Russian troll sites kept online by US companies

The use of American companies to push Russian propaganda goes beyond social media sites like Facebook. Russians also used American internet services to keep their websites up and hide their true owners, according to internet records and two executives at internet routing companies.

The firms routing these websites’ internet traffic include Cloudflare, a major Silicon Valley corporation, and a Ukrainian company’s subsidiary in Florida.

The websites are part of a network run by the Internet Research Agency, a troll army based in St. Petersburg, Russia, with ties to the Kremlin. The groups, with names like “Don’t Shoot Us” and “Black Matters,” posed as black American activists. They posted videos showing police brutality against African Americans and attempted to organize protests across the United States. But they need internet infrastructure to keep sites online.

The use of the routing companies shows how Russian trolls tried to mask their efforts that also used Facebook, Google, Instagram, Twitter, and other popular social media platforms.

CNN interviewed Sergey Kashyrin, an executive at the U.S. subsidiary of the Ukrainian company, outside his home on Staten Island on Monday evening. He acknowledged that his internet service, Orlando-based Green Floid, played a role in keeping these Russian websites up and running.

“We cannot look at all our clients. It is just not possible,” he said.

But Kashyrin said he’s willing to turn over all evidence in his company’s possession — revealing the identities of customers and PayPal payment information — to the FBI, congressional investigators and Special Counsel Robert Mueller’s federal team looking into the Russian operation. He said government investigators have not yet reached out to him.

Internet records consistently point back to Kashyrin’s small firm, its parent company ITL in Ukraine, and ITL executive Dmitry Deineka. The records identify the two companies as running internet infrastructure that kept at least three Russian websites online, possibly as a hosting service.

If Kashyrin’s firm served as a host, it would have provided the computers that serve as a physical home to the digital site.

However, Kashyrin claimed instead that Russians quietly used his internet service as a proxy, and that the websites were hosted elsewhere. That would still mean his company provided computers that rerouted internet traffic to the true physical location hosting the site. Either way, Kashyrin’s firm kept the website online — even if it did so inadvertently.

Before and after the 2016 election, the Russian government maintained a classic Cold War-style “information war” on the United States, creating fake news and promoting protests in an attempt to meddle in American politics by stoking real tensions, according to public reports by American intelligence agencies and congressional investigators.

Russian agents used websites and social media campaigns, several of which have been identified by CNN and confirmed by entities with knowledge of these operations.

A mysterious group calling itself “Blacktivist” publicized black activist protests across the country and even sold Blacktivist T-shirts. DoNotShoot.us tracked police brutality against minorities. BlackMattersUs.com posed as a news site for African-Americans, but it peddled anti-Hillary Clinton content and called her “a candidate for the corporate elite.”

The digital trails for all of these websites lead back to Kashryin’s firm, Green Floid, and Deineka’s firm, ITL. Internet records track what computers and services are involved in keeping a website up.

Deineka is plainly listed as the point-of-contact for Blacktivist.info, likely because his firm was used as a proxy service.

Deineka, ITL and Green Floid registered the site sergy.uaservers.net, which points to the IP address 107.181.161.172 — the same IP shared by both BlackMattersUs.com and BlackMattersUSA.com. Again, because these websites used their service.

Deineka runs another online service, Layer6.net, which plays a role in routing traffic to DntShoot.com — which shares the IP address 107.181.174.34 with DoNotShoot.us. This too indicates that the Ukrainian firm was used.

CNN conducted this research using investigative software from DomainTools, a cybersecurity firm that maintains historical and current internet records.

The left-leaning news site ThinkProgress was the first to report on the connection between these websites, ITL and Green Floid. It was first discovered by Andrew Weisburd of the Alliance for Securing Democracy, an initiative by the public policy group German Marshall Fund.

On Tuesday morning, Deineka spoke to CNN from his office in Burgas, a Bulgarian port city on the coast of the Black Sea.

Deineka said he did not register Blacktivist.info in his name. As for the other websites, Deineka said ITL does not closely monitor all of its clients’ online content. This is a standard industry practice, although some hosting and proxy services are willing to cut off clients who violate laws or company policy.

