retask long-standing accounts to different Kremlin causes or set up accounts for future use.

“They may have some sitting on the bench, just to let them mature,” said former FBI counterterrorism agent Clint Watts, who’s been studying Russia’s election interference. “Then when you ramp up, you have personas to match.”

The sleeper accounts joined in with the heavy hitters to hammer on the theme that the election was rigged in favor of Clinton.

One of the prominent accounts, USA_Gunslinger—“Gunslinger Girl” from “Wisconsin” with 25,858 followers—linked to a Breitbart article reporting that President Obama was phoning into local radio stations to encourage Democratic voter turnout in some battleground states. “Outrageous!” USA_Gunslinger tweeted.

A Trump campaign insider, Michael Flynn Jr., personally replied to the Russian troll account with his own commentary: “desperation stinks.”

‘See How Your Democracy Works?’

At 7 p.m. Eastern, voting ended in some states, and, to no one’s surprise, Indiana and Kentucky were immediately called for Trump. The Russian tweets continued. At 7:20, MarchForTrump pushed a reminder that “This election is being rigged!” along with the special voter fraud hotline. But that was the last Russian tweet in our dataset that complained about a rigged election.

In the United States, ballots in the key battleground state of Florida were being counted, and millions of voters, along with a room full of Russian propagandists, were hanging on every update.

At 7:45 p.m., with more than half the votes counted, Trump was slightly ahead with 49.8 percent of the vote to Clinton’s 47.3 percent. It was closer than most pundits had expected, and after endless predictions of an easy Clinton victory, a Trump win began to seem possible. “Trump’s lead in Florida is growing!” TEN_GOP tweeted at 8:24 p.m.

The Russians changed tack and completely abandoned the election fraud message they’d been pushing since dawn, joining with American Trump supporters to celebrate the turn the election was taking. “Alabama is RED!” tweeted “America First!” at 8:33 p.m. “Hope Texas goes red,” added “South Lone Star” three minutes later. “Saddest day for the Media!” TEN_GOP vowed at 10 p.m. “Trump is winning in a landslide!”

The next day, with Trump officially the victor, the popular Russian account “Jenna Abrams” appeared to momentarily break character to share the popular vote tallies from the presidential race and deliver the troll factory's final judgement on America’s 2016 election: “See how your democracy works?”