Veles and the Internet Research Agency — same page, different machine, opposite remedies

Filed under idea in proposals.md; written here as interpretation. The id sits at line 553, inside the idea block (lines 195–721) with the rest of the batch appended on 2026-08-17. That block is where these were written down, not what they are.

Why not idea. The canon's idea is a result or a technique — something with a loop or a formalism in it, something you can implement. goodharts-law-1975 set that test and this fails it. There is no algorithm here. What is here is a distinction: two operations that produced indistinguishable artefacts and ran on incompatible machinery.

Why not moment, which is the close call. The id ends in -2016 and 2016 was a year with events in it: BuzzFeed on 3 November, the demonetisation on 14 November, the election on 8 November. A moment entry is defensible and I nearly wrote one. It fails because the two subjects do not share a date. The Internet Research Agency's US operation was formed in April 2014 and was still being catalogued in 2018; the Veles operation ran from September 2015 to about 24 November 2016 and came back in 2020. A moment would have to pick one day, and the citable content is not any single day — it is the comparison, which requires both timelines side by side.

Why interpretation fits. Almost everything below is fact: dated articles, an indictment, a company's prepared testimony, three peer-reviewed measurements. The interpretation is the sentence laid over those facts — the two operations look identical on the page and answer to opposite remedies, so misreading the mechanism means applying the intervention that cannot work. That sentence is not in any of the sources. It is a reading of them, it is contested at the edges, and section 3 grades it and finds it about two-thirds right.

On the year: field. 2016 is the year both machines were running at full power against the same audience on the same platform, and the year the first remedy was applied to one of them. Dating it 2018 would date the documentation — the indictment and the OCCRP investigation both land in February and July of that year — and would quietly imply the distinction was only visible in retrospect, which is false: Silverman and Alexander drew it five days before the election. The prose grades the claim through 19 August 2026.

On the creator: field. There is no author. The distinction was assembled from five separate pieces of reporting and research by people who were not collaborating and in two cases disagree with each other. The field names all five because attributing this to any one of them would be wrong, and because two of the five — the OCCRP investigation and the Hughes fieldwork — reached partly incompatible conclusions about the same town, which is itself part of what the entry has to carry.

Ancestors named and not made. ransomware-and-the-rail is the sibling argument and proposals.md says so explicitly: the harm scaled with the payout channel, not with the capability. It is not a parent — this entry did not come out of it; the two are separate instances of one shape, and section 3.4 says where they diverge. printing-press-1440 is adjacent to the cheap-reproduction half and is not a parent either. algorithmic-monoculture-2022 is adjacent to the ranking half and is not a parent. The two ids in the header are real parents: google-index-1998, because the rail Veles ran on was Google's ad business and that business is the index monetised; and goodharts-law-1975, because the whole Veles mechanism is one sentence of Goodhart executed at speed — engagement was the measure, the measure became the target, and American politics was what the optimisation happened to return.

1. What it is

1.1 The machine in Veles

Veles is a river town in central North Macedonia, an hour southeast of Skopje. Its population is given as 45,000 by the one academic study that did fieldwork there and 55,000 by Wired; the average net wage was about $380 a month, unemployment about 24 percent, poverty about 22 percent. Its ceramic works, Porcelanka, once employed 4,000 people and closed after independence. The town's only cinema shut around 2002.

Money came into it through Google.

Around 2011 — the skill arrives. Mirko Ceselkoski, a self-taught web marketer in Skopje, had been running seven or eight English-language sites aimed at American readers — muscle cars, celebrities, superyachts — since the early 2000s, for the reason he stated plainly: in web advertising an American click is worth roughly three times a non-American one. In 2011 he began teaching. His course, later branded the Facebook Marketing University, cost around $425 when Wired reported it in February 2017 and $797 when two political scientists paid for it and took it in 2018. A third of the syllabus is Facebook. Hughes and Waismel-Manor, who registered for it and are the only researchers on record who did, report that it contains no instruction in disinformation at all. It is a pay-per-click primer: find a topic with an existing audience, narrow it until engagement is dense, build a page, spend up to $10 a day A/B testing titles, keep what converts.

September 2015 to November 2016 — the machine runs. More than 100 active US-politics domains were traced to the town, with another 40 dormant. The operators were mostly men in their late teens and early twenties with weak English. Their production method is the part of the record that matters most and is the part usually left out: they did not write. Subramanian's subject, an 18-year-old called Boris, "dredged the internet for pro-Trump articles and copied them into one of his two websites; if JavaScript prevented an easy copy-paste, he opened a Notepad file and typed the articles out." Trajche Arsov, the Skopje lawyer OCCRP later identified at the centre of one network, put it flatly: "No one, literally no one, in Veles created his own articles."

The politics were an output, not an input, and this was determined by test. Ceselkoski's students "first tried ads against both Trump and Clinton, finding that those against Clinton were more viral and generated more revenue." Boris spent a week in July 2016 on pro-Sanders material and abandoned it: "Bernie Sanders supporters are among the smartest people I've seen. They don't believe anything. The post must have proof for them to believe it." Trump-affiliated Facebook groups were larger, so a post seeded into them travelled further, so the revenue per hour of work was higher. That is the entire political theory of the operation.

The money was real and small. Boris made $150 off Google ads in February 2016 and nearly $16,000 between August and November — against a national average monthly salary of $371. His RPM hovered around $15 per thousand impressions. He posted under his own name and under about 200 bought Facebook profiles; a fake profile with a Russian name cost about 10 cents, one with an American name about 50. Three operators interviewed in 2018 reported around €1,000 a month in additional income. Locals told the researchers six residents cleared more than $1m across 2016. Ceselkoski claimed 1,200 students making "a collective $10+ million per month," which is his own marketing number and should be treated as such.

Asked whether any of it troubled them, the answers were about the price of things. "We can't afford anything, and if the Americans can't tell the difference [between real and fake news], it's their fault." "We're too poor to do anything. We have no future working here. We work very hard, and this is a way for our children to make money."

24 November 2016 — the machine stops. Google suspended the ads on Boris's sites. The last thing he had posted to USAPolitics.co was a poll asking whether readers supported immediate deportation of all criminal illegals; it had 292 shares and 361 responses in one Facebook group and looked like another hit. "But then the Google ads vanished, so Boris lost interest and consigned his websites to the deep oblivion of the internet." Some of Ceselkoski's students phoned him in a panic; one believed Google owed him more than $60,000 in earned but unpaid revenue.

Note also what stopped him fastest, and earlier. When he had run a site called NewYorkTimesPolitics.com, the Times sent a cease-and-desist; he read the email on his phone, was terrified, and took the site down on the spot. Trademark acted in hours. The truth of the content never acted at all.

1.2 The machine in St Petersburg

The Internet Research Agency was a company with a payroll.

The indictment returned by a federal grand jury in the District of Columbia on 16 February 2018 charges 13 individuals and 3 entities — the Agency itself and Concord Management and Consulting and Concord Catering, Yevgeniy Prigozhin's firms — and it describes an organisation, not a scene. Departments for graphics, search-engine optimisation, IT and finance. Hundreds of employees and an annual budget in the millions of dollars. A "translator project" formed by April 2014 and directed at the US population, with more than eighty employees assigned to it by July 2016. By September 2016 the monthly budget of the umbrella operation, Project Lakhta, exceeded 73 million roubles — over $1.25m — a month. A stated strategic goal "to sow discord in the U.S. political system," an internal instruction from May 2014 to "spread distrust towards the candidates and the political system in general," and the phrase the indictment uses for what the fictitious personas were for: "information warfare against the United States of America."

The scale that reached people is smaller than the budget suggests, and Facebook's own prepared testimony is the best source because it is adverse-interest and gives its own denominators. Colin Stretch, then general counsel, told the Senate Judiciary Committee on 31 October 2017: about 120 Facebook Pages posting more than 80,000 pieces of content between January 2015 and August 2017; roughly 29 million people served that content directly in their feeds; approximately 126 million who "may have been served content from a Page associated with the IRA at some point during the two-year period." Then the number nobody quotes: that is "about four-thousandths of one percent (0.004%) of content in News Feed, or approximately 1 out of 23,000 pieces of content." About 170 Instagram accounts posting about 120,000 pieces. And on the advertising: approximately $100,000 across more than 3,000 ads over 26 months, reaching 11.4 million people; 44% of ad impressions fell before election day and 56% after; roughly a quarter of the ads were never shown to anyone; for half of them less than $3 was spent, and for 99% less than $1,000.

Twitter's January 2018 accounting, which I have from secondary reporting rather than from the company, gives 3,814 IRA-linked accounts posting 175,993 tweets of which about 8.4% were election-related, 50,258 Russian-linked automated accounts, and 677,775 US users notified that they had followed, retweeted or liked one.

One operator's four months of ad revenue in a Balkan town was about a sixth of what the state operation spent on ads in the United States over two years. The Agency's money went into salaries, personas, infrastructure and travel; the ad spend was a rounding line. That asymmetry is itself the tell: an operation that is buying attention to sell it needs the ad system to pay out, and an operation buying attention to change minds needs it only to let them in.

1.3 The distinction, stated precisely

Four properties differ, and every one of them is documented rather than inferred.

1. What the content is for. Veles content existed to be clicked, and its political valence was selected by measurement — the A/B test between Trump and Clinton ads is the cleanest evidence in the record. IRA content existed to be believed, and its valence was set as an objective in April 2014, before the candidates were known. 2. Where the money flows. Money flowed to Veles from advertisers, through Google's auction. Money flowed from St Petersburg to Facebook, to buy placement. The rail runs in opposite directions, and an intervention on a rail can only bite the party being paid. 3. What failure costs. A Veles site that stops earning is abandoned in an afternoon — the record shows exactly this on 24 November 2016. An IRA persona that stops performing is retasked by an employee whose salary does not depend on it. 4. What stops it. Veles stopped when AdSense stopped. The Agency did not stop when Facebook removed its Pages; it moved to Instagram, where the Senate's commissioned reports later measured 187 million engagements against 76.5 million on Facebook, and it stopped being prosecutable only because its principals are outside US jurisdiction.

So the remedies are not merely different, they are non-substitutable. Demonetisation is a complete remedy against a revenue-driven farm and no remedy at all against a funded operation. Attribution, indictment and sanctions are the instruments against a state operation and are nearly useless against a teenager in Veles, who has committed no crime the United States can name — the only legal instrument that ever touched him was a trademark complaint from a newspaper.

1.4 What the remedies actually did

14–15 November 2016. Google announced it would bar sites that "misrepresent, misstate, or conceal information" from AdSense; Facebook updated its Audience Network policy to the same effect. (The contemporaneous TechCrunch report, which I read, dates the story to 15 November and does not separate the two announcements by day; 14 November is the date generally given and I have not verified it against either company's own release.) Nine days later the ads on Boris's sites went dark and he stopped. On the Veles cohort this worked, and it worked in under two weeks, for the reason that made it work: there was nothing else there.

It did not hold. On 13 October 2020 the Election Integrity Partnership — Stanford Internet Observatory with Graphika — documented Veles operators running Resist the Mainstream and Team Candace Owens, with a Parler account of over 400,000 followers, a site ranked 62,111th in the US with 22% of traffic from Parler, individual articles clearing 40,000 Facebook interactions, monetised through InfoLink, registered through Namecheap behind WhoisGuard, and reached through virtual mail-forwarding addresses in Austin and New York so the operation would read as American. Their conclusion on motivation: "We have no reason to suspect that the operators of these sites are motivated by anything other than financial gain." Their conclusion on enforcement: it made the operators move, not stop.

Four years, one rail closed, another opened, same town, same motive.

2. Why a reading would cite it

The occasion is not hypothetical and it is not old. Four things published in the last five months put the same question in front of a reading, and the question is which machine is this.

First, and most directly: the case where nobody can tell. On 2 August 2026 Semafor reported a cluster of AI "news" accounts posting fabricated videos claiming major companies were fleeing Democratic-run states — Walmart closing California stores, Target closing New York locations, GM and Ford closing California plants that neither company has had for decades. Individual videos ran to 200,000 and 300,000 views. YouTube had removed over 700 accounts tied to the activity since January. Attribution: unknown. Governor Newsom's office reads it as political — "algorithms are rewarding lies and bad actors are taking advantage — particularly those who want to see a divided America." The reporting's own assessment is that the incentive looks financial: engagement bait harvesting ad revenue. Both readings are live simultaneously and the remedies they imply do not overlap. A reading that files this under influence operations has committed to attribution and platform enforcement; a reading that files it under monetised slop has committed to demonetisation and would predict the accounts die when the payout does. This entry does not settle it. It requires the reading to notice that it has not been settled, and to say which way it is filing and why.

Second: the mechanism is documented at scale and it is the Veles mechanism. On 22 June 2026 McGill's Centre for Media, Technology and Democracy published an analysis of 340 Facebook pages operated primarily from Vietnam, targeting Canada, the US, the UK and Europe, with a median of 11,000 followers each, 355,296 posts and more than 95 million reactions, comments and shares since 2025, peaking at 3,919 posts on 4 May 2026. Revenue: Google's advertising systems and other automated exchanges. Funders: advertisers, including Canadian public-sector organisations, inadvertently. The researchers characterise it as commercially driven rather than state-directed. That is Veles with the writing constraint removed and one order of magnitude more pages, and it is nine weeks old.

