Where is Stepan Mazura?

Every one of us is aware of the information warfare. Trolls are its chair de canon in social networks. In 1921—1926 the Soviet secret police known as GPU (the State Political Directorate) created a fake underground “Monarchic Organisation of Central Russia” (MOCR) with a purpose of attracting the “whites” (i.e. Anti-Communists). This operation, which turned out successful, was known as Operation Trust . Apart from keeping anti-Soviets under surveillance, MOCR managed to persuade Anti-Soviet immigrants not to organise terrorist attacks in the Soviet Russia. Double agents, smart tricks, information support in the White immigrant media involving publication of numerous rumors concerning MOCR — these were components of the operation’s success.

Creating an organization whose members will be your enemies is an excellent warfare tactics. It is still in use. According to Ukrainian intelligence agencies, about 300 specialists in Moscow are engaged in recruiting and overseeing of agents in Ukraine. This work involves not only money and blackmailing but also whispering in the ears of necessary people.

This article’s topic is a bit different – it is about the Internet. Working in its space is easier, since you do not know personally those who create the content of this or that account. Knowing what the target audience wants to read or hear, one can gain its trust and promote necessary messages.

We have detected and visualized a network of accounts linked to that of Stepan Mazura. Just to remind who he was: a virtual agent of influence exposed by Ukrinform press agency. He pretended to be a simple Ukrainian patriot disappointed in the power and political games and thus wanted to win the country’s future on the Maidan, 3 rd edition... There was a Russian track behind Mazura’s account: on the other side of the monitor was Sergei Zhuk, a former combatant of the Russian “hybrid army” at Donbass.

It is not just Mazura himself but the whole social network tied to him loudly appeals for a forcible overthrow of the Ukrainian government. Naturally, some of these accounts are real people with real political beliefs, who are not linked with Russia in any possible way. We have reconstructed the network based on connections between Facebook accounts. If you found yourself on our visualisation diagrams, it is just one more reason to think who your Facebook friends are and to what extent the communities where you post your opinions are contaminated with trolls.

For the beginning, let us provide definitions: who do we mean under “trolls”? In our opinion, the “trolls” are accounts of real people or robots, which are used for political propaganda.

The “trolls” are accounts of real people or robots used for political propaganda

How are trolls created?

As a rule, our troll is an 80% program and 20% human. A program-troll makes automatic friendship requests. A troll grows “fatter” with every new friend. Its weight in social networks boosts especially after befriending a popular blogger.

A troll algorithm (a program) can even post some bullshit or exchange likes with similar programs: such actions increase their weight. However, at Hour X, when it is necessary to boost a certain topic, troll accounts are filled by living people.

Real people often also, under pseudonyms, moderate groups with percentage of trolls. Let us label these moderators as “trolls” as well – in the same way as accounts of living people who are influential personalities in our network and who actively post news or comment.

How does it work? First, a troll posts something. Then a host of other trolls begins to like it, comment and repost. The Facebook’s algorithm perceives it as interest of living people towards this post, which begins to appear in news feeds of NON-trolls who happened to befriend a troll.

If any post is successful, regular people start to repost it – and then journalists as well. The same scheme boosts video clips on YouTube.

“One of important elements of the Soviet (and currently Russian) set of tools were so-called “active measures”, i.e. direct interference in the politics of another country by means of covert operations. The active measures may include, among others:
- influence on policy of other governments;
- undermining confidence to the country’s leaders and public institutions;
- destroying its relationships with other nations;
- discrediting and weakening of governmental and non-governmental opponents”, as write in their analytical survey of the Russian propaganda Edward Lucas, the Editor-in-Chief of The Economist and Peter Pomerantsev, an independent researcher.

If you have too many friends who repost the troll content, you may come to conclusion that the only way out of despair and treason is violence. The troll accounts hint – more than explicitly – to do with the current president and his entourage the same as with the former.

