Invisibility

Just as faces can be hidden behind masks, online influence can be invisible—and paradoxically, invisibility guarantees its effectiveness. The sociotechnical online infrastructure renders online trolls invisible, as they operate in the back end of the online environment they inhabit—be it through algorithms or programmed spaces. Additionally, the availability of tools, such as application programming interfaces (known as APIs), along with machine learning or, synthetic data-driven artificial intelligence, for online developers, make some online spaces more accessible for automation than others (see discussion in Zelenkauskaite & Bucy, 2016). As discussed earlier, these online spaces can be exploited to enable invisible acting, or the infiltration in online communities.

Invisible forces in the current media landscape can be unleashed not only by human users but also by automated bots that run according to algorithmic programs. As nonhuman actors, bots are invisible while operating in the background system through programming commands that run the surface content. The system is algorithmic because information can be driven by bots or algorithms that push, promote, or circulate content. Russian trolls can use to their advantage algorithmic tools that involve automated responses or frequent posting. The encoding and circulation of algorithmic information further enable Russian trolls to hide, and these can be customized to generate influence.

From the perspective of information structure, online spaces are invisible because of the inaccessible identities of actors that populate and promote them. For example, it is difficult to pinpoint who is posting and to determine whether that user is an actual person or a bot, even if tools have been developed for some platforms, such as Botometer for Twitter (Botometer, Page 42 →n.d.). Moreover, bot detection is currently unavailable for users accessing online news comments. Because general public users lack both knowledge about bot technologies and the ability to recognize disinformation and their actors, hiding in online spaces is guaranteed. Furthermore, leading scholars of the digital divide might argue that such invisibility is problematic not merely as an outcome of lack of technology access but of the requisite skills and online tools for understanding how online influence takes place (Van Dijk, 2013).

To fully understand how information systems work, general readers in online spaces need to move beyond individual posting levels to access contexts in which messages are posted. Such contexts involve access to a bird’s-eye view of big data of all posting flows to observe the circulation of information to start making sense of the patterns of influence, besides uncovering techniques that enable their proliferation which we currently lack. Technologically speaking, online users typically do not have access to or the capability of viewing patterns of information circulation, as critical accounts of remediation and big data uphold (Zelenkauskaite, 2017). However, it is worth mentioning that news portals have implemented user’s activity access, especially if they register.

Similar arguments hold for fighting disinformation where an understanding of digital tools used becomes instrumental. While these lists of tools are compiled publicly (e.g., Rand’s tool list is thorough and comprehensive) for bot and spam detection, credibility scoring, disinformation tracking, education and training, verification, whitelisting, and establishing codes and standards (“Rand,” n.d.), their use in everyday life is still limited given that these lists appear post hoc and are not implemented as preemptive measures.

Given that users in online spaces typically cannot focus on how systems process the information surrounding them, invisibility becomes a key element that facilitates Russian trolling. Such invisibility can be enabled by the masks that mediated environments create. Thus, technological affordances of system-based seamlessness can be exploited to hide the influence of Russian trolling. Yet it remains crucial to uncover the mechanisms through which influence can take place and to enable users to recognize them.

Masks at Play

Trolling as a masquerade has been contextualized by Bakardjieva’s (2008) analysis of the news comments within a larger national popular culture by describing online news comments as carnivalesque. As carnivalesque discourse,Page 43 → comments can be grotesque, humorous, or loud. Thus, Bakardjieva (2008) has emphasized the loose and informal aspects of online commenting. How can masks be interpreted through text? And how can masks instill chaos? How do these informal practices are translatable into contexts where not all actors involved are genuine?

Since the carnivalesque nature of online comments allows discursive participants to wear masks, such masks depend on the wearer’s targeted audience. Moreover, given that any user can participate with any type of mask, and with any form of commenting, carnivalesque masks can also include ideological influence and disinformation. In such instances, trolling is rendered visible by approaching discourse as a mask—especially when Russian trolling is defended or called out. These discursive practices expose Russian trolling’s subverted masks. The purpose here is to outline how subversion through online news comments takes place and which tactics are used to persuade. Specific masks that are examined here show how Russian trolling appears in comment spaces.

Propagandistic trolls are characterized by the intention to subvert authentic participation in the Habermasian public sphere, where everyone is invited to discuss news story issues. This subversion can take place in several ways. To be effective, ideological or propagandistic trolls need to blend into a conversation that is already taking place by presenting topics that would be approved by the group they join. Rather than employing a classical trolling strategy of aimlessly opposing ideas that have already been presented by group members, such trolls infiltrate conversations by amplifying, introducing new interpretations, or contesting a given issue at a specific moment (see, e.g., Herring et al., 2002). Such discursive tactics allow for a propagandistic mask to be perceived as one of the voices that constitutes online public debate. Thus, because online incivility attracts user scrutiny, the Russian troll, who intends to engage in disinformation, tries to hide in the crowd of other users to become one of the alternative or amplifying voices.

