[Thread] 1/ As I said yesterday, today is another thread on what I believe to be another #Saudi-based bot network. I've identified approximately 3,500 bot accounts. These are separate from the 5000 strong bot network I identified yesterday. I believe the purpose is different
2/ First, @Buenen highlighted some suspicious activity on Twitter. Namely, accounts posting on the hashtag "something that you like about Saudi". Each of the accounts bizarrely had a few (4) letters of gibberish in English and were only posting the hashtag. 
@Buenen 4/ The reason for this claim about 'hiding' a hashtag is not unusual. Many in the region suspect one of the tactics to divide or pollute hashtags is to create rival trends that demote those that might be critical or problematic to regimes cc @khalidalbaih @iyad_elbaghdadi
@Buenen @khalidalbaih @iyad_elbaghdadi 5/ If we click on one of the accounts, tweeting on the hashtag "what you like about Saudi", and scroll down the timeline, we find something interesting. The account has been tweeting hashtags related to the attack at the park, but with extra letters. Garden with three 'ds', Malaz
@Buenen @khalidalbaih @iyad_elbaghdadi 6/ with three 'zs' etc. In short - words that are present in what seems like the legitimate hashtag "attack in al-Malaz". How many accounts are doing this, and are they real? Well let's dig a little deeper and look...
@Buenen @khalidalbaih @iyad_elbaghdadi 7/ My friend @abulkhaezuran at @citizenlab downloaded tweets with the phrase "#هجوووم" in. Meaning 'attaaaack" (see what I did there), the hashtag was being tweeted by a lot of the suspicious accounts seemingly polluting the "attack on al Malaz hashtag." This resulted in about
@Buenen @khalidalbaih @iyad_elbaghdadi @abulkhaezuran @citizenlab 8/ 24,000 accounts. Of all those accounts, there were very few apps being used to tweet from. Around 8. That itself is unusual. Far more unusual still is the fact 91% of those Tweets were sent using "Twitter Web App" from a mobile platform.
@Buenen @khalidalbaih @iyad_elbaghdadi @abulkhaezuran @citizenlab 9/ If we keep only those tweets sent from Twitter Web App, and look at the tweets, we can see they all seem to contain the peculiar repeated error of three or for letters in English. To make it easier to see, I've included a screen grab below where you can see the three letters
@Buenen @khalidalbaih @iyad_elbaghdadi @abulkhaezuran @citizenlab 10/ We can also see that the accounts tweeted in distinct periods. The below graph shows the accounts tweeting from specific platforms. The Blue/Green line is Twitter Web App (the one we are interested in). There are two spikes, one at 8.40 pm, the other at 10.20pm,
@Buenen @khalidalbaih @iyad_elbaghdadi @abulkhaezuran @citizenlab 11/ If we remove the duplicates from the suspicious account we are left with around 3,528 individual unique accounts. That's 3,528 accounts that are clearly being used to co-ordinate some form of trend manipulation. They've produced approximately 1,649,000 tweets between them
@Buenen @khalidalbaih @iyad_elbaghdadi @abulkhaezuran @citizenlab 12/ What is very bizarre and different about this crop, is that most of them weren't created in a short time frame - a usual indicator of bot accounts. While we see some spikes in account creation in Jan and Sept 2016, most of these accounts were created between 2012 and 2014.
@Buenen @khalidalbaih @iyad_elbaghdadi @abulkhaezuran @citizenlab 13/ Given the repeated errors in the tweets they are likely bots as opposed to sock puppets, but it would seem that given the spread of creation dates a lot of the accounts might have once belonged to real people. Alternatively, they've always been sketchy. It's hard to say
14/ I mean you can go back individual timelines for each account to see what else they have tweeted about. However accounts verify, some have only produced 16 tweets, the other hundreds. On one account I scrolled back and found they had been tweeting on a hashtag promoting the
15/ execution of Shia cleric Nimr al-Nimr. The suggestion to me is that it was a propaganda account back then too.
16/ So to sum up. We've identified about 3,500 bots. They could be marketing bots, or political bots, or both. Their purpose could be to drown out problematic trends with apolitical trends or gibberish. In short, they form part of the social media censorship apparatus in Saudi
17/ To end on, some of the names of these 'Arabic' accounts are great > Hugo Ponce for example. Hi Hugo!
