Summary
On July 9, 2024, a report was published and co-authored by the FBI and Cyber National Mission Force (CNMF), in partnership with the Netherlands General Intelligence and Security Service (AIVD), Netherlands Military Intelligence and Security Service (MIVD), the Netherlands Police (DNP), and the Canadian Centre for Cyber Security (CCCS).(FBI, p. 1)
It details how RT, a Russian state-sponsored media organization, used artificial intelligence and other software to create fake online personas of varying nationalities on Twitter. It spread disinformation primarily to the United States, Poland, Germany, the Netherlands, Spain, Ukraine, and Israel.(FBI, p. 1)
Meliorator
It uses an AI-enabled bot farm generation and management software called Meliorator to spread disinformation to the aforementioned countries. Its goal is to create “authentic” personas en masse, spreading the most disinformation possible. As of June 2024, it has only operated on Twitter, but it does plan to progress to other social media networks,(FBI, p. 2) such as Facebook and Instagram.(FBI, p. 3)
Brigadir
Brigadir is the user administrator interface for Meliorator, including tabs for Souls and Thoughts.(FBI, p. 2)
Taras
Taras is the back-end for the Meliorator software containing .json that contain the information for the personas for the fake social media users. These files are highly decentralized, meaning that they don’t function on their own and are required to connect to other files in order to run.(FBI, p. 2)
Souls
The identities of the users generated by Meliorator are called Souls, and are determined based on their selection of specific parameters and archetypes selected by the user using Brigadir. If nothing was selected it would be auto-generated. Bot archetypes are then tied to group ideology bots to help form each bot’s persona, location, political ideologies, and biographical data. Once a bot is created by Taras, then the bot has an account on the social media platform.(FBI, p. 4)
Thoughts
Thoughts are the actions or scenarios a Soul or a group of Souls can take, such as a like, repost, or comment on others’ posts with videos or links. The Thoughts tab also allows for the maintenance and creation of a new identify, and logs it into an the already existing profiles. The code for Thoughts notably includes Facebook and Instagram, two social media platforms not used by this software.(FBI, p. 4)
Diagram
Below shows a diagram of how Meliorator works:(FBI, p. 6)
Characteristics of the bots
The bots have three primary types.
- First type contains an AI-generated profile photo, banner, and biographical data, such as name and location.(FBI, p. 6) These bots post the most disinformation and conduct most of the activity.(FBI, p. 7)
- Second type contains very little information, usually only its user name. Its only purpose is to like already shared information.(FBI, p. 7)
- The final type uses a software called Nemezida, a variant of nemez1da, that browses over data of real users to create a profile with no AI-ties. This bot generates a lot of activity, thereby gaining a lot of followers. This type of bot is the most humanlike and mirrors or amplifies any disinformation shared by a bot or non-bot accounts.(FBI, p. 7)
Sophistication
To avoid being banned, the bots tend to only follow accounts that have over 100,000 followers,(FBI, p. 7) follow very few bots, or follow accounts that constantly post stories or ideas reflective of the bots political leanings and interests in their Soul, or already highly-publicized accounts.(FBI, p. 8)
Capabilities
The bots created with Meliorator are capable of the following:(FBI, p. 8)
- Displaying content similar to normal users, such as posts, following users, liking, commenting, reposting, and obtaining followers.
- Mirroring disinformation of other bots through with messaging, replies, reposts, and biographies.
- Perpetuating already existing false narratives to amplify Russian disinformation.
- Messages that include the topic and framing based on the specific archetype of the bot.
Obfuscation Techniques
Creators of Meliorator have considered multiple says to get around detection by Twitter, such as obfuscating their IP, bypassing dual factor authentication, and change the user agent string. They auto-assign a proxy IP address to each persona with a check on each persona to make sure they don’t use the same IP address or location again for any previous or future bot.(FBI, p. 8)