First Person

My short life as (the face of) a Russian disinformation troll

July 30, 2018
Image via Pixabay

On a Saturday in late October, 2016, I started receiving odd messages: Total strangers were mentioning my name on social media; others were asking if I was a person named Hector Morenco; a few people emailed me about a suspicious account. That night, I got online, searched for Hector Morenco, and found a Twitter account—with my face. Morenco’s profile picture was my official headshot from the University of Georgia, where I work as a professor.

Morenco’s Twitter bio stated that he was an Air Force veteran, a former Boy Scout, a “Based Conservative Independent,” and a political essayist. He had more than 50,000 followers, and his tweets had thousands of likes and retweets. My stomach sank. “What in the hell is this?” I wondered. And “Why me?” From the account, created in August 2015, Morenco had been posting almost nonstop—often with ruthless attacks against Hillary Clinton, Wikileaks updates, and geopolitical conspiracy theories. He took aim at “establishment” Republicans and Barack Obama. His pet subject, which helped propel his social media fame, was a bogus theory about a Qatar-Turkey pipeline. That hoax, which for a while was his pinned tweet, featured a doctored map lifted from a story published in 2015 by an Australian news site. A reverse image search led me to the original source.

Morenco’s tweets seemed professional—there were graphics, memes, and hashtags—and prolific enough to be someone’s day job. He worked hard to discredit Western media outlets and mainstream politics. He advocated for nationalism and raged against American presidents of both parties. In a meme that Morenco promoted, George H.W. Bush, Bill Clinton, George W. Bush, and Barack Obama were labeled “scumbags” and part of a globalist elite out to “destroy America.” That meme, called “28 Years of Hell, 1989-2016,” was based on a photograph of the four presidents together in the Oval Office. In another meme, featuring a photograph of Mitt Romney and Paul Ryan, Morenco framed Donald Trump’s opposition in the GOP as the “Goldman Sachs/Media/Defense Contractors arm of the Republican party who will benefit from HRC as POTUS & support her.” Another post implied that Dick Cheney and George Soros were terrorists.

ICYMI: Newspaper staffer resigns, says publisher called story “racist against white people”

Many of Morenco’s fans were loyal, and in a similar way, somewhat suspicious. One of them, @Lucky5713, (with 190,000 tweets and counting), identified as a “Shadow Banned PATRIOT.” Another was @mexicangop, whose picture featured a scantily clad woman; that profile contained two links—one to Morenco’s account and another to a defunct website devoted to overturning Roe v. Wade.

I contacted Twitter immediately, by filing an impersonation claim. Four days later, having supplied a photo ID and information verifying my identity, I received an automated response: “We were unable to take action on the account given that we could not determine a clear violation of the Twitter rules.” That was it—I was on my own. 

Sign up for CJR's daily email

THE 2016 ELECTION MARKED an historic escalation in the directness, scope, and intensity of Russia’s disinformation efforts in the United States. They involved hacking the servers of both parties, strategic leaking of stolen documents, and manipulating public perception on social media. Once pressed by the U.S. government to investigate, Twitter identified 3,814 accounts actively managed by Russian operatives and some 50,258 bots that tweeted over a million times around the election. Other social media platforms also were—and continue to be—part of disinformation campaigns. Google sold political ads to Russian-backed accounts; YouTube provided an outlet for RT (formerly Russia Today), a Russia-backed propaganda channel. Facebook acknowledged that, around Election Day, 126 million Americans were exposed to Russian-generated disinformation. Clint Watts, a national security and counter-terrorism expert, described Russia’s campaign as the “swiftest and most pervasive influence effort in world history.”

Influencer troll accounts were busy creating content, building followers, and often driving a narrative. If Morenco’s wasn’t one such account, he was pulling off a masterful impersonation. Leonid Bershidsky, a Russian-born journalist, has said, “If it looks like Kremlin shit, smells like Kremlin shit, and tastes like Kremlin shit too—then it’s Kremlin shit.” Morenco, it can now be said, looked, smelled, and tasted like Kremlin shit—the overstated patriotism, the false identity, the pro-Trump agenda, the syntactic errors. Days before the polls opened, he trumpeted leaks of hacked information from the Clinton campaign and declared, “These bombshells will be confirmed by Wikileaks/Dikileaks soon, but maybe not before the election. The volume of hacked material is massive.”

Screenshot from Google Images

I wanted to ask Morenco how my face ended up on his profile. I was irritated but also a little scared. Knowing nothing back then about Russia’s election interference, I assumed that hackers were behind the account, but who were they? Plus, Morenco had tens of thousands of followers. I had seven hundred or so. Sure, I had credibility and truth on my side, but he had an enormous volume advantage. He could easily drown me out.

ICYMI: A California TV station neglected to update an old story on the web. That ended up having big consequences.

In tangible ways, Morenco embodied the style and nature of Russia’s interference, which was extensive, systematic, and maybe even effective. But it was also sloppy. While I was sorting through my confusion, Morenco began getting questions about me. Using a simple reverse image search, which led straight to my university profile, people on Twitter uncovered the mystery. Soon, Morenco had a small-scale PR crisis on his hands. Followers posted links to my profile, asking pointed questions, or concluding that he was a fraud. In response, he ducked their messages and changed his avatar—my face was replaced with an American flag.

