Did Ukraine Just Bomb the Russian Bots?

0:00Is your home wish list just sitting in your cart? Well, get ready to hit checkout because Wayday at Wayfair is here. Save up to 80 % off everything home during the biggest sale of the year. Whether you're refreshing the living room, upgrading the bedroom, or finally tackling that home project you've been putting off, now's the time to save big. Shop Wayfair's Wayday sale and get up to 80 % off now till October 26th. These deals won't last. Go to Wayfair.com today. Wayfair, every style, every home. On October 11th, a member of the European Parliament posted a chart on Twitter showing that online activity around Germany's AFD party had collapsed right after Ukrainian drones hit Russian data centres.

0:44It was viewed more than 4 million times and it was very convincing, not least because it included data from three days in the future. To be fair to the poster, he did add the words if confirmed, which is always a sensible precaution when sharing a graph that knows what happens next Wednesday. Now, as someone who spends a lot of time looking at financial charts, I can tell you that good historical data can be hard enough to get. Data for next Wednesday is where it gets really tricky. A Bloomberg terminal costs around$30 ,000 a year, and it won't give you that. This chart managed it for free. It was posted on a Sunday, and the plunge ran all the way through till Wednesday the 14th.

1:33When the fact checkers at the German broadcaster DW took a closer look, they found that the chart didn't name a data source, didn't say which online platform it covered and didn't say what it was measuring. Its title was Daily Activity Over Three Months. Activity of what? It didn't say. In fact, the chart didn't even mention the AFD. The scaling on both axes was off. On the vertical axis, the gap between 2 ,500 and 3 ,000 was shorter than all of the other 500-point gaps, which is one way to make a decline look steeper. The German magazine Capital traced the chart back to a Threads account claiming to belong to a 24-year-old flight attendant, and DW concluded that while AI involvement couldn't be proven, it couldn't be ruled out either.

2:31But still, if confirmed, it was a devastating blow to the box. You can see why people wanted to believe it. That same weekend, the British Prime Minister said in an interview that Russia had interfered in the Brexit referendum. With the US midterms just a few weeks away, the idea that a few well-aimed drones could switch off foreign propaganda and make social media pleasant again was hard to resist. It was certainly a more decisive approach to content moderation than anything the tech companies have come up with so far. So today let's look at what those drones actually hid, why the bots didn't seem to notice and the humdrum business of manufacturing online outrage.

3:19So what actually happened? Well, over the previous month, Russia had been striking data centers in Ukraine, something the Russian Defense Ministry described on Telegram as a digital detox. Ukraine responded by sending drones into three of the six major data centers run by Yandex, which is usually described as Russia's Google, but which also runs the country's biggest taxi app, a food delivery service, a payments business, and its own AI chatbot. Two of the sites were shut down completely and the third lost several modules. Within hours people were sharing charts from Cloudflare radar, showing Russian bot traffic falling off a cliff.

4:05Euronews calculated that automated traffic from Yandex's network had dropped by about 94 percent. Now Cloudflare is an American company that sits between a large share of the world's websites and the people visiting them. They protect those sites from attacks, and part of that job involves guessing which visitors are human and which are software. Because so much of the internet passes through them, Cloudflare publishes a public dashboard called Radar, showing what they see. In Cloudflare's world, a bot is any automated online request, And before the strikes, these made up more than a third of all of the traffic they handled from Russia.

4:49Most of them are search engine crawlers and other scripts, which tend to be a lot more boring than online trolls. According to Cloudflare, the traffic that collapsed was almost entirely Yandex's search crawlers. Programs like YandexBot, which spent their days reading news websites so that the search engine knows what's on them. So, the internet had spent the weekend celebrating the destruction of a search engine's filing clerk – one that around 40 % of the news sites it visited had already blocked anyway. Yandex's entire search network came to about 0.05 % of the world's bot traffic. Cloudflare then checked the thing people cared the most about – traffic to social media sites, including the parts of a platform that handle posting, replying and liking.

5:44From Russia, or from anywhere else, they found no unexpected change. They were careful to point out that they can only see traffic passing through their own network, so they couldn't rule out a broader effect. But as far as they could see, the troll farms hadn't missed a single day's work. The drone strikes did plenty of damage though. According to the FT, users of Yandex's payment app woke up to find that their balances had vanished. Timetables disappeared from bus stops in some cities, and residents of many Moscow apartment blocks found themselves locked out of their own courtyards because the barrier gates were run by a company that relied on Yandex.

6:28The reason three strikes could do that much damage goes back to a decision Vladimir Putin made in 2014. Is your home wish list just sitting in your cart? Well, get ready to hit checkout because Wayday at Wayfair is here. Save up to 80 % off everything home during the biggest sale of the year. Whether you're refreshing the living room, upgrading the bedroom, or finally tackling that home project you've been putting off, now's the time to save big. Shop Wayfair's Wayday sale and get up to 80 % off now till October 26th. These deals won't last. Go to Wayfair.com today. Wayfair, every style, every home.

7:07In 2014, Vladimir Putin described the internet as a CIA project, complaining that everything went through servers in the United States. So later that year, he signed a law requiring that Russian citizens' personal data be stored on servers inside the country. LinkedIn refused to comply and was blocked in 2016, sparing millions of Russians a decade of posts from strangers explaining what their toddler taught them about B2B sales. For a long time this looked like a smart move. When cloud providers like Amazon, Microsoft and Google stopped dealing with Russian customers after Russia invaded Ukraine, the internet kept on running in Russia because it was run by Russian companies on Russian servers, and nobody abroad had an off switch.

8:00The data localization law insulated the Russian internet from Western sanctions. The downside was that much of the Russian digital economy ended up in a handful of buildings within drone range of Ukraine, which, it turns out, is not a great place to keep your country's bus timetables and banking data. And if Russian companies would like to move their data somewhere safer, say abroad, the data localization law won't let them. So Yandex advised its customers to back up their data with rival providers, most of whose data centers are also around Moscow and St. Petersburg. Investors seemed fairly relaxed about the destruction.

8:46Yandex's shares fell about 11 % over the course of the strikes, a modest reaction for a tech company that had just had half of its major data centers knocked out. Part of the reason is that the cloud business, the bit that was actually on fire, makes up only about 4 % of Yandex's revenue, according to T-Journal. The real money comes from taxis, advertising and online shopping, and those services could be shifted onto the remaining data centers, at least as long as there continue to be remaining data centers. Yandex's customers weren't so lucky. Thousands of Russian businesses rent space on Yandex's servers, and when those servers went down, so did they.

9:34One Russian telecoms analyst estimated that the combined losses ran to billions of rubles a day. Fixing it won't be quick either. Someone close to Yandex's management told the FT that the company hoped to have its services running again quickly, just somewhat more slowly than usual, but that getting back to full capacity would take several months. And Yandex will be shopping for replacement servers at the height of the AI boom in a country that Western sanctions are supposed to stop most computer equipment from reaching. So the replacements will probably have to come from China or through the kind of middlemen in Central Asia who don't ask too many questions, which tends to be slower and more expensive.

10:24As for who should be protecting this critical infrastructure, well that depends on which official you ask. The State Duma said that the responsibility for protecting data centers lies with the companies themselves. And according According to the FT, Putin recently told businesses not to come looking for state support. Meanwhile, the digital ministry said that it was working with the defense ministry to protect them. So Russia's data centers are either the private sector's problem or the army's, which if you run a data center is probably not reassuring. Someone will, of course, do well out of this.

11:05Meduza reports that one of the firms selling mobile data centers to nervous Russian companies has a deputy director whose father is the first deputy director of the FSB. Now, the standard way for a cloud company to protect its customers from a data center going offline is redundancy, spreading the work across several sites. As the tech side XenoSpectrum points out, Yandex's own documentation explains how to do this properly. If your application needs nine virtual machines, you don't just spread nine machines across two locations. You put nine in one location and nine in another. So you pay for 18 in total.

