Here’s Everything The Mueller Report Says About How Russian Trolls Used Social Media

Special counsel Robert Mueller’s report on Russian interference in the 2016 election and the Trump campaign provides one of the most detailed looks at how Russia’s Internet Research Agency — the infamous Kremlin-linked troll farm — tried to hijack the 2016 election and swing the vote in favor of Donald Trump.

The report, which concludes that Trump didn’t commit a crime but “also does not exonerate him [of obstruction],” gives us a clear and exhaustive look at the scope, focus, and results of the IRA’s efforts. The agency learned how to use platforms like Facebook and Twitter over the span of four years. By the end, it used analytical tools and the built-in network effect of massive social media platforms to create large artificial grassroots political organizations that were aggressively targeting both Republicans and Democrats.

The IRA was able to reach up to 126 million Americans on Facebook via a mixture of fraudulent accounts, groups, and advertisements, the report says. Twitter accounts it created were portrayed as real American voices by major news outlets. It was even able to hold real-life rallies, mobilizing hundreds of people at a time in major cities like Philadelphia and Miami. Fake online personas were able to communicate with members of the Trump campaign — who were unaware they were ever communicating with foreign nationals.

Here’s everything we know about Russian interference from the report.

It started in 2014.

According to Mueller’s report, the IRA began creating fake Facebook accounts and small groups as early as 2014.

“IRA employees operated social media accounts and group pages designed to attract U.S. audiences,” the report reads. “These groups and accounts, which addressed divisive U.S. political and social issues, falsely claimed to be controlled by U.S. activists."

The lines up with what we already knew about the IRA’s activity. One of its first large-scale misinformation projects was the Columbian Chemicals Plant explosion hoax in September 2014, when IRA members created a completely fake explosion at a chemical plant in Louisiana. “The perpetrators didn’t just doctor screenshots from CNN; they also created fully functional clones of the websites of Louisiana TV stations and newspapers,” the New York Times wrote about the hoax.

The IRA consolidated all of its US operations into one department called the “Translator” department, which appears to have operated like a typical digital media startup with different agents focusing on specific platforms, monitoring analytics, and even graphic designers. About a dozen people, known as “specialists,” would run an account at a time.

The IRA’s activity wasn’t confined to social media, either. IRA employees traveled to the United States on intelligence-gathering missions in 2014.

“Four IRA employees applied to the U.S. Department of State to enter the United States, while lying about the purpose of their trip and claiming to be four friends who had met at a party,” the report reads. “Ultimately, two IRA employees-Anna Bogacheva and Aleksandra Krylova-received visas and entered the United States on June 4, 2014.”

The IRA was on pretty much every platform.

At first, the IRA focused its activity on Facebook, YouTube, and Twitter. Later, Tumblr and Instagram accounts were created. In the beginning, Russian trolls were manning only fake individual accounts. By 2015, however, they began creating larger groups and pages. Finally, they attempted to flex their network effect to hold real-life rallies.

According to Mueller’s report, the Facebook groups were particularly popular. By the time Facebook deactivated them in 2017, the Russia-controlled group "United Muslims of America" had over 300,000 followers, the "Don't Shoot Us" group had over 250,000 followers, the "Being Patriotic" Facebook group had over 200,000 followers, and the "Secured Borders" Facebook group had over 130,000 followers.

IRA Facebook accounts posted about already divisive social issues like Black Lives Matter and the tea party and even privately messaged other, real users.

“In total the IRA-controlled [Facebook] accounts made over 80,000 posts before their deactivation in August 2017, and these posts reached at least 29 million U.S persons and ‘may have reached an estimated 126 million people,’” the report reads.

On Twitter, it focused on two strategies: growing fake accounts and then using a botnet of automated accounts to amplify them. IRA “specialists” tweeted publicly, but also were direct messaging people behind the scenes.

Last spring, Tumblr announced that it had uncovered and terminated 84 accounts linked to the Internet Research Agency. According to findings from researcher Jonathan Albright and BuzzFeed News, trolls were using Tumblr in similar ways as other platforms. They posed as black activists and generated hundreds of thousands of interactions for content that ranged from calling Hillary Clinton a “monster” to supporting Bernie Sanders and decrying racial injustice and police violence in the US.

