The Troll Hunter
For each kind of game, there is a specific time of day when it’s best to hunt. For instance, the optimal time to catch a wild turkey is just after daybreak. most white-tail deer are regularly active at dawn or dusk. Coyotes, raccoons, and feral hogs are usually nabbed at night. online Trolls, on the other hand, are plentiful and ripe for the kill at any hour of the day, any time of the year. When it comes to those social media saboteurs who stoke division, sow disinformation, and seek to undermine political discourse and, increasingly, democracy itself, it’s always open season—even on Josh Russell’s day off.
The systems analyst and programmer at IUPUI is spending time away from work on this sunny Tuesday in mid-October to be with his two sons, who are on fall break from school. But quality time with the kids will have to wait: Russell thinks he’s caught the scent of his prey.
While flipping through channels on the living room TV, Russell and his wife happen upon the live broadcast of Facebook CEO Mark Zuckerberg giving a speech about freedom of expression to an auditorium full of students at Georgetown University. This amuses Russell, given what he knows about Facebook’s role in the spread of disinformation, particularly leading up to the 2016 presidential election. “It’s a shitshow,” Russell says of the speech.
Unable to resist, Russell pulls out his phone and immediately checks Zuckerberg’s own Facebook page, which is airing the speech with real-time commentary. Russell notices that among the expected jeers and call-outs of Zuckerberg’s hypocrisy, there are strings of unrelentingly positive comments—all using the same basic wording, tone, and structure.
Chandresh H Kishor: “Thanks Mark for providing such a wonderful platform. Stay blessed.”
Chinyere Christopher: “Thanks for the creation of this wonderful platform.”
Aarthy Viven: “Dear Mark, your love story was amazing. Thanks for the wonderful social platform…”
Punam Pajput Kaushik: “Thank you sir creative and such a amazing platform.”
The recognition of this pattern excites Russell—it’s usually the first sign of a troll. He eagerly toggles over to Twitter, where he posts screen grabs of the suspicious comments and hurriedly thumbs out an alert to his almost 13,000 followers. The chat on the live Zuckerberg stream, Russell tweets, “is really weird, lots of accounts thanking him???”
Russell’s wife knows the drill. “You think it’s bots?” she says, referring to automated web robots that disseminate pre-programmed messages and information, sometimes with malicious intent. They often pose as real people and are therefore confused with trolls.
“No,” he says. “It’s hard to tell if it’s a Facebook bot, but the profiles seem real.”
He concludes that the commenters are most likely real people, possibly from an Indian troll farm or just some company trying to get on Zuckerberg’s good side. Either way, Russell doesn’t waste much more energy on it. Despite the pomp surrounding this First Amendment speech, the Facebook creator is notorious for his inaction to mitigate the harmful disinformation and downright lies that flow freely through his “wonderful” platform. Besides, the small corps of boot-lickers is hardly worth Russell’s pursuit.
For Russell, the real hunt happens at night, when he’s free to roam the wilds of the internet. He combs through social media sites and the publicly available data behind them, including user names, dates the accounts were created, and pages and accounts those users have linked to. He’s searching for patterns and trails—users that have all linked to the same dubious story or meme, for instance—that lead to bots, trolls, and organized campaigns spreading lies through Twitter, Facebook, Reddit, and other social media outlets. Russell tracks big game: propaganda and troll farms (groups of trolls working in concert) sponsored by states like China, Saudi Arabia, Turkey, and, of course, Russia.
Russell’s followers are equally big names, including journalists from NBC News, CNN, and The Wall Street Journal, all of whom use his work to expose bad actors and inform the public. He also has the ear of the security departments from sites like Twitter, which follow up on Russell’s work and suspend or delete accounts accordingly. He’s a big enough threat that he’s even been targeted by the trolls themselves, trying to feed him false information that might discredit him. And he does it all from the attic of his Irvington home. “He’s a secret weapon for a lot of people working on this beat,” says Ben Collins, an NBC News reporter who collaborates with Russell. “Journalists need this info more quickly than a researcher can get it. Josh can get it. We need Josh—he knows how to analyze and synthesize the information, and he’s willing to work with reporters. He’s the only one I know of in the world.”
With a reference like that, one would think Russell might be able to make a lot more money turning his hobby into a full-time profession—and he’s had offers to do just that. However, he has yet to accept a dime. “I don’t want to appear biased,” he says. “I know I’m not going to convince someone with a strongly held belief, but maybe I can get people to second-guess some of the stuff they read online.”
When asked about his motivation for pouring so much time and effort into these intricate online investigations, Russell readily admits that it’s a bit more complicated than pure do-goodery. He thrives on the adrenaline rush of the sport, relishes the sense of justice it brings, and seems to enjoy the newfound notoriety. But there’s another, more personal reason: Like so many of us, Russell was once duped and misled by online misinformation. Now he’s out for revenge.