We are currently living in a post-factual world where emotional attitude matters more than facts. Trolls cater to emotions and theories of conspiracy

Their target are patriotic Ukrainians, in other words those most concerned about the situation in their country. According to Peter Pomerantsev, the above-mentioned researcher of modern mass media, we are currently living in a post-factual world where emotional attitude matters more than facts. Trolls cater to emotions and theories of conspiracy.

“It may look like a paradox but people who mistrust the “traditional” media are more susceptible to consume red herring publications, as revealed the research performed by the Northeastern University. What starts as sound skepticism ends up looking for weird theories of world conspiracy”, writes Pomerantsev.

The tactics of Russian trolls in the USA, quite like that in Ukraine, was discussed by Adrian Chen in the New York Times. An American “troll patriot” tweets images of national banners and messages of American supremacy seasoned with rough insults of Obama. Same kind of messages are posted about the leaders of Ukraine.

The troll network

Now you will see how we managed to untangle the twisted pattern of treason by watching the network of propaganda trolls on Facebook. Let us not forget that their network may in fact be much larger. Apart from it, there are many other Russian troll networks, each of which targets its own audience in various countries of the world.

Troll Galaxy

The accounts included in our network were detected by our software. Part of those accounts belongs to common people, which are not propagandists. They got involved in the network because their friend circles contain a lot of trolls.

Here is the model of the Troll Galaxy. The purple colour stands for groups infected by trolls, that is, trolls are their members and administrators. The blue stands for troll users.

The size of the user’s circle depends on the number of groups administered, posts and comments written, the number of friends and membership in groups. The size of the group’s circle of connection was determined by quantity of trolls it contained and links to this group in the respective social network. The colour of lines means types of connections: blue stands for friends, purple for group members and its activity level.

The thickness of links corresponds to the total of membership (× 1), comments (×2), posts (×3) and administering (×10). For example, if a troll wrote 4 comments and 3 posts in a group and is its member, then the strength of his/her connection to the group will be 4×2+3×3+1=18, which means that the line will be visually thicker than a simple membership link in a group (1).

If a real person (not a troll) becomes part of a network in question, then a point corresponding to him / her will be small and distant from the network center.

Our research started from visiting the profile of Mazura (Mykola Haiduk) on Facebook and VK, all the way to the pages managed by him, according to Ukrinform: “Patriots of Ukraine” and “Ukrainian Revolution”.

Later we discovered other groups that contained Maidan-3 keyword or its analogs in their names.

We also started to work with a group suggested by Facebook due to similarity of topics discussed. It turned out that the users in questions befriended each other and it was obvious that there is a network in social media that can be labeled as Maidan-3.

Then we added the admins of those groups. We ended up creating a list of 29 group, including 3 closed ones, so that it is not possible to retrieve data about activity on their pages from the network but only their members and admins.

Out of the total number of friends of the admins and all the group members we chose only those who were members of 5 and more groups, or who had more than 5 admins as friends, or who had written more than 5% of posts and/or comments in a single group or more than 15 in the total of 26 open groups. Then we added those who befriended more than 5 people from the previous list. Thus, these users became part of our network. Let me repeat that a few of them may in fact be real people.

Here is the model of the Troll Galaxy. The purple colour stands for groups infected by trolls, that is, trolls are their members and administrators. The blue stands for troll users.

By clicking on the blue circle, one can see the person’s relationships (connections). By clicking on the purple circle, one can check which users are related (linked) to the group. One can find Haiduk using the search engine. The click provides information about a knot: statistics, link to a FB page and a list of connections.

If a real person (not a troll) becomes part of a network in question, then a point corresponding to him / her will be small and distant from the network center.

Our network does contain special cases. The group “Freedom to prisoners of the regime!” consists mostly of real people, who are surely neither trolls nor paid propagandists. The group members post photos of their actions supporting the Right Sector activists and the ATO members who currently have problems with law enforcement bodies. We did not know about its existence and we came across it while studying connections of the post-factual Haiduk.

