Cyber intelligence officials in the United States, Netherlands and Canada have identified a sophisticated Russian bot farm that used artificial intelligence to facilitate almost a thousand covert accounts on the social media platform X. The U.S. Department of Justice said investigators seized two internet domains in the United States and took down sham accounts created by the Russian government after the invasion of Ukraine. But the allegations are unlikely to lead to arrests although the exposure of propaganda operations may disrupt their impact.

1. Introduction

On July 9, 2024, the U.S. Federal Bureau of Investigation and Cyber National Mission Force released an advisory to social media companies that malicious actors sponsored by Russia have leveraged the covert artificial intelligence enhanced software package, Meliorator, for foreign malign influence activity benefiting the Russian government. (here) The advisory was issued in partnership with the Netherlands General Intelligence and Security Service, the Netherlands Military Intelligence and Security Service, the Netherlands Police and the Canadian Centre for Cyber Security. Affiliates of RT (formerly Russia Today), a Russian state-sponsored media organization, used Meliorator to create fictitious online personae representing a number of nationalities to post content on X (formerly Twitter). Using this tool, RT affiliates disseminated disinformation to and about various countries including the United States, Germany and Israel.

2. Background

Although Meliorator was only identified on X, the analysis of the tool indicated the developers intended to expand its deployment to other social media platforms. The analysis also indicated the tool is capable of the following:

• creating authentic appearing social media pesonae en masse;
• deploying content similar to typical social media users;
• mirroring disinformation of other bot personae;
• perpetuating the use of pre-existing false narratives to amplify malign foreign influence; and,
• formulating messages, to include the topic and framing, based on the specific archetype of the bot.

The U.S. Department of Justice concurrently announced the seizure of two domain names used by Russian actors to create the AI-enhanced bot farm that spread disinformation in the United States and other countries. The probable cause affidavit, posted on its website, was sworn in support of an application for the search of 968 accounts on the X social media platform. (here) The social media bot farm used elements of AI to create fictitious social media profiles – often purporting to belong to individuals in the United States – which the operators then used to promote messages in support of Russian government objectives. According to FBI Director Christopher Wray, the actions are “a first” in disrupting a Russian-sponsored Generative AI-enhanced social media bot farm. The advisory and affidavit present another opportunity to consider the international disruption tactics of cooperative law enforcement agencies that I discussed in previous posts to On The Wire. (here and here)

3. The Probable Cause Affidavit

The affidavit asserts that individuals associated with the bot farm, believed to be based in Russia, transferred funds internationally to purchase two domain names from Namecheap, a U.S.-based domain name registrar, in order to create private email servers which were then used to create email addresses in order to register 968 fictitious social media accounts for the benefit of Russia’s FSB security service. However, these cyber actors did not obtain a licence from the U.S. Office of Foreign Assets Control before purchasing or renewing the U.S.-based domain names in violation of the International Emergency Economic Powers Act. Because these actors transferred funds from or through a place outside the United States to a place inside the United States, with intent to promote a specified unlawful activity (here, an IEEPA violation), there is probable cause to believe they violated U.S. money laundering laws.

The development of the bot farm was organized by an individual identified in Russia as “Individual A”. In early 2022, Individual A was the deputy editor-in-chief at RT, based in Moscow, and led the Directorate of Digital Journalism from 2022 to the present. Prior to 2022, RT leadership sought the development of alternative means for distributing information beyond RT’s standard television news broadcasts. Individual A proposed the development of software able to create and operate a social media bot farm. In theory, the social media bot farm would create multiple social media accounts through which RT could distribute information on a large scale basis. The leadership agreed with Individual A’s proposal. The development of the bot farm was executed by another individual, Individual B, and designed to give Individual A and other operators the ability to generate fictitious online personae.

In early 2023, an individual identified in Russia who is an FSB officer (“FSB Officer 1”) created the private intelligence organization (PIO) with the approval and financial support of the Kremlin. The affidavit states that the real purpose of the PIO was to advance the mission of the FSB and the Russian government. One means by which the PIO accomplished the mission was by attempting to sow discord in the United States by spreading misinformation through social media accounts created by the bot farm. Here are three examples of Russian government narratives that the bot farm posted on X in October and November 2023:

• In October 2023, the bot account replied to a post from the official account of a U.S. candidate for federal office. The bot account purported to be from the district the candidate was campaigning to represent. In response to the candidate’s post – which addressed the conflicts in Ukraine and Israel – the bot account posted a video of President Vladimir Putin justifying Russia’s actions in Ukraine. (para. 33)
• In November 2023, the bot account posted a video of President Putin discussing his belief that certain geographic areas in Poland, Ukraine and Lithuania were liberated from Nazi control by the Soviet Union during World War II and were therefore “gifts” to those countries from Russia. (para. 34)
• In November 2023, a bot account posted a video in which the speaker claimed the number of foreign fighters embedded with Ukrainian fighters was significantly lower than public estimates. In another post nine days later, the same bot account posted a video of President Putin claiming the war in Ukraine is not a territorial conflict or a matter of geopolitical balance but the, “principles on which the New World Order will be based.” (para. 48)

In response to legal process in April 2024, X Corp. provided subscriber records for twenty-three identified accounts. The records indicate the accounts were created between June and December 2023. As of April 2024, twenty of these accounts remained active. Nineteen of the twenty active accounts were registered using email addresses hosted by the domain names summarized in the affidavit (i.e., @mlrtr.com or @otanmail.com).

4. Conclusion

In a piece for The New York Times titled U.S. and Allies Take Aim at Covert Russian Information Campaign published on July 9, 2024, Steven Lee Myers and Julian E. Barnes said the disclosure of such a large, global network of bots confirmed widespread warnings that the popularization of rapidly developing AI tools would make it easier to produce dubious content. “With A.I., information campaigns can be created in a matter of minutes – the kind of work that in the months before the 2016 presidential election, for example, required an army of office workers.” (here) In an interview by Joseph Menn for The Washington Post, John Scott-Railton of Citizen Lab at the University of Toronto said the countries provided such detail about the inner workings of the botnet to help other companies know what to look for. However, many other AI systems are operating already and they will only get better as they adapt. “This isn’t even the tip of the iceberg,” Mr. Scott-Railton added. “This is the drip of the iceberg.” (here) When asked by the Times to respond to the accusations, RT’s press office replied, “Farming is a beloved pastime for millions of Russians.”