11:49Redundancy like this works like an insurance premium. The customer pays for capacity they hope that they'll never use. And customers who followed the manual and split their servers between two locations may have discovered that Ukraine had hit both of those locations. The trouble with insurance is that you have to buy it before the fire. After the third strike, Yandex stopped selling new computing capacity altogether, so customers who hadn't paid the premium couldn't buy it now. And with half of the major data centers out of action, anyone still running in the remaining ones has nowhere else to go if another strike lands.

12:32Which is how a drone strike on a server farm in Ryzen ends up with someone in Moscow unable to get into their own courtyard. Politicians in Europe and Canada are currently debating the importance of data sovereignty too. The idea is that countries should stop relying on American tech giants to host their data and should build domestic cloud infrastructure instead. This is usually pitched as a matter of national security. But from a CFO's perspective, it's a classic risk management problem. You weigh the risk of depending on a single foreign supplier against the physical risk of keeping all of your servers at home.

13:14To be fair, American cloud providers aren't fireproof either. When Iran struck Amazon's data centers in the Middle East this spring, customer data in the UAE and Bahrain was permanently lost. Wherever you keep your servers, the lessons from Yandex is to have more than one basket and to make sure that each basket has room for all of the eggs. So, if the trolls weren't in Yandex's data centers, where were they? When people picture a Russian influence operation, they tend to imagine a building full of people typing away in an underground bunker. That part isn't far from the truth. The best known one in Russia was the Internet Research Agency, which employed hundreds of people in an an above ground office block in St.

14:06Petersburg. But, if all of their posts had come from that building's internet connection, they would have been fairly easy to spot and block. So the connections these operations post through are mostly rented. An online influence campaign has two main parts, the accounts that post things and the websites they link to. The websites are the easy part. Russia's best-known campaign, which researchers call Doppelganger, has been cloning Western news sites since 2022, posting fake versions of Der Spiegel, Le Monde and The Washington Post on lookalike web addresses filled with made-up stories. An investigation by the German outlet Corrective traced a key part of the operation to a data centre run by the German hosting company Hetzner, just outside Helsinki.

15:02The fake Spiegel article would only appear if you connected through a German IP address. Everyone else was sent to a random website. Hosting companies will serve web pages for almost anyone, and as a rule, they don't fact-check their customers. The user accounts are the hard part. Social media platforms know that real users don't live in server racks, so they treat traffic from data centers as lightly automated. As Ned Mendez of the research group Alliance for Europe told The Guardian, serious bot operations get through this by running through residential connections and phone farms, which he pointed out airstrikes can't really knock out.

15:47A residential connection is just somebody's home internet, and there's a large market in renting them out, mostly from people who don't know they are for rent. In May 2024, the US Justice Department dismantled a network called 911S5, which the FBI described as likely the largest botnet ever. Its alleged administrator, a Chinese national, had infected millions of home computers by hiding his code in free programs and pirated software. He then rented out their internet connections. His customers used them to file 560 ,000 fraudulent unemployment claims, among other things. He allegedly made about$99 million, and the list of assets prosecutors wanted to seize included a Ferrari, a Rolls Royce, and 21 properties in five countries, which as long-term viewers will know, is roughly how these stories always end.

16:49In January, Google disrupted a similar network called IPIDA, which had recruited devices through at least 600 Android apps and more than 3 ,000 Windows programs that secretly turned them into relays. In a single week, Google counted more than 550 different threat groups using it, including groups from China, Iran, Russia and North Korea. Google didn't say what they were all up to, but it did list creating fake accounts among the usual uses, and it's safe to assume that most of them weren't just checking the weather forecast. Mendez's other example, Phone Farms, solves a different problem. Most platforms want a phone number before they'll let you open an account.

17:38So, if you need thousands of accounts, you need thousands of phone numbers. Last year, Europol raided a SIM farm in Latvia and seized 1 ,200 devices, holding 40 ,000 active SIM cards. Numbers from that one operation had been used to open more than 49 million online accounts. This all brings us to the unsung hero of the modern disinformation economy, the off-brand$55 Android TV box. People buy them online, plug them into the television, connect them to the Wi-Fi and never think about them again. They run stripped down versions of Android that their manufacturers don't bother to secure and some of them arrive with the malware already installed, which saves everyone a lot of time.

