Thread by @marcowenjones

[Big thread on #Saudi-related sock-puppets] 1/

Summary of Findings: I have identified between 1600 - 3900 sock puppet accounts trying to displace a trend critical of Saudi's 2030 Vision

Read on for more details and analysis #disinformation #platformmanipulation

2/ Around 15 March the hashtag "what do we benefit from the Vision ((2030))" was active. In Arabic this reads as #ماذا_استفدنا_من_الرؤية . This trend was critical of the money being spent in pursuit of Saudi's 2030 vision, and critical of MBS. See examples >

3/ Special attention needs to be paid to the first part of this construction "ماذا_" (matha_) which is the Arabic pre-verb question particle 'what'.

There has been increasing trend of using partial hashtags to displace critical ones by using chopped hashtags. See below...

4/ The premise appears to be to using partial content to trick the trending algorithm into confusing or displacing the trend with the chopped hashtag. We've seen this several times over the past few weeks on hashtags about Khashoggi. Often the 'chopped' hashtag is more successful

5/ By downloading accounts tweeting on the matha_ one can reasonably assume that they are downloading accounts that are one of the following:

1) Acting in bad faith by tweeting a chopped hashtag
2) Accidentally tweeting matha_
3) Deliberately tweeting it for non-sinister reasons

6/ However an analysis of around 4000 accounts tweeting on the hashtag it becomes clear that at least 1600 of those accounts are sock puppet accounts (fake accounts that have been taken over to spread marketing and/or propaganda)

7/ There are a number of vectors that illustrate they are sock puppets. Firstly low interaction and low 'familiarity'. The accounts predominantly tweet the hashtag in isolation, not interacting or connecting with others. You can see this illustrated in the below graph. Here the

8/ accounts exist in their own boxes indicating they are neither retweeting nor tweeting at others. By way of an example, on the left you can see a network with accounts interacting, and on the right a community of accounts not interacting

9/ Compounding anomalies also point to sockpuppets. A disproportionate number of the isolated accounts are tweeting using either Twitter Web Client or Twitter Web App, two platforms that are easily to manipulate. You'd usually expect to see a larger share of iphones v TWC/TWA

10/ Furthermore, the accounts using Twitter Web App appeared to be tweeting in a highly anomalous fashion in terms of temporal patterns (time).

The red spikes on the time series graph shows two sudden surges in accounts tweeting 'matha_' using Twitter Web Client

11/ Of course you'd expect a more even distribution of timings if the accounts were acting organically. We saw a similar thing happen on a similar chopped hashtag "اد_ال" - on the below graph, the blue/green spike indicates a similar spike of accounts using Web Client

12/ Beyond metadata, a visual inspection of the accounts also indicates they are tweeting unrelated spam, such as the tweets about mood and oud (agarwood)

13/ Some of the sock puppets are not even trying to be convincing Arabic accounts, such as Jone Bryant, an account clearly using someone else's photo - in this case, Veronica Toussaint....

14/ So from the sample we can make two estimations, a conservative one, and a non-conservative estimation to calculate number of sock puppets .

Non-Conservative - 3900 sockpuppets
Conservative - 1600

15/ The conservative estimation only includes those using TWC or TWA and tweeting in isolation, while the non-conservative estimation assumes the majority of accounts tweeting on the hashtag matha_ are doing so for bad faith reasons. I would say the real figure of suspicious

16/ accounts is closer to 3900.

A few more important notes. As sock puppet accounts, these are likely accounts that used to belong to people but have been hacked and sold to a bot farm. The original tweets from the accounts have been deleted.

As real accounts their

17/ creation dates are varied and more or less random/organic. This means conventional ways of detecting bots based on large spikes in the same creation date is not helpful.

We've seen this before, and it makes it somewhat harder to detect manipulation

18/ A few weeks ago Twitter suspended 3500 accounts connected to pro-MBS propaganda at the time a spotlight was cast on his role in murdering Jamal Khashoggi. This is a separate group of accounts, but are behaving in a similar way.

19/ So does this represent a development in tactics - i.e. the use of chopped hashtags to displace trends criticizing MBS and Saudi government policy?

Probably yes.

Who is behind it? Hard to say. Marketing firm perhaps?

20/ Bottom line, Twitter is still falling prey to fairly obvious computational propaganda, despite their belief that they are effectively able to combat this problem @TwitterSafety