Russian trolls had some of the best luck on Instagram, based on the report. IRA Instagram accounts had hundreds of thousands of US followers. Russia was controlling 170 Instagram accounts that posted 120,000 pieces of content during a two-year period.

“Collectively, the IRA's social media accounts reached tens of millions of U.S. persons,” the report reads.

The IRA's tweets got a lot attention.

Last year, Twitter publicly identified 3,814 Russia-controlled Twitter accounts. According to Twitter, in the 10 weeks leading up to the 2016 U.S. election, these accounts posted approximately 175,993 tweets. About 84% of the content they posted was political.

According to Mueller’s report, IRA tweets were quoted extensively in US news outlets. Seventy US outlets were found to have quoted a Russian-controlled Twitter account and attributed it to a real person.

It wasn’t only media attention the trolls were getting. Mueller’s report names several politicians, media personalities, and celebrities who were interacting unknowingly with the IRA, such as former Ambassador Michael McFaul, Roger Stone, Sean Hannity, Kellyanne Conway, Michael Flynn Jr., Donald Trump Jr., and President Trump.

One account is mentioned extensively by Mueller’s report, @TEN_GOP, an account that posed as a member of the Tennessee Republican Party. @TEN_GOP, and its backup account @l0_gop, was particularly prolific. Its @l0_gop backup even got a response from President Trump.

"We love you, Mr. President!,” @l0_gop tweeted.

“THANK YOU for your support Miami! My team just shared photos from your TRUMP SIGN WAVING DAY, yesterday,” Trump responded. “I love you — and there is no question — TOGETHER, WE WILL MAKE AMERICA GREAT AGAIN!"

The IRA's main target: Hillary Clinton.

Across all platforms, the IRA maintained a pretty unified strategy: Find cultural pressure points, target them with memes and posts, find like-minded users, and use every opportunity to criticize Hillary Clinton.

At one point, the IRA employee moderating a Facebook page called “Secured Borders” was scolded for having a "lower number of posts dedicated to criticizing Hillary Clinton" and was reminded "it is imperative to intensify criticizing Hillary Clinton."

The IRA built Facebook communities across the political spectrum, but targeted Clinton in all of them. Mueller’s report lists conservative groups like "Being Patriotic," "Stop All Immigrants," "Secured Borders," and "Tea Party News”; black social justice groups like "Black Matters," "Blacktivist," and "Don't Shoot Us”; LGBTQ groups like "LGBT United”; and religious groups “United Muslims of America.”

“Main idea: Use any opportunity to criticize Hillary [Clinton] and the rest (except Sanders and Trump — we support them),” IRA operators told specialists.

The IRA bought ads.

The first known ad from the IRA that explicitly endorsed the Trump campaign was purchased on April 19, 2016. It was an Instagram ad for an account called “Tea Party News” and asked users to help “make a patriotic team of young Trump supporters” by uploading photos with the hashtag #KIDS4TRU.

In the following months, the IRA would purchase ads via the Facebook Groups "Being Patriotic," "Stop All Invaders," and "Secured Borders."

The IRA also purchased ads posing as real US citizens or entities.

“Some IRA employees, posing as U.S. persons and without revealing their Russian association, communicated electronically with individuals associated with the Trump Campaign and with other political activists to seek to coordinate political activities, including the staging of political rallies,” the report reads.

According to Facebook, Russian agents were able to purchase over 3,500 advertisements and spent about $100,000.

In April 2016, they purchased ads for its account, Black Matters" calling for a flash mob to "take a photo with #HillaryClintonForPrison2016 or #nohillary2016." There’s no evidence this flash mob ever materialized and the YouTube account promoting it has since been taken down. But it was in ads like this that the IRA focused most of its anti-Clinton messaging. All of the ads purchased about Trump were positive.

Another IRA-purchased ad, from March 2016, was a photo of Clinton with a caption that read, "If one day God lets this liar enter the White House as a president — that day would be a real national tragedy."

The IRA organized rallies via catfishing.

