2/6 It starts with accounts tweeting the suspicious hashtag in isolation (why would you tweet a deliberately nonsensical hashtag spontaneously unless it was co-ordinated?) Graph shows tweets (i.e. not RTs, mention etc) in green starting off the activity
3/6 Almost all the tweets that begin the hashtag are sent from iphone (see turqouise colour). Again, multiple accounts, tweeting a strange hashtag in isolation, using the same devices)
4/6 The content they are tweeting is mostly random content, ads, football stuff, aphorisms and quotes. Basically, nothing cohesive - after all, the hashtag is jargon and not a real thing.
5/6 The velocity (number of tweets and how fast they are sent) is high in the beginning, with around 252 being sent in the space of 20 minutes. Velocity is important in getting something to trend.
6/6 Most of the account histories are spammy, suggesting it's some sort bot/sockpuppet operation though. Some are real, but most suspicious. Needless to say, this violates many of Twitters rules on spam and platform manipulation
Summary, there is a network of around 629 sockpuppet accounts using 'chopped hashtags' to drown out a hashtag advertising a broadcast from Saudi dissident @oamaz7
2/8 As this screenshot shows, the original hashtag promoting broadcasting of @oamaz7 is بث عمر عبد العزيز while the chopped hashtag takes four consecutive consonants from the middle of the hashtag: مر عب
3/8 As with similar networks, the accounts do not generally interact with each other. The fact they are tweeting the same nonsensical chopped hashtag 'independently' of each other with few RTs indicates it is co-ordinated sockpuppet activity.
[Thread] 1/4 Around 1956 sockpuppets tried to disappear a hashtag critical of MBS, translated as "The loser MBS". In Arabic this reads as #المهزوم_مبس .
The same chopped hashtag technique was used, with #وم_مب trending. Again, see the two screenshots #Disinformation
2/4 As with before, most of the accounts are not interacting with each other and are using Twitter Web Client
Graph below show lots of isolated accounts tweeting on the hashtag but not interacting with each other.
2/ Around 15 March the hashtag "what do we benefit from the Vision ((2030))" was active. In Arabic this reads as #ماذا_استفدنا_من_الرؤية . This trend was critical of the money being spent in pursuit of Saudi's 2030 vision, and critical of MBS. See examples >
3/ Special attention needs to be paid to the first part of this construction "ماذا_" (matha_) which is the Arabic pre-verb question particle 'what'.
There has been increasing trend of using partial hashtags to displace critical ones by using chopped hashtags. See below...
2/10 It's definitely the same photo, same hair same shirt, same everything - although the one on the right has been photoshopped with a smile and juicier beard...
3/10 However, the guy on the left is Dave Sharma, a very nice (I imagine) music teacher at Prelude Music Foundation, a setup designed to transform the lives of under-served children around Houston.
A few important notes on this great article. 1) I would caution there is a prevailing narrative about Saudi accounts, risks creating a straw man. 2) it is useful to make a distinction between bots and trolls as trolling is behavioural not computational; Trolls
could be hypernationalist real or paid real people attacking those who disagree 3) Saying someone is a real human risks conflating that with a troll whose *unknown* function might be to artificially generate support 5) As bots and trolls evolve it becomes more difficult to do
anomaly detection at scale and be sure of how many accounts have been missed in analysis 6) Twitter's own suspensions aren't a reliable or comprehensive barometer of what is and isn't definitely a bot - or troll 7) co-ordinated inauthentic behaviour includes trolls (real humans)