Yet another non-typical group is the “Ukrainian Front”. They represent the “pure cotton wool” (i.e. pro-Putin activists), a mixture of Kremlin activists and their believers. However, this group was suggested to us by Facebook since it contains a lot of our “patriotic” trolls. It is noteworthy that the “cotton wool” and the radical patriotic group contain common members, such as Oleg Vityaz, an adherent of Balashov and his Party 5.0.

When you look at the general network, you can watch connections for yourself.

From Mazura to Haiduk

The exposure of Mazura-Zhuk became known back in January 2016, on the verge of the so-called Maidan-3. After the failure of the virtual agent and the Maidan-3 that he was inciting, Mazura’s page was removed.

The name is gone, but the deed is alive. Mazura is almost forgotten by now. However, as reports a famous volunteer Roman Donik on his Facebook, Zhuk-Mazura is currently active under pseudonym “Mykola Haiduk”.

Unlike Ukrinform agency, we did not have to crack Mazura’s or Haiduk’s accounts, but we know for sure that Haiduk became the administrator of Mazura’s webpages and groups, he popped up just out of the blue and is doing the same as Mazura.

Therefore, Donik’s testimony, the sudden appearance after Mazura was discarded, the “inheritance” of his groups and web pages – these are valid proofs that Zhuk is still on the other side of the screen. It is interesting to note that Mazura-Haiduk-Zhuk does not belong to the most influent among the “patriotic trolls”.

Mazura’s network

We have been watching the Maidan-3 groups on Facebook for half a year. It turns out to be a boring business, since little things change apart from profiles of users that create content. Every group keeps its publication activity and has permanent authors. They also have a network in VKontakte, which is not that strong, but it is beyond our research.

You will see below the “toxicity ranking”. We emphasize that the majority of members of the groups administered by Mazura’s cohorts are just regular users. Those groups are just baits, online sequels of the mentioned Trust Operation.

So we started detecting them.

How did we select groups for the research? For example, if an admin of e.g. Maidan-3 was an admin or an active writer or a different group, then that second group was our target as well.

Our criteria of adding groups to our list may be subjective, but we have all reasons to doubt that any of them was a self-organised patriotic community, as all the groups in question had common traits:

- specific content written by 3 persons in average;
- excessively political content;
- few original posts, few authored posts – mostly links;
- low user activity (few comments or likes);
- similar content in all the groups, reposts from the same sites.

Selected groups do not consist completely of trolls. However, the concentration of trolls in them is high, and they are administered by trolls.

- specific content written by 3 persons in average;
- excessively political content;
- few original posts, few authored posts – mostly links;
- low user activity (few comments or likes);
- similar content in all the groups, reposts from the same sites.

We ended up having a list of 29 groups, including three closed ones (the network does not allow to retrieve any data about activity on their pages, only membership and admins). In this way, we collected information about each of the groups. Then we began to establish the key personalities – and all of them turned out to be linked to each other – in the virtual space of course.

Who and how fills the groups?

Let us consider the top 5 post writers. Attention: they never forget about keeping secrecy and often change their user names, but their id are perpetual. It is a part of their Web address: https://www.facebook.com/profile.php?id=100011309687992 . Let's read their “creative works”.

Name	Admin of groups	Comments	Member of groups	Posts / 2 months
Tatyana Manina	0	1	14	637
Anatoliy Trofymenko	0	9	17	440
Mykola Yarovyi	1	0	1	425
Mykola Haiduk	1	16	11	338
Vanya Romanov	0	1	9	294

Name	Admin of groups	Comments	Period
Valera Lapin	1	720	7/01/2016 — 11/03/2016
Zenoviy Shepitko	0	361	01—24/03/2016, + 3 comments 28—29/08/2015
Petro Chaika	1	314	22/02/2016 — 23/03/2016
Ivan Haidamak	0	220	09/03/2016 — 21/03/2016
Dmytro Zvolinskyi	0	189	16/06/2015 — 11/10/2015 — 100 comments, 89 comments between 19/01/2016 and 23/03/2016

Real people

A very interesting person is Dmytro Lyukshev, the admin of “Maidan-3” and the “National Revival” groups. He is a real man who administers the webpage “Maidan 3.0”, as well as head of a public organisation “National Revival”. Its website was last updated in August 2015 and hardly contains any information apart from a few news, mostly appeals to overthrow Poroshenko.

Dmitry posts a lot of his personal photos and is an ardent defender of Maidan’s ideals. One of projects presented by the “National Revival” projects is art therapy for ATO veterans (which is said to be organised in cooperation with Solomyanka District Administration).

However, he pays much greater attention to the project “Maidan-3” where he calls for a “perpetual Maidan”. The last of such appeals is dated June 2016.

The owner and admin of “Maidan-3” group in Vkontakte, Mykola Yeremenko, is active on Facebook as well. Despite his connection to Zhuk exposed by Ukrinform, on July 18 Yeremenko won additional election to Kotsyubynske village council as a candidate of the Human Power party. His activity in the Facebook troll network (see his page here) is low, although he lists Mykola Haiduk as a friend.

Unexpected finds

The larger is content posted in a group, the more posts are shared and liked by FB users, the higher is their rating on the graph.

Basic characters, or ideal types

A typical Troll Galaxy member is usually one of the following four basic types.

The portraits depicted below are descriptive for the most of our network: they are something that Jung called archetypes, i.e. generic images engraved in the national memory and ringing a bell at everyone’s mind. It’s a powerful manipulation tool.

The first one is a RADICAL REVOLUTIONARY, a prophet of violence. Machine guns and tommy guns, Ukraine for Ukrainians, internal occupation, ethnic revolution, death to Waltzman (i.e. Poroshenko), death to Yatsenyuk and then to Groisman, death to Putin, to the Jewish clique, to faggots, hang bureaucrats on lanterns, fire squads for corruption, when we come – there will be order! Red and black colours, the cult of war and death, iconic images of Sasha Bilyi and Lisnyk. When we destroy the state and kill all the bad ones – then we will prosper.

Their avatars are military-styled: a Volunteer, an Anti-Terrorist Operation combatant, or an Insurgent. It may be a modern-style Cossack, i.e. with a rifle or cyber-punk elements, but in any case terrifying and with a hair crest. If an avatar represents a face, the latter will be covered with a cloth (Insurgent) or tactic glasses (Warrior). They like to use images of Cossacks and insurgents from Andriy Yermolenko’s paintings. On their pages you will see photos of weapons, collages with burning municipal buildings, and calls for fighting.

Ukraine’s leaders are depicted negatively. It is noteworthy that they place Poroshenko next to Putin. Naturally, this type pays attention to current breaking news, but the President of Ukraine is its permanent target. These militant trolls often support ultra-right political movements and imitate the cult of Stepan Bandera.

At least part of these profiles are real people, which is obvious from a look at their pages: volunteering, multiple photos, and few political comments. However, trolls like using such images as a disguise.

The second type is a POLITICAL COMMENTER, mostly focused not on call for revolution but on current political events. Generally, their posts look as follows: the photos they post often contain humiliating images of politicians and public figures, and their cover photos represent quotes about fighting and treason. Often they quote Ukrainian literature or fighters for independence of various times. Sometimes these quotes are FAKE.

The contents of their pages resembles that of the Cossack-Insurgent but there is more political dirt. Some personalities, such as Petro Chaika, focus on promoting certain political forces, most often Yuliya Tymoshenko’s Block or Lyashko.

The third type: DEMONSTRATIVE UKRAINIANS. Especially popular are images of dreamy girls wearing wreaths (from blue-yellow stripes or thorns), flag-coloured gowns, embroidered dresses, on the background of a wheat field etc. Let us consider for example Olya Ukrainochka (“Olya the Little Ukrainian Girl”): her image bears shades of suffering, something that reminds of Shevchenko’s heroines and the impoverished Ukraine. There is usually just a single personal photo, made in an excessively professional manner, which unfortunately does not reflect the content: the same links from sites with dubious reputation, defamation of the legitimate power, examples of injustice and solid proofs that “everything is lost”.

The fourth type, not too frequent: PREDATOR ANIMALS, such as wolves and tigers. No cute kittens! This is the type of a few users having numerous links on the net. Quite often they are group admins, they have a lot of friends but just a few posts.

External links: where do they all go?

Our research would have been incomplete if we missed the question of what links are most favorite for the trolls. No, those links do not lead towards “Russia Today”. Using FB Netvizz, we established that the majority of posts in those groups are EXTERNAL LINKS (sites, other groups and pages on FB). Trolls rarely express their own thoughts.Наше дослідження не було б повним, якби ми не вивчили, які лінки найчастіше постять тролі. Ні, вони не ведуть на «Russia Today».

The external links may contain popular resources, such as 112, Censor.net etc.; we found even 7 links to our own Texty.org. However, there were too many dubious or completely unknown sites.

The top 10 sites whose news are most often promoted by the trolls

Site	Number of references	Description
varota.com.ua	2236	Most striking is not the sinister content but the site’s low quality.
amn.com.ua	1384	At first sight, the content is pro-Ukrainian, most positively depicting the military, Nadiya Savchenko (our research took place when she was behind the bars) and downplaying the more “peaceful” politicians
zvamynews.blogspot.com	1252	“The News Time”. They publish about 5 news a day. In early June about a third of their content was discussing Savchenko
uaexpert.blogspot.com	955	This “expert site” does not publish any expertise except for a prophecy “when Crimea returns”. Too many materials about Russia
kozak.co.ua	863	A site for “real Cossacks” (in the steppe, bare-chested, with a saber and wolves) using symbols of the Right Sector
v7ved.ru	794	A typical news site with an obsessive request to like it.
bbcccnn.com.ua	712	Don’t read BBC or CNN: you can find their 2-month-old materials at bbcccnn.com.ua together with reposts of the above junk sites
follownews.info	653	It aggregates news from various sites, from the well-known Korrespondent.net and Liga.net up to the “Sofa Hundred” (very popular among the trolls) and similar junk resources
retrans.in.ua	651	The address resembles a well-known aggregator (a site that collects news from elsewhere)
joinfo.ua	600	The address resembles a well-known aggregator (a site that collects news from elsewhere)

Troll and a regular person: how to differentiate?

All that we can see are FB profiles; we could not verify every single of them personally. The network was built based on purely quantitative criteria. Let us remind the typical sings indicating a troll.

They have friends, which are numerous: a thousand, or two, or five Sometimes we came across non-socializing trolls having hardly 30—60 friends.

Here are typical signs of fake accounts: absence of personal photos or basic personal information at least, their pages contain few personal thoughts but rather reposts about “traitors”, “enemies” or just junk content like videos demonstrating how to tie a tie or lose weight fast – all of this without personal comments or impressions. As we mentioned in the beginning, most often trolls are 80% robots capable to post such meaningless content.

Most users of our troll network do have those signs: pages without content, too few or, on the contrary, too many friends (of the same kind as theirs, or popular users: we found Yuri Lutsenko, Arsen Avakov and other politicians among the latter). Their photos and albums are not events from their life but rather demotivators, or sometimes just labels on photos with other, real users.

A troll’s news feed contains mostly reposts, emotional reports about “treason”, links to photos of cool girls or meaningless articles. And there is nothing about real life: important events, selfies, photos from travels or parties are absent.

If a real person becomes a net person, there are reasons.

He or she could have a troll friend who added him / her in respective groups. In this case, we advise to watch the list of your friends and groups. The habit to friend everybody is bad – think about risks entailed by adding unknown persons to your friends.

There may be a third reason: someone could just be too gullible to trust a troll. In this case, it is worth mentioning that the cyber world provides immense opportunities for manipulation, and when you do not know someone personally, you can never be sure whether his or her Internet profile is real.