In short, such Russian trolls, to be effective, deliberately aim for online invisibility through discursive assimilation. Such deliberate efforts are sustained through the creation of masks and their continuous use. The true (authentic self) is hidden behind a customized mask, as is the case, for example, with Internet Research Agency’s employees who pretend to be someone else when posting online, as further detailed in Chapter 4. The mask is based on a predefined ideological framework that is created for a specific case of influence. And the invisibility of trolls can be directly linked to the presence of a mask. Rather than the usual physical mask that may come to mind, the mask, in these online instances, is a nebulous abstraction that is based on Page 44 →text, video, and internet links—and most importantly, an abstraction that projects a specific ideology used to craft messages for disinformation.

Within the parameters of this discussion, Russian troll masks need to be distinguished from the masks that other kinds of internet trolls wear in the online social sphere. Typically, online masks have been associated with internet trolls to explain uncivil behaviors. However, the behavior of an internet troll as disruptor is geared toward visibility because the objective is to monopolize attention or to stand out from the user crowd. Thus, internet trolls are represented as users who wear masks or who crave attention. While they may be masked by their social media name or handle, they still want their online comments to attract notice.

Although their masks assume numerous forms, they are invariably represented as grotesque. Yet Russian trolls can be distinguished from other internet trolls because they take advantage of user crowds to conceal themselves while advancing disinformation agendas. Furthermore, because Russian trolls endorse such agendas, they prefer denial and obfuscation to adopting a series of standardized troll masks to engage in uncivil behaviors in online spaces. For instance, they will deny the existence of Russian trolling in order to defend its operations while obscuring its effects. Thus, numerous questions arise: What types of masks can hide online identities or be replaced? How are masks worn? Who is behind the masks? How can Russian troll voices be amplified? And, why are masks convenient for engaging in information warfare? However, rather than confirm the presence of Russian trolls behind masks, the goal is to authenticate their discursive practices and their effects—in other words, to explain how troll masks can be created if they do not originate in authentic user behaviors.

Location as a Mask

Is a troll a mask, or is a troll the one who wears the mask? Or, when anyone can wear a mask, who is behind the troll mask? These questions permeate the problematic issue of Russian trolling in the current media landscape. Geographical location online can become a mask since it is marked through multiple sociotechnical affordances online—automatic ones (e.g., Internet Protocol (or IP) address where the content is produced); user-created such as geotagging where users can tag their own location or the location of the post, or providing location in the text. Location has been prolifically analyzed to draw insights on war and conflict to map physical spaces and online spaces (see e.g., Siapera et al., 2015).

Page 45 →Analyzing tweets associated with Internet Research Agency–based accounts confirms, so far, that users adopt a mask to present themselves as authentic (Xia et al., 2019). Therefore, the question is not about the existence of Russian trolling as self-masking performance. Rather, we might ask how that masquerade is performed. In her book on cyberwar, Jamieson (2018) observed that Russian trolls wore masks by harnessing the power of impersonation: “Because the geographic location of the communicator is not evident to those viewing posts and tweets, in a single sitting, a troll in St. Petersburg could masquerade as a housewife in Harrisburg, Pennsylvania; a black nationalist in Atlanta, Georgia; and a disaffected Democrat in Ripon, Wisconsin. Accordingly, @TEN_GOP was not in Tennessee, as its inhabitants alleged, but continents away. Likewise, there were no longhorns named Bevo or Boris anywhere near the Heart of Texas account’s authors” (p. 12).

This excerpt specifies how trolls can masquerade by impersonating various prototypes embedded in the American public consciousness. The key to understanding such impersonations is the intentionality of the acting—its specific goal to influence or at the very least “muddy the waters” or create chaos. Jamieson’s (2018) examples reveal location-based, deceptive self-representations, or masks designed to generate a perception of authentic participation in various online spaces, such as social media, and hypertext.

Manipulating one’s IP address is a practice that has been attributed to generating fraudulent accounts online, which constituted around 3% of Twitter and 1.5% of Facebook accounts (Thomas et al., 2013). However, in news portal contexts, IP-based, location-based evidence of foreign activity in Lithuania’s online spaces has also been exposed.

User IP address concealment is treated in IP analysis as the blueprint mask in online spaces. Typically, IP is automatically assigned to a message (or any content) on the basis of a device’s parameters, through which the message is transmitted. To mask these parameters, IP requires intentional alteration. Analysis of news portal content in the Russian-language version of Delfi.lt in previous research has shown how IP concealment is prevalent online (Zelenkauskaite & Balduccini, 2017). To trace such intentionality about altering locations, Zelenkauskaite and Balduccini (2017) analyzed 1,304 stories published between 2015 February 15 and 2015 March 15 on the Delfi.lt news portal, together with all related comments. This sample consisted of 4,940 users who contributed portal with 34,038 comments, with 6.9 comments per user on average. The sample contained 14 content categories, as defined by the news portal. Geolocation analysis of the data showed the following distribution of the countries from which comments have originated: the highest percentage of comments was traced back to Page 46 →Lithuania (53.3%), followed by Russia (16.8%), then by cases whereby locations could not be identified (7.9%). These statistics further confirm the “mask” enacted through IP concealment.

