How online trolls popped up to attack Estonia’s defence readiness exercise

Trolling started from news portals

During this year’s extra defence readiness exercise Quill, a pattern of trolling emerged in both news portals’ comment rooms and social media, indicating planned activity. The content directed against the Defense Forces on social media had common talking points, themes or patterns, and although the Defense Forces also published other materials during this period, the focus of the trolls was on posts related to Quill 2022.

At the beginning of the exercise on 22 to 24 September, anonymous comments under stories on Estonian online publications (e.g. Delfi.ee) published content in Estonian where the spelling and style were similar, and the sentence structure was noticeably non-Estonian, indicating either a poor grasp of the language or a machine translation. Here’s one example:

The main activity of trolling took place between 10 to 23 October with the most active periods from Monday to Friday, indicating it was being conducted by people as part of a normal working week.

The purpose of the posts was to ridicule the Estonian Defense Forces, saying that the Estonian Defense Forces are pointless and weak, and that additional training does not make Estonia stronger than the Russian army. The Estonian Defense Forces were repeatedly compared to a circus, in various comments written in Cyrillic, as smileys or as GIF-images.

Quill has been attacked before

This is not the first time that the Quill defence readiness excercise has come under attack. At the beginning of October 2021, a lot of false information was also spread, especially in Estonia’s Russian-speaking Facebook groups. That time, the main wedge issue that they sought to exploit related to the pandemic. Claims were made that unvaccinated reservists should not come to training sessions because they will be sent back home. The claims were widely debunked, including in the Estonian media, and the comments promptly disappeared.

In addition to trolling in posts on public social media profiles and comments on news portals, a common trick is for trolls to infiltrate social media groups with the aim of getting the opportunity to post to a large audience at once. This is where most misinformation about Quill 2021 was spread. The tactic has been used again.

For example, one of the largest traffic-related communities in Estonia, the Russian-language EZ-duny (EZ-dunы), detected a large number of application for joining with fake accounts at the end of October. The main theme of the EZ-duny group is driving and parking culture, safety and mutual assistance on the road. The group’s membership is close to 90,000, so obviously an audience of desirable size, despite its lack of relevance to the topic of the defence exercise. See the following screenshot:

Help fight misinformation

Propastop invites you to flag, check and report false information like this on social media platforms. Only with joint power can we resist information attacks. If you see suspicious information on Facebook, check the information and the background of the person sharing it.

The first sign of a fake account is often just its name. Fake accounts often use ordinary and simple names in both Estonian and English. Obviously recognisable pseudonyms are also often used. In addition, the names of famous people, especially politicians, or some variation of them (like Edward Obama) are often used. Propastop has written about how to identify fake accounts before (link in Estonian).

Second, look at the profile picture. The portraits on a white background, as seen among the trolls suddenly joining the EZ-duny group, have been artificially created by an online image generator. Photos of beautiful models are also often “borrowed” as profile pictures of fake accounts. Images of animals, animated people, nature or screenshots of social media content are also used. As a rule, fake accounts do not show pictures that were taken in everyday situations or, for example, on vacation.

Also check the account creation time and shared content. The majority of fake accounts were created relatively recently and this can also be seen on their profile. It is also common for accounts to have not shared any posts or have only done so a few times.

See also the number of friends and mutual friends. There are two ways fake accounts are noticeable. They either have a lot of friends and add everyone as a friend (which may also mean that you have mutual friends), or they have a very small number of friends who are often connected based on some kind of one characteristic (went to the same school, members of the same group, etc.).

If you have identified a troll or spreader of false information, report it to Facebook. How to do this, based on the example of the silencing of a war propaganda, read here (in Estonian). For non-Estonian readers, we’ll get more information out in English in future.