After Ukrainian drone strikes on Yandex data centers, social media users began distributing graphs that they believe show a sharp decline in the activity of Russian Internet trolls. Many claim that pro-Russian bots have gone silent.
On October 8, cybersecurity researcher Jeremiah Fowler wrote on social network X about the decrease in Russian “bot traffic” after the attack on the Yandex data center. He did not specify what kind of bots he was talking about, but asked whether this could affect the US midterm elections on November 3.
In the following days, the version of the silenced trolls was picked up by Garry Kasparov (announced a “foreign agent” in Russia), former US Ambassador to Russia Michael McFaul and other popular X authors.
On Monday, October 12, speaking at the Warsaw Security Forum in Warsaw, Ukrainian President Vladimir Zelensky stated this.
“When our strikes reached Yandex data centers, it suddenly became a little easier to breathe on many social media platforms,” he said at the Warsaw Security Forum. “Many, many people have noticed this: there is less hatred, less division and less provocation, because there are fewer bots.”
“Since there are fewer bots, it becomes quite obvious where they came from,” Zelensky said. He did not provide data to support his words.
The BBC reviewed the charts and spoke to researchers into Russian influence operations.
A short conclusion: there is no evidence of a decrease in the activity of pro-Kremlin bots. The graph that supporters of this version most often refer to shows the activity of completely different bots. Researchers of Russian influence operations also did not notice changes in the networks of accounts known to them.
Why doesn't the data support this version?
Most often, a graph from the Cloudflare Radar service is cited as evidence that attacks on Yandex data centers hit Russian Internet trolls.
It actually shows that after the attacks, bot traffic from one of the Yandex networks decreased. Users decided that the attacks disabled Russian “troll factories.” But here two different types of bots are confused.
Cloudflare is a company that helps websites operate and protect themselves from attacks. The company told the BBC that the Radar service counts automatic calls to sites served by the company.
Such requests are made, for example, by search robots. They crawl sites and read pages so that search engines can add them to the results. A significant portion of these requests are likely related to the Yandex search engine. Search robots are also called bots, but they do not publish political comments on social networks.
In addition, the graph circulated on social networks shows requests only from one specific Yandex network - AS13238, and not the activity of all Russian bots.
The decrease in the number of such requests is due to the consequences of attacks on the company’s IT infrastructure, but the graph does not say anything about the work of propaganda accounts.
This error was noticed by the Bot Blocker project, The Bell publication (also in the register of “foreign agents”) and other media.
The BBC also asked dTeam, a volunteer group of researchers that monitors Russian influence operations on social media, about this. They responded that after the attacks they had not noticed any changes in the activity of known Russian Internet trolls and botnets on any of the platforms.
“If the offices of SDA/Structura, ANO IRI75/ANO Dialog/Dialogue Regions, Readovka, the Moscow Information Technology Department, and so on were on fire, we would have seen changes,” the researchers explained. The group associates the listed organizations with such operations.
The Yandex press service responded to a BBC request that the use of Yandex Cloud for mass manipulation in social networks, spam and other dishonest activity is prohibited by the platform rules. According to the company's statement, this is enshrined in clause 2.1.1 of the rules; the accounts of violators are blocked.
Yandex's response does not allow us to determine whether the activity of Russian Internet trolls has changed after the attacks.
Meanwhile, social networks continued to publish the Cloudflare graph and conduct “bot tests”: write statements that, according to the authors, would have previously caused an influx of responses from Russian trolls.
“Russian bot factories shut down? Let's test this theory. “Vaccines work,” says one such post. Some users claim that there are now fewer suspicious responses. But individual posts do not measure the activity of propaganda networks.
New graphs have also appeared. One of them was posted by MEP Tomasz Zdechowski on October 11. According to him, the graph showed a sharp drop in “social media activity” around the German Alternative for Germany party.
But the chart published on October 11 showed data up to October 15—four days in advance. However, the publication did not contain the name of the author of the study, nor a description of the methodology, nor information about the sample. When German fact checkers noticed this, Zdechowski admitted in an interview with the Czech publication News that he should have checked what he published more carefully.