I was reluctant to stir up an online hornet’s nest, but on November 4, just four days before the election, I got up the nerve to send him a direct message on Twitter. My pulse quickened as I wrote him the most disarming, pleasant message I could muster. “I’m not angry, but I am genuinely curious—of all the millions of available options,” I asked, “why a picture of me? Or was it just random?”

A screenshot of messages between Tim Samples and the person behind a Twitter account using the professor’s image.

Within minutes, he replied. “Hey Tim, sorry about the picture. Never occured [sic] to me that someone would piece it together. I wanted a Latino looking profile, because I wanted to be a representative of a protected class (Hispanic) so I wouldn’t get censored. I googled ‘South American Professor’ to hopefully get a nice repurposed stock photo of a respectable looking Hispanic man. You seemed perfect for the Hector avitar [sic].”

I couldn’t believe he answered. I was communicating directly with my identity thief. And he was civil, polite even. Later, I tested Morenco’s explanation with a number of Google searches, including the exact terms he’d given me and several variations. I tried Yahoo, too. None of the searches yielded my picture anywhere near the top of the results. (I didn’t try a search in Russian or on non-English search engines.)

He continued, “Then my Qatar pipeline story blew up because it is true. I had no idea you were Tim Samples, and I had no intent of somehow dragging you into my social media world. Thanks for being cool. I bet we would have a lot in common actually.”

No idea I was Tim Samples? Anyone with an internet connection could have figured that out—in fact, many people did. The bullshit was piling up fast. Morenco went on, “Yeah, I was actually super horrified when I saw that you were an American prof. and on Twitter. I specifically searched a different continent because I thought it would be untraceable.”

I remained tense, but was breathing easier now, relieved that he was responsive and didn’t seem to want a fight over my identity. Still, I didn’t know who I was dealing with or how they might retaliate against me. “What are your thoughts on the Hector account?” he asked. This time it was me ducking the question. Instead of telling him what I really thought, I changed the subject to his day job. He had recently tweeted about trial prep, which implied that he practiced law as a litigator.

“Yeah, another reason I have to remain anonymous,” he replied. “I work at Skadden. Can’t have my colleagues running around reading my highly political twitter blog.”

The more Morenco said, the more his story crumbled. He claimed to be in Palo Alto, California. And now he was claiming to be employed at Skadden—a large, prestigious American law firm. Skadden does indeed have an office in Palo Alto. But the spelling errors, intellectual laziness, and carelessness in choosing my university portrait all seemed to puncture his cover. Perhaps the greatest giveaway was the frequency of his posting. I have yet to meet a top attorney who has enough spare time to manufacture tens of thousands of disinformation tweets for months on end.



WHY WOULD MORENCO PUT EFFORT into a cordial reply and apology? It was just days before the election—a crucial moment for the Russian interference campaign. He had work to do and a lot of momentum behind the account. Perhaps he feared that I would escalate my concern with Twitter or law enforcement, which would put his profile, and maybe others like it, in danger.

“Thanks for understanding,” he wrote. “I appreciate it, and wish you all the best.” He added, “DM me anytime.” Oddly, I felt better after our conversation. It was still unsettling and confusing, but he voluntarily switched the avatar and didn’t seem to be looking for a fight.

The next day, Morenco sent me a message. He had again switched his avatar, this time to an image of Justice Antonin Scalia, who had died several months earlier. “Tim, found a new avi,” he wrote. “Pretty sure this guy won’t be on twitter, LOL.”

My encounter was far from the worst-case scenario. Abuse of platforms like Twitter has raised existential questions for social media companies about corporate and civic responsibility. To what extent should they intervene to minimize false news or to protect the democratic process? Russia, intent on sowing discord, has seen that, the more polarized America becomes, the more vulnerable Americans are to disinformation. When an election is at stake, there can be no room for political squabbling. In a statement that accompanied the hacking indictment of twelve Russian intelligence officers, Rod Rosenstein, the Deputy Attorney General, said, “When we confront foreign interference in American elections, it is important for us to avoid thinking politically, as Republicans and Democrats, and instead to think patriotically, as Americans.” He added, “So long as we are united in our commitment to the shared values enshrined in the Constitution, they will not succeed.”

I came out relatively unscathed. I had just enough public presence to pressure Morenco into changing the avatar and my identity wasn’t completely corrupted. Morenco’s Twitter handle was deactivated in early 2018, along with a number of other suspicious accounts, though it was quickly reclaimed by another suspicious user. The new account has a generic patriotic icon and marketing for a Swiss watch that is for sale only as a pre-order through a crowdfunding website. Recently, I discovered a Hector Morenco Facebook profile and a Pinterest account. My face wasn’t on those. But today, if you punch Hector Morenco into a Google image search, you’ll find me smiling in the first result.

ICYMI: Cuts at the Daily News highlight a local news crisis

Tim Samples is an Assistant Professor of Legal Studies for the Terry College of Business at the University of Georgia. His research focuses primarily on the legal dimensions of interactions between sovereign governments and international markets.