Deineka said his company had spotted anti-Ukrainian Russian propaganda activity on its platforms in 2014, and it stopped providing online services — presumably forcing the Russians to find other internet infrastructure. His business partner in New York, Kashyrin, referenced that as well in his interview with CNN. Kashyrin said they stopped providing proxy services to keep the Russians out. However, CNN pointed out they actually continued service in 2015 and 2016, according to internet records. Kashyrin could not explain that.

Deineka and Kashyrin denied direct involvement with Russian online trolls. They both expressed moral disgust at the notion that Russia used their services to peddle propaganda meant to destabilize the West, citing what they said is their anti-Russian stance because of Russia’s military capture of Crimea and eastern Ukraine.

“I’m from Ukraine. I have colleagues who lost their homes, who relocated from Crimea,” Deineka said. “How can I support the Russian government?”

All three of these Russian websites are still up. BlackMattersUs.com and DoNotShoot.us are still online, but “Blacktivist” is a blank page. Internet records do not show what online service is hosting them. All of them are now hiding behind proxies that shield the identities of the website’s true operators.

These three Russian propaganda websites are tied to robust social media campaigns run by Russian trolls. Facebook and Twitter are starting to purge of this type of content, and they have taken down pages relating to these particular sites.

The names of those running the websites BlackMattersUS.com and DoNotShoot.us now remain hidden with the unwitting help of the San Francisco-based company Cloudflare.

Cloudflare provides protection from hackers, placing its computer servers between clients’ websites and the outside internet. This allows Cloudflare to absorb cyberattacks, such as Distributed Denial of Service attacks that flood a website and take it down.

But Cloudflare’s services can also be used as a mask, because the outside world can no longer identify who operates the website — or the location of its physical home.

That’s because Cloudflare serves as a guard that receives incoming internet traffic. It offers this service to legitimate companies, but in this case, it is also inadvertently assisting the Russian troll army’s operations.

Cloudflare its role as a proxy service when asked specifically about DoNotShoot.us earlier this month, but it said “terminating a customer wouldn’t actually remove the content from the internet.” Cutting off that customer would, however, stop the Russians from using that particular American firm as a shield.

Cloudflare also provided online services to the U.S.-based neo-Nazi website The Daily Stormer, until it decided to drop the site earlier this year.

The company’s CEO, Matthew Prince, made the decision to drop the site but later warned of the consequences of companies, like his, making such decisions.

“You win a lot of points for firing Nazis from using your service,” Prince said in August. “But it sets a dangerous precedent when a company that most of your viewers have never heard of is effectively deciding what can and cannot be on the internet.”

However, Cloudflare said it would not consider dropping these Russia-linked websites unless compelled to by a court order.

“Cloudflare does not view its role to pass judgment of content that runs on our infrastructure and our network,” the company’s general counsel, Doug Kramer, said Tuesday night. “An open internet and an opportunity for all voices is a good principle. If we try to regulate in any way with our resources and capabilities, we would do more harm than good.”

Cloudflare is, however, willing to pass along public complaints to the websites’ operators, Kramer said.

Follow this story

Twitter promises greater transparency for political ads

Twitter announced Tuesday that it will label all political advertising on its platform and provide information about who bought the ads and what they spent.

The announcement comes as Twitter and other social media companies face scrutiny over their sale of ads to Russian trolls who sought to meddle in American politics, though it is not clear that the new guidelines would have prevented such ads in first place.

“In the coming weeks, we will launch an industry-leading transparency center that will offer everyone visibility into who is advertising on Twitter, details behind those ads, and tools to share your feedback with us,” Bruce Falck, the company’s General Manager for Revenue Product, said in a blog post.

As part of that effort, Twitter will now place a purple dot on political ads that refer to a specific candidate, along with a note identifying the account that paid to promote the tweet.

But the majority of Russian-bought ads identified by Twitter were issue ads, focusing not on candidates but on divisive topics like race, refugees, immigration and gun control, and thus might not be affected by the change. As Falck noted, these ads are harder to define.

