Recently, repetitive tweets containing the text "As a Hoosier, I'm calling on @SenDonnelly to confirm Brett Kavanaugh to the Supreme Court. #KavanaughSCOTUS" started showing up. Let's have a look. At the time of this writing, there are 756 such tweets from 727 accounts.
Of these 727 accounts:
119 have default profile pictures (16.4%)
102 have fewer than 100 tweets (14.0%)
331 have fewer than 100 followers (45.5%)
These percentages are all roughly 5x what we usually see. Doesn't mean all these accounts are bots/sockpuppets, but some likely are.
The first "As a Hoosier, I'm calling on @SenDonnelly to confirm Brett Kavanaugh to the Supreme Court. #KavanaughSCOTUS" tweet is from a default profile pic account with 18 tweets, and includes a button to allow others to quickly duplicate the tweet.
Whoever #Organization1 is, they appear to have approached Guccifer2 on at least one occasion seeking more material. The "within a week" of July 18th comment lines up with the July 22nd release by @wikileaks.
#AltAltGov: Why Fonts Where Uppercase "I" Looks Like Lowercase "L" Are Stupid
Earlier this morning, a curious response to a @LalaBova tweet from a @PalmerReport doppelganger (@PaImerReport - uses an uppercase "I" in place of a lowercase "L") crossed our radar.
This isn't the first time we've noticed an account like this in recent history. Here's an example of an interaction between @propornot and @AIt_uscis - once again, an uppercase "I" instead lowercase "L".
Two days ago, the news broke that two people in #Amesbury, England (not far from the site of the Skripal poisoning) were poisoned with an unknown chemical agent. Police have since announced that the two recent victims were, like the Skripals, exposed to #Novichok.
Here's an analysis of the first ~40 hours of Twitter traffic related to the #Amesbury poisoning. This dataset contains 34848 tweets from 21500 accounts containing the word "Amesbury" - almost all are related to the incident.
Retweet network for Amesbury tweets. The disinformation category was determined by checking the tweets of the 50 most retweeted accounts in the set for #Amesbury#FalseFlag theories and the like. Accounts which exclusively RT'd accounts in the disinfo category are also included.
The #WalkAway hashtag, purportedly associated with a viral grassroots movement of frustrated Democrats abandoning the party, has generated considerable tