Trending Now
We have updated our Privacy Policy and Terms of Use for Eurasia Group and its affiliates, including GZERO Media, to clarify the types of data we collect, how we collect it, how we use data and with whom we share data. By using our website you consent to our Terms and Conditions and Privacy Policy, including the transfer of your personal data to the United States from your country of residence, and our use of cookies described in our Cookie Policy.
{{ subpage.title }}
Tracking anti-Navalny bot armies
In an exclusive investigation into online disinformation surrounding online reaction to Alexei Navalny's death, GZERO asks whether it is possible to track the birth of a bot army. Was Navalny's tragic death accompanied by a massive online propaganda campaign? We investigated, with the help of a company called Cyabra.
Alexei Navalny knew he was a dead man the moment he returned to Moscow in January 2021. Vladimir Putin had already tried to kill him with the nerve agent Novichok, and he was sent to Germany for treatment. The poison is one of Putin’s signatures, like pushing opponents out of windows or shooting them in the street. Navalny knew Putin would try again.
Still, he came home.
“If your beliefs are worth something,” Navalny wrote on Facebook, “you must be willing to stand up for them. And if necessary, make some sacrifices.”
He made the ultimate sacrifice on Feb. 16, when Russian authorities announced, with Arctic banality, that he had “died” at the IK-3 penal colony more than 1,200 miles north of Moscow. A frozen gulag. “Convict Navalny A.A. felt unwell after a walk, almost immediately losing consciousness,” they announced as if quoting a passage from Koestler’s “Darkness at Noon.” Later, deploying the pitch-black doublespeak of all dictators, they decided to call it, “sudden death syndrome.”
Worth noting: Navalny was filmed the day before, looking well. There is no body for his wife and two kids to see. No autopsy.
As we wrote this morning, Putin is winning on all fronts. Sensing NATO support for the war in Ukraine is wavering – over to you, US Congress – Putin is acting with confident impunity. His army is gaining ground in Ukraine. He scored a propaganda coup when he toyed with dictator-fanboy Tucker Carlson during his two-hour PR session thinly camouflaged as an “interview.” And just days after Navalny was declared dead, the Russian pilot Maksim Kuzminov, who defected to Ukraine with his helicopter last August, was gunned down in Spain.
And then, of course, there is the disinformation war, another Putin battleground. Navalny’s death got me wondering if there would be an orchestrated disinformation campaign around the event, and if so, whether there was any way to track it? Would there be, say, an online release of shock bot troops to combat Western condemnation of Navalny’s death and blunt the blowback?
It turns out there was.
To investigate, GZERO asked the “social threat information company” Cyabra, which specializes in tracking bots, to look for disinformation surrounding the online reactions to the news about Navalny. The Israeli company says its job is to uncover “threats” on social platforms. It has built AI-driven software to track “attacks such as impersonation, data leakage, and online executive perils as they occur.”
Cyabra’s team focused on the tweets President Joe Bidenand Prime Minister Justin Trudeau posted condemning Navalny’s death. Their software analyzed the number of bots that targeted these official accounts. And what they found was fascinating.
According to Cyabra, “29% of the Twitter profiles interacting with Biden’s post about Navalny on X were identified as inauthentic.” For Trudeau, the number was 25%.
Courtesy of Cyabra
So, according to Cyabra, more than a quarter of the reaction you saw on X related to Navalny’s death and these two leaders’ reactions came from bots, not humans. In other words, a bullshit campaign of misinformation.
This finding raises a lot of questions. What’s the baseline of corruption to get a good sense of comparison? For example, is 27% bot traffic on Biden’s tweet about Navalny’s death a lot, or is everything on social media flooded with the same amount of crap? How does Cyabra's team actually track bots, and how accurate is their data? Are they missing bots that are well-disguised, or, on the other side, are some humans being labeled as “inauthentic”? In short, what does this really tell us?
In the year of elections, with multiple wars festering and AI galloping ahead of regulation, the battle against disinformation and bots is more consequential than ever. The bot armies of the night are marching. We need to find a torch to see where they are and if there are any tools that can help us separate fact from fiction.
Tracking bot armies is a job that often happens in the shadows, and it comes with a lot of challenges. Can this be done without violating people’s privacy? How hard is this to combat? I spoke with the CEO of Cyabra, Dan Brahmy, to get his view.
Solomon: When Cyabra tracked the reactions to the tweets from President Joe Biden and Prime Minister Trudeau about the “death” of Navalny, you found more than 25% of the accounts were inauthentic. What does this tell us about social media and what people can actually trust is real?
