Thread by @hmason

This piece on the bot economy is excellent for many reasons! The presentation of data, code, and images in the story is fantastic.

One aspect of this story that was under-emphasized is Twitter's hostility to victims of impersonation.

I was one in 2015. Here's what happened...

https://twitter.com/cocteau/status/957613471151030273

I had just given a keynote at @ghc, and my account was getting a lot of attention. All of a sudden accounts popped up using my photo, bio, and tweets, under usernames like @hmason0 and @hmasonab. I heard from at least 25 people who were confused, trying to find the real me.

To report these impersonating accounts, you must click through an interface that takes many clicks and minutes for each one. Then you must upload your photo ID.

You must do this individually for EACH account. There were over a hundred.

I spent hours, and got through about 30.

Some of those 30 were suspended within a few days. Some were not. I was told they were not violating Twitter's terms, even though they were all doing the same thing. It seemed to be an entirely random decision.

In the meantime, new impersonator accounts were being created.

I did two things. 1) I got the help of a friend who was a Twitter engineer. This is apparently the only way to solve the problem.

2) I started making my own bots.

The impersonator's namespace was very predictable (it was always "hmason[a-z0-9*]". I wrote my own bot creation script to fill up all of the available usernames in that namespace before the impersonators could.

It took less than an hour.

This way, someone looking for me might see 100 impersonator bots, but they would also see 100s of my bots, all pointing back to the real @hmason.

This shouldn't be easy. All I needed was a rotating set of IPs and a headless browser.

(As an addendum: I ended up getting my bots all suspended a few months later because I set them up to ALL AT ONCE favorite tweets that I really liked. Turns out that's suspicious behavior. But it was totally worth it and fun while it lasted. :)

And the moral of the story: You should not need to have inside connections (my friend did manage to get the set of bot accounts suspended) or technical skill to protect your identity on Twitter.

Twitter can do more.