Twitter shares millions of tweets linked to Russia and Iran, shedding light on manipulative messaging

Twitter said it was opening up the data to the public to encourage independent analysis by researchers, academics and journalists.
(Nicolas Asfouri / AFP/Getty Images)

Twitter Inc. has published data sets composed of millions of tweets, images and videos and thousands of accounts linked to operatives based in Russia and Iran, shedding light on how bad actors outside the United States sought to manipulate social-media discourse in their home countries and abroad.

The San Francisco social media company has previously disclosed the activities, dating from 2016, but said Wednesday that it was opening up the data to the public to encourage independent analysis by researchers, academics and journalists.

The data sets released Wednesday are made up of 3,841 accounts affiliated with Russia’s Internet Research Agency and 770 accounts potentially based in Iran, as well as 10 million tweets and more than 2 million images, videos and other media.


Many of the accounts disclosed in the data sets have been previously reported. What’s unprecedented is the size of the archive of information. Researchers were able to glean that the Internet Research Agency posted far more in Russian than in English, especially from late 2014 to early 2015, when Russia was fighting in Ukraine, according to analysis conducted by the Atlantic Council’s Digital Forensic Research Lab, or DFRLab.

“One of the big takeaways is just how big these operations were. The second point is that these operations started out for the benefit of the countries they were working in,” said Ben Nimmo, a senior fellow at DFRLab. “It really started out as a domestic tool for repression, and then it was turned into an outward weapon targeting the U.S.”

The Iran operation was largely pushing pro-Iranian government messaging abroad and directing users to certain websites. The top three geopolitical phrases mentioned by the Iranian trolls included Saudi, Iran, and Trump. One-third of the posts from the Iranian troll farm led users to, which calls itself an independent news agency, yet Nimmo refers to it as “part of the Iranian messaging laundromat.”

The Russian operation had multiple goals, including interfering in the U.S. presidential election, dividing polarized online communities, unifying support for Russia’s international interests and weakening trust in American institutions, according to DFRLab. One main purpose was to prevent a victory by Democratic presidential candidate Hillary Clinton, with Russian troll accounts amplifying the hashtag #CrookedHillary and alleging voter fraud in favor of Clinton on election day. One tweet from an account masquerading as the Tennessee GOP read, “BREAKING: Machine refuses to allow Vote For Trump in Pennsylvania! RT the hell out of IT! #VoterFraud.” It was retweeted more than 25,000 times.

The trove of data revealed numerous instances when Russian troll accounts tweeted on both sides of divisive debates in the United States. After a shooting rampage in San Bernardino in 2015, one account posted, “mass shootings wont stop until there are #GunFreeZones #Prayers4California.” Another post read, “I’m tired of this whole anti gun thing. Saying that Guns cause murders is like saying Steering Wheels cause car wrecks #Prayers4California.”

Nimmo said the English-language Russian troll accounts defended Russia as well, including posting 781 tweets referring to U.S. special counsel Robert S. Mueller III’s investigation into Russian election interference as a “witch hunt.”

Tech companies have come under pressure in the last year from U.S. and European lawmakers to do more to rein in such activity, after intelligence services concluded that Russia spread disinformation across their platforms to influence the 2016 U.S. presidential election and Britain’s Brexit vote.

The data disclosed Wednesday also show that the operatives directing the Russian bot accounts used U.S. businesses that enable users to relay content onto Twitter — such as IFTTT, RoundTeam and — in addition to Twitter products such as TweetDeck and the Twitter mobile apps for iPhone and Android. For instance, San Francisco-based IFTTT offers software that connects multiple apps to run automated tasks. RoundTeam automates the task of searching and sharing tweets. Portland, Ore.-based, which is used by publishers including Reuters and BuzzFeed, automatically posts content across social media platforms.

Twitter said it doesn’t expect such information operations to stop and expects bad actors to keep adapting to new technologies. The company said an independent analysis of the activity is an important step toward a shared understanding of the threats.