Brahmy: From elections to sporting events to other significant international headline events, social media is often the destination for millions of people to follow the news and share their opinion. Consequently, it is also the venue of choice for malicious actors to manipulate the narrative.
This was also the case when Cyabra looked into President Biden and Prime Minister Trudeau’s X post directly blaming Putin for Navalny’s death. These posts turned out to be the ideal playing ground for narrative-manipulating bots. Inauthentic accounts on a large scale attacked Biden and Trudeau and blamed them for their foreign and domestic policies while attempting to divert attention from Putin and the negative narrative surrounding him.
The high number of fake accounts detected by Cyabra, together with the speed at which those accounts engaged in the conversation to divert and distract following the announcement of Navalny’s death, shows the capabilities of malicious actors and their intentions to conduct sophisticated influence operations.
Solomon: Can you tell where these are from and who is doing it?
Brahmy: Cyabra monitors for publicly available information on social media and does not track IP addresses or any private information. The publicly shared location of the account is collected by Cyabra. When analyzing the Navalny conversation, Cyabra saw that the majority of the accounts claimed themselves as coming from the US.
Solomon: There is always the benchmark question: How much “bot” traffic or inauthentic traffic do you expect at any time, for any online event? Put the numbers we see here for Trudeau and Biden in perspective.
Brahmy: The average percentage of fake accounts participating in an everyday conversation online typically varies between 4 and 8%. Cyabra’s discovery of 25-29% fake accounts related to this conversation is alarming, significant, and should give us cause for concern.
Solomon: Ok, then there is the accuracy question. How do you actually identify a bot and how do you know, given the sophistication of AI and new bots, that you are not missing a lot of them? Is it easier to find “obvious bots”— i.e., something that tweets every two minutes 24 hours a day, then say, a series of bots that look and act very human?
Brahmy: Using advanced AI and machine learning, Cyabra analyzes a profile’s activity and interactions to determine if it demonstrates non-human behaviors. Cyabra’s proprietary algorithm consists of over 500 behavioral parameters. Some parameters are more intuitive, like the use of multiple languages, while others require in-depth expertise and advanced machine learning. Cyabra’s technology works at scale and in almost real-time.
Solomon: There is so much disinformation anyway – actual people who lie, mislead, falsify, scam – how much does this matter?
Brahmy: The creation and activities of fake accounts on social media (whether it be a bot, sock puppet, troll, or otherwise) should be treated with the utmost seriousness. Fake accounts are almost exclusively created for nefarious purposes. By identifying inauthentic profiles and then analyzing their behaviors and the false narratives they are spreading, we can understand the intentions of malicious actors and remedy them as a society.
While we all understand that the challenge of disinformation is pervasive and a threat to society, being able to conduct the equivalent of an online CT scan reveals the areas that most urgently need our attention.
Solomon: Why does it matter in a big election year?
Brahmy: More than 4 billion people globally are eligible to vote in 2024, with over 50 countries holding elections. That’s 40% of the world’s population. Particularly during an election year, tracking disinformation is important – from protecting the democratic process, ensuring informed decision-making, preventing foreign interference, and promoting transparency, to protecting national security. By tracking and educating the public on the prevalence of inauthentic accounts, we slowly move closer to creating a digital environment that fosters informed, constructive, and authentic discourse.
You can check out part of the Cybara report here.
- Understanding Navalny’s legacy inside Russia ›
- Navalny’s widow continues his fight for freedom ›
- “A film is a weapon on time delay” — an interview with “Navalny” director Daniel Roher ›
- Navalny's death is a huge loss for democracy - NATO's Mircea Geona ›
- Alexei Navalny's death: A deep tragedy for Russia ›
- Navalny's death is a message to the West ›
- Navalny’s death: Five things to know ›
When Russia is your neighbor: Estonian PM Kaja Kallas' frontline POV
Estonian Prime Minister, Kaja Kallas, knows firsthand the dangers that come with being a frontline state on the Russian border. In 2007, her country was hit by Russian cyber attacks that crippled banks, media outlets, and government institutions for weeks. But being on the receiving end of this new kind of modern warfare has also made the country more resilient. In the years since Estonia has invested a lot in cyber security and can better monitor bad actors seeking to divide their society with digital warfare.
