We started taking a deeper look at this Gab dataset (please feel free to reply with suggestions for additional analysis). 28M Gab posts, courtesy of @jasonbaumgartne. Based on the IDs of the posts, this set is at missing <16% of the Gab posts in the time range.
Media sources for 28 million Gab posts. Most are right-wing conspiracy-oriented sites, although Russia Today/RT also puts in a prominent appearance.
What topics are prominent in Gab posts? 28.9% of posts contain one or more of the terms show in this chart. Of particular interest: the ethnic/religious slur category has actually *increased* in prominence over time. #AltWankers.
In a tongue-twisting twist, @alwaysTFan wasn't always @alwaysTFan - until roughly November 3rd, the account was named @NJTfan.
What does @alwaysTFan tweet about? 52.1% of the account's tweets contain one or more of the terms shown in this chart. Notable themes include voter fraud conspiracy theories, "anti-white racism", and telling people who are in the USA on work visas to go back to India.
Following last night's Thousand Oaks shooting, there's been an uptick in Twitter traffic about "false flags". We downloaded tweets containing #FalseFlag/"false flag" (and filtered out content related to unrelated topics such as Syria).
Here are some examples of the tweets asserting that the Thousand Oaks mass shooting is a false flag. The #FalseFlag theories vary, but everything from #Calexit to voter fraud to claims that this shooting is a "distraction" from the outcome of the 2018 midterms surfaces.
Here's the retweet network for #FalseFlag/"false flag" (with terms unrelated to the Thousand Oaks shooting filtered out). A number of these accounts, including the largest node (@LizCroken) are #QAnon fans who've crossed our radar before. . .
Oh, What A Bungled Bot We Weave, When First We Practice To Deceive. . .
Meet @SheebaKarungis. This account crossed our radar when it posted this tweet regarding the Thousand Oaks shooter, with a picture of a different shooter (the man shown killed two people in a bar in 2017 after telling them to "get out of my country").
This is not the only time @SheebaKarungis has used a stolen photograph. In fact, the account's user picture is of a person who accidentally drowned in 2014. Note that the account itself was not created until October 2015.
A few minutes after the incident shown in this video (which doesn't show @Acosta laying hands on anyone, contrary to @PressSec's claims), tweets containing anti-Acosta hashtags such #AcostaAccosts and #AcostaAssaults started appearing. Let's take a look.
The #Walkaway hashtag, hypothetically used by former Democrats who have recently switched parties, has been around for a few months. Its mirror image, #GOPVotingBlue (indicating a Republican voting Democrat in the midterms) has recently surfaced. Let's compare.
We downloaded all tweets containing #GOPVotingBlue, resulting in 122428 tweets from 40137 accounts over the last two days. We then downloaded the most recent 122428 tweets containing #Walkaway (45855 accounts) for comparison.
We compared the accounts involved by four criteria that are more common among sockpuppet accounts (default picture, low tweet count, low follower count, recent creation date). #WalkAway set has a higher percentage of accounts flagged for each trait other than low follower count.
Pre-midterm look at RT/Russia Today Twitter activity: the 20 articles most frequently shared among the last 50K English tweets linking to rt(dot)com. The article about the Mueller assault allegations has not been updated to reflect Thursday's trainwreck of a press conference.
Other interesting food for thought: anti-CNN and Hillary Clinton material, an article hinting at potential war between the US and China, the "migration not a human right" theme, and a couple of articles about abandonment of the US dollar as a currency.
Project Veritas released a video purporting to show that Beto O'Rourke is "funding the caravan". In reality, his staff made a $300 charitable donation to asylum seekers already in the country, but @JamesOKeefeIII isn't one to let facts disrupt his agenda.
We downloaded tweets containing "Beto" and "caravan", yielding 161881 tweets from 68402 accounts. The inaccurate nature of the story hasn't stopped it from spreading like wildfire among those who are inclined to believe it.
Here are the first twenty accounts with on-topic tweets containing "Beto" and "caravan". @JamesOKeefe's tweet announcing the upcoming "expose" is the one that kicked off the trend.
We took a look at Twitter traffic surrounding the much-hyped reveal of a hypothetical Robert Mueller sexual assault victim by @Jack_Burkman and @JacobAWohl.. We downloaded tweets containing Mueller and accuser(s)/assault, yielding 121050 tweets from 70212 accounts.
We then classified the top 50 accounts in terms of retweet volume by political stance, and assigned the same stance to the retweets of those accounts. The initial interest died down quickly, and the right is all but absent post-press conference.
Convicted mobster Whitey Bulger was murdered in prison on Tuesday. Although it appears he was murdered by organized-crime-connected figures, critics of the Mueller investigation on Twitter wasted no time trying to connect the murder to Mueller.
We downloaded tweets containing "Bulger" and "Mueller", resulting in 7631 tweets from 5967 accounts since the time of Bulger's murder.
The retweet network for tweets connecting Bulger's murder to Mueller is interesting. A variety of prominent right-wing accounts are present, but British pro-Kremlin troll @Ian56789 also puts in an appearance. Several of the major accounts are #QAnon fans.
The name Lorraine Parsons surfaced earlier today attached to an individual theoretically offered a bribe to provide false testimony against Robert Mueller. We took a look at the early traffic (2298 tweets from 2278 accounts).
This chart shows the first 20 accounts with tweets containing "Lorraine Parsons". The name appears to have first shown up 20 minutes prior to the first tweet in a Politico article.
The first mention of Lorraine Parsons on Twitter is a reply to @JacobAWohl asking for the name of the woman he offered to pay to accuse Mueller. 10 minutes later, Wohl himself tweets Parsons' name with a claim disputing her existence. Several users speculate that Parsons is Wohl.