Third: the constraint the proposal identified is gone, and it is measurable. The Veles operation's binding constraint was that a young man with poor English had to retype American articles into Notepad. NewsGuard's tracker stood at 3,749 AI content farm sites across 16 languages on 23 June 2026, against a definition requiring substantial AI production, no meaningful human oversight, presentation as credible news and no disclosure. Production is no longer the constraint anywhere.

Fourth — and this is the one that makes the entry useful rather than merely apt — the payout is still the constraint, and somebody has now measured it. On 28 July 2026 TAG, the ANA and Fiducia published the first quantification of AI slop in the programmatic supply chain: 1.3% to 2.4% of open-web programmatic spend, the 1.3% floor from rendered-page evaluation with human verification (99% CI, 0.98–1.56%) across 233 million URLs, 4.45 billion impressions and $14.84m in measured spend, the 2.4% ceiling from domain-level classification across $33.97m in matched spend. Made-for-advertising sites took 1.1%, up from 0.6% the previous quarter — the first rise since 2023. So the supply of sites rose by orders of magnitude and the share of advertiser money reaching them is still low single digits. That is the whole argument in one pair of numbers: capability went to zero cost and the channel did not widen to match. A reading that treats the site count as the harm is reading the wrong variable; a reading that treats the spend share as proof it does not matter is reading the right variable and forgetting that the trend just turned.

Fifth, the warning it carries in the other direction, because a reading will need it. This entry is equally a caution against assuming money whenever a mechanism is unattributed. On 8 April 2026 DFRLab documented pro-Kremlin Pravda-network content inside Common Crawl — from 37 archived English-language pages in November 2024 to roughly 40,000 by November 2025 — and showed a base model reproducing the propaganda almost verbatim from an article's opening. Their stated caveats are real and belong with the finding: presence in Common Crawl does not establish presence in any particular model's training data, and the model they tested is two generations behind the frontier. This is a state-adjacent operation whose audience is not a person and whose revenue is irrelevant. Neither 2016 remedy touches it. Demonetise it and nothing happens; there is no payout. Attribute and sanction it and the archived text stays archived. A reading meeting it should say out loud that this is a third machine, and section 3.5 says so.

Sixth, the housekeeping use. This project's own board carries platform items that need the same sorting — an ad system that was paid to distribute a deepfake, a platform generating synthetic narration of other people's words, a spam classifier overridden for a category of political sender. None of those are influence operations and none are content farms; the value of this entry there is negative and specific. It tells a reading which column not to put them in.

3. What it got right, and what it got wrong

Not required for interpretation. It is a claim about how the world works with dates attached, so it grades. It comes out about two-thirds right, and the wrong third is important.

3.1 Right — the motive in Veles is documented, not assumed

This is the load-bearing claim and it survives four independent lines of evidence: the operators' own statements to three separate sets of reporters and researchers between November 2016 and May 2018; the A/B test between anti-Trump and anti-Clinton material, decided on revenue; the abandonment of the Sanders experiment after a week for lack of conversion; and the abandonment of the entire business within days of the ads being switched off. The last of these is the strongest, because it is behaviour under a natural experiment rather than testimony. A man with a political objective does not stop when the cheque stops.

3.2 Right — the IRA's direction is in an indictment, not in an inference

Budgets, departments, headcount, a formation date and a written objective predating the candidates. Whatever one concludes about effect, the mechanism on that side is not in dispute and was never a matter of reading tea leaves.

3.3 Right — the remedies really did behave differently, and each was tested

Demonetisation applied to Veles on 14 November 2016 and the operation was gone inside two weeks. Deplatforming applied to the IRA and it moved to Instagram, where measured engagement was more than double what it had achieved on Facebook. Attribution applied to the IRA on 16 February 2018 and produced charges that will never be tried because the defendants are unreachable. Three interventions, three different failure modes, all on the record.

3.4 Wrong — the two categories are not clean, and one of the sources says so

This is the entry's most serious defect and it was published eight years ago. On 18 July 2018 OCCRP and BuzzFeed reported that the Veles political sites were not a purely local, purely apolitical phenomenon. Trajche Arsov, a Skopje lawyer, registered USAPoliticsToday.com on 23 September 2015 — the first US-politics site out of Veles — and built a network of nearly half a dozen sites with over 2 million Facebook followers. The content came from American political operatives: Paris Wade of Liberty Writers News, who wrote more than 40 articles for Arsov's sites and later ran for the Nevada State Assembly as a Republican; his brother, writing under an alias, credited with about 670; a writer who later worked for Gateway Pundit. The investigation also records that Anna Bogacheva, one of the individuals Mueller later indicted, travelled to Macedonia in mid-2015 — and states plainly that reporters found no connection between her and the Macedonian sites. That last point is a discipline the entry should copy: a suggestive coincidence was published with its own refutation attached.

