The Russian Bot Apocalypse

Viral Chart Debunked [0:00]

• A widely shared chart falsely suggested Ukrainian drone strikes on Russian data centers had caused online activity around Germany's AFD party to collapse.
• The chart included data from the future and lacked crucial details about its source, platform, and measurement, with manipulated scaling to exaggerate a decline.
• Fact-checkers discovered the chart did not even mention the AFD and traced its origin to a social media account, with AI involvement not ruled out.

  "Data for next Wednesday is where it gets really tricky."

Drone Strikes and Yandex Disruption [1:31]

• Russia had been striking data centers in Ukraine, which it called a "digital detox."
• Ukraine retaliated by hitting three major Yandex data centers, causing two to shut down and a third to lose modules.
• Yandex, often called Russia's Google, also runs its largest taxi app, food delivery, payments, and an AI chatbot.

  "Ukraine responded by sending drones into three of the six major data centers run by Yandex..."

Bot Traffic Collapse? [2:33]

• Immediately after the strikes, charts showed a dramatic drop in Russian bot traffic, with Euronews calculating a 94% decrease from Yandex's network.
• Cloudflare, which monitors internet traffic, defines a bot as any automated online request, with Yandex's search crawlers making up the majority of the collapsed traffic.
• This traffic represented a small fraction of global bot traffic, and crucially, Cloudflare observed no change in traffic to social media sites, indicating troll farms were unaffected.

  "Because so much of the internet passes through them, Cloudflare publishes a public dashboard called Radar, showing what they see."

Real-World Impact of Strikes [4:25]

• Beyond bot traffic, the drone strikes had tangible consequences for Russian users.
• Users of Yandex's payment app found their balances vanished, bus timetables disappeared, and access to apartment courtyards was lost due to system failures.
• These disruptions stemmed from a 2014 Russian law requiring data localization, concentrating critical infrastructure within drone range of Ukraine.

  "The reason three strikes could do that much damage goes back to a decision Vladimir Putin made in 2014."

The Disinformation Divide [5:19]

• Claims about whether bot activity slowed after the strikes became politically polarized, highlighting the difficulty of assessing disinformation risk.
• Ground News is presented as a tool to navigate biased reporting by showing the spread of sources, bias distribution, and factuality ratings.
• Misinformation about the effectiveness of such strikes can lead to either complacency or unbacked panic, depending on how the narrative is framed.

  "And that's exactly the kind of moment where I check ground news before taking any single account at face value."

Russia's Insulated Internet and Its Vulnerability [6:56]

• A 2014 law mandated Russian citizens' data be stored on domestic servers, insulating the Russian internet from Western sanctions after companies like Amazon and Google stopped dealing with Russian customers.
• This data localization, however, made the Russian digital economy vulnerable, concentrating data centers within potential drone strike range.
• Yandex advised customers to back up data with rivals, but most of their data centers were also located near Moscow and St. Petersburg.

  "The downside was that much of the Russian digital economy ended up in a handful of buildings within drone range of Ukraine..."

Yandex's Business Impact and Recovery [8:44]

• Yandex's share price fell modestly, as its cloud business, affected by the strikes, was only about 4% of its revenue.
• The core businesses of taxis, advertising, and online shopping could be shifted to remaining data centers.
• However, thousands of businesses renting Yandex servers faced losses estimated in billions of rubles daily, with full recovery expected to take months.

  "The real money comes from taxis, advertising and online shopping, and those services could be shifted onto the remaining data centers..."

Infrastructure Protection and Profiteering [10:29]

• Responsibility for protecting data centers is unclear, with the State Duma blaming companies and the Digital Ministry coordinating with the Defense Ministry.
• Putin reportedly told businesses not to expect state support for protection.
• One firm selling mobile data centers to Russian companies has a deputy director whose father is the first deputy director of the FSB, suggesting potential profiteering.

  "So, Russia's data centers are either the private sector's problem or the Army's, which if you run a data center is probably not reassuring."

The Real Spread of Disinformation [12:11]

• Online influence operations, like Russia's "Doppelganger," clone Western news sites and use rented connections, often from residential IPs or phone farms, which airstrikes cannot disable.
• Botnets like 911 S5 and Epida exploit millions of home computers and Android apps to rent out internet connections for fraudulent activities.
• Phone farms, using thousands of SIM cards, enable the creation of massive numbers of online accounts, bypassing platform requirements for phone numbers.

  "Serious bot operations get through this by running through residential connections and phone farms, which he pointed out airstrikes can't really knock out."

Hijacked Devices and AI's Role [15:20]

• Off-brand Android TV boxes, often sold for $55, are easily compromised due to unsecured firmware and pre-installed malware, becoming part of botnets like KimWolf.
• These devices rent out internet connections, contributing to disinformation spread and illegal streaming.
• AI models are being tested on these devices, with researchers warning that small AI models could soon replicate themselves across such compromised hardware.

  "Millions of these boxes are sitting in living rooms around the world, streaming football that nobody has paid for, and renting out their owners' internet connections to people they have never met."

State-Sponsored and Monetized Outrage [17:23]

• Governments, including Russia, China, Iran, and Saudi Arabia, engage in organized social media manipulation, often hiring private firms for "computational propaganda."
• Even Western democracies, like the UK and the US, have been involved in creating content to influence foreign audiences.
• The primary driver for much of this activity, especially from non-state actors, is advertising revenue, with political "rage bait" offering high returns.

  "Somebody somewhere is sending invoices for this."

The Economics of Anger [19:05]

• Creators in lower-cost countries earn significantly more by targeting Western audiences with political anger and outrage due to higher advertising rates.
• A thousand views from the US or UK can earn 15 to 75 times more than from Pakistan, making Western political anger a high-margin export.
• Accuracy is secondary to engagement, with a significant percentage of content from these networks containing false or unsupported claims.

  "Western political anger is, in effect, a high margin emerging markets export."

Platform Incentives and Human Amplification [20:48]

• Social media platforms, by paying creators based on engagement, incentivize sensational and provocative content, akin to a casino promoting responsible gambling while offering loyalty schemes.
• While bots contribute, real people, particularly "super sharers," are the primary amplifiers of fake news, sharing significantly more links than the average user.
• False news, especially in politics, spreads faster and further than true news, driven by emotions like surprise and disgust.

  "The platforms are in the business of supplying outrage, but the demand comes from us."

The Future of Disinformation [23:06]

• The raw material for disinformation is human indignation, supplied freely by users.
• Compromised devices like Android TV boxes, often with default passwords, are vulnerable to takeover by self-replicating AI, creating a decentralized threat.
• While AI may struggle with persuasion, human amplification through sharing remains crucial, highlighting the ongoing need for critical engagement and basic security measures.

  "So humanity's first line of defense against self-replicating AI may be asking manufacturers to stop setting the password to admin."