It was also discovered that a location’s specificity was yet another indicator of Russian trolling. When scholars analyzed Twitter accounts associated with the IRA’s activities, they identified certain markers that revealed differences between typical Twitter users and IRA-orchestrated tweets (Zannettou et al., 2019). One difference identified was that IRA users included generic locations in their self-descriptions, while other types of users included specific ones (Zannettou et al., 2019). Other attributes of atypical posting in the news portals were found to involve users who post quickly—that is, by simulating the automated behaviors known as bot-based behaviors in social media (Zelenkauskaite & Balduccini, 2017). Indeed, there is a noticeable proportion of users who post very quickly when a news story is released and in response to multiple stories about similar topics synchronously. These behavioral traits indicate an orchestrated effort behind the accounts. Thus, accounts can function as masks.

Sabotage: Calling Out Russian Trolls

Russian troll call out sabotage examples can be considered as a form of defensive measure where face saving is subverted by the audiences who do not comply with script promoted by Russian trolling. Goffman (1959) identified performative face saving as a defensive measure enabling performers to Page 48 →save their own show. Defensive attributes and practices include dramaturgic loyalty (teammates must act as if they have accepted certain moral obligations), dramaturgic discipline (teammates must be on top of the performativity), and dramaturgic circumspection (constant awareness of performance).

Since these codified attributes can also apply to Russian trolling, the performance of Russian trolls can be sabotaged when an audience calls them out, as evidenced by multiple forms of such sabotage exemplified in the subsequent section. In other words, the sabotage can result from a violation of this tacit code. Violation occurs when expectations of audience cooperation remain unfulfilled. More specifically, an audience sabotages a Russian troll’s masquerade by acting in ways that are contrary to typical audience behavior expectations in specific online spaces. According to the ideal scenarios for Russian trolls’ success, such behavioral expectations include unconditional acceptance of Russian troll participation in online discussions. Such user acceptance can be demonstrated by playing along with trolls or cooperating with them by allowing them to propagate information.

Masks also represent tactics of self-presentation that are verified by audiences, who are presented with two choices: to accept masks at their face value by treating Russian trolls as legitimate participants of a given media ecosystem, or to call them out by sabotaging their performance and exposing them. An exposé of Russian trolling illustrates performance sabotage. Sabotage can counteract disinformation through user activities that do not conform to standardized communicative rituals—thus, breaking with the preestablished norms for avoiding embarrassing incidents. Consequently, disinformation can be nullified through the knowledge that a propagandistic act is taking place. It is when the act’s occurrence has become a known fact that one can choose to expose or ignore it.

Comments calling out Russian trolls found in analyzed platforms’ comments functioned as exposés. Many of these exposé frames allude to Russian trolls being paid by the government to comment online. Russian trolls, in these instances, were treated as mercenaries, paid by the Russian government—specifically, the Internet Research Agency, as exemplified below.

Page 49 →In some cases, Russian trolls were called out on the basis of linguistic features that provoked the suspicion that they were nonnative speakers of English:

Some exposé frames used a sarcastic tone:

Yet others called out Russian trolls by demanding their permanent departure from the Breitbart comments section.

Others called them out through specific reference to typical Russian troll attributes, such as being paid and their intent to influence.

Similarly, another user posted:

Some comments included a variation of the line “I am not a Russian troll, like you are,” by generating opposition or through distancing.

Another user insinuated that Russian trolls are trained by an “apparatus.”

Similarly, claims that Russian trolls not only exist but indeed exist here to sow discord are expressed by this user:

Others called out the opposition by stating that there are also “Soros trolls.”

Some referred specifically to foreign interference.

In this exchange, the second comment calls out the user who posted pro-Trump post referring to them as “foreign troll.” Similarly, other users pointed out that in Breitbart there are Russian trolls and bots who act like regular citizens:

Similarly, another user perceives that in Breitbart comments there are a lot of posts by Russian trolls:

Some users stated that Russian trolls exist and were “here” on Breitbart.

The statement “Russian trolls are here” is repeated in the following comment.

Similarly, some users refer to Russian trolls by calling them “comrades” and referring to “rubles” in reference to Russian trolls being paid by their government:

In the New York Times sample, a user flagged a comment as a Russian troll post based on its content.

Page 52 →Some users were hesitant to publicize Russian troll exposés. Others argued that certain posts “might have been written” by Russian trolls, as the following comment exemplifies.

One user sarcastically called out another user’s posts as those authored by Russian trolls.

Some users offered media literacy lessons on how trolling works.

Yet others explicitly praised the New York Times for exposing Russian trolling. For example, the following post received 185 “Recommend” hits.

Some users provide not only media literacy frameworks, but also, broader explanations for why Russia and conservatives are compelling.

Some users called out Russian trolling by commenting on the behavioral traits and language of Russian trolls.