As Eric Schmidt, Google’s CEO, predicted a few years ago in his book “The New Digital Age”, creation of fake accounts in social networks becomes one of most profitable businesses of the future. And this future has arrived. Everyone who has a need and resources can fill social networks with bots and trolls and try to manipulate others with their help.

If a real person becomes a net person, there are reasons.

Maidan and Kremlin: so different, but so close?

It is difficult to convince a person to change his / her views by 180 degrees. The majority of Ukrainians are immune to “classical” Russian propaganda, as it does not match their vision of the situation. The propaganda targets mostly the pro-Russian audience.

The objective of the information warfare is to sow disorder and distrust, to deprive people of landmarks in their lives. Their weapon in this war is defamation of the legitimate power and public institutes, since “why should we die for oligarchs”.

“To sow distrust between people at the top and the bottom of society” is one of methods of defeating an enemy state described long ago by Chinese strategists.

Ukrainian patriots and volunteers (in fact their cyber-puppets) are excellent carriers of messages about “treason” and calls for a new revolution. The fact that the “insurgents” write in Facebook insults about Russia, Putin & Co. etc. does not matter. Does Putin really care as to who, how and to what extent likes him? Apparently, he does not, when it is about business.

The content of groups and Facebook profiles in the network exposed by us is full of despise and hatred towards the Ukrainian legitimate power and politicians. They focus their criticism on the feeling of injustice and provide parallels between Putin and Poroshenko-Yatsenyuk-Groisman. In this context the surname of the Ukrainian Prime Minister or President does not matter: whoever he/she is, the total “carnage” will go on and the reasons will be the same and unchanged.

So what should we do?

That is the point. First, we need to bring to everybody’s attention the information about trolls, as well as to remind about the necessity to invent complicated passwords and not to show them to anyone.

However, apart from propaganda, trolls play another important role: they make us silent. Do not express your thoughts: you run the risk of being trolled!

For this reason, it makes sense not to be scared by a worker of a troll factory, who is already tired and overwhelmed. There is a better option: to complain about their accounts, preferably in large batches. Quite expectably, they will retaliate by doing the same (as they did before), but is it difficult for a real person to unblock an account and to prove that a photo from a museum (or similar) is not pornography or fascist propaganda? For a troll, unblocking a page will be a harder task.

In our research, just like other mass media in their investigations, we provided sufficient proofs that the “factory of trolls” is quite powerful. The quality of their product (content of FB pages) is low, but it is outweighed by its volume. There is nothing new, the same old KGB school. Their credit line for trolls is unlimited, and their growth is supported by highly paid programmers and the best of Moscow intellectuals.

The Ukrainian response is unfortunately miserable. The “information troops” announced by Stets’ Ministry of Propaganda have only 34 thousand likes on Facebooks, and Google returns a bunch of articles about low efficiency of the aforesaid “MinStets troops”.

Certain work targeting the enemy’s mind via social networks is conducted by the military, but its volume is by far not comparable with the Russian.

We cannot defeat trolls by trolling, since the Russian budget for propaganda is still astronomical. The recipe is simple:

1. Do not befriend trolls; do not share their posts and links.
2. If you ever see a post about “treason”, full of indignation and emotions, just count to ten before sharing it, and then think: “Why are there so many emotions and words written in CAPITAL LETTERS?”; “Will this information improve the country’s defence or will it rather sow panic?”; “How is it exactly possible to implement the solution that the author is proposing?”.
3. Ban immediately accounts that spread excessively aggressive hatred – even towards the enemy. Most probably, they are feigning their indignation in order to turn your brains off, to cater to your emotions and gain your trust.

Pseudo-patriotic trolls are more dangerous than blatant missionaries of the “Russian world” are. The trust of Ukrainians to their public bodies and law enforcement agencies (with exception of the army) is quite low – and the enemy benefits from this mistrust.