18:29One botnet called KimWolf infected more than 2 million devices, mostly boxes like these and according to Google, Epida's infrastructure helped support it. So, millions of these boxes are sitting in living rooms around the world, streaming football that nobody has paid for, and renting out their owners' internet connections to people they've never met. How they get taken over in the first place is almost embarrassingly simple, and we'll come back to that near the end. So, once someone has assembled a few million hijacked TV boxes and a warehouse full of SIM cards, they need customers, and governments are often the most reliable ones.

19:13In July 2024, the US Justice Department shut down a Russian bot farm of nearly a thousand Twitter accounts built with a piece of AI software called Meliorator. According to the FBI, the project was pitched by a deputy editor-in-chief at the Russian state broadcaster RT, and later folded into an organization set up by the FSB. The software could create fake personas in bulk and copy the tone of ordinary social media users. Some of the bots replied to American candidates for federal office, claiming to live in the candidates' its district. Every account needed an email address, so the operators set up their own email domains.

20:00One of them was mlrtr.com, which looks a lot like Meliorator with the vowels taken out, a level of tradecraft that suggests nobody expected the FBI to ever pay attention. When the FBI seized the domains, the bots lost the email addresses they needed to get past Twitter's bot filters. When CyberScoop asked RT for comment, its deputy editor-in-chief, Anna Belkina, said that she was more than happy to tend her farm, her DACA, which is made up mostly of tomatoes and strawberries. Her boss, editor-in-chief Margarita Simonian, had a harder time when the drones hit Yandex. According to Medusa, she complained on Telegram that she kept being asked to prove she wasn't a robot.

20:50I'm not a robot, she wrote, which is exactly what a robot would probably say. She then threatened to switch to Google before deleting her post. It's not really clear who she was trying to convince. State interference is real and well documented. What it does to actual votes is much harder to measure. Meta and OpenAI have both reported that Russian groups using AI mostly failed to reach large audiences. Governments keep paying for it anyhow though, which suggests that someone thinks it works. It isn't just Russia either. A 2019 report by the Oxford Internet Institute found organized social media manipulation in 70 countries and Facebook and Twitter had traced campaigns aimed at foreign audiences to governments including China, Iran and Saudi Arabia.

21:46In 25 of those countries, governments were hiring private firms offering what the researchers called computational propaganda as a service. Somebody somewhere is sending invoices for this. Western democracies aren't sitting it out either. The Oxford Report counts a unit at Britain's GCHQ that set up Facebook groups and YouTube videos designed to discredit, promote distrust, dissuade, deter, delay and disrupt, a mission statement written by somebody who had just discovered the letter D. It also counts a USAID program that built a fake social network in Cuba nicknamed Cuban Twitter back when Twitter was still called Twitter.

22:32It apparently started out with sports, music and weather, and the plan was to add the political content once it had built an audience, which, let's be serious, sounds like a huge improvement on regular Twitter. At its peak, it had around 40 ,000 users, and then the money ran out. So far, everyone in this story has at least been working for a government, but some of the angriest political voices on the internet don't work for a government, and don't even care who wins. Last November, Twitter rolled out a feature that showed which country an account was based in. Within days, people discovered that some of the loudest, most patriotic American political accounts on the platform were being run from places like Nigeria, Bangladesh, and Eastern Europe.

23:23And it wasn't politically one-sided. The Republicans Against Trump account turned out to be operating from Austria, which is a long commute when it comes time to vote. So, why would someone in Lagos care so much about American politics? Or, for that matter, why would someone in Sri Lanka care about British immigration policy? A YouTuber named Kristoff spent months looking into this and the answer turned out to be advertising rates. A report by the Institute for Strategic Dialogue called Hate for Profit identified 128 Facebook pages and groups posting anti-migrant content aimed at British audiences with a combined following of 1.6 million.