These examples illustrate how Russian trolls embedded in news portal comment spaces have been caught and called out wearing propagandistic masks. Yet even if exposés occur in online spaces, they do not necessarily sabotage the performances of Russian trolls. Instead, such exposés illustrate that, due to the prevalence of Russian trolls in a given online forum, information posted there is generally unreliable. Such projections of impending online chaos can suppress democratic debate by inciting users to leave spaces permanently, to request websites shut down user commenting due to challenges of comment moderation, or to merely ridicule the seriousness of Russian trolling.

It is possible to interpret such sabotage through the lens of Goffman’s theory of performativity. According to Goffman (1959), however, the disloyalty of online community, exemplified here through callouts of Russian trolls, threatens potential backfire. In short, callouts can strengthen the opposition’s in-group solidarity. Even if some audience members were to expose Russian trolls, those who endorse other perspectives (e.g., the conviction that Russian trolling is unproblematic) could form an opposing coalition. The opponents could then amplify the disinformation originating from Russian trolls and realize what Goffman called the “dramaturgical discipline” ideal. From the perspective of teammates, dramaturgical discipline involves the cooperation that enables them to follow along with the scripted performance. Thus, as a concept, dramaturgical discipline permits Russian trolls to play the role of trolls consistently. Sustaining such role-playing over time is possible because they can always attract complicit supporters, despite the presence of online community members who expose them and thus sabotage their masquerades.

Yet for Russian trolls to be successful, they need to find the right topics to attract followers. Thus, dramaturgical circumspection is required—a quality defined as a constant (self-)awareness or prudence in communicative acts. Goffman (1959) stated that “the prudence is needed while staging the event, exploiting contingencies that are presented with them and opportunities that remain” (p. 218). He also specified requirements for the successful enactment of prudence, such as selection of loyal and disciplined team members and awareness of how much loyalty can be expected from the team. In other words, Russian trolling needs support from loyal followers,Page 55 → or collaborators, who succumb to the lure of disinformation messaging and treat it as an authentic discursive form. These loyal followers can also be mere believers of disinformation messaging overall, if parts of the messaging appeal to their values. Consequently, they become enablers of Russian trolling success. As Jamieson (2018) observed, such followers can also be paid operatives who create a critical mass, or the general public who enables the proliferation of ideas held by Russian trolls.

To target enablers, there is another tactic that can be utilized for the performative masking of Russian trolling that involves what Goffman (1959) called the circumspect performer. More specifically, this tactic requires “selecting the kinds of audiences that will give a minimum of trouble in terms of the show the performer wants to put on” (Goffman, 1959, p. 219). Thus, theoretically speaking, before casting a wide messaging net, Russian trolls should test out online spaces where contestation of ideas is minimal. Then, they can deploy tactics for persuading audiences to take sides on issues that have already been endorsed for online debate. Such tactics expose potential alternatives that appeal to that specific segment of the audience. In other words, by providing various justifications for Russian trolling, the ones that become amplified or the ones that audiences find most appealing become increasingly evident. After such testing, messages can be seeded through repetition across multiple platforms.

Another technique that supports the circumspect performer is ensuring that information remains closely related to the facts and that these facts remain minimal for the production of simple and succinct scripts. In other words, the shorter and simpler the script, the less risky (as in the case of alibis) and the more likely the performance is prone to withstand sabotage. While this technique allows for less error, Goffman (1959) cautioned that it could decrease audience interest and engagement. Thus, short and simple, persistently repeated messages have the greatest likelihood of success as tactics of persuasion and influence. For Russian trolling specifically, such messages need to address topics that appeal to public affect and should be duplicated.

Another aspect of visibility that performers must consider is the amount of information sources available to the audience during the interaction process. This concern is important because it allows the performers (i.e., masked Russian trolls) to adapt to situations depending on the audience type they face—examples are shown in the subsequent chapters referring to cracks in the society pertinent to each sociocultural context. In other words, different news portals will draw specific audiences—whether that portal is Breitbart, the New York Times, Gab, or Delfi.lt. Thus, issues need to be customized for each of these audiences.

Page 56 →News portals that waive user registration requirements for posting comments also enable successful online masquerades. In such cases, invisibility can be more readily negotiated by performers, whereas automation further facilitates such masquerades. More specifically, the creation of myriad bots that act autonomously and promote certain messages becomes possible. If the human team behind the bots has an orchestrated agenda, it can render Russian trolling effective due to its ability to dispatch messages on a global scale.

Protective Measures

Protective measures can also be variations of the Russian trolling mask. While such measures have been described as modes of impression management, they are usually implemented according to voluntary discretion—that is, of interlocutors who ask individuals to refrain from entering spaces to which they have not been invited. Once they are invited to a performance, they still need to maintain what Goffman (1959) called tactful inattention.

Where Russian trolls and news portals are concerned, the uninvited aspect of online audiences is rendered irrelevant by the general assumption that democratic deliberation invites all users to participate and that such discursive participants self-select. Consequently, performances in online spaces can be deliberately sabotaged by any actor. While some participants are more active than others, the nature of participation varies, depending on news story categories and participant (inter)activity levels, for which an indicator is the number of messages posted.

