Twitter released multiple datasets with Tweets by Russian (IRA) and Iranian accounts. blog.twitter.com/official/en_us…
I just downloaded the Tweets (about.twitter.com/en_us/values/e…) and will add my findings in this thread. My focus is Europe and Germany.
/1
I just downloaded the Tweets (about.twitter.com/en_us/values/e…) and will add my findings in this thread. My focus is Europe and Germany.
/1
This is work in progress. I make errors. There is no editor who checks my Tweets. Feel free to ask questions. /2
@DFRLab got the data upfront.
Thread and article medium.com/dfrlab/trolltr….
Their conclusion: Little to no impact. /3
Thread and article medium.com/dfrlab/trolltr….
Their conclusion: Little to no impact. /3
@DFRLab 99 332 Tweets are German.
They were published by 1 058 different accounts.
Twitter anonymized all accounts with less than 5k followers.
I think I have seen 'erdollum' before. Will have to go through my older analyses. /4
They were published by 1 058 different accounts.
Twitter anonymized all accounts with less than 5k followers.
I think I have seen 'erdollum' before. Will have to go through my older analyses. /4
@DFRLab @ChrisStoecker The other accounts with more than 5k followers have only few German Tweets. /6
@DFRLab @ChrisStoecker Tweets by erdollum got embedded by several newspapers.
The account seems to have been fast with tweeting images for breaking news. Newspapers like to embed Tweets because they have to worry less about copyright. /7
The account seems to have been fast with tweeting images for breaking news. Newspapers like to embed Tweets because they have to worry less about copyright. /7
@DFRLab @ChrisStoecker @europhil07 already stumbled across the account when he analyzed the FiveThirtyEight dataset. With 82k German Tweets, it only contained slightly less than this dataset. /8
@DFRLab @ChrisStoecker @europhil07 Wordcloud including Retweets (hence the big RT), without common German words. /9
@DFRLab @ChrisStoecker @europhil07 Most Tweets were published in 2017. And they didn't increase slowly. With January 2017 the jumped from 450 4 000 Tweets per month. Volume increased until September with nearly 15 000 Tweets. /10
What happened in September? German federal election. On 24.09.2017. Volume slowed down afterwards and nearly stopped on 21.10.2017. I don't remember if Twitter intervened at that point. /11
Most retweeted Tweets of September 2017.
- Nearly all Tweets have Hashtags
- Typical far right topics
- Some have bad grammar
/12
- Nearly all Tweets have Hashtags
- Typical far right topics
- Some have bad grammar
/12
Back to all German Tweets. The majority was published through @twibbleio. A tool to auto-post content from various content sources.
Basics of lazy marketing automation. Makes the account look active. Can we find patterns, when we look at what kind of content was posted? /13
Basics of lazy marketing automation. Makes the account look active. Can we find patterns, when we look at what kind of content was posted? /13
@twibbleio Some accounts auto-tweeted the headline of articles with its image and the URL. Up to three times on the same account. Spammy and boring. /14
@twibbleio Replies were mostly written through the Twitter Web Client (which could be scripted, but I doubt it).
Let's look through the replies of the more active accounts. /15
Let's look through the replies of the more active accounts. /15
@twibbleio One account tried to tell people that gay people love Trump. Same reply to different accounts with slightly changed wording.
Did Twitter notify those users that they were contacted by a suspicious account? /16
Did Twitter notify those users that they were contacted by a suspicious account? /16
@twibbleio A lot of accounts are obsessed with Hitler's book and it becoming popular online. All these Tweets were mis-categorized as German. /17
@twibbleio More accounts who repeated the same phrase over and over to different accounts. Probably reply-spam to the attention of the followers of those accounts.
Asking questions seems innocent and like they are actually interested. /18
Asking questions seems innocent and like they are actually interested. /18
@twibbleio Several accounts in support of Merkel. Sometimes there are non-copy-pasted Tweets in between. /19
@twibbleio This account showed a higher variety of Tweets than the other ones. Some mistakes like "Hauptzeile" instead of "Schlagzeile". Hints at a wrong (direct) translation of "headline". /20
@twibbleio Another recurring topic: Christianity. 208 Tweets contained the hashtag #WirSindChristen. /21
@twibbleio Some of the accounts with a higher variety, still use the recurring themes. /22
@twibbleio Another theme: Nato. Again with lots of questions. /23
@twibbleio One of the few hashtags that got at least some use from other accounts: #stopptTerror /24
Look what @raymserrato found in the FiveThirtyEight dataset: /25
@raymserrato None of the Tweets contains 'toxischeNarrative' or 'nichtMeinSpiegel'. Those two hashtags were used by Russian spam bots before the German federal election in 2017.
Article by @LcsWho based on my data for
@uebermedien: uebermedien.de/20286/wie-russ… /26
Article by @LcsWho based on my data for
@uebermedien: uebermedien.de/20286/wie-russ… /26
@raymserrato @LcsWho @uebermedien German Tweets: 99 332
Without RTs: 85 566
Without URLs: 11 740
Wordcloud of those 11 740 Tweets. /27
Without RTs: 85 566
Without URLs: 11 740
Wordcloud of those 11 740 Tweets. /27
@raymserrato @LcsWho @uebermedien These less-/non-automated Tweets show a different picture. Less than 50 German Tweets on most days.