24:10They were all traced back to one man in Sri Lanka who runs an online academy teaching students how to make money from political rage bait on Facebook. In his training videos, he explains that politics is the niche most likely to go viral quickly. Charlie Munger famously said, show me the incentive and I'll show you the outcome. And the economics of political rage bait are quite simple. A Pakistani YouTuber told Kristoff that a thousand views from a Pakistani audience earn a creator around 40 cents, while a thousand views from the US, the UK or Canada earn between$6 and$30. That's 15 to 75 times as much for the exact same effort.

24:56Western political anger is, in effect, a high-margin emerging markets export. Accuracy doesn't come into it whatsoever. The goal is quite simply engagement, and these guys just aren't there to help you with your decision-making. When the political scientist Angus Bridgman's team fact-checked almost 6 ,000 posts from a network of spammy news pages targeting Canada, about 54 % were found to contain false or unsupported claims. Ideology doesn't seem to come into it much either. ISD noticed that the British pages occasionally posted content in favour of immigration, which is not something you see a lot of from committed nationalists.

25:45Christoph's video is well worth watching and I'll put a link to it in the description. The platforms pay for all of this. Since 2024, Facebook's content monetization program has shared ad revenue on videos, photos and even plain text, so the more engagement a post gets, the more it earns. In March, Twitter announced that it would give more weight to views from a creator's home region to discourage people from gaming the attention of US or Japanese accounts. Creators complained, and within hours Elon Musk paused the change until further consideration, which is the fastest I've ever seen a social media company respond to user feedback.

26:31The accounts that Twitter's location feature caught cheating were just the ones that hadn't bothered to hide. For anyone who does bother, there's a product for that. The Justice Department said that customers of 911 S5 could pick IP addresses to make it look as though they were posting from a particular location. So somewhere in Ohio there may be a$55 Android TV box under a television streaming football while moonlighting as a patriotic American voter. But a post from a user in Sri Lanka still needs someone to share it. and that's where the rest of us come in. For years, the comforting assumption was that the outrage in our feeds was being produced by bots.

27:19But when researchers look at how this material actually spreads, the bots turn out to be a fairly small part of the story. Most of the heavy lifting is done by real people. Back in 2018, Mark Zuckerberg published a chart of what he called the natural engagement pattern. His point was that left unchecked, people will engage disproportionately with more sensationalist and provocative content. The closer a post gets to breaking the rules without quite crossing the line, the more engagement it gets. Unlike the chart at the start of this video, his one didn't bother with numbers at all, which at least meant that it couldn't get the scaling wrong.

28:04And in fairness, it didn't claim to know the future either. Calling it natural was a nice touch though. It makes the whole thing sound like a force of nature rather than a set of choice. Is your home wish list just sitting in your cart? Well get ready to hit checkout because Wayday at Wayfair is here. Save up to 80 % off everything home during the biggest sale of the year. Whether you're refreshing the living room, upgrading the bedroom, or finally tackling that home project you've been putting off, Now's the time to save big. Shop Wayfair's Wayday Sale and get up to 80 % off now till October 26th.

28:40These deals won't last. Go to Wayfair.com today. Wayfair, every style, every home. ...that Facebook makes. Facebook said that it would train its AI to spot borderline content and show it to fewer people. But then, in 2024, it started paying creators based on how much engagement their posts get, which if you look at the curve is a bit like a casino announcing a responsible gambling policy and then launching a loyalty scheme. The platforms are in the business of supplying outrage, but the demand comes from us. In 2018, researchers at MIT studied about 126 ,000 stories that spread on Twitter between 2006 and 2017.

29:29And for most of that time, Twitter just showed posts in the order they were written. False news still spread further and faster than the truth in every category, and most of all in politics. False stories were 70 % more likely to be retweeted, and true stories took about six times as long to reach 1 ,500 people. When the researchers removed the bots, the gap stayed the same. Their best explanation was novelty. Replies to false stories showed more surprise and disgust, and replies to true ones showed more sadness, anticipation and trust. Surprise and disgust, it turns out, are more engaging. It doesn't take many people either.