GZERO World traveled to the Munich Security Conference to speak with western leaders on the one-year anniversary of the Russian invasion. One of the biggest challenges within NATO is maintaining cohesion and staying united in support of Ukraine. Kallas acknowledges their internal divisions about how far the alliance is willing to go and says Russia's invasion of Ukraine is a lot different than the illegal annexation of Crimea in 2014. She even mentions one anonymous European leader who wants to be on the right side of history in supporting Kyiv, even though public opinion is against it. Any guesses as to who that might be?
Catch Ian Bremmer's full interview with Kallas in this week's episode of "GZERO World with Ian Bremmer," airing on public television stations in the US. Check local listings
Russia freezing out Ukrainian civilians because it can't beat military, says Microsoft's Brad Smith
What's Russia doing differently now in Ukraine compared to a few months ago?
Microsoft President and Vice Chair Brad Smith thinks the Russians have clearly failed to defeat Ukrainian soldiers, so they've turned to using their weapons against the civilian population and knocking out their power.
"It's as if they're hoping to freeze out 40 million people and force them to flee," he says during a Global Stage livestream conversation hosted by GZERO in partnership with Microsoft.
Meanwhile, cyberattacks are spreading beyond Ukraine's borders to countries like Poland. Still, Smith says the $423 million in aid his company has provided has helped Ukraine hold the line.
What's more troubling, he adds, is that Russia is doing the opposite of what the international community set out to do with the Geneva Convention: fight wars with military force and protect civilians.
Watch the full Global Stage livestream conversation on "The Road to 2030: Getting Global Goals Back on Track."
- 2022 has been rough. Will 2023 be any better? ›
- Why hasn’t Ukraine suffered a debilitating Russian cyberattack? ›
- Who can solve the world's "emergency of global proportions"? ›
- Microsoft president Brad Smith has a plan to meet the UN's goals ›
- Brad Smith: Russia's war in Ukraine started on Feb 23 in cyberspace ›
Will the US be able to withstand cyber attacks on critical infrastructure?
The US Cybersecurity and Infrastructure Security Agency was set up in 2018 to help protect America's critical infrastructure.
It might sound like a technical term, but CISA chief Jen Easterly explains that critical infrastructure is how we get water, power, gas — even food at the grocery store. And 80% of it is operated by the private sector.
So, how does the agency help businesses defend themselves from hackers?
"In cybersecurity, the federal government is just a partner ... so we all have to work together to drive down risk to the nation," Jen Easterly tells Ian Bremmer on GZERO World.
- Does Jeh Johnson consider Russia's cyber attack against the US to ... ›
- Podcast: Lessons of the SolarWinds attack - GZERO Media ›
- SolarWinds hack a wake-up call to the tech sector - GZERO Media ›
- Biggest cybersecurity threat to watch in 2022 - GZERO Media ›
- A (global) solution for cybercrime - GZERO Media ›
- Hackers, Russia, China: cyber battles & how we win - GZERO Media ›
Brad Smith: Russia's war in Ukraine started on Feb 23 in cyberspace
Weeks before Russia invaded Ukraine, Microsoft was already helping the Ukrainians defend their cyberspace against Russian hackers, for instance by moving the government's physical servers into the cloud to avoid destruction by Russian missiles.
In the virtual world, like on the battlefield, "you've gotta disperse your defensive assets so they're not vulnerable to a single attack," Microsoft President Brad Smith says in a Global Stage livestream discussion at the World Economic Forum in Davos, "Crisis in a digital world," hosted by GZERO in partnership with Microsoft.
Then came defending Ukraine against Russian cyberattacks.
In cyberspace, Smith says the war really started on February 23, a day before Russia's land invasion, when Microsoft noticed some 300 coordinated attacks trying to take down Ukrainian government websites and banks via Microsoft's own data centers in Seattle.
Still, it worked. Why? Because "so far in this war, defense has proven to be stronger [than] offense, frankly, in almost every category, but especially when it comes to cyberspace."
Watch more of this Global Stage discussion: "Crisis in a digital world"
- What We're Watching: Cyberwarfare in Ukraine, Imran Khan in ... ›
- Why hasn't Ukraine suffered a debilitating Russian cyberattack ... ›
- Podcast: Cyber threats in Ukraine and beyond - GZERO Media ›
- How Russian cyberwarfare could impact Ukraine & NATO response ... ›
- A different Davos amid geopolitical conflicts and security issues - GZERO Media ›
- Microsoft president Brad Smith has a plan to meet the UN's goals - GZERO Media ›
- Russia freezing out Ukrainian civilians because it can't beat military, says Microsoft's Brad Smith - GZERO Media ›
- Tech innovation can outpace cyber threats, says Microsoft's Brad Smith - GZERO Media ›
Watching Russia: cyber threats & disinformation
Marietje Schaake, International Policy Director at Stanford's Cyber Policy Center, Eurasia Group senior advisor and former MEP, discusses the Ukraine conflict from the cybersecurity perspective:
Unfortunately, the war that Russia started against Ukraine is still ongoing in all its devastation. And so today we focus again on some of the tech related aspects of that completely unjust and unnecessary conflict.
