Thread by @conspirator0

Let's take a look at Twitter bot/sockpuppet activity related to the recent murder of Jamal Khashoggi. Source dataset is 70K accounts with English tweets mentioning Khashoggi between October 18th and 20th, 2018. We'll review two sets of accounts.

First, we took a sample of 1000 accounts and checked for 24/7 activity and use of known automation services. 84 accounts (8.4%) were flagged by this test (average across datasets we've analyzed is ~3%).

Next, there are 794 accounts in the Khashoggi dataset with randomized 15-character names. 75 accounts in this set flag the previously-mentioned automation test, with the caveat that many have too few tweets to perform it.

Here are some statistics on the 794 accounts with random names. The percentages of accounts with default pics, few tweets, low follower counts, and recent creation dates are all unusually high.

The activity for this set of randomly-named accounts is negligible until a few days ago. If they are an organized operation, it's being operated 24/7. The recentness suggests a coordinated campaign related to current events.

Let's compare the two sets of accounts. First, they differ starkly in terms of language - most of the tweets from the sample of automated accounts are in English, whereas the randomly-named accounts primarily tweet in Arabic (though Khashoggi tweets are in English).

Finally, here's a comparison of the apps/services used by both groups to post the tweets. The demonstrably automated accounts mostly use services such as IFTTT, in contrast to the randomly-named ones which largely post via smartphone apps (although still possibly automated).

Conclusions about the two suspicious sets of accounts with Khashoggi tweets:

1) There is an unusually high percentage of automated accounts.
2) There is a set of very similary oddly-named accounts that are likely to be sockpuppets, whether or not they are bots.