“There is currently no clear industry definition for issue-based ads,” he wrote, “but we will work with our peer companies, other industry leaders, policy makers, and ad partners to clearly define them quickly and integrate them into the new approach mentioned above.”

Twitter announced earlier this month that it had identified roughly 200 accounts linked to the Internet Research Agency, the shadowy Russian troll farm with ties to the Kremlin. Lawmakers believe the ad buys identified by Twitter, Facebook and other companies represent a small fraction of the full scope of Russian meddling.

Democratic Senators last week announced a new “Honest Ads Act” that would, if passed, require greater transparency for online political advertising.

Sen. Mark Warner, the top-ranking Democrat on the Senate Intelligence Committee, and a co-sponsor of the Honest Ads Act, said Tuesday that Twitter’s new initiative was “a good first step” and that “online political ads need more transparency & disclosure.”

Lawyers for Twitter, Facebook and Google will appear before the Senate and House Intelligence Committees next week in a pubic hearing, where they are expected to be pressed on their role in Russia’s meddling in the 2016 presidential election.

Twitter is the first of these three companies to provide a comprehensive plan for political ad disclosures.

In addition to identifying political ads, the Twitter “Transparency Center” will include a list of all the ads that are on Twitter, the amount of money each advertiser has spent, and information about the organization or individual funding the ads, Falck said.

Falck also said the company would introduce “stricter requirements on who can serve these ads and limit targeting options.”

Adam Sharp, Twitter’s former head of news, government, and elections, who’s now doing consulting work and speaking, told CNN that the initiative “harkens back to Twitter’s original approach to political ads.”

“When they launched in 2011, they had a special purple indicator and when you moused over them, you got the full FEC disclaimer,” Sharp said. “Twitter was the only platform to set that standard, but with no action from the FEC, the company succumbed to the industry direction — and buyers’ demands — for less transparency.”

“Twitter has now righted that retreat, and I’m glad they’ve returned to steering ahead of the pack and demonstrating that the industry is able to provide meaningful transparency without the sky falling. The challenge will be if the industry and regulations don’t keep up with Twitter’s step here. My fear would be that the market will again demand a pullback.”

Follow this story

Rep. Frederica Wilson: Trump’s call ‘not a good message’

Rep. Frederica Wilson said Friday that President Donald Trump’s message to the late Sgt. La David Johnson’s family is “not a good message to say to anyone who has lost a child at war.”

“You don’t sign up because you think you’re going to die,” the Florida Democrat told CNN’s Alisyn Camerota on “New Day.” “You sign up to serve your country.”

She also said that instead of responding to Trump’s tweet Thursday night — the president said Wilson made a “total lie” about his condolence call to Johnson’s widow — she wants to shift the focus on receiving more information from the Pentagon about the Niger attack.

“My emphasis today is on my constituents and helping them lay our hero to rest,” she said. “That’s where my head is today. I’m also concerned about (Sgt. La David Johnson) and his last moments. I want to know why he was separated from the rest of the soldiers.”

She continued: “Why did it take 48 hours to find him? Was he still alive? Was he kidnapped? What’s going on? … I am distraught and so is the family. There are so many questions that should be answered.”

Johnson was among the four U.S. soldiers killed by 50 ISIS fighters in Niger in an ambush earlier this month.

Her comments come after Trump again refuted Wilson’s account of his call, deeming it a “total lie” hours after his own chief of staff said she mischaracterized the call.

“The Fake News is going crazy with wacky Congresswoman Wilson (D), who was SECRETLY on a very personal call, and gave a total lie on content!” Trump tweeted Thursday evening.

Trump and Wilson have engaged in a public dispute over the highly sensitive call for the past several days.

Wilson said Tuesday evening that Trump told the widow that her husband “knew what he signed up for, but I guess it still hurt.”

Wilson, who listened in on the call via speakerphone because she is close with the family, said on CNN’s “New Day” on Wednesday morning that Trump didn’t appear to know Johnson’s name and that his widow “broke down” after her call with the president.

