Thread by @carljackmiller

When we say Kyiv is winning the information war, far too often we only mean information spaces we inhabit.

Pulling apart the most obvious RU info op to date (as we did using semantic modelling), very clear it is targeting BRICS, Africa, Asia. Not the West really at all.

This is the kind of thing this network shares by the way. Mainly an amplification network pumping a small number of viral pro-invasion meme, largely around themes of western hypocrisy, NATO expansionism and BRICS solidarity,

These were the accounts receiving most inward amplification - the higher value accounts actually sending the virals. You'll see they, too, are spread across Asian and African languages + identities.

A slightly different rendering that should let you zoom in to see account locations better. V. linguistic concentrations especially with the pro-BJP/Hindi accounts, and also South Africa, connected with longer, looser tunnels of asian/indian accounts that tend to mix in English

Some of these clusters, like dark green, have accounts which are quite old. The blue cluster is different from all the others - almost no account creation and then BANG almost all accounts created very recently.

Clear across all of them is this: they all snapped into action across March 2nd-3rd. These are when the pro-invasion memes all trended.

There is difference in how much non-Russian messaging each cluster shares. 'Keywords' here are ones like 'Putin' and 'Ukraine'.

For anyone who wants to dive more into this network, i'll be sharing more info about it today.

Let's start where we left yesterday. Really the point of this network was to concentrate Retweets to a small number of pro-invasion memes/virals, marked on the map here.

The clusters are distinct from each other in other ways than language. The red, bright green and beige clusters send WAY more retweets than the others. avg. ratio is about 4:1, whereas orange is 0.5.

The accs in the middle of red/beige/green only send retweets. Prolly RT farms

Let's jump into the clusters. Disclaimer: I'm going to use real accounts as examples here. I'm not suggesting they're certainly bots or Russian info agents; just that behaviourally they are very similar to a network that - in its entirely - is extremely suspicious.

The reds look like this. A tight, dense pocket of pro-BJP, hindi-language accounts.

566 in total, sending 4M messages. The spammiest is my reading: highest retweet:tweet ratio of any cluster. Weren't bothered at all by Russia until March 2nd.

The blues are different from any other cluster. English language and very little in the way of clear locality or regional focus. The youngest accounts, 5M messages and almost all of it - from what I see - is pro-invasion messaging. Almost no followers.

A separate operation imo

Orange is a tunnel of accounts that kind of connect the Hindi-cluster to the SA cluster. 736 mainly using Urdu, Javanese, Nepali, Malay. Each one averages 3.4k messages, only has avg. 23 followers. Again, 'activates' in volume over March 2nd (anyone spotting the pattern?).

The yellow cluster is really interesting. Clearly South African, lots of pro-Zuma, BRICS-solidarity messaging. Highest number of original messages and avg. followers, many of these 1010 accounts are real imo

This is where the artificial campaign got the most organic take-up imo

There are some accounts in each of these networks that have been around for years, but each cluster has a similar profile: a lot of accounts were created very recently.

Check out blue, especially

The DARKGREENS are a linguistic cluster entirely unto themselves. 474 accounts using Urdu, Sindhi, Farsi: lots of pro Imran Khan/PTI messaging.

By far the highest (mean average) followers in this analysis: 3.5k. There are some very big, very visible accounts here.

In many ways, I've found VIOLET the hardest to characterise.

- The biggest cluster (1441)
- Easily the most messages (12M)
- Most messages per user (8.6k)
- 2nd highest followers per user (220)
- Oldest accs (avg. 2017)

Currently concerned with Nigerian fuel shortages.

This just leaves the BRIGHT GREENS. It looks like a tunnel cluster but isn't really; the majority of accounts are bunched up next to the Hindi-language pinks

These are Indian accounts too, but tend to use more English. 1314 in total sending 6.8M messages. Avg. only 18 followers

The point of doing this network mapping wasn't just to describe this particular campaign, but also discovery. We're now swinging towards the less researchable and probably more harmful activity across all the other social media platforms we can reach.

There's loads of us over at CASM working on social media research method.Special citation here to Chris Inskip, who did the semantic mapping using DistilRoberta - trained as a sentence similarity model. That's the topic of his PhD, which will be sensational when it's done.

People have asked for some more examples of the messaging. Whilst i don't like to amplify, it is important to show the rhetorical positioning that's being used here.

So there's a lot of media attention on this work, which is great. But i'd like to clarify two things:

(1) Does the data definitively point towards the Russian state? No, that's not what data science can do. Twitter has taken down some of the accounts for 'coordinated...

inauthentic behaviour',but exactly who that is becomes a judgement. Contextually, and in terms of the techniques likely used, my judgement is that it is a pro-Russian, pro-invasion operation;but that's my impression as a researcher who spends their time pulling apart these things

(2) Bots... are they all bots? We became interested in this exactly because of all the amazing research that pointed in inauthenticity:





medium.com/dfrlab/istandw…

isdglobal.org/digital_dispat…

Our work also uncovered some patterns you very rarely see with organic activity.

- A lot of accounts made on the day of the invasion
- High engagement from accs with no followers
- Substantial overlaps in sharing activity
- v. High retweet:tweet ratios

But again, there was a lot of research on this. And none of that can ever definitely say what's a bot and what isn't - they just notice suspicious patterns.

IMO there's some automation here. But also compromised accounts, human ones and some which flip back and forth

Our research wasn't primarily aimed at that question either. It was - on the basis of the research already looking at all of that, and on the basis of the takedowns that had happened - interested in the nature of these accounts and what they might say about strategy and targets

Hey there folks o/

If anyone is interested, here's a White Paper explaining a lot more of the methods and findings (not to mention nuances and caveats) underlying our research here.

casmtechnology.com/case-studies/d…