Meet @Ingrid39678584, a one-year-old #MAGA account with 20.5K followers and 234K tweets. Spoiler alert: this one's a bot, as is evidenced by the 24/7 tweet schedule. Early tweets were posted using an app called "navod", which switched to "zvrndash" in July 2018. cc: @ZellaQuixote
Navod and zvrndash do not appear to be automation services that the public can sign up for. The account is likely automated via the Twitter API using custom scripts. Interestingly, google searches for the words "navod" and "zvrndash" indicate the operator may speak Croatian.
What does @Ingrid39678584 tweet about? 31.9% of tweets contain one or more of the terms shown in this chart. For the last nine months, the relative proportion of the different categories have been remarkably consistent, which is a sign of repetition. Let's take a closer look. . .
This chart shows the time of first tweet from the first ~20 accounts to tweet about each target. The stories that turned out to be rumors are indicated via a blue background. The erroneous stories spread more slowly than the true ones (with the exception of the White House).
Retweet networks for the first 500 tweets mentioning each potential bomb. As the story developed throughout the week, the networks grew progressively more cohesive; the first consist of multiple independent conversations whereas the later ones coalesce around a few major sources.
Beginning with the device that appeared in George Soros' mailbox two nights ago, a number of prominent left-wing individuals have had bombs delivered to them in the last couple of days. Let's take a look at the Twitter traffic.
The retweet networks for the majority of these searches have something in common - the traffic is grouped into a left-wing and a right-wing cluster, indicating a high degree of polarization. The proportion varies; notably, #FalseFlag tweets got more traction on the right.
A "migrant caravan" traveling from the southernmost regions of North America and headed to the USA (allegedly) has been a major topic on Twitter recently, mostly from right-wingers framing it as an "invasion". Reports of the size of the "caravan" vary widely. cc: @ZellaQuixote
We downloaded tweets containing "migrant caravan", resulting in 341891 tweets from 120471 accounts.
The notable aspect of this trend isn't bots, though we did check a sample of 4656 accounts with recent "migrant caravan" tweets for signs of automation (24/7 operation and/or use of automation apps/services). 138 were flagged (3%), which is about average.
Let's take a look at Twitter bot/sockpuppet activity related to the recent murder of Jamal Khashoggi. Source dataset is 70K accounts with English tweets mentioning Khashoggi between October 18th and 20th, 2018. We'll review two sets of accounts.
First, we took a sample of 1000 accounts and checked for 24/7 activity and use of known automation services. 84 accounts (8.4%) were flagged by this test (average across datasets we've analyzed is ~3%).
Next, there are 794 accounts in the Khashoggi dataset with randomized 15-character names. 75 accounts in this set flag the previously-mentioned automation test, with the caveat that many have too few tweets to perform it.
Sometimes it can be difficult to be absolutely sure if an account is automated. @jogman308 is an example - this account doesn't post round-the-clock, and all tweets are via the Twitter website. There are reasons for suspicion, though.
First, very little of @jogman308's material is original - 99.9% of tweets are either news site links or retweets. We were unable to find any hint of personal backstory. These charts of media sources and keywords used provide an approximate picture of the content.
There's something odd about some of @jogman308's tweets linking to news sites - in some cases the headlines in the tweet text are paired with the wrong article. Could be human error, but could also be a sign of a script gone awry.
#NPC Twitter accounts: either bots or the most repetitive video game ever invented. . .
In recent days, a number of "#NPC" accounts that self-identify as #Resistance have emerged. We found this example while researching another project, and have also had various folks draw our attention to the phenomenon. Let's take a quick look. . .
The theme of the accounts is to portray those opposed to the present administration as "NPCs" (a term for non-player characters in games), likely in an attempt to imply that opponents are simply executing a script rather than stating a genuine position. #GamerGate
Since @RoguePOTUSStaff is now selling a book about their purported experiences resisting from inside the White House, this seems an opportune time to point out that there is good reason to doubt their legitimacy.
We decided to repeat this analysis to see what (if anything) has changed with #WalkAway traffic since July. The volume has decreased, for one: a 200000 tweets sample now covers a span of 64 hours rather than 18.
Let's repeat this test on the new dataset - we'll compare 216K tweets from 2018 from accounts with recent (Oct 9 - 11) #WalkAway tweets with 216K tweets from the same accounts from the five previous years. We'll look at both hashtag use and media sources.
Much like when we tested this in early July, the hashtag use of the #WalkAway accounts indicates that the vast majority have always been conservative. They may be attempting to encourage others to "walk away", but they don't seem to have walked away themselves.
One - repeatedly constraining the time window examined to the ten week period prior to the election. This excludes a portion of the general election campaign as well as the entire primary season.
(Also, since when are there 194 weeks in two years?)
Two - introducing a general statistic and applying it exclusively to Internet Research Agency content. For example, this 10% figure applies to everything competing with the IRA content just as much as it applies to the IRA material.
Meet @ShawneeDeaver. This account's first tweet - and only non-reply tweet - is 2scEY0T, an apparently random 7-character alphanumeric code. The rest of the tweets are replies sent within hours of its creation; the collage is representative. (Thanks @OlgaNYC1211 for the lead).
We decided to look for more accounts like it. We started by harvesting the recent replies to the accounts that @ShawneeDeaver replied to, and filtering the results to accounts with a 7-character code as their first tweet and all subsequent tweets being quickly-launched replies.
Let's take an updated look at the traffic related to Russia Insider, a Russian news site featuring sections such as "Western Collapse", "The Jewish Question", "Free Assange", "Russiahoax", and "EU Conservative Uprising".
(previous Russia Insider thread in which failed Congressional Candidate Paul Nehlen featured prominently)