The chief of staff said he was “stunned” that Wilson had listened to the call on speakerphone, but he added that the message the president tried to convey included the idea that “he knew what he was getting himself into.”

Defense Secretary James Mattis said on Thursday that the “U.S. military does not leave its troops behind” but did not provide additional details into why Johnson’s body was recovered nearly 48 hours after his 12-member team was ambushed.

Follow this story

Parents upset with school’s handling of racist message

The parents of an African-American high school freshman in Texas say they are livid with their daughter’s school district for not doing enough to discipline a student who sent her a racist message saying, “we should have hung all u n*****s while we had the chance.”

The white male student — who also is a ninth-grader at The Woodlands High School in Conroe — sent the direct message, adding, “trust me it would make the world better.”

R.J. King, the father of the 13-year-old girl who received the harassing text, said it was sent via Snapchat on September 24. His daughter took a screen shot and saved it.

The matter has not been addressed swiftly enough by the school, King told CNN.

“Immediately after she received the message, she showed it to me,” he said about his daughter. “It was a traumatizing statement. It has traumatized my daughter and makes her fear for her life right now,” King said. “It took me a few times to read it for it to sink in. I was disturbed.”

The conversation between the teens began after they were discussing the “recent NFL protests” and “white supremacy marches on the East Coast,” King told CNN. While the two teens involved “followed each other on social media” and were classmates at the school, “they were not friends,” according to the girl’s parents.

King said the incident happened late on a Sunday night, so he and his wife went to the school “first thing Monday morning to contact the principal.”

“Initially, their reaction was serious, and we thought this was going to be handled in a serious manner,” King told CNN. “We want to know what happened.”

The student did have his electronics taken away from him while in class, according to King, as well as his class schedule changed as a way to “make sure the kids didn’t see each other at school,” King said.

Even so, the two found each other face-to-face in the halls a few days after the incident. His daughter, King said, “suffered a panic attack.”

“Although the comments made on Snapchat occurred over a weekend and not on campus, Conroe ISD does not tolerate behavior of this type,” the Conroe Independent School District said in a statement to CNN.

“The campus administered several levels of disciplinary consequences and continues to work with the students involved and their parents,” the district said. “While student privacy laws will not allow us to comment specifically about student discipline, this matter is being addressed in accordance with the Student Code of Conduct.”

That’s not enough accountability for the Greater Houston Coalition for Justice, which is representing the King family. It said “the school is showing a nonchalant attitude.”

“[The student] should have been sent away to another school,” coalition official Johnny Mata told CNN. “He should have been disciplined. This gives an example to other students that nothing is going to happen to them if they do something like it.”

“It seems that the Conroe ISD has already made up their mind that next to nothing will happen,” King family attorney Randall Kallinen said.

A spokeswoman for the Conroe district told CNN that, in addition to contacting an on-campus police officer, officials referred the case to the Montgomery County Sheriff’s Office. An official at the sheriff’s office said it was “not involved in the case” and referred all comments to the county district attorney.

Montgomery County’s chief juvenile prosecutor told CNN that while the incident is “frustrating,” it would not have qualified for a criminal offense.

“For it to qualify as an offense in Texas, with this particular scenario, I would need an actual specific threat to the person,” Marc Brumberger told CNN. “The statement was offensive and racially bigoted, but it was not threatening anyone.”

“There’s a harassment charge in Texas which could encompass offense remarks, but I would have had to have repeated instances of it. This, as I understand it, was not,” he said.

“The school said they would do everything they can,” King told CNN. “The punishment should fit what he did, by removing him from the district.”

“When something of this magnitude happens, you’re sending a message to black kids, not only my daughter, but another 4½-thousand black kids that are part of this district that that message wasn’t serious enough to take action. That message wasn’t serious enough to hold this kid accountable to saying these types of evil and disturbing things.”

Follow this story

Facebook acquires beloved teen app ‘tbh’

Facebook just nabbed a popular new teen app called tbh.