Let's look at the burst days. /28
Let's look at the burst days. /28
@raymserrato @LcsWho @uebermedien 2016-07-21
487 Tweets
MerkelMussBleiben.
'erdollum' either doesn't understand what happens or wants others to believe that it doesn't understand it.
/34
487 Tweets
MerkelMussBleiben.
'erdollum' either doesn't understand what happens or wants others to believe that it doesn't understand it.
/34
@raymserrato @LcsWho @uebermedien 2016-09-01
Autumn start. Like your average marketing agency. But with a little bit of politics.
/36
Autumn start. Like your average marketing agency. But with a little bit of politics.
/36
@raymserrato @LcsWho @uebermedien 2017-07-17
116 Tweets.
After nearly a year of low volume, it's time for action. MerkelSuccess.
/37
116 Tweets.
After nearly a year of low volume, it's time for action. MerkelSuccess.
/37
@raymserrato @LcsWho @uebermedien 2017-09-24
127 Tweets.
Election day. Hard push for AfD.
127 is a ridiculously small number of Tweets. That's what a single more active account tweets within an hour of a TV discussion.
/38
127 Tweets.
Election day. Hard push for AfD.
127 is a ridiculously small number of Tweets. That's what a single more active account tweets within an hour of a TV discussion.
/38
@raymserrato @LcsWho @uebermedien What did we learn today?
- 100k Tweets sounds like a lot. But it isn't.
- 90% of the Tweets are fully automated Tweets of news articles to make the accounts look active and maybe attract followers.
- There were around 11 days of action.
/39
- 100k Tweets sounds like a lot. But it isn't.
- 90% of the Tweets are fully automated Tweets of news articles to make the accounts look active and maybe attract followers.
- There were around 11 days of action.
/39
- On these days the accounts tweeted around a specific topic. Often in combination with one or two hashtags.
- They use reply-spam to gain more visibility. (Replying to accounts with many followers.)
- They use questions to be less obvious.
/40
- They use reply-spam to gain more visibility. (Replying to accounts with many followers.)
- They use questions to be less obvious.
/40
- There were just 100 Accounts with more than 100 German Tweets. 236 with more than 10 German Tweets.
- Few of them gained a significant number of followers.
- When their Hashtags got traction, other accounts ridiculed them.
/41
- Few of them gained a significant number of followers.
- When their Hashtags got traction, other accounts ridiculed them.
/41
I still would like to know what's the story behind 'erdollum'. Some Tweets seem like it was the only account that interacted with the IRA accounts. The single user that got tricked. Or it was actually part of it.
Enough for today. Thanks for your attention.
/42
Enough for today. Thanks for your attention.
/42
@kearneymw is looking at the data as well. First peek: Comparison of how often Clinton an Trump were mentioned.
Has someone a graph of the general usage of the terms at that time?
/43
Has someone a graph of the general usage of the terms at that time?
/43
@kearneymw Threads by @noUpside and @NewKnowledgeAI looking how they grew their followers in the US by faking local media organizations.
/44
/44
@kearneymw @noUpside @NewKnowledgeAI Thread by
@conspirator0
about the news sources the accounts used.
/45
@conspirator0
about the news sources the accounts used.
/45
@kearneymw @noUpside @NewKnowledgeAI @conspirator0 Thread and article by @katestarbird with a deeper look at hashtags
/46
/46
@kearneymw @noUpside @NewKnowledgeAI @conspirator0 @katestarbird Today I try to figure out which accounts were targeted by the Russian IRA accounts.
Mention and Retweet Network of the German Tweets.
Position: ForceAtlas2 (Stronger Gravity, Gravity 0.1)
Color: Modularity Group (no edge weight influence)
/47
Mention and Retweet Network of the German Tweets.
Position: ForceAtlas2 (Stronger Gravity, Gravity 0.1)
Color: Modularity Group (no edge weight influence)
/47
You can see nearly 12k accounts 623 IRA accounts replied to, mentioned or retweeted.
There errors where IRA accounts interact with each others because I extracted the handles from the Tweet text which aren't obfuscated.
I just realized I didn't lowercase handles.
/47
There errors where IRA accounts interact with each others because I extracted the handles from the Tweet text which aren't obfuscated.
I just realized I didn't lowercase handles.
/47
The only cluster that seems to have something in common is the big green, orange, pink one in the middle. Big German media accounts in the center, smaller German accounts surrounding it.
To the right are mostly English accounts.
/48
To the right are mostly English accounts.
/48
Fixed the username capitalization issue.
/49
/49
The account on the top left (orange) mentioned 1 637 accounts and every single tweet is spam. Mis-categorized as German.
/50
/50
Top right (green) spammed 4 454 accounts.
That was boring. /51
That was boring. /51
Let's look at the green cluster on the left.
Again, no German Tweets.
/52
Again, no German Tweets.
/52
Brown cluster on the right. Not German Tweets either. /53
Pink cluster between center and left.