How likely will Russia launch a sweeping cyberattack on the West?
Well, I don't have a crystal ball, but going by with what we've seen in the past with ransomware attacks, hacks, cyberattacks on Ukraine's power grid already years ago, as well as attempts to manipulate the US presidential elections, there are certainly is no lack of will or ability on the Russian side and that makes the absence of new meddling or direct attacks with devastating impact on Western targets, actually quite remarkable. These were feared and predicted, but they have not quite manifested yet.
With disinformation becoming a weapon in the war, how can individuals better protect themselves?
Well, indeed, this information, propaganda, are specialties of the Kremlin, and it is important to be careful about what to trust, especially online. There's been a dramatic change, however, because EU sanctions have been imposed on state propaganda and Russian state media, making those sources inaccessible on both television and the internet for European audiences. But of course, there are other sources of this information, and so critical reading, verifying news by finding multiple sources, or choosing to look at reporting from trusted media or reporters that adhere to good journalistic practices, can be helpful to make sense of what is actually going on amidst an avalanche of information of which disinformation can be a part.
Cyber warfare & disinformation play key role in Russia Ukraine conflict
Marietje Schaake, International Policy Director at Stanford's Cyber Policy Center, Eurasia Group senior advisor and former MEP, discusses the Ukraine conflict from the cybersecurity perspective:
These are dark and bitter times. We've just seen Russia starting a completely unjustifiable war with disproportionate force against Ukraine and these acts of aggression that we see, threats on the foundations of a rules based order and of our own freedoms in democracies worldwide. Yes, to all this aggression, there is also a cyber dimension.
Cyber warfare is clearly a major part of the Russia Ukraine conflict, but cyber weapons are notoriously hard to control.
What is the risk that hackers at war in Eastern Europe could wind up, intentionally or not, wreaking havoc in the West or beyond?
Now in terms of the deployment of tools to attack digital infrastructure and systems, going with what we have seen so far, attacks on Ukraine have already wreaked havoc on the West. Whether it was the NotPetya attack or attempts to manipulate the US presidential election, old KGB tactics are an integral tool in Putin's toolbox. So we shouldn't think of cyberwar as something separate or detached from the broader conflict confrontation, escalation and geopolitical agenda. And there is also this disinformation element woven through all aspects of the confrontation coming from Russia. Not to forget that in Europe today, as well as in the United States, Vladimir Putin has allies in political office. So sometimes I wonder with friends like these, who needs enemies?
- Constant Russian attacks on Ukraine in cyberspace - GZERO Media ›
- How Russian cyberwarfare could impact Ukraine & NATO response ... ›
- Russian cyber attack could trigger NATO's Article 5, warns NATO ... ›
- How Russian cyberwarfare could impact Ukraine & NATO response - GZERO Media ›
- Watching Russia: cyber threats & disinformation - GZERO Media ›
"We're identifying new cyber threats and attacks every day" – Microsoft’s Brad Smith
Cyber threats are the new frontier of war. That's why companies like Microsoft are investing heavily in the capability to identify new threats and attempted attacks. “We work every day to make sure that we’re identifying new threats and attacks, regardless of where they’re from,” said Microsoft President Brad Smith at the Munich Security Conference. This includes monitoring infiltrations and alerting companies, countries and sometimes even the public, as needed, in a timely fashion, he explained.
Smith spoke with moderator David Sanger in GZERO Media's Global Stage livestream discussion at the Munich Security Conference.
- How Russian cyberwarfare could impact Ukraine & NATO response ... ›
- DarkSide hack reveals risk of ransomware cyberattacks - GZERO ... ›
- Would you pay a cyber ransom? - GZERO Media ›
- Russian cyber attack could trigger NATO's Article 5, warns NATO ... ›
- How Russian cyberwarfare could impact Ukraine & NATO response - GZERO Media ›
- Global Stage ›
- Podcast: Cyber threats in Ukraine and beyond - GZERO Media ›
- Microsoft president Brad Smith has a plan to meet the UN's goals - GZERO Media ›