The same morning, “Katherine Fulton” also began promoting DCLeaks in the same awkward English Mr. Redick used. “Hey truth seekers!” she wrote. “Who can tell me who are #DCLeaks? Some kind of Wikileaks? You should visit their website, it contains confidential information about our leaders such as Hillary Clinton, and others http://dcleaks.com/.”
So did “Alice Donovan,” who pointed to documents from Mr. Soros’s Open Society Foundations that she said showed its pro-American tilt and — in rather formal language for Facebook — “describe eventual means and plans of supporting opposition movements, groups or individuals in various countries.”
Might Mr. Redick, Ms. Fulton, Ms. Donovan and others be real Americans who just happened to notice DCLeaks the same day? No. The Times asked Facebook about these and a half-dozen other accounts that appeared to be Russian creations. The company carried out its standard challenge procedure by asking the users to establish their bona fides. All the suspect accounts failed and were removed from Facebook.
Mobilizing a ‘Bot’ Army
On Twitter, meanwhile, hundreds of accounts were busy posting anti-Clinton messages and promoting the leaked material obtained by Russian hackers. Investigators for FireEye spent months reviewing Twitter accounts associated with certain online personas, posing as activists, that seemed to show the Russian hand: DCLeaks, Guccifer 2.0, Anonymous Poland and several others. FireEye concluded that they were associated with one another and with Russian hacking groups, including APT28 or Fancy Bear, which American intelligence blames for the hacking and leaking of Democratic emails.
Some accounts, the researchers found, showed clear signs of intermittent human control. But most displayed the rote behavior of automated Twitter bots, which send out tweets according to built-in instructions.
The researchers discovered long lists of bot accounts that sent out identical messages within seconds or minutes of one another, firing in alphabetical order. The researchers coined the term “warlist” for them. On Election Day, one such list cited leaks from Anonymous Poland in more than 1,700 tweets. Snippets of them provide a sample of the sequence:
@edanur01 #WarAgainstDemocrats 17:54
@efekinoks #WarAgainstDemocrats 17:54
@elyashayk #WarAgainstDemocrats 17:54
@emrecanbalc #WarAgainstDemocrats 17:55
@emrullahtac #WarAgainstDemocrats 17:55