By 2016, according to Mueller’s findings, the IRA was becoming increasingly interested in mobilizing its followers physically. It was buying ads to organize anti-Clinton flash mobs and building pro-Trump photo challenges.

One of the most unsettling things in Thursday’s report are the details about how successful Russia-controlled social media accounts became at actually organizing political rallies. First, they would use spoofed accounts on Facebook or Twitter to announce an event. Then they’d privately message the event to real users, asking them if they could attend. Then if they got a bite, they’d assign one of these real people to be the event coordinator. Usually, the Russian troll would make up some excuse as to why they couldn’t personally attend, according to the report.

The users messaged privately about the events were usually recruited for their social media popularity. “The IRA recruited U.S. persons from across the political spectrum,” the report reads. “Initially, recruitment focused on US persons who could amplify the content posted by the IRA.”

Once a real social media user was set up as the coordinator, the IRA would promote the event to members of the media. After the event was over, they’d share photos and videos of it across their network of groups and fake accounts.

Mueller said this happened dozens of times, with the earliest rally being a "confederate rally" in November 2015. Also, these artificial rallies didn’t stop after the election, continuing after 2016. Attendance apparently varied, between just a few protestors, but occasionally reaching the hundreds.

At first, the rallies ran the gamut in terms of focus, but after June 2016, all of them became focused on the election. Meuller’s report includes a flyer for a “Miners for Trump" rally held in Philadelphia in October 2016. The IRA was able to successfully organize three rallies in New York and a series of pro-Trump rallies in Florida and Pennsylvania.

At one point, the IRA used Craigslist and an email called “beingpatriotic@gmail.com" to recruit someone to walk around New York City in a Santa suit and Trump mask.

The Trump campaign didn’t know it was talking to Russians — but it was.

One of the largest questions going into the report was what, if anything, Trump and his campaign team knew about Russian attempts to hijack the American political conversation in the lead up to the 2016 election. According to Mueller’s report, they were duped like the rest of us.

“In total, Trump Campaign affiliates promoted dozens of tweets, posts, and other political content created by the IRA,” the report reads. “The investigation did not identify evidence that any U.S. persons knowingly or intentionally coordinated with the IRA's interference operation.”

When the IRA decided to create an artificial rally, they would recruit a real-life recruiter to act as the on-the-ground coordinator, but would also, typically, connect with Trump’s campaign.

“Some IRA employees, posing as U.S. persons and without revealing their Russian association, communicated electronically with individuals associated with the Trump Campaign and with other political activists to seek to coordinate political activities, including the staging of political rallies,” the report reads.

Russian trolls would direct message or email Trump Campaign officials and ask for things like campaign buttons, flyers, and posters to make their artificial rallies look more organic.

By May 2016, the IRA were trying to organize enough rallies that they decided to create a Twitter account called @march_ r_trump, which they then used to promote IRA-organized rallies in support of the Trump campaign.

Mueller's report found no evidence of a similar relationship, publicly or privately, with the Clinton campaign.

The IRA’s accounts were distribution channels for its hacking.

The last piece of the IRA’s online strategy was its use of hacking. In March 2016, members with the Russian Federation's Main Intelligence Directorate of the General Staff (GRU) hacked the computers and email accounts of employees and volunteers with the Clinton campaign and campaign chair John Podesta. Then a month later, the IRA hacked the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC).

It released the hacked materials, at first, via two online personas, "DCLeaks" and "Guccifer 2.0." DCLeaks disseminated the leaked emails via a website, dcleaks.com, but more importantly, the leak was shared across the IRA’s vast network of social media plages. Then a Guccifer 2.0 WordPress blog was created. Once again, a similar strategy was deployed — push the Guccifer 2.0 hack across social media and send it directly to members of the media.

Then, finally, the IRA gave the leaked emails to WikiLeaks. GRU officers used both the DCLeaks and Guccifer 2.0 personas to direct message WikiLeaks on Twitter. Once WikiLeaks released the hacked emails, IRA pages picked it up as they would any other news cycle or divisive social issue.

If you were a member or follower of any of the accounts named in this article, please email tips@buzzfeed.com.