30:17A 2024 study in science followed more than 660 ,000 registered American voters on Twitter during the 2020 election. Just 2 ,107 of them, 0.3%, shared 80 % of the panel's fake news. The researchers called them super sharers. Nothing about them looked automated. They were ordinary people with an average age of 58, retweeting by hand. on average almost 16 political news links a day. That's a level of commitment most employers can only dream of. And the content that does the most damage often isn't fake. Jennifer Allen, Duncan Watts and David Rand studied Facebook during the early COVID vaccine rollout.

31:07Fact-checked misinformation made up just 0.3 % of the 2.7 billion views of vaccine-related links. View for view, it did reduce people's willingness to get vaccinated, but hardly anyone saw those posts. The most viewed story in the entire data set was a Chicago Tribune article headlined, a healthy doctor died two weeks after getting the COVID vaccine. CDC is investigating why. More than 50 million people saw that headline on Facebook, over 20 % of its American users, and it got more than six times as many views as all of the flagged misinformation combined. Overall, the researchers estimated that vaccine-skeptical stories that were never flagged had 46 times the effect on vaccine hesitancy.

32:02Which brings us back to the chart from the future. It told people something they wanted to hear. So a member of the European Parliament shared it and 4 million people looked at it. When a chart is that pleasing, very few of us zoom in to see how far into the future the data goes. So, the academies in Sri Lanka, the ad rate arbitrage and the TV boxes in Ohio all depend on one raw material – our own indignation, which we supply every day completely free of charge. I mentioned earlier that taking over these devices was almost embarrassingly simple. The Mirai botnet spread largely by going through a default list of manufacturer usernames and passwords.

32:51On a lot of consumer hardware, both of those are simply admin. On October 12th, researchers at Anthropic published a paper testing whether AI models could run on and eventually spread across devices like these. They bought 15 off-brand Android TV boxes for about$55 each, networked them together and ran an AI model across all of them. It managed 0.39 tokens per second. A full-length tweet is roughly 70 tokens, so that's about one post every three minutes, which would still make it one of the more productive accounts on Twitter. The paper warns that small AI models may be months away from being able to copy themselves across devices like these.

33:42In a separate test, where an AI copied itself across simulated Android devices, the hacking step was trivial. The devices had no password at all. But given how Mirai spread, the researchers point out that real-world security might not be dramatically more difficult. They compared the result to a slime mold – slow but hard to shut down, since there is no centralized point to shut off. This is the opposite of Yandex's problem. All two million devices in the Kim Wolf botnet would add up to at most about 40 high-end graphics cards worth of computing power. It would be the least efficient data center ever built, but it wouldn't be all in one building, so you couldn't take it out with a drone strike.

34:34So what's the defense against a self-replicating digital slime mold? The paper's suggestions are fairly humble. When one internet provider quarantined its infected customers and told them about it, it cleared 92 % of Mirai infections within 14 days, and the UK has made default passwords like admin non-compliant in UK markets. So humanity's first line of defense against self-replicating AI may be asking manufacturers to stop setting the password to admin. The UK got their first on that one. There's one more comforting detail. The researchers found that small models are very poor to poor at the persuasion side of hacking, tricking people with convincing messages.

35:27So even if a self-replicating AI does take over your television, it'll still need ordinary people to furiously click the retweet button before anyone reads its posts. It's been quite a career for the off-brand Android TV box. It started out streaming football that nobody had paid for, became a residential proxy, moonlighted as a patriotic American voter and may one day be home to a digital slime mold. Not bad for$55. Thanks for tuning into the podcast. If you'd like to support the show, there's a link to my Patreon in the show notes. If you have one of those$55 TV boxes, it might be worth changing the password.

36:15Have a great week and talk to you again soon. Bye.

36:21Thank you.

36:51Thank you.

37:21Thank you.

37:53Is your home wish list just sitting in your cart? Well, get ready to hit checkout because Wayday at Wayfair is here. Save up to 80 % off everything home during the biggest sale of the year. Whether you're refreshing the living room, upgrading the bedroom, or finally tackling that home project you've been putting off, now's the time to save big. Shop Wayfair's Wayday sale and get up to 80 % off now till October 26th. These deals won't last. Go to Wayfair.com today. Wayfair, every style, every home