Skip to content
Troll Factories: Manufacturing Specialized Disinformation on Twitter

Troll Factories: Manufacturing Specialized Disinformation on Twitter

Authors: Darren L. Linvill, Patrick L. Warren

Venue: Political Communication, Vol. 37, No. 4, pp. 447–467 (2020) — DOI

TL;DR

Linvill and Warren analyze 9.04 million tweets from Russia's Internet Research Agency (IRA) spanning 2009–2018, identifying five specialized account categories—Right Troll, Left Troll, News Feed, Hashtag Gamer, and Fearmonger—each with distinct behavioral patterns, temporal deployment strategies, and communication styles. The authors demonstrate that content analysis alone suffices to categorize 83% of English-language accounts and that IRA operations functioned as an interchangeable "propaganda factory" with discrete specialized units responding to political events.

Contributions

  • Account typology: Five distinct IRA handle categories with consistent behavioral signatures across activity timing, network location, and communication strategy.
  • Behavioral analysis: Evidence that account types operated in response to real-world political events (presidential debates, email releases) and maintained disciplined shifts between "on" and "off" periods consistent with shift-work scheduling.
  • Content-based classification: Demonstration that thematic content alone (tweets analyzed without metadata) suffices to reliably identify account type, suggesting stable organizational specialization.
  • Strategic insight: IRA accounts operated not as monolithic bot networks but as coordinated units with distinct propagandistic functions—a "propaganda factory" with specialized production lines.

Method

The authors employed mixed methods: first qualitative analysis of 1,726 IRA-associated Twitter handles to identify emergent thematic categories, followed by quantitative behavioral analysis across multiple dimensions (temporal activity, network position, communication actions).

Sample: Twitter's October 2018 dataset release contained 9.04 million tweets from 3,613 suspected IRA accounts; the researchers focused on 1,858 English-language handles with 2,962,903 tweets after filtering out 163,317 tweets from accounts engaged purely in commercial activity.

Coding: Two independent coders classified handles using axial coding to identify patterns in tweet content, hashtag use, external links, and handle names. A subsample of 50 handles achieved 0.92 inter-coder reliability. The final data included 1,726 classified accounts.

Analysis: Account-day and account-hour aggregation allowed quantification of behavioral variation over the full observation period and within specific event windows. The authors tested whether account types differed in circumstances of deployment, communication mix (original tweets, retweets, quotes, replies), and network location.

Results

RQ1 & RQ2—Five account categories emerged:

  1. Right Troll (454 handles, 705,064 tweets, mean daily output 1,553): Broadcast nativist and right-leaning populist messaging using hashtags like #MAGA, #tcot, #AmericaFirst. Consistently attacked mainstream Republican moderates and Democratic politicians; routinely employed pro-Trump talking points, often divisive. Examples: support for Trump's firing of James Comey; denigration of the Democratic Party as "lazy ass Obamacare recipients."

  2. Left Troll (228 handles, 560,744 tweets, mean daily output 2,459): Sent socially liberal messages with overwhelming focus on cultural identity. Frequently employed #BlackLivesMatter, #MuslimBan, #LGBTQ, and #PoliceBrutality hashtags. Tweets appeared intentionally divisive, attacking both Democratic and Republican politicians (especially Hillary Clinton) while supporting Bernie Sanders. Some appeared designed to camouflage as genuine political commentary.

  3. News Feed (55 handles, 910,384 tweets, mean daily output 16,552): Presented as U.S. local news aggregators (@OnlineMemphis, @TodayPittsburgh). Linked to legitimate regional news sources and tweeted local-interest content. A small subset tweeted pro-Russia perspectives on global issues; some linked to Syrian Arab News Agency content.

  4. Hashtag Gamer (110 handles, 392,285 tweets, mean daily output 3,566): Dedicated almost entirely to hashtag games (e.g., #ThingsILearnedFromCartoons, #ThingsThatMakeYouFeel). Often posted mundane, entertaining content; some tweets were overtly political. Many appeared designed to gain followers through seemingly innocent participation while hiding more provocative content.

  5. Fearmonger (698 handles, 293,337 tweets, mean daily output 420): Spread disinformation about fabricated crisis events—Ebola outbreaks in Atlanta, an explosion at the Columbia Chemicals plant in Louisiana, a phosphorus leak in Idaho, nuclear plant accidents, and war crimes in Ukraine. Accounts often tweeted innocuous poetry or song lyrics alongside crisis disinformation. Changed behavior (switched between Fearmonger and other types) only before mid-2015; after that, accounts remained consistent in category.

RQ3—Differential deployment and behavior:

  • Timing: Fearmongers operated most intensely in late 2014 and early 2015; Left Troll, Right Troll, and Hashtag Gamer accounts ramped up in late 2016 and early 2017. This timing variation suggests the IRA deployed account types in response to perceived strategic opportunities. Fearmongers may represent an "abandoned method" from an earlier phase of operations.

  • Output variance: Left Troll, Right Troll, and Hashtag Gamer accounts showed high daily output variance (coefficient of variation 1.3–1.8), while News Feeds showed lower variance (0.48). The mean daily output was remarkably consistent across account types in 2016 (Left Troll: 708, Right Troll: 606, Hashtag Gamers: 686, News Feeds: 549 tweets), with large standard deviations indicating tightly coordinated operations.

  • Event responsiveness: Account types reacted differently to political events:

  • September 11–16, 2016 (Clinton health rumors): Right Trolls and Hashtag Gamers produced prominent spikes in #HillarysHealth and #HillarysBodyDouble hashtags; Left Trolls were largely inactive.
  • September 20–October 25, 2016 (Podesta emails and debates): Hashtag Gamers dominated immediately around the first debate; Left Trolls increased dramatically after the Podesta release, engaging in retweet activity (>90% of their output by late 2016) and showing substantial behavioral shifts.

  • October 6, 2016 (peak English-language activity): IRA output peaked—the maximum day since early 2015. Left Trolls engaged for >14 hours across two time zones (St. Petersburg and NYC time), switching from primarily original tweets to 90% retweets.

  • Network structure: Account types occupied different positions in the Twitter social graph; RQ3.3 addressed this through link analysis (mentions, retweets, quote connections defining directed links).

Connections

Notes

Strengths: - Large-scale analysis (9M tweets, 1,858 accounts) using official Twitter data release. - Mixed-methods approach: qualitative thematic analysis informed quantitative behavioral modeling. - Clear operational typology that has become canonical in IRA research; account types are discrete, stable, and replicable. - Precise temporal analysis linking account behavior to real-world political events (debates, email leaks), demonstrating responsiveness and coordinated strategy. - Reveals IRA as operating under organizational discipline (shift-work scheduling, type consistency post-mid-2015).

Limitations & open questions: - Analysis limited to English-language accounts; Russian and non-English operations excluded. - No individual-level follower or network data; account-level behavior aggregated to daily/hourly units. - Fearmonger accounts (the earliest operational type) are less extensively analyzed than later types; reasons for their discontinuation unclear. - The paper does not quantify the reach, engagement, or downstream political impact of IRA content—only its production characteristics. - Content analysis depends on researcher judgment (coding) for type assignment; while inter-rater reliability was good, potential subjectivity in theme identification remains.

Significance: This paper is foundational to understanding Russian information operations on Twitter. The typology has become the standard framework for categorizing IRA accounts and has informed subsequent work on bot detection, coordinated behavior, and state-sponsored disinformation.