Modus Operandi 1: The Troll Mask as Camouflage and Alter Ego

Constantly changing message flows in online spaces permits users to camouflage themselves within message clusters while enabling them to assume various roles. Russian trolls, in particular, if employing classical propaganda techniques, can assume at least two forms: the overt propaganda and covert propaganda. Choukas (1965) traced these propaganda techniques to World War II. Overt propaganda involves the propagandist’s infiltration of an audience to simulate agreement with the majority of members. The goal is infiltration, followed by further polarization. By contrast, covert propaganda techniques require the propagandist to side with the opposition.

Such treatment of propagandistic masks is useful where Russian trolls can join movements and present themselves as members of a generally informed citizenry or as merely opinionated online forum participants. Consequently, group membership enables Russian trolls to operate as masked users who infiltrate spaces to sway opinions. Russian troll infiltration case was recently identified in the conflict among groups within the Black Lives Matter movement (CNN video, Russian trolls exploit, 2018; Stewart et al., 2018; Zannettou et al., 2019). In such cases, infiltrating trolls can feign participation in social movements through the tactics of overt or covert propaganda. Assimilation into the general online population further enables them to deploy these propaganda tactics. For example, they can assimilate by impersonating activists and by pretending to endorse their values. Infiltrating trolls can also impersonate members of oppositional teams. Thus, by assuming both activist and oppositional team member roles, disinformation is enabled through the consolidation of control over messaging, as in examples of “I am a Russian troll.”

Furthermore, when referring to propaganda as a mask, Choukas (1965) stated that the mask represents the covert position of propagandists. He also claimed that unlike overt propaganda scenarios, whereby opponents are openly exposed or attacked, the covert propagandist assumes the role of the friend of an opponent, or—better yet—that type of propagandist assumes the roles of opponents. Thus, covert propaganda is understood to be fully orchestrated with complete objectivity, while no personal elements are included in its agenda. Moreover, covert propaganda involves using lies Page 60 →to create objective facts. Yet when such facts became verifiable, such “covert” propagandistic messages become evident lies. Then, the propagandist is compelled to change strategies. But before that need arises, the propagandist can freely circulate pushed agendas as objective truths, due to debate distortion or sabotage in the online public sphere.

Modus Operandi 2: “Fake It Till You Make It”

Through the symbology of masks, online trolling can be viewed as a staged performance, especially if it is orchestrated by external forces of influence. Yet its performative element implies that to be perceived as “real,” one must engage in a persistent performance. This persistent performance can be encapsulated in the dictum “fake it till you make it.” Goffman (1959) described the sustained performance accordingly: “Performers may even attempt to give the impression that their present poise and proficiency are something they have always had and that they have never had to fumble their way through a learning period” (p. 47).

While Goffman noted that performers are better off if they enter a performance site without doubts, faking can be a useful technique for persuading an audience that the performance they are about to witness is actually authentic. Goffman, then, specified examples of high-executive jobs and how applicants for them are hired on the basis of the qualities that they appear to embody rather than the skills that they actually possess. In the case of executive positions, job applicants land them because of these “quasi-inherent” or performed (in advance) qualities.

So, how does all this apply to Russian trolling? First, Russian trolling in the comments has been positioned through specific frames. These frames are conveniently packaged for the reader as lenses through which Russian trolling should be interpreted. For example, Russian trolls exist and Russian trolls do not exist are two major oppositional frames through which Russian trolling was treated online. Russian trolling, thus, requires a great deal of effort with “fake it till you make it.” The need of sustained positioning of a given idea suggests that there is no agreement on a given topic, such as Russian trolling existence.

Sustained performances in professional settings were found to involve degrees of signaling. Goffman (1959) observed that “fake it till you make it” in service occupations is accompanied by tangible signs such as the appearance of “cleanliness, competence, [and] integrity” (p. 26). Such signs, he argued, are related to the self-presentation. Thus, in online performance Page 61 →contexts, Russian trolls have to take stances by crafting targeted messages toward the groups and online spaces they intend to influence.

Additionally, the “fake it” aspect of trolling requires the adaptive selection of a presentation for maximizing approval of an issue related to disinformation. Such issues typically refer to sensitive topics that are relevant to a given group or are customized according to context. Then, to sustain that performance of authenticity, frames need to be repeated till audiences validate or accept them. Thus, performers encounter risks when adopting “fake it till you make it” strategies. However, performers can underperform or overperform when using given masks. Thus, a successful Russian troll needs to calibrate performance capacities. According to Goffman (1959), one calibration method involves setting the scenic parts of the expressive equipment. Thus, for disinformation to be effective, masks require constant adjustment as new topics emerge.

