Cypso birdhouses

Russian propaganda is constantly afraid of psychological operations. We estimated the number of Ukrainian bots in VKontakte - there are 53 times less than Prochrevsky

The media in Russia constantly talk about information attacks from abroad. During disputes, users of social networks accuse each other in the work of Tsipso (the Center for Information and Psychological Operations of Ukraine). Novyevropa decided to check that it was behind this propaganda stamp. We found Ukrainian bots in the most popular social networks in Russia - VKontakte - and appreciated their influence. We tell you how they work and what they are trying to convince Russians.

From August 12 to 14, in the Patriot Center in Kubinka near Moscow, the Army-2024 forum was held. By its beginning in some groups, several same comments appeared in VK (hereinafter spelling and punctuation are preserved):

• “People, don't go there. Such a large -scale event cannot get out of the water! Now Zakharova warned that there could be some kind of attack. ”

• "What is this? The birdhouses with such an incomprehensible sign are hung throughout the expo center. Scary……"

• “God why are you taking them pictures? How you were allowed to go there ... There are work of specialists, evacuation. They said that everything is under control and there is no photo to the network. ”

• “Tin. I also saw them. They look too suspicious, so he left. And people are now evacuated at the EXPO, the threat of terrorist attacks. ”

• "These birdhouses explode."

The first comment was accompanied by a diplay video with Maria Zakharova, where she allegedly warned of a possible terrorist attack on this forum. Others contained photos of birdhouses with strange symbols:

Also, commentators distributed a video in which they put an explosive device in one of these birdhouses, and a sunbathing voice says that "accompanying victims are not important." At the end of the video, the birdhouse explodes.

In total, we discovered 197 comments with warnings about possible terrorist attacks at the Army-2024 forum. They were distributed from at least 17 accounts in at least 15 groups in VK.

Most likely, the misinformation campaign with the birdhouses was the work of the hands of Ukrainian bots. However, it seems that it went completely unnoticed - so much so that many of these comments have not yet been removed from VK.

Earlier, with the same accounts they wrote that they want “Switch” to end faster:

• “I wish you to finish the HP and send these mountains of money to the victims. But we will not do so, of course. ”

They called not to let the Russian military into the houses:

• "People, do not let the military into their homes, they will destroy them."

And they complained about the indifference of the federal authorities against the shelling of Belgorod:

• “On peaceful in Belgorod for a long time, everyone in **@t! It seems that the power of our peaceful ones in the border Ukrainians is ready to give. ”

To identify Ukrainian bots, we used the data of the Botnadzor project, which monitors bots in VK. We considered the bots both automated accounts and employees of the boot farm. We investigated the comments of such accounts critical in relation to the Russian authorities and, using machine learning, allocated from them those that were most likely left by Ukrainians. First, we determined the sample of such bots by lexical features characteristic of native speakers, and then expanded it to the accounts close to the topics of comments and activity.

As we thought

We used the Botnadzor project comments base from October 1, 2022 to August 30, 2024.

“Botnadzor” checks about 2.5 thousand various publics daily, collecting information from them about comments on all written posts. This list includes news and political publics (for example, RIA Novosti, TASS, RBC, Lentach, PostNews), regional groups and media, as well as other groups popular with bots (for example, the Plin of Plugs "Saved"). Additionally, Botnadzor monitors posts on news and political topics that are not related to a fixed list of publics: war in Ukraine, Israel, news about drones, etc.

The project does not disclose a detailed methodology for identifying bots, but it is known that the bots are calculated according to similar patterns of activity, after which most of the bots accounts are manually valid. The patterns of activity that Botnadzor takes into account include the number of comments written from the account, the groups in which they are written, the posts to which comments were written, the page registration dates (bots are often recorded in “packs”) and other criteria.

“Botnadzor” classifies bots that write “opposition” political comments in a separate category. Most of these comments until February 2024, when the Factory of Elves closed Free Russia Foundation, they wrote. However, there are other small opposition boto -foards. We call pro -government bots in this text both Kremlinboats supporting the federal agenda and regional bots.

In order to highlight Ukrainian bots, at the first stage we sorted by keywords comments containing the lexical features characteristic of native speakers of the Ukrainian language. We do not give concrete expressions here, because this information can be used by the owners of the boots and make it difficult to further identify bots.

Naturally, not all Ukrainian bots fell into our original classification - there are accounts that do not use these lexical features. However, we suggested that bots from one boto -farm should write comments with a similar content and in a similar set of publics. Therefore, we used a model of machine learning, which found other accounts similar to bots we have already selected with lexical features, which were written by comments close in meaning to about the same groups.

To highlight the bots that write comments in similar publics, we compiled a matrix where the lines are users, columns are public, and in the cell there is a number 0 or 1, depending on whether the account left comments in this public. We did not take into account the groups in which the comments of less than 5 bots wrote. It turned out a matrix of 49883 lines (this is the number of all the accounts of non-service bots operating since October 2022) and 1321 columns (the number of publics in which they wrote comments). We put the resulting matrix and reduced its dimension to 5 using UMAP .

To search for bots that write similar comments in content, we used 20 random comments for each account (or less, if less than 20 comments were written from the account). We compiled embedding (vector representation of the text) using the Openai model for each Bot account. So we got a matrix of 49883 lines and 1536 columns. Next, we worked with her in the same way as with the public matrix - reduced its dimension to 5 using the same UMAP method.

We combined two matrices in order to take into account the information for each account and about which groups he wrote comments and the content of comments. On this matrix, we used the K-Means clustering method to 50 clusters and convinced that clusters on the two-dimensional projection of these data are really distinguishable from each other.

Then we calculated in each cluster a share of bots that use the lexical features we highlighted. In almost all clusters of such bots, there were less than 1%. However, there were 2 clusters of accounts, where bots with lexical features were more than 10%. It was these clusters that we considered clusters of Ukrainian bots. The accuracy of our model, calculated using a cross-ninetition, amounted to 90%.

To analyze the topics of the bots, we used the Bertopic model.

How Ukrainian bots work

In total, we discovered 2369 accounts, presumably, Ukrainian bots, which wrote 290 thousand comments in one and a half thousand publics. This is relatively low activity. For the same period, from October 2022 to August 2024, Russian pro-government bots wrote almost 13 million comments from 126 thousand accounts in almost 44 thousand publics. This is 43 times more comments and 53 times more - bots.

Ukrainian bots leave comments almost only on weekdays (like many Kremlinbots ). From this, as well as from the ability of the bots to conduct meaningful correspondence in the comments, we can conclude that living employees, not neural networks, control accounts.

Typically, Ukrainians imitate Russians, often from border regions. In order for the disguise to be more convincing, bots use vocabulary insulting to Ukrainians.

For example, Ukrainian bots used the word "Khokhol" 10 times more often than pro -Kremlin.

The typical image of the bot is an apolitical Russian who, due to the war of war, realized that the authorities cannot be believed, she cannot protect its citizens and is to blame for his sufferings. This is what Ukrainian bots differ from most other opposition bots that “have” a clear anti -war position. For example, Ukrainians almost do not use the word “Putin”, which is used by opposition bots when they express their attitude to the regime.

Such a disguise, it seems, slightly reduces the likelihood of a ban in VK, but not very much - Ukrainian bots are blocked in 76% of cases, while the rest of the opposition - in 85%. The activities of the Kremlinbots, on the contrary, are covered by the social network by the administration, and they are banned much less often (less than half of all pro -government bots are banned in total, including the Kremlinbots and regional bots), and they are diluted more often, we wrote about this earlier .

Five campaigns in the interests of Ukraine

Unlike the Kremlin, who are active, Ukrainian bots work in campaigns that are tied to information farms and last from several days to several months. Out of such campaigns, the bots are almost inactive.

In total, we identified five campaigns of Ukrainian bots. The first lasted from October 2022 to January 2023 (the campaign could begin until October, but we have no earlier data). It was conducted after the declaration of mobilization in September 2022. The main message was the unjustified war with Ukraine from the point of view of the interests of Russia. For example, bots wrote the following comments:

• “What does it have to do with it? Why do we violate the airspace of another country? After all, we do not want even more conflicts, but the opposite happens! ”

• “3 people died !!! Why did no one warn about the consequences before starting us? They promised to deal with crests in 2 weeks, and in the end now arrivals in our territories! ”

The next campaign, in April 2023, began after the murder of the military commander Vladlen Tatarsky-he was blown up at a meeting with fans in the St. Petersburg Cafe Street Bar. The narrative of the bots has changed somewhat: they focused on the fact that it is unsafe in Russia, and the FSB cannot prevent real terrorist attacks (“I wonder where the FSB was during the terrorist attack in St. Petersburg?”). The reason for the unsafe bots considered the waging of the war: "So far it will last its own ... there will be no security in the country !!"

Also, the bots during this period tried to refute the leakage of secret data from the Pentagon, which was leaked to Discord 21-year-old US intelligence officer-it contained information about the provision of the Ukrainian army, counter-offices and relations of Russia and Ukraine with other countries. The bots commented on this leak like this: “Secret documents usually do not drain into the network ...). Maybe, as always, a slope is a trick. ”

In May 2023, the main theme of the campaign remained the unsafe and inability of Russia to protect its citizens, but the focus shifted from the attacks on the shelling of the Russian territory (“The okre of the shelling also flies anywhere, the features of the country are going on, and the government’s inaction is simply shocked”) and the counterattack of Ukraine (“if not talking about their counterattack, then it is either a counterattack. Will there be such a position? ”). The bots complained about the lack of evacuation in the border regions (“does not offer evacuation in order not to make a rustle, they are more important in society than the lives of people”).

The next campaign began a little less than a year later, in March 2024, and was associated with the presidential election in Russia. The bots actively urged the Russians not to go to the polls, arguing that there are still no democracy in Russia and the elections do not affect anything (“Well, when everything has already been decided, what is the point of going and vote?”). Another argument of the bots was that going to vote now is unsafe due to shelling (“I won’t go to vote. I'm afraid that I would fly and explode again. I’m afraid that my son will be an orphan”).

As usual, they blamed in this, they are the beginning of "l":

“We have shocked on his own plan in three days ... which has turned in two years with thousands of dead and a holey economy.”

On July 25, a new bots campaign began, which was noticeably different from the previous ones: the narratives became more aggressive, the bots began to spread fakes - it was within the framework of this campaign that the bots published posts about exploding birdhouses, which we wrote about at the beginning. For example, the bots said that the Ukrainians reached the Kursk NPP (“Dill already at the Kursk NPP, I have enough to lie, Putin help us!”) And that the Russian military takes men at the exit of the Kursk region, because they are not enough at the front (“When leaving Sudzhi, military men are already pulling out of cars and buses and take it to not clear where !!!” we are not careful !!! ”) We found any evidence of this information.

One of the main topics was comments that excite the hatred of migrants: “There are such problems in the country, and everywhere they say that some director of the park was planted ... Who cares? From this, will the shelling in Belgorod will become less? Or will migrants stop killing Russians? " Typical comments of Ukrainian bots with condemning war and inaction of the authorities remained, although there were fewer (“I remind you that before the military arrived, everything was fine with us ... The feeling that the government punishes us or does not consider us worthy to protect”).

Judging by the comments that bots write, their task is to increase the distrust of Russians in power and the military, and sometimes to sow panic. A researcher at the Goverov Institute at Stanford Sergey Sanovich believes that the information distributed by these accounts may in some cases be a warning: “Due to censorship, Russians find themselves in the war zone unexpectedly for themselves. The fact that the state does not inform its citizens about danger is a much bigger problem than the fact that information about the reality of the war is spreading through fake accounts. ”

The scale of the work of Ukrainian bots is small compared to the Kremlinboat: we thought that Ukrainian bots left only about 2.2% of all comments of political bots in VK since October 2022.

For comparison, the share of comments of pro -government bots is 91% (80% of federal Kremlinbots and 11% - regional), and other opposition bots - 7%.

At the same time, in 2024, the share of political comments left by Ukrainian bots completely decreased to 1%.

What else is included in the Arsenal IPSO

The Ukrainian cybersecurity expert Nikita Knysh notes that the boot farmers in Ukraine are widespread long before the full -scale war, but then they were focused on the Ukrainian audience - for example, they were used to promote the interests of politicians or oligarchs. According to him, in 2019 he knew about the existence of six companies in Ukraine related to the oligarchs and engaged in such activity.

Now many information and psychological operations (IPSO) of Ukraine are aimed at the Russian audience and apply to different sites. So, on August 6, on the day of Ukraine’s invasion of the Kursk region, Dipfecta-Video spread from the acting governor of the Kursk region Alexei Smirnov, where he allegedly called on all adult men to appear in the military commissariats to receive weapons, Baza wrote. Russian prostrate media regularly talk about such cases of the spread of fakes.

Some campaigns completely go beyond the limits of social networks: the residents of the region allegedly called from the Russian authorities and warned about the imminent seizure of the Kursk nuclear power plant and the need to evacuate, the regional administration reported .

Typically, Russian propagandists associate Ukrainian information campaigns with Tsipso (the Center for Information and Psychological Operations, the Unit of the Armed Forces of Ukraine). Such an organization really exists, however, it is difficult to establish who actually conducts campaigns in most cases.

Sergei Sanovich from the Guuver Institute believes that private organizations can work much more efficiently, so it is profitable for the state to outsource information campaigns: “It is good in Ukraine, by world standards, digital marketing industries and analysts are developed. After [the beginning] of the Russian invasion, specialists in these areas began, including independently, to create projects to protect Ukraine in the information space. ” В то же время, по его словам, в РФ структуры, распространяющие пропаганду и дезинформацию, находятся в более тесной связи с государством. Таким образом, российские медиа, перенося на Украину представление об устройстве пропаганды, рождают штамп о ЦИПсО.

О проведении информационных кампаний говорится на сайте украинской исследовательской организации OpenMinds, в качестве ее партнеров указан Совет национальной безопасности и обороны Украины. Основатель OpenMinds говорил The Economist, что их исследования в том числе пытаются ответить на вопрос о том, «как правительство Украины может нанести максимальный удар по моральному духу [россиян], создав “особую информационную среду”». OpenMinds отказалась отвечать на наш запрос о конкретных направлениях своих кампаний.

Украинские кампании иногда даже выходят в физическое пространство российских городов. В мае 2023 года в Москве задержали электромонтажника Константина Кочанова , который рисовал на асфальте красные кресты по просьбе украинского проекта « Хочу жить ». Проект работает с Минобороны и Главным управлением разведки Украины и называет своей основной своей задачей помощь российским военным в сдаче в плен.

Фотографии этих крестов были опубликованы на канале УНИАН, затем растиражированы другими украинскими медиа. Украинский военкор Андрей Цаплиенко прокомментировал эти метки так: «В Москве сходят с ума из-за появившихся по городу красных крестиков. Видимо, опасаются, что это могут быть маркеры для ударов с воздуха на 9 мая».

По информации «Первого отдела», на автора красных меток Кочанова собирались завести дело о госизмене, однако ему удалось уехать из страны.

Похожую кампанию проводили и российские силы, нанося метки на асфальте в Украине в начале полномасштабного вторжения с целью вызвать панику в украинском обществе. Проект «Система» выяснил , что кампанию координировал связанный с ГРУ ультраправый политтехнолог Игорь Мангушев.

Использование ботов в информационных кампаниях становится нормой, считает исследователь медиа и пропаганды из Королевского колледжа Лондона Григорий Асмолов: «Все больше разных акторов воспринимают это как легитимный инструмент политического влияния», — заключает он.