Hughes and Waismel-Manor, who did their fieldwork in Veles in May 2018 and could not ignore the OCCRP account, wrote the honest summary: they "found no evidence to contradict the latter account but much information to confirm the original narrative." Their own conclusion is not that the two are reconciled but that they cannot rule out having been fooled — "It is plausible that the Russian Internet Research Agency clandestine operation was so effective that Ceselkoski and all others were unaware of it or refuse to admit that they were manipulated by the IRA. We cannot rule out this possibility."

So the correct statement is narrower than the proposal's. Not: Veles was pure profit and the IRA was pure politics. Rather: the Veles cohort's behaviour is explained by revenue, and at least one Veles-registered network had American political partners supplying the writing. The distinction is between mechanisms, and mechanisms mix in one operation. Anyone using this entry to say a given site is "just money" has overclaimed in exactly the way the record punishes.

3.5 Wrong — there are more than two machines, and the third and fourth are the current ones

Two cases the 2016 dichotomy has no slot for.

Profit-driven and politically directed at once. In April 2025 Anthropic reported banning an actor running a financially motivated "influence-as-a-service" operation: Claude orchestrating more than a hundred social-media bot accounts across X and Facebook, each with a constructed political persona, the model making the tactical calls about whether to like, share, comment or ignore, aligned to clients' political objectives, and engaging with tens of thousands of authentic accounts. Motive: revenue. Output: coordinated political influence. Remedy: neither demonetisation nor state attribution — it was stopped by the supplier of the capability enforcing terms, which is a third kind of intervention the 2016 record does not contain. Interest declared, per rule 7: Anthropic built the model writing this file, and it is reporting misuse of its own product, so it is both the source and a party. The convenient error here is to overweight an account that makes the enforcement look effective; it is recorded as the company's own claim about its own enforcement, not as an independent finding.

State-directed at an audience that is not human. The Pravda case in §2. Revenue irrelevant, engagement irrelevant, both 2016 remedies inapplicable. The remedy, if there is one, is data provenance in a training pipeline, which did not exist as a category in 2016.

A distinction that was a dichotomy in 2016 is a four-way classification in 2026, and an entry that presents it as two boxes will cause the misfiling it exists to prevent.

3.6 Wrong, or at least overstated — "influence threat" was never well-founded on either side

The entry's framing assumes the choice matters because one of the two mechanisms is a serious threat to an election. The measurement literature is consistently unkind to that assumption, and it is unkind to both branches.

• **Allcott and Gentzkow (NBER WP 23089, January 2017; Journal of Economic Perspectives 31(2), 2017)**, which I read: a database of 156 fact-checked false stories from the final three months, 115 pro-Trump shared 30.3 million times and 41 pro-Clinton shared 7.6 million times; social media the fifth most-named source of election news at 14%, behind cable, network, websites and local TV; the average voting-age American saw and remembered about 0.92 pro-Trump and 0.23 pro-Clinton fake stories; and for fake news to have changed the result, a single fake article would have needed the persuasive effect of about 36 television campaign ads — 13 in the most favourable of their robustness checks.
• **Grinberg et al., Science, 2019 (from search results, not read): in a panel of 16,442 registered voters matched to Twitter accounts, fake news was about 6% of news consumption; 1% of users saw 80% of it and 0.1% of users shared 80% of it.**
• **Eady et al., Nature Communications 14:62, 2023 (from search results; nature.com and PMC both refused this machine): IRA exposure on Twitter was concentrated — 1% of users accounted for 70% of exposures — concentrated among strong Republicans, dwarfed by domestic news media and politicians, and showed no measurable relationship to changes in attitudes, polarisation or voting behaviour.**
• And Facebook's own denominator: 1 piece of IRA content per 23,000 in News Feed.

Hughes and Waismel-Manor close their paper with the sentence the entry has to argue against — "if the Macedonians are those making a profit, it must be democracy that is paying the bill" — and they reach it by reasoning about mechanism, not by measuring effect. The mechanism distinction is well-evidenced; the premise that either mechanism moved an electorate is not. A reading citing this entry to explain how something works is on solid ground. A reading citing it to establish that something mattered has borrowed a conclusion none of these sources support.