Goffman (1959) also claimed that there were preestablished fronts, or modes of self-presentation, that require particular performance acts for various roles. Users can fake authenticity by repeatedly employing such predesigned frames, or aforementioned fronts. Thus, specific positioning of Russian trolls through repeated frames can relate to fronts or the sustained presentation over time of a given idea as an authentic façade pertaining to a given matter. While typically sustained performance requires extensive effort, the current media landscape allows for automation. When the concept of preestablished fronts is applied to Russian trolling, a range of activities of self-presentation on the web can be automated.

Automation can be achieved through programming. Typically programming online is associated with bots. Gorwa and Guilbeault (2020) categorized bots based on structure (systems that are algorithmically or human-based), function (what bot’s task in the specific online space: e.g., to emulate accounts or communicate with others), and uses (how bots are employed). Based on programmed parameters, bots (short for “robots”) were originally designed to automate tediously repetitive online tasks. In such instances bots were launched in the early days of the web to perform tasks such as the systematic cleanup of Wikipedia entries to ensure their conformity to formatting requirements (Geiger, 2017). Bots are not unique in this way: Bots can exploit advantages that online environments provide for communication, described by Van Dijck and Poell (2013), such as programmability, popularity, connectivity, and datafication in social media.

While it is true that not all bots are malicious, Twitter, for example, outlined what constitutes prohibited activity by citing the following: “Malicious use of automation to undermine and disrupt the public conversation, like Page 62 →trying to get something to trend; Artificial amplification of conversations on Twitter, including through creating multiple or overlapping accounts; Generating, soliciting, or purchasing fake engagements; Engaging in bulk or aggressive tweeting, engaging, or following; Using hashtags in a spammy way, including using unrelated hashtags in a tweet (a.k.a. ‘hashtag cramming’)” (Roth, 2020, para. 9).

Automated actors such as bots in current online media systems can be programmed to accomplish lists of tasks: search users by keyword, account, or ID; follow and classify users based on predefined parameters such as user types, trends, and keywords; “like” content, based on predefined parameters, such as user types, trends, and keywords; tweet and mention users and keywords based on AI-generated content, fixed-template content, or cloned content from other users; retweet users and trending content, and mass tweet based on specific parameters; chat to (reply) or with other users; use pauses to mimic API or human expectations; and store information for later use (Daniel & Millimaggi, 2020).

These automated tasks enable Russian trolls that are programmed through bots, as argued by Im et al. (2020) to express themselves with simulated authenticity. Specific type of bots, sockpuppet bots, are known to be designed with the goal to fake identities; and are deployed to interact with other users online. These bot accounts are controlled manually; however, automatic control has been also detected (Gorwa & Guilbeault, 2020). To sustain a sense of authenticity, the bot programmer simply needs to scan constantly posted user-generated content and, in so doing, extract relevant aspects—be it from social media posts or news portal comments. Based on these extractions, the programmer can simulate “authentic” content for dispatch. Through machine-learning techniques, typically used for artificial intelligence applications and deep-learning, these texts can assume any types of masks. Such prepackaged messages are just as easy to dispatch online by automated means. In such instances, “fronts” can function as online platform properties. These fronts can represent, while also enable, different behavior types. At the same time, the signaling system of messaging can be simulated through location identifiers or the kind of self-representation that involves impersonating someone else.

However, through the concept of automation, bots can also contribute toward the rhetorical contouring of propaganda. In the specific context of Russian trolling, the discussion concerns bots that are designed to deliver specific messages. According to Ferrara et al. (2016), these are “social bots” that “automatically produce content, and interact with humans on social media” (p. 96). Thus, these bots simulate human online behaviors. SpecifyingPage 63 → bot typologies—for example, for advancing political agendas—becomes crucial for exposing and disambiguating the misconceptions about online information and communication ecosystems, where various actors coexist, as shown by Golovchenko et al. (2018). Such political bots were found to drive discussion about the shooting down of Malaysian Airlines Flight 17 in the Ukrainian war zone in 2014, even if it looked like a general public of “curators” or “involved” citizens, who tweeted about the incident (Golovchenko et al., 2018). However, a closer analysis of this tweet sample performed to detect bots revealed that a large number tweets were posted by bots acting on behalf of “citizens” and adopting impostor masks with a goal of a targeted circulation of centralized disinformation about the airplane shooting (Stukal et al., 2019).

Thus, the purported human users in this case had actually been masked automated bots that simulated active human engagement in information propagation, exemplifying the difficulty of unmasking online behaviors. Thus, automation through nonhuman means can be implemented through the use of automated bots, as an available option in the current media landscape.

Modus Operandi 3: Dramatic Self-Realization

Dramatic self-realization is another technique that enables Russian trolls to simulate the authenticity of self-presentation. This technique enables performers to appear spontaneous or authentic. For example, to facilitate discussions about the practice of dramatic self-realization, Hilton (1953) coined the term “calculated spontaneity.” This term refers to the need to achieve a conversational or spontaneous tone when reading a script. While this competence is crucial for professions, such as those involving presenters in TV or radio broadcasting, it is also applicable to online scenarios. Thus, dramatic self-presentation is acceptable or even desirable in certain situations, such as those involving TV, radio, or the internet. In fact, calculated spontaneity is a professional expectation for some occupations, especially those related to public speaking. For Russian trolling, however, strategic spontaneity is a tactic of influence.