For the first 37 years of his life, Russell never had much use for journalism or politics.
He grew up in Martinsville, a rural outpost so staunchly conservative that everyone pretty much took political affiliation for granted. His family voted Republican as a matter of course; no one ever really talked about it. They were also less-than-avid consumers of news, either on TV or in print, so as a child he never paid much attention to current events.
Had Russell thought much about his parents’ political bent, he probably would’ve leaned hard in the opposite direction. While his classmates listened to country and classic rock, Russell was tattoo-clad with piercings, head-banging in his room with blue leopard-print hair to death metal music. All he really cared about was computers. From an early age, Russell would incur his parents’ ire for constantly breaking (and ultimately fixing) the family Acer desktop. Finally, he built his own PC, piece by piece, and optimized with souped-up hardware for gaming.
Josh Russell became an online vigilante after falling prey to fake news during the 2016 presidential election
Even when Russell put off college to open a music venue, The Emerson Theater on East 10th Street in Indianapolis, computers and technology were always part of his life. He built websites for friends, played games online, and did some IT work on the side. Finally, when the club closed in 2010, he went to Indiana University and got his bachelor’s degree in computer science. Russell was also an early adopter of just about anything tech-related, including social media. MySpace, 4chan, Twitter, Reddit. Sometimes he’d create a page without even posting to it, just to have his foot in that door for when it caught on.
That’s how politics found the previously apolitical Russell. By 2015, in the run-up to the U.S. presidential election, politics and social media were inextricable. According to a study by the Brookings Institution, a D.C. public policy think tank, only 27 percent of people relied upon social media for their news in 2012. By 2017, that number had almost doubled to 51 percent. “As the overall media landscape has changed, there have been several ominous developments,” the report reads. “Rather than using digital tools to inform people and elevate civic discussion, some individuals have taken advantage of social and digital platforms to deceive, mislead, or harm others through creating or disseminating fake news and disinformation.”
This was just becoming apparent in 2015. Suddenly, every computer, tablet, phone, and smart-watch seethed with pointed memes, photos, videos, and stories about every candidate and issue on every ballot. Much of it was salacious and provocative. Much of it was simply not true. It was difficult to tell where the malicious posts originated. Most people didn’t take the time to ask— they just nodded and clicked forward, retweet, or share.
Russell was among those fooled. “I actually didn’t believe any of the stuff I saw on the news,” he says. “I was extremely skeptical of it. That’s the main reason I started messing around online [trying to verify it]. There were stories on The New York Times, CNN, or The Washington Post about Russian trolls and bots—I didn’t believe them at all.”
Instead, he tended to put stock in the fringe far-right conspiracy theories that filtered through the online gaming community, which, in general, is rife with alt-right and even white-nationalist propaganda, and his own social media bubble, particularly on Reddit. Russell describes himself as an independent who leans conservative. He was never quite onboard with Donald Trump as a presidential candidate, but he knew he didn’t like Democrat challenger Hillary Clinton, and that bias opened him up to considering even the most outlandish things he read on the web about the former U.S. senator and secretary of state.
But it wasn’t until Russell’s wife, whom he describes as “very progressive,” got into a Facebook argument with someone making outrageous claims about Clinton—that she had, for instance, engaged in Satanic rituals—that Russell questioned everything he thought he knew. He scoured the web for clues or corroboration, any shred of evidence that these stories had some basis in reality. Of course, he found nothing. “It was eye-opening to go back and reassess,” he says. “Why was I so dumb?”
When Trump won in November 2016, Russell decided to take a step back. He logged off of Reddit, stayed away from other conspiracy hotbeds, and tried to detox. “After the election, I started undoing the damage I had done to myself,” he says. “But it takes time to understand that not every person that’s telling you something has good intentions.” The first step in Russell’s re-education was to dust off his long-dormant Twitter account and start following as many verified journalists and legitimate media outlets as he could find. “There’s always some bias—you can’t really avoid it,” he says. “So you look around and if The Wall Street Journal and MSNBC, two starkly different outlets, are saying something is true, it’s most likely true.”
Meanwhile, in the wake of the election, the country was beginning to learn that there had been a foreign effort to manipulate American public opinion and influence voters. In January 2017, the Office of the Director of National Intelligence released a report confirming that Russia had orchestrated a social media campaign to not only undermine Clinton’s run for the White House, but also to weaken public faith in the entire electoral process and democratic institutions.
That’s when Russell was compelled to take action. “This was real,” he says. “I was shocked that no one looked up the [background info] that I looked up. These [troll] accounts existed and were still live on these platforms. I thought it was important to get that information out there.”
The hunt begins every night around 9 p.m., when, with the boys quiet and his wife in bed, Russell climbs the stairs to his attic, a snug wood-paneled den with a low sloped ceiling that requires the tall and broad Russell to stoop as he approaches his desk. He plops down in his office chair, lights the first in a string of hand-rolled cigarettes, and awakens his home-built desktop with the swirl of the mouse. He puts on his stereo headphones blaring death metal, leans over his backlit black keyboard, and, through thick horn-rimmed glasses that magnify his eyes, he sets out into the web in search of his prey. Sometimes he’s online for a couple hours. Sometimes longer.
He’s searching for trolls, specifically troll farms that have organized to push specific agendas, usually posing as American citizens, like the Russians of 2016.
When Russell started doing this in 2017, his approach was admittedly unsophisticated. Despite his vast computer programming and engineering background, he leaned on the above-the-board internet search skills employed by researchers or journalists—and an almost superhuman reserve of tenacity. He started by looking at the malicious accounts already flagged and outed either by the platforms themselves or by the handful of national reporters who were blazing this new disinformation beat. Russell would examine each account, specifically how it interacted with other accounts. Who were they following? What other posts had they retweeted or “liked?” What hashtags were they using, and who else was using them, too? He followed those leads to corresponding accounts on other platforms, where he would look for the telltale signs of a foreign poseur: garbled English, fishy avatars, meme formats specific to other troll accounts, and multiple connections to other suspicious accounts. “That’s how social media works; it’s all interconnected,” he says. “If a journalist had posted a story about a specific account, I would burn the internet to the ground to find every piece of information about that account. Then I would go back to that reporter on Twitter until they paid attention to me.”
Josh Russell began hunting trolls in relative anonymity, but has become an unlikely media star in short order.Image courtesy CNN
One of the first reporters Russell DM’d was CNN’s Donie O’Sullivan. In September 2017, O’Sullivan ran a report about Blacktivist, a Facebook page that mimicked Black Lives Matter (the group that campaigns against violence and racism toward African Americans). But Blacktivist was actually run by the Internet Research Agency (IRA), the now-notorious Russian troll farm outed in the National Intelligence report. The fake group was siphoning off BLM’s followers and feeding on the real activists’ political bent to sow discord and division. Russell dove in, looking at other sites and pages that Blacktivist frequently linked to, the accounts it retweeted, and the hashtags it used. His careful research resulted in a curated list of dozens of additional Russian accounts on several sites that O’Sullivan—and everyone else—had missed.
Another journalist Russell reached out to was NBC’s Collins, who, in late 2017, was working for The Daily Beast, where he pioneered coverage of this topic extensively. “I don’t trust just anyone who comes to me with information,” says Collins. “There are so many people bullshitting that want to be part of this discussion, but they don’t have the goods. Hundreds of people have come to me. Josh has earned my trust because he shows the work. We know he’s reliable and that he cares about getting the information out [in the public].”
Through his work on Blacktivist, Russell unearthed a Russian-language dark-web site that was auctioning off hacked information, including the sale of what it claimed was a cache of leaked Russian IRA documents. Those docs contained names of targeted American political activists and U.S.-based proxies (user names) on Twitter, YouTube, Facebook, and other social media sites. Apparently the Russian group planned to dupe those Americans into peddling Kremlin-penned propaganda and even setting up protest rallies. In short, Russell’s find of this IRA data leak helped The Daily Beast reporters broaden the scope of their investigation to show the scale and sophistication of the efforts to disrupt the 2016 election.
As Russell’s work became more and more in-depth, he used his engineering background to organize and scale up. He set up expansive Excel spreadsheets and wrote his own programs to filter the background information of tens of thousands of social media and accounts into the tidy rows and columns. He could then scroll quickly up and down in search of patterns. He built word clouds to spot oft-used terminology and track hashtags to still more malignant accounts. And when Twitter, responding to criticism of spreading disinformation, released its private archive of more than 10 million tweets associated with foreign interference, Russell was able to use his programs to distill vital info from a virtual firehose of data. “There’s a very small number of journalists and researchers working in this space that have the kind of digital fluency, the ability to navigate the disinformation landscape, and the ability to produce original findings to flesh out entire operations,” says Casey Michel, who researched post-Soviet regimes at Columbia University and has written for Foreign Affairs, POLITICO, and The Washington Post. “It was very apparent from the early days, as we began having these cascades of disinformation, that he was a voice worth listening to. He knew what he was talking about. We had pinhole views—Josh was one of those go-to voices that kept unearthing material and providing insights, especially on the Twitter side of things.”
In Russell’s first year-and-a-half of hunting, his findings made their way to about a dozen reporters at various publications who listened and used his work anonymously in the background of more than 40 stories. But perhaps even more impressive, and maybe more important, the sites themselves considered him an asset. Accounts he reported were suspended or deleted in a matter of days or even hours. Twitter, in particular, seems to value his expertise—even if they’ll only begrudgingly share the credit. “As a uniquely open service, we’re not only a resource to researchers, but we also benefit from their findings,” says Twitter spokeswoman Katie Rosborough. “We’ve published an industry-leading archive of information operations so responsible researchers like Josh Russell can further investigate and learn from the tactics of bad actors.”
In the summer of 2018, Russell had to make a decision about his own online identity.
Until that point, Russell’s reputation and name had continued to grow in journalistic and research circles. But those media outlets only knew him as an avatar. Some, if not all, news organizations certainly did their background checks before trusting an unverified online account claiming to be from Indiana that was reporting on other unverified and suspicious accounts; but none of the reporters had even seen Russell’s face, let alone met him in person. They trusted his work, though they rarely cited him specifically or gave him a byline. And Russell was comfortable in his relative anonymity.
But O’Sullivan, the journalist, thought that Russell’s effort and backstory warranted a profile of its own on CNN.com. The reporter asked Russell if he would consider coming out of the dark attic and into the spotlight.
The request gave Russell pause. His employer, IUPUI, said they would be fine with the publicity as long as it was clear that Russell did this away from his workplace, on his own time. Russell’s immediate family gave their consent; his older son, Cooper, then 11, especially warmed to the notion of his father’s title of “troll hunter.” But Russell was concerned about his family’s safety. A full-blown feature with his name and picture for all to see might draw the wrong kind of attention to his home, his wife, and his children. On the other hand, he was already fielding online intimidation, even threats of violence to him and his family. In the end, he agreed to the piece, deciding that being in the public eye, where everyone can see you and what happens to you, offers its own kind of security.
In August 2018, Anderson Cooper 360 ran a four-minute segment on Russell, and the CNN website featured the video atop the corresponding web story. “Meet the Indiana dad who hunts Russian trolls,” ran right above a picture of Russell, muscular and tatted arms crossed, standing right in front of his eastside Indy bungalow, American flag visible just above his left shoulder. The night the story ran, someone dug up Russell’s personal information and had pizza delivered to his home.
The stunt was harmless, but as Russell’s reputation grew, so did the complexity of the attacks. Before the November 2018 midterms, Russell and a handful of journalists, including Michel, received a suspicious Twitter DM from an account called Red Stone Hacking. The person claimed to have access to parts of Special Prosecutor Robert Mueller’s still-unreleased report on Russian interference in the 2016 election. Russell quickly identified the gambit as a Russian attempt to spread false information that would discredit the Mueller Report. It was also an attempt to discredit Michel and Russell, now an official Russian target. “The first thing I did was take a screen shot of the message and send it to Josh asking, ‘What do you make of this?’” says Michel. “For me, it was one of those bizarre messages you get. Josh was the one who took an eagle eye and put two and two together.”
As the 2020 presidential election draws closer, these kind of attacks have increased. Russell says he’s already seen an uptick in strikes on former vice president Joe Biden and other Democrat front-runners as they enter the primaries. In many ways, Russia has learned from its mistakes and become even harder to catch. The Kremlin’s success in 2016 has inspired a bevy of imitators, from China to Saudi Arabia to Nigeria to Turkey. Even more insidiously, Russell fears that the far-right disinformation that was on the fringe in 2016 has since worked its way into mainstream outlets like Fox News, making it even harder to root out. As a result, the once apolitical Russell now finds himself surprisingly well-versed on global affairs, from the aftermath of the Turkish revolt to Putin’s campaign against Ukraine to Texas secessionists—anything that helps him understand the motivation of a troll.
Likewise, average Americans seem to at least be more aware of the presence of foreign interference and have taken strides forward. Now virtually every national newsroom has a disinformation desk of reporters and researchers dedicated to sniffing out trolls. There are entire independent companies with cubicles full of employees doing the type of research Russell does at his attic desk. And many of the platforms themselves have become more proactive in ridding their sites of malignance. Several times in recent months, Russell has flagged clusters of suspicious Twitter handles only to find that the company has ousted them before he even makes his report.
Unfortunately, as a country, the U.S. appears grossly unprepared for what might be coming. Not only are the Facebooks and Twitters of the world still coming to terms with their role and responsibility in policing disinformation, it’s also clear that many citizens lack the media and technology literacy to find reliable information and educate themselves.
Russell says he’s trained his sons to be skeptical of what they see on the internet, and he monitors their online habits as closely as he can. But when it comes to his extended family, that’s unfortunately a different story. He’s seen many of them online, spreading disinformation and propaganda created by some of the very trolls he’s committed to eliminating. “I try to explain to them what I do, and they just really don’t understand it,” he says. “I talk with them about it if they bring the subject up. But I try to keep the politics out of it. I just make sure that whatever they post isn’t from a crazy source, a foreign person trying influence them. But I certainly don’t get into the political arguments. They will just sit and argue with you. You’re better off just trolling them back and moving on with your life.”