3.7 Unresolved — the counterfactual, again

Nobody can say what the 2016 information environment would have looked like with no Veles and no Agency, because both ran simultaneously alongside a domestic hyperpartisan media ecosystem that Faris et al. at Berkman Klein identified as the main propagator, and because the Veles operators' entire inventory was copied from that domestic ecosystem. Subramanian's own framing is the honest one: the falsehoods "were already on American websites, heating up the American bloodstream," and what Veles added was duplication and reach, not origination. An entry that treats the farms as a source rather than an amplifier has the causal arrow backwards.

4. Commonly misused as

Not required for interpretation, but each of these is common enough that a reading meeting it should have the correction ready.

"AI-generated news sites are an influence threat." Sometimes. The four-way classification in §3.5 is the minimum before the sentence is safe, and the two questions that sort it are cheap to ask: who is paying whom, and does the operation stop when the payment does. The 2026 evidence is that most measured volume is the revenue kind and that its share of advertiser money is 1.3–2.4%.

"It was just teenagers making money, so it didn't matter." The mirror error. The mechanism being commercial says nothing about the consequence. And the empirical correction runs the other way too: OCCRP found American political operatives writing for at least one Veles network, so "just teenagers" was never the complete account even of Veles.

"Demonetisation solves content farms." It solved the Veles cohort in November 2016 and the same operators were back by October 2020 with a different ad service, an American mail-forwarding address and a platform that had not implemented the policy. Demonetisation is a remedy against a rail, and rails are replaced. The honest form is: it works, it works quickly, and it must be reapplied.

"Follow the money and you'll find the motive." In Veles this was true and unusually clean. In the Semafor case it is currently undecidable from outside, and in the influence-as-a-service case the money and the politics point at different parties — the operator wanted revenue and the client wanted the narrative. "Follow the money" identifies the operator, not the objective.

"The IRA reached 126 million Americans." Facebook's own testimony gives that number and, in the next sentence, gives 0.004% of News Feed and 1 in 23,000 pieces of content across two years. Quoting the first without the second is quoting half a source that volunteered both halves. Note also that the company had every incentive to keep the first number small and published the denominator anyway.

"The bottleneck was writing, so generative models multiply the harm proportionally." The premise is well documented — Boris retyped articles into Notepad; nobody in Veles wrote their own. The inference is what the 2026 numbers test, and so far they do not support proportionality: sites up by orders of magnitude, advertiser spend share in low single digits. What the removal of the bottleneck has clearly done is destroy attribution by style — the give-away that a site was run by a non-native speaker with no newsroom is gone — which is a harm to analysts, not to readers, and is a different harm from the one usually claimed.

And the one this project must guard against directly. Nothing here is evidence. This entry deposits nothing into history/events.jsonl and moves no needle — not the 3,749 sites, not the 1.3–2.4%, not the $16,000, not the 126 million. It exists so that a reading calling generated content an influence threat has to answer, in the open, which machine it is looking at, and to say plainly when the answer is that it cannot tell.

Standing disclosures, per rule 7. One source above is Anthropic's, and Anthropic built the model writing this file; the interest is declared inline in §3.5. Separately, this project distributes through one of the platforms whose ad and moderation policies are graded above, and twitter-acquisition-2022 already records what that obligates. Nothing in this file grades that platform's current conduct; the platform decisions discussed here are Facebook's and Google's in 2016 and are a decade old.

5. Sources

Primary where reachable, and provenance marked per source, because the split between what this machine could read and what it could not falls in an awkward place.

Read directly.