Teens have been flocking to the app — named after the acronym frequently used in texts, “to be honest” — to participate in anonymous polls and give feedback to friends.

The app creators control the content of the polls, like “Best person to go on a roadtrip with.” It’s a measure that’s meant to keep the sentiments expressed on the app positive, which is something that other anonymous apps have struggled with.

The concept has spread like wildfire amongst teens. The app is designed for people who are 13 and older, and according to the company, over 5 million people have downloaded it in just the past few weeks. And it’s only available on iOS for now.

On Monday, tbh announced it has also attracted the attention of Facebook — which has acquired the company.

The move isn’t surprising given that the social media giant has shamelessly sought out teenagers in recent years amid reports that younger users are abandoning its platform in favor of newer apps and services.

“We were compelled by the ways [Facebook] could help us realize tbh’s vision and bring it to more people,” read a blog post from tbh, which has four cofounders. They wrote that the app’s experience “won’t change.” It will, however, now have “plenty more resources,” it said.

The app is just several months old. It first launched on August 3rd, 2017 in Georgia and is currently available only in 34 states to date “to ensure the reliability of the app.”

Facebook also confirmed the acquisition news to CNN Tech. Terms of the deal were not disclosed but the social media company said tbh’s four co-creators Nikita Bier, Erik Hazzard, Kyle Zaragoza, and Nicolas Ducdodon will join Facebook’s Menlo Park headquarters.

Follow this story

#WomenBoycottTwitter protest erupts over Rose McGowan’s suspension

Woman all over the world have joined a call to boycott Twitter over the platform’s treatment of actress Rose McGowan.

It started as a reaction to McGowan’s temporary suspension from Twitter earlier this week and quickly escalated to the number one global trend on the social media platform on Friday as #WomenBoycottTwitter.

The actress, known for the television series “Charmed” and the movie “Scream,” is on a growing list of woman that have accused Hollywood mogul Harvey Weinstein of rape, abuse and other forms of misconduct and has been tweeting about the scandal.

On Thursday, a spokeswoman for the disgraced movie mogul said, “Any allegations of non-consensual sex are unequivocally denied by Mr. Weinstein.”

McGowan instagrammed the notification she received from the company, adding: “TWITTER HAS SUSPENDED ME. THERE ARE POWERFUL FORCES AT WORK. BE MY VOICE.”

The social network responded with a tweet, clarifying that McGowan’s account was temporarily locked because one of her Tweets included a private phone number,” which they said violated their Terms of Service.

“She had been tweeting powerfully about sexual harassment and bias in Hollywood, and her own experience as a survivor of sexual assault, and she spoke for many women who felt they couldn’t,” said Heidi N. Moore, a New York-based business editor, who was among the first to popularize the boycott.

“Twitter seems to be sending a message that they’d rather see us silenced than take real, meaningful action to fix a problem that’s plagued Twitter since the beginning … when Rose McGowan was temporarily blocked by Twitter, that amplified the perception of silencing victims of various forms of abuse. The idea behind the boycott is to show Twitter that silence they seem to prefer, so we wanted to show them what it looks like.”

Moore suggested the boycott last 24 hours, and advised users to completely log out of the popular social media platform starting at midnight Eastern Daylight Time. She added that if folks want to keep tweeting they should amplify women’s work and voices instead.

McGowan joined in on the boycott, tweeting: “At midnight we RISE.”

Celebrities, like Alyssa Milano, Chrissy Teigen, Kathy Griffin and Anna Paquin also tweeted their support, as well as media organizations IndieWire and Refinery29.

Twitter could not be reached for comment.

Male twitter users, like comedian Michael Ian Black and actor Mark Ruffalo, joined in on the movement as well, but there were also female users who questioned the validity of volunteering a silence.

“Some visible users have left the platform, but it hasn’t seemed to make Twitter sit up and take notice. This was a different idea for trying to get that message across,” said Kelly Ellis, a software engineer from San Francisco, who created the hashtag. “I hope to see some meaningful changes come out of it, including better tools for dealing with dogpile-style harassment.”

Follow this story