“The magic of the internet is there is always another clue to find,” he said.
Mr. Nimmo speaks fluent Russian, French, German and Latvian — and is conversant in several other languages — teaching himself by buying books in the “Lord of the Rings” trilogy in languages he is trying to learn. That makes it easier for him to spot clues like mistakes a native Russian speaker makes when writing in English in disinformation posts.
The amount of disinformation has increased recently. In October, Mr. Nimmo’s team at Graphika explained how pro-China propaganda accounts targeted Hong Kong demonstrators. In November, he helped expose an operation that used fringe platforms to leak a sensitive British trade document before Britain’s general election. And in December, he analyzed Facebook’s first big takedown of fake accounts with profile pictures generated by artificial intelligence.
Most recently, he has investigated Iranian disinformation after the United States killed the head of Iran’s security machinery, Maj. Gen. Qassim Suleimani, last month. Mr. Nimmo is also tracing Russia-linked campaigns, including an effort to blame the United States for the downing of Ukraine International Airlines Flight 752, which Iran said it mistakenly shot down last month, killing 176 people.
This past week, after technical problems delayed the reporting of results from the Iowa caucuses, Mr. Nimmo was on alert for disinformation. There was little, he said, and he mainly found gleeful trolling from Republican supporters and right-wing groups.
Mr. Nimmo has sometimes made mistakes in identifying culprits. In 2018, he pinpointed a number of Twitter accounts as “Russian trolls,” when one of them was a British citizen sympathetic to Russia.
One recent evening, he started work at 7, chasing leads on Iranian disinformation related to the killing of General Suleimani. One suspicious Twitter account provided clues that led to various YouTube videos. From there, Mr. Nimmo found links to Facebook and Instagram pages. After a few hours, he had traced how memes from a suspicious pro-government Iranian website had traveled elsewhere on the web.
By the time Mr. Nimmo went to bed after 2 a.m., he had more than 50 tabs open on his browser, but no definitive evidence of an Iranian government campaign.