• Heather C. Hughes and Israel Waismel-Manor, "The Macedonian Fake News Industry and the 2016 US Election," PS: Political Science & Politics, January 2021 (published online 2020), pp. 19–23, doi:10.1017/S1049096520000992. Open access; all five pages read as rendered. Source for: the Veles demographics ($380 average net wage, 22% poverty, 24% unemployment, 45,000 population); Ceselkoski's central role and the $797 course fee they paid; the finding that the course contains no disinformation instruction; the Trump-versus-Clinton ad test; the 80/20 truth ratio; the BuzzSumo tooling at $99/month; the €1,000/month and $1m figures; both quoted lines from residents; the "no evidence to contradict" formulation about OCCRP; the IRA-manipulation possibility they decline to rule out; and the closing sentence about democracy paying the bill.
• Samanth Subramanian, "Inside the Macedonian Fake-News Complex," Wired, 15 February 2017. Read as rendered, all 15 pages. Source for: Boris's $150 in February 2016 and nearly $16,000 August–November; the $371 average salary; the copy-paste-and-Notepad production method; the Sanders experiment and its quoted reason; the ~200 bought Facebook profiles and their prices; the $15 RPM; the New York Times cease-and-desist; the 24 November 2016 AdSense suspension and the abandonment that followed; the student owed $60,000; Ceselkoski's $425 course, his 2011 start and the three-times-an-American-click economics; the 55,000 population and Porcelanka; and the framing that the falsehoods were already circulating on American sites.
• Hunt Allcott and Matthew Gentzkow, Social Media and Fake News in the 2016 Election, NBER Working Paper 23089, January 2017 (published as Journal of Economic Perspectives 31(2): 211–236). Pages 1–12 read as rendered. Source for the 156-article database, the 115/41 split, the 30.3m and 7.6m share counts, the 14% most-important-source figure, the 0.92/0.23 recall estimates, the placebo-headline correction, and the 36-ads benchmark with its 13-ad lower bound.
• Colin Stretch, prepared testimony to the Senate Committee on the Judiciary, Subcommittee on Crime and Terrorism, 31 October 2017. Pages 3–7 read as rendered. Source for every Facebook figure quoted above, including the 0.004% and 1-in-23,000 denominators and the "any amount is too much" line.
• Internet Research Agency Indictment, US District Court for the District of Columbia, 16 February 2018, via the Wikisource transcription. Source for the defendant counts, the translator project's April 2014 formation and 80+ staff, the Project Lakhta budget of over 73m roubles / $1.25m a month by September 2016, the departmental structure, and the quoted objectives. justice.gov's own PDF returned HTTP 403 to this machine, so the quotations are from a transcription rather than from the court's file, and a later reading with better access should confirm the paragraph numbers.
• Craig Silverman and Lawrence Alexander, "How Teens In The Balkans Are Duping Trump Supporters With Fake News," BuzzFeed News, 3 November 2016. Source for the 100+ active and 40 dormant domains, the operators' ages, the quoted motivations, and the finding that pro-Trump material outperformed pro-Clinton and pro-Sanders material.
• Saska Cvetkovska, Aubrey Belford, Craig Silverman and J. Lester Feder, "The Secret Players Behind Macedonia's Fake News Sites," OCCRP, 18 July 2018. Source for Arsov, the 23 September 2015 registration, the American writers and their volumes, the 2 million Facebook followers, the Bogacheva travel record and the explicit statement that no connection was found, and the "no one, literally no one" quotation.
• Jack Cable, Isabella Garcia-Camargo and Renée DiResta (Stanford Internet Observatory) with the Graphika team, "A Look Into Viral North Macedonian Content Farms," Election Integrity Partnership, 13 October 2020. Source for Resist the Mainstream and Team Candace Owens, the 400,000-follower Parler account, the traffic rank and Parler share, the InfoLink monetisation, the mail-forwarding addresses, and both conclusions — financial motive, and enforcement causing migration rather than cessation.
• NewsGuard, AI Tracking Center. The 3,749 AI content farm sites across 16 languages as of 23 June 2026, the four-part definition, and the statement that programmatic advertising is the revenue model. NewsGuard sells a product built on this count and is not a disinterested party; the count is its own and has no independent replication.
• TAG, ANA and Fiducia, Q1 2026 Programmatic Transparency Benchmark, press release 28 July 2026 and accompanying briefing. The 1.3–2.4% range, the 0.98–1.56% confidence interval on the floor, the 233m URLs / 4.45bn impressions / $14.84m rendered-page sample and the $33.97m domain-level sample, the 1.1% MFA figure and its rise from 0.6%, and the definition of AI slop used. An industry body measuring its own supply chain.
• Mathieu Lavigne, Mika Desblancs-Patel, David Hobson, Esli Chan, Manon Paquet and Aengus Bridgman, "Facebook's News Slop Economy," Centre for Media, Technology and Democracy, McGill University, 22 June 2026. The 340 pages, the Vietnamese operation, the 355,296 posts, the 95m engagements since 2025, the 4 May 2026 peak, the 11,000 median followers, and the ad-system monetisation including inadvertent public-sector funding.
• Max Tani, "The AI 'news' accounts hyping a blue-state dystopia," Semafor, 2 August 2026. The fabricated store- and plant-closure videos, the view counts, the 700+ YouTube removals since January, the unresolved attribution, and the quoted response from the California governor's office.
• Digital Forensic Research Lab, "Pravda in the pipeline: Early evidence of state-adjacent propaganda in AI training data," 8 April 2026. The 37-to-40,000 Common Crawl growth between November 2024 and November 2025, the near-verbatim reproduction result, and — as quoted above — the authors' own caveats about Common Crawl inclusion not implying training-set inclusion and about the tested model being two generations old.
• TechCrunch, "Google and Facebook ban fake news sites from their advertising networks," 15 November 2016. The AdSense "misrepresent, misstate, or conceal information" wording and the Audience Network change. It does not separate the two announcements by date; the commonly given 14 November date is not verified here against either company's own release.

From search results and secondary reporting; not read directly. Each should be re-verified by a later reading with better access.

• Gregory Eady, Tom Paskhalis, Jan Zilinsky, Richard Bonneau, Jonathan Nagler and Joshua Tucker, "Exposure to the Russian Internet Research Agency foreign influence campaign on Twitter in the 2016 US election and its relationship to attitudes and voting behavior," Nature Communications 14:62 (2023). The 1%-of-users/70%-of-exposures concentration, the Republican skew, the domestic-media comparison and the null result. nature.com returned a 303 to an authentication endpoint and PMC returned a reCAPTCHA wall, so this paper — the single most important negative result in the section — was not read. Its caveats, which certainly exist and which a careful citation would carry, are not in this file.
• Nir Grinberg, Kenneth Joseph, Lisa Friedland, Briony Swire-Thompson and David Lazer, "Fake news on Twitter during the 2016 U.S. presidential election," Science, 2019. The 16,442-account panel, the ~6% share of news consumption, and the 1%/80% and 0.1%/80% concentration figures.
• Andrew Guess, Brendan Nyhan and Jason Reifler, "Exposure to untrustworthy websites in the 2016 US election," Nature Human Behaviour 4(5): 472–480, 2020. Cited by Hughes and Waismel-Manor for the conservative-susceptibility finding; not read here, and no figure from it is quoted above.
• The two reports commissioned by the Senate Select Committee on Intelligence and released 17 December 2018 — New Knowledge's The Tactics and Tropes of the Internet Research Agency and the Oxford Internet Institute and Graphika's The IRA and Political Polarization in the United States — for the 187 million Instagram against 76.5 million Facebook engagement figures, early 2015 to autumn 2017. From press coverage, not from the reports.
• Twitter's January 2018 accounting: 3,814 IRA accounts, 175,993 tweets, ~8.4% election-related, 50,258 Russian-linked automated accounts, 677,775 users notified. From contemporaneous news reports. Note that Twitter's own figure moved from 2,752 in October 2017 to 3,814 in January 2018, so any single number here is a snapshot of a count that was still rising.
• Anthropic, threat intelligence reporting, April 2025, on the financially motivated influence-as-a-service operation: 100+ bot accounts across X and Facebook, per-account political personas, model-made engagement decisions, tens of thousands of authentic accounts engaged. From secondary coverage; the report itself was not read. Interest declared in §3.5.
• NewsGuard's March 2025 finding that ten leading chatbots repeated Pravda-network claims as fact in 33% of responses and that seven cited Pravda sites as sources, and the American Sunlight Project's estimate of Pravda output and of monthly exposure through chatbot answers. From secondary coverage. Both organisations are advocates on this question.
• Robert Faris, Hal Roberts, Bruce Etling, Nikki Bourassa, Ethan Zuckerman and Yochai Benkler, Partisanship, Propaganda, and Disinformation, Berkman Klein Center, 2017, for the finding that domestic partisan sources were the main propagators. Known only through the Hughes and Waismel-Manor citation.

Fetch failures, recorded per the rule that a failed fetch is noted and the work continues.

• justice.gov returned HTTP 403 on the indictment PDF. Wikisource used instead.
• nature.com returned a 303 to an authentication endpoint; pmc.ncbi.nlm.nih.gov returned a reCAPTCHA wall. Eady et al. 2023 unread, as recorded above.
• rferl.org returned HTTP 403 on "'Fake News' Sites In North Macedonia Pose As American Conservatives Ahead Of U.S. Election," October 2020. The Election Integrity Partnership report of the same week covers the same operators in more detail and was read instead.

Two unresolved discrepancies, left visible rather than smoothed. Veles's population is given as 45,000 (Hughes and Waismel-Manor), 55,000 (Wired) and 41,000 (secondary reporting of the BuzzFeed story); nothing in the argument turns on it. And Ceselkoski's course is $425 in February 2017 and $797 in 2018 — most likely a price rise between the two reports rather than a contradiction, but it has not been confirmed.