Filling in the Gaps: How Social Network Analysis is Being Used to Trace Kremlin Hacking Activities

Campbele Moon 

Image Portraying a Russian Hacker - Modern War Institute at West Point 

Social media has transformed the way we interact with each other. These platforms have increased debate, communication, and access to information. However, these networks also foster the growth of disinformation campaigns with goals of spreading harmful information and manipulating public perceptions. Analysis of these social networks helps expose Kremlin-backed disinformation by identifying actors, coordination attempts, and groups involved in spreading false information.  

Disinformation is defined by the American Psychological Association as false, inaccurate, or manipulated information that is deliberately created and spread with the intent to deceive, mislead, or cause harm. Russian information operations have disrupted major U.S. audiences through social media platforms, interfering with American elections, the response to the COVID-19 pandemic, and the war in Ukraine. 

Disinformation attempts involve coordinated strikes on social platforms, often attacking influential individuals or organizations to spread false information. State-backed operations can limit public trust and amplify social or political divides. Common disinformation methods include coordinated social media attacks and amplification of harmful narratives, tailored messaging across platforms, and use of misleading sources to increase reach.  

Social Network Analysis works to combat these strategies. Since disinformation campaigns typically stem from collaborations between accounts, network analysis can reveal patterns between groups with common interests. This is done through network modeling, network centrality, and community detection.  

Network modeling utilizes relationships between accounts and maps how information moves between them. Using statistical analysis and graphing technology, analysts can create a map of where narratives are spread, as well as connecting the dots between accounts through common ideas. Network centrality measures specific actors within each system. The measurements determine and identify accounts and their connections, further combating misinformation by shutting down accounts aiming to spread harmful narratives. Finally, community detection works to determine clusters of accounts and individuals within them; this is used to investigate secret messaging and patterns.  

There have been several instances where these strategies have been combined to combat Russian disinformation techniques; misinformation about Ukrainian biolabs, interference in U.S. elections, and disinformation about the war in Ukraine are some of the most well-known to the public.  

During the 2016 and 2024 U.S. Presidential elections, the Russian government was found to interfere with social media operations, influencing votes and spreading false information about candidates. The groups were working to delegitimize democratic candidates, favoring the republican party. This raised several questions and concerns, primarily about election security.  

Early detection of these issues is key for protecting information and national security. Preventing attacks or coordinated activities is possible through network analysis. To expand on this, it is important to investigate connections between accounts and influential individuals, while also recognizing that suspicious activity does not necessarily indicate direct support from the Kremlin.  

To counter these threats, public education is crucial to ensure information is accurate and verified, while avoiding disinformation traps. It is important that we work to support legitimate political activists and reports through analysis of data and intelligence.  

Overall, social network analysis implements several strategies to combat disinformation, including network modeling, network centrality, and community detection. These tools work to combat misinformation at the source while discovering the actors and networks behind it. These strategies can improve election and national security by preserving and protecting truthful information and limiting the spread of false information, especially when it impacts the democratic process.