Russian trolling as performance entails another strategic principle—what Goffman (1959) called expressive coherence, whereby “performers tend to foster an impression that their current performance of their routine and their relationship with their current audience have something special and unique about them” (p. 4). Consequently, once the mask is on, the expectationsPage 64 → of that mask must be fulfilled. On a similar note, Enli (2015) spoke of a concept of mediated authenticity and the craft of the construction of the authentic self. And even if that authenticity is highly constructed, what matters is how the general public perceives these self-presentations. In other words, if spectators perceive interactions as authentic, they become authentic.

In the social media world, a similar concept of strategic authenticity has been proposed as an instrumental logic wherein the value of authenticity is based on ensuring a loyal base of followers (Gaden & Dumitrica, 2015). Thus, the calculated spontaneity, or what Gaden and Dumitrica (2015) referred to as a strategic authenticity, dominant in the current social media world, allows for the self to act differently in various settings. In these settings, or what Marwick and boyd (2011) called context collapse, expectations of different audiences encourage the compartmentalization of behaviors. For example, in an academic setting, a professor could opt for a dramatic classroom entry, while in daily life, that same professor could behave with extreme modesty. In the case of Russian trolling, however, constructed authenticity allows trolls to perform in masks based on the specific expectations of authenticity within political spectra they want to target.

Visibility of the Masks Through Private Versus Public Posting

Users who posted on Russian trolling stories were analyzed according to automation and anonymity, the main tools of computational propaganda. Automation of posting and self-presentation through anonymity can provide masks for Russian trolling to masquerade online by merely adjusting user privacy settings that allow one’s comments to be visible or invisible. Thus, trolls can take advantage of the various levels of anonymity or identity-masking that news portals provide or use to create perceptions of a genuine public sphere debates. Thus, sociotechnical configurations of news portal comments matter. For example, the Lithuanian news portal Delfi.lt allows for anonymous posting. The majority of comments on the portal are anonymous, with no user identifiers other than IP address. Even if users register to post comments, they use social media screen names. Otherwise, they opt for Delfi.lt accounts that permit them to select any self-identifying screen name. Previous studies of Delfi.lt indeed found that anonymous IP posting dominated commenting on Delfi.lt (Zelenkauskaite & Balduccini, 2017). This shows how anonymity can be a tool that is utilized to project publics and what scholars call counterpublics—the movement that challenges the established status quo (Asen & Brouwer, 2001). Discussion regarding Russian trolling becomes a terrain to uncover the relationship between various types of publics and anonymity.

Let’s first look at media systems at play and how they allow for anonymity to be revealed. As described above, Delfi.lt account settings and user options do not enable greater transparency. They are, in fact, very similar to those employed by the New York Times or Breitbart. As for Gab, users create Page 67 →accounts, as they would for any social networking site. During the data collection period for this study, all Gab posts were publicly accessible. However, by using the third-party Disqus platform, Breitbart allows users not only to create accounts to comment on multiple sites but also to preserve the privacy of their accounts. The platform promotes such user options by stating: “Most importantly, by utilizing Disqus, you are instantly plugging into our web-wide community network, connecting millions of global users to your small blog or large media hub” (“Disqus, What is Disqus,” n.d., para. 1). Making accounts private prevents other users from accessing posts across multiple news stories when they open a specific user account.

The analyses referring to the individual user activity and anonymous vs. public user commenting practices presented in this section is exclusively based on Breitbart because it is the only news portal in the sample that uses Disqus, a third-party platform based on individual user accounts, rather than message-level presentation of the comments. These individual accounts provide a lens for understanding online masks, as users can choose to have their archives visible or invisible to the public. About 53% of comments, or 19,152 comments, were found to be sent from private or “masked” accounts in the analyzed sample of comments in response to Breitbart news stories on Russian trolling. These private accounts do not allow for a reader to see any other content associated with a given account or their frequency of posting.

To account for the typicality or atypicality of private commenting for stories related to Russian trolling, stories on unrelated topics were also collected, such as Breitbart’s sports stories on the South Korean 2018 Winter Olympics in Pyeongchang. This additional sample was collected with the expectation that users act similarly on both samples in terms of choosing anonymity in the posting. Twenty stories generated 4,554 comments. Of this total, 1,761 (or 39%) were posted privately. Yet Russian trolling and the sports story posting by users indicate vast differences in two ways: First, Russian trolling stories received more comments overall; second, they also had more comments from private accounts. This finding further supports the claim that masking is a major behavioral characteristic of Russian trolling news story commenters.

To identify the level of content circulation through masking, amounts of repeated posts or duplicate comments were assessed in both samples. In the analyzed sample that includes 13 Breitbart stories on Russian trolling and 37,137 comments, 7.6% (n = 2,851) were duplicate posts. By contrast, examination of Breitbart’s news stories on sports topics yielded far fewer duplicate comments, at 2% (n = 94), which shows how comments on Russian trolling were more likely to recirculate the same content, indicating Page 68 →either automated content circulation or repeated frames to try to convince someone of something, compared to the comments on the sports story, which had a limited number of duplicates.