Retweets of German Tweets. Nearly all of them by far right accounts.
/54
Retweets of German Tweets. Nearly all of them by far right accounts.
/54
Finally, the center cluster. Three strongly connected clusters. Here are the accounts, the Russian IRA accounts interacted with the most.
For the second graph I removed accounts that had less than 3 RTs/Mentions/Replies and recalculated the positions. Size by in-degree. /55
For the second graph I removed accounts that had less than 3 RTs/Mentions/Replies and recalculated the positions. Size by in-degree. /55
@welt @tagesschau @SPIEGELONLINE @Tagesspiegel @redefaznet @StN_News @ntvde @zeitonline @abendblatt @wznewsline We already know how the Tweets looked like. Spam-replies to reach their followers and Retweets to appear like a normal account. /56
@welt @tagesschau @SPIEGELONLINE @Tagesspiegel @redefaznet @StN_News @ntvde @zeitonline @abendblatt @wznewsline They interacted with nearly every big German Twitter account. Media, journalists and politicians.
/57
/57
@welt @tagesschau @SPIEGELONLINE @Tagesspiegel @redefaznet @StN_News @ntvde @zeitonline @abendblatt @wznewsline Before I look at the global network, here is a article by @netzkolumnistin, @marcelpauly and @PatrickStotz, who looked at the German Tweets in the dataset as well:
spiegel.de/netzwelt/web/t… /58
spiegel.de/netzwelt/web/t… /58
@welt @tagesschau @SPIEGELONLINE @Tagesspiegel @redefaznet @StN_News @ntvde @zeitonline @abendblatt @wznewsline @netzkolumnistin @marcelpauly @PatrickStotz Until now I only looked at the German Tweets. The following graph shows all replies and mentions in the IRA dataset.
577 252 accounts, 712 033 mentions or replies. /59
577 252 accounts, 712 033 mentions or replies. /59
At the bottom are the hyper active accounts with big clouds of accounts they targeted exclusively. Between them are shared targets. I assume we will find the same mix of media, journalists and politicians at the center. /60
I was wrong. Most mentioned/replied to accounts are at the top. Maybe the bottom thing is a spam operation like the one we saw at top of the network of German Tweets. /61
Filtering out accounts with less than 5 interactions, there are 5 906 (1%) nodes left.
Recalculating Positions (ForceAtlas2) and adding colors (Modularity).
Will we be able to give the clusters names? /62
Recalculating Positions (ForceAtlas2) and adding colors (Modularity).
Will we be able to give the clusters names? /62
Rose cluster at the top left sounds rather Russian.
Why didn't I add the language data to the network? /63
Why didn't I add the language data to the network? /63
Longish, blue one right below on the left side is the German cluster I looked at before. /64
Dark green one on the right is NYC and health/nutrition focused. /65
I don't understand the brown cluster at the bottom. Group of accounts that often interact with each other. But their Tweets are near-gibberish. Maybe an machine generated text experiment to make a group of accounts look real. /66
Bottom left. Pink cluster. Russian Tweets. Many of the mentioned accounts are still live. Those accounts are inactive at the moment but were fully automated while active.
accountanalysis.lucahammer.com/Maksimoverypcor
accountanalysis.lucahammer.com/logvinovfihysfu
/67
accountanalysis.lucahammer.com/Maksimoverypcor
accountanalysis.lucahammer.com/logvinovfihysfu
/67
Small Arab cluster in pink, on the right side of the German one, in the middle of the connection between Russian and center cluster.
/68
/68
Light blue at in the middle, left. The not so real news outlets?
/69
/69
Red, middle, right. Political agitators? They interacted with various political Twitter accounts.
/70
/70
Light green, middle bottom. Conservative, trollish.
/71
/71
Other accounts at the center. Not sure if there is a common theme.
/72
/72
Zoom out. These are the different clusters I identified based on mentions/replies in the IRA Tweets dataset. /73
Using those labels to put them on the full graph of 577 252 accounts. /78
Which cluster is responsible for how many mentions/replies?
87% of all mentions/replies were posted by the big green cluster.
I have a hunch that many of them are regular spam. /79
87% of all mentions/replies were posted by the big green cluster.
I have a hunch that many of them are regular spam. /79
Just 7 accounts are responsible for 80% (571 713) of all mentions/replies.
What did they tweet? Weight loss spam. /80
What did they tweet? Weight loss spam. /80
Wow. 571 713 Twitter users were contacted by Russian IRA accounts.
With weight loss spam. /81
With weight loss spam. /81
Today I will work on some other stuff, but I will come back to this. If you come across an analysis by others, please send it to me (reply preferred, DM as alternative). Thank you. /82
Article by @parismartineau about the dataset. Researchers say it's too old and therefore can't be used to say something about current tactics. Featuring @3r1nG and @mentionmapp.
/via @MikeH_PR
/83
wired.com/story/twitters…
/via @MikeH_PR
/83
wired.com/story/twitters…
@thomasrdavidson tried some latent semantic analysis. I fear the automated Tweets of news headlines distorted the results. /84
Article by @katestarbird about the role of IRA accounts in the Black Lives Matter discourse. With a paper for further reading. /86
