Unmasking Evil: A Russian Troll Farm in Vinnytsia

When the Ukrainian police burst through the doors of an abandoned garage in Vinnytsia last summer, they found what they were looking for: a Russian troll farm. Searching the building, the police found a treasure trove of 3,300 SIM cards. 

SIM is short for Subscriber Identity Module, an integrated circuit designed to securely store an international mobile subscriber identity number along with its corresponding key used to identify and authenticate subscribers on mobile telephone devices. The troll farmers had used the SIM cards to create 3,300 fake identities. Once the troll farm operators had the fake identities, they set up numerous social media accounts for each of the SIM cards. Each account would appear to be from a real Ukrainian in Ukraine. 

The approach of using thousands of fake identities was both wicked and clever. Social media platforms typically require a phone number for account verification, but by using multiple SIM cards, the troll farmers managed to bypass this restriction. When the police examined the trove of computers, mobile phones, and SIM cards, they learned that the bot farm operators were sending out more than 500 messages a day. 

According to James Acuna, a former CIA operative, “We can easily trace Russian disinformation back to their operatives in Saint Petersburg, but it doesn’t matter to them. The payload of disinformation can be highly effective, even as we watch them doing it. They get their intended effect and that’s all that matters to them.” He said the Russians’ aim is to use social media, online forums, and other digital platforms to spread information that is divisive and weakens the West. He’s seen that frequently the Russians take several sides of an issue. The goal is, as he puts it, “…to rile people up.”

Acuna has professional insight on how the Vinnytsia troll farm is likely to have operated. The local operators would be given information from Russia’s Internet Research Agency (IRA), often referred to as a "troll factory." The local operators would learn about various affinity groups, such as, for example, people who watch FOX or those who watch CNN. 

The troll farm operators would then use their fake identities to penetrate the ecosystem of these affinity groups. “If you introduce the right disinformation, you can stoke people’s fears and anger,” points out Acuna. "As an example of how this works, during Brexit, they created campaigns to disparage the Mayor of London, or to encourage race riots.”  

The Russians’ approach: anything that splinters the European Union or NATO is good for Russia. The fact that Brexit was especially contentious and bitter was, in the view of Acuna, partly a result of Russia’s disinformation efforts.

Acuna adds, “It's important to note that the IRA's methods are designed to exploit the open nature of social media. The operators know that sensational or divisive content will be more widely shared. They want to get a ‘Did you hear this?’ reaction so people will propagate it.” 

The discovery of the Vinnytsia troll farm is a chilling reminder of the ongoing cyber warfare being waged in the shadows of the digital world. As James Acuna's insights reveal, the tactics employed by these operatives are not just about spreading falsehoods, but about sowing discord and undermining the unity of Western societies. 

The operation in Vinnytsia, with its thousands of fake identities and relentless disinformation campaigns, epitomizes a larger, more menacing threat to the integrity of our information ecosystem. We need to find an answer to a threat that can tear apart the very fabric of our democratic societies.