Analysis of public comments also yielded divergent results in the analyzed samples. This part of the analysis excluded comments for which users had selected private commenting options. On average, 1.9 comments per user were publicly posted in response to sports stories. For these stories, 1,467 users posted a total of 2,793 public comments; 965 of these comments (or 66%) were posted by users who posted only one comment, and the maximum posted was 36 by one given user. However, the Russian trolling news story sample included 16,985 public comments posted by 4,050 users, with an average of 4.2 comments per user. In this same sample, 1,847 users (or 46%) posted one comment, while one user posted a maximum of 152. This shows that commenting for news stories that covered Russian trolling was much more active, with twice as many comments posted by a given user on average than for the sports stories. As conceptualized by CUT, these contrasts in commenting, together with the posting frequency for a given story at a steady rate of one comment per minute, point to automation or at least intentional intensity of the posting process.

By reviewing duplicates within comments’ sample for news stories that covered Russian trolling in the Breitbart sample, the following results were tabulated.

Results in table 1 indicate, for example, the significantly greater number of duplicates in private comments compared to their public counterparts. Timing is also relevant for the successful continuation of disinformation. If the audience is privy to only a brief performance, that fleeting glimpse diminishes the potential for embarrassment that results from exposed inconsistences within that performance. Posting frequency varied in commenting behaviors for Russian trolling and sports stories. Thus, staging of that which can be seen is another technique that Goffman has elaborated on. In other words, the performer must be cautious about the conditions under which the performance is to be staged. The same caution must be exercised for messages left in news comment spaces. For Russian trolls to succeed, it is crucial to send the right persuasive messages at the right time. Such Page 69 →messages need to follow news story cycles—that is, immediately after news story release—for maximum exposure. In cases where online trolling is a masquerade, timing is particularly critical. Thus, trolls need to latch onto relevant news portal stories the moment they are released. Interestingly, previous research on tactical commenting in online news portals found that there was a percentage of users who posted frequently right after news stories were published (Zelenkauskaite & Balduccini, 2017).

The following repeated comment sequence exemplifies such frequency. The comments were spawned by an anonymous user within four minutes in response to a Russian trolling story:

Page 70 →The example above illustrates a sequence of repeated comments by a given user. Time stamps of the comments show a rapid reposting. The consistent frequency of the repeated comment indicates automation behind its propagation. Otherwise, it can be deduced that the posting user intended the comment to stand out among the others. In either case, it is worth noting that one of the comments in the sequence had been linked to a tweet from a suspended Twitter account. This finding illustrates how users can try to promote content through news portal comment sites after they had already violated other platform regulations and are subsequently blocked from them using them. Moreover, the RedStateWatcher article link directs to a page with story claiming that Russian trolling does not exist. That online story also vouched for the innocence of Donald Trump and the need to investigate his political opponents (e.g., Hillary Clinton). Public users posted the following duplicate comments:

For a story headlined, “Putin ‘Couldn’t Care Less’ About Russian Interference Claims,” these duplicate posts emerged:

As seen in the examples above, although posting times vary, these comments were sent on the same day and in response to the same story. These examples illustrate the facility of duplicate concealment through private posting. In other words, private posting obscures the sequence of duplicated posts. Duplicate postings as a type of content memetic circulation have been found in other platforms such as 4chan, typically used to circulate hate and anti-Semitic content (Zelenkauskaite et al., 2020).

Page 71 →Facets of Commenting

Looking at specific users and the frequency of their posting patterns online to stories related to Russian trolling on Breitbart provides a more fine-grained insight on attack and defense interplay. Such a coexistence of attack and defense tactics (i.e., comments that support Russian trolling or are against it) may look like what is referred earlier to as perceived counterpublics. To identify what type of narratives are projected to discuss publics and counterpublics, the most frequent posters who intensely and repetitively posted in a condensed period of time were further analyzed.

Within the sample of users who posted more than 50 comments within a comparatively short time, atypical behavioral traits that included posting frequency were identified. For example, user 276975563 (users were assigned an arbitrary number to preserve anonymity) posted on two separate days and in response to two different stories. In the first instance, posting began on 16 February 2018 at 20:43:28 and ended on the same date at 22:34:06. During those two hours, the user generated 67 comments. One comment per minute appeared in the first 17 minutes before the posting rate decreased. Within the next 111 minutes, the user posted 67 times, for an average of approximately one comment every 2 minutes. The remaining two comments were posted in response to a different Russian trolling story nearly six months later, on 21 August 2018. For this later story, the user generated three comments within 2 minutes. According to the user’s self-description and overall activity via Disqus, the user is from a broad geographical location (“the Midwest”); joined the platform on 13 January 2018; and since that date produced 25,292 comments and registered 58,420 “likes” across the Disqus platform. Comments posted by the user include the following sequence: