On April 2, people in Armenia for the first time voted in the National Assembly elections, which became the debut of the new parliamentary system.

The hashtag for the elections had long been decided: #Armvote17. It was and will still be used to share and collect information about the election.

Attempt to control the hashtag

But the day before the election, on April 1, there was odd activity on Twitter: a dozen users of Russian origin — bots and trolls — began to use the #Armvote17 hashtag and launch manipulative operations. A similar attack in the Armenian virtual space occurred also during the 2013 presidential election, when the #Armvote13 hashtag was subjected to an Azerbaijani attack.

The purpose of an attack is usually to hijack the hashtag, with the help of trolls making the real content less serious, creating a diversion, or simply replacing it with other content.

On April 1, “protests are going to be organized in Armenia after the elections with American money” and other similar Russian text accompanied by a fake USAID email was shared on social media. The image of the letter was presented as a leak, which, however, should’ve been perceived as information that was acquired with difficulty. The letter said that USAID is providing funds to “democratic society” in Armenia to support post-election protests and attempts to destabilize the situation.

Also Pastebin posted 29 Mar w/ link to version of fake @USAID memo w/out typos @usembarmenia highlighted https://t.co/pIdEliu5MO. #armvote17 pic.twitter.com/R4MrFoDsWc

— Onnik J. Krikorian (@onewmphoto) April 1, 2017

 

The US Embassy in Yerevan exposed the email as fake, pointing out the grammatical and spelling mistakes in the text. For example, the email was sent from a Gmail account, which couldn’t have happened in USAID’s case, since the domain for the agency’s email addresses is usaid.gov.

A second version of the letter was subsequently circulated, without the Gmail account or spelling mistakes. The bots accompanied this letter’s screenshot with the same posts in Russian: “NGOs are preparing to disrupt elections in Armenia” (НПО готовятся сорвать выборы в Армении).

A dozen Twitter accounts (whose avatars, and low number of followers and tweets implied that behind these accounts weren’t real people) began their informational attack, with cookie-cutter text and the same screenshot.

On Twitter, Facebook, VKontakte, and other platforms, accounts with a Russian connection posting about a leak on the topic of Armenia’s election were similar in appearance to one another: Russian first and last names, Russian-appearing boys and girls, texts with almost the same content.

The Twitter account @Poljakov5Sergej is a typical example: it was created in May 2015, has tweeted 89 times, has 0 followers and follows 0 accounts.

Or the account @xeiucqs. It likewise was created in 2015, has 2 followers, follows 20 accounts.

Many of these accounts were created in 2015 but have been dormant. They became active on April 1, the day before the election in Armenia.

A week ago, many of these Twitter accounts tweeted about the anti-corruption demonstrations in Russia, with the hashtag #ДимонОтветит (#DimonOtvetit, or #DimonWillAnswer).

In the case of #DimonOtvetit, the bots tried to make the hashtag’s content less serious, by tweeting unrelated content.

Similar political content of such a volume immediately brings to mind media reports on the army of Russian trolls. Working in the Russian trolls “factory” are people who get orders to support the ruling Russian ideology and to launch condemning posts against those who express opinions against that ideology on social media.

Suspension of real Twitter accounts

But the attack of these bots in Armenia led to a different result: the accounts of a few active Twitter users in Armenia were suspended. The accounts that were suspended were my own ( @reporterarm), Hetq (@Hetq_Trace), CivilNet.am (@CivilNetTV), and political analyst Stepan Grigoryan (@stepangrig).

Several Armenian Twitter accounts suspended amid attempts by Russian bots to hijack #ArmVote17 hashtag 1 day before key elections pic.twitter.com/jG2KsW9gKt

— Artur Papyan (@ditord) April 1, 2017

Though these accounts were reopened a few hours later thanks to active users’ tweeting to Twitter support and the work of AccessNow, all the same, the problem isn’t resolved. The reason for the suspension remains unclear.

Why the attack on the #Armvote17 hashtag and Armenian Twitter users and who ordered the attack are unknown. What is known is if a professional factory of trolls really exists, it’s in Russia. The question of who gave the order is more complicated. Theoretically, it could be a person or entity that is capable of issuing such an order to the trolls factory or paying for an attack.

This story of trolls and #Armvote17 showed that the Armenian online space is vulnerable to manipulative attacks and the spread of disinformation. The volume of the attack on the Armenian hashtag wasn’t large. In the case of a large-scale campaign, the local online space may simply temporarily stop functioning. For instance, I was in a digital coma for a few hours. So perhaps on April 1 we witnessed a test of forces.

Gegham Vardanyan

The views expressed in the column are those of the author's and do not necessarily reflect the views of Media.am.