Thread by @marcowenjones

[Thread on Saudi bots] 1/ On 25th February, a day before the release of the CIA report on MBS's ordering of #JamalKhashoggi 's murder, the trend 'the people of the kingdom (Saudi) support the crown prince'. No doubt the purpose was to rally support around MBS before bad publicity

2/ Such trends lionizing the Crown Prince are very common. This one demonstrated some interesting inauthentic activity. The following analysis show how the tweet screenshotted below (which says MBS will overcome his enemies), was retweeted by hundreds of fake accounts

3/ How do we know? A network analysis of the hashtag reveals an unusual cluster of accounts in the bottom left. Here's the edges (relationships between accounts) have been coloured according to device used to send the tweet. The orange shows that activity around this account

4/ involved accounts almost exclusively using Twitter Web App. It is suspicious (anomalous) that accounts using one app are boosting one account. By looking more closely at the accounts in that cluster we can see that in addition to using Twitter Web App, they all have generic

5/ looking profile pictures, and, crucially, all tweet the exact same things. Below are four screenshots of random accounts from the suspicious cluster (except for one which is yet to update). The accounts work in clusters, with each cluster RT'ing specific groups of tweet.

6/ Of the 9200 or so accounts in my sample, at least 653 (7%) accounts that are likely fake - designed to boost the appearance of support for MBS, ironic on a hashtag called "the people support the crown prince". This was one of many operations yesterday , and highlights

7/ how pro-MBS platform manipulation is still going strong on Twitter. It shows how Twitter still have a long way to go in improving the quality of conversations on Twitter, so that it is not merely a propaganda device. #JamalKhashoggi

8/ Important to note that these accounts were not all created in a short time frame (although a bunch were - see Oct/Nov 2020), suggesting they are repurposed accounts. This (presumably) makes them more difficult to algorithmically filter out