However, improvement of the quality of management requires looking for sources of this or that problem, changing each specific situation, well-grounded criticism instead of further defamation. When there is no trust to your own power, then there is no order – there is chaos.

Updated on October 8, 16:10 The group “Freedom to the Regime’s Prisoners” contains many real people related to the former and the current “Right Sector” movement. The group itself is located on the periphery of the troll network, and its members are marked with small dots. Which means that they are not too active in posting the troll content.

Why is the “Freedom to the Regime’s Prisoners” present on our graph at all? It was included because its admin, Taras Deyak, was actively posting (more than 70 times) in the “Patriots of Ukraine” (although the latter was deleted, we have kept the data). According to our methodology, such admin’s activity would indicate that the group was part of the Troll Network, as the group members shared messages of the covert Russian propaganda spread via Mazura’s networks.

Radical patriots are the target audience of the trolls, and the group “Freedom to the Regime’s Prisoners” is a good example of how trolls managed to involve real people into their network.

Methodology

The starting points for collecting data about the troll network were the Maidan-3 groups, which we detected based on Ukrinform’s data. Their names contained “Maidan-3”, and their active participants were admins and/or activists of Mazura-Haiduk’s groups, and finally, they were offered by Facebook as similar (and they indeed had contents similar to Maidan-3). We decided to perform a quantitative investigation into Stepan Mazura’s network, to begin with groups selected manually, and to obtain a list of their members, admins, admins’ friends, FB posts and comments, and sources of their news. All of this having in mind that we were dealing with those who tend to add friends by thousands.

It was impossible to collect data manually. Facebook has a great benefit for a user, which at the same time is a great impediment for a researcher: its privacy settings are too strict. The fact that we see something on a user’s page does not necessarily mean that we can download it by means of API.

For this reason, data collection was automated by means of Selenium module for Python. It is a simulation tool that can manage a browser’s work. In other words, there is a script with instructions (visit a web page, log in, proceed to the list of friends / group members, scroll it down all the way to the end, and the data will be downloaded as the list is scrolled down with the use of AJAX technology, extract from the code the names and Facebook IDs of the users, write them to a file, and proceed to the following user or group). It looks similar to manual data collection by visiting pages of trolls; the only difference is that Selenium did all the work of making loads of repetitive clicks and scrolls in a regular browser.

At first, we downloaded a list of group admins and members. Facebook does not display a complete list of members of a group (for example, it can show only 5 thousand out of 10). However, our bot (meet Oleh Havrytsky, who likes soccer, revolution and ultra-right ideas) added several important trolls as friends, while FB itself displays friends and friends of friends at the beginning of a list of group members. All of this increases reliability of data.

Later we downloaded lists of group admins’ friends. Note the restriction: if a user did not open a list of his / her friends, then his / her friendships cannot be tracked. Then we selected only users being members of more than five groups or friends of more than five group admins. Using Netvizz, a Facebook extension, we retrieved all the posts and comments in open groups in question, based on which we in turn created:

- a list of active writers and commenters: those who wrote more than 3% of comments or posts in a certain group or above 15 posts or comments in all the suspicious groups in total.
- a list of web sites most referred to in groups (more than 5 links).

Since Netvizz initially provides anonymous data, we additionally downloaded names of post and comment authors from respective entries. Having obtained a list of “presumable trolls” (admins, active members, commenters and authors), we downloaded data of their FB friends. Then we removed from the list those who had less than five troll friends. In this way, we formed a list of all key knots and connections of the network in question

The selection of groups, downloading of friends of admins and members of open groups took place in March 2016. The downloading of data of members and admins (and hence their friends as well) of the closed groups (“Maidan-3”, “National Revival” and “Organisation Committee of the Third Maidan”) took place in June 2016. The data about the content of open groups were obtained from November 2015 through late March 2016. The period depended on the number of posts in groups, since we downloaded either the last 1000 posts or further posts between March 1 and 26 (in some groups 1000 can be reached in a few months while in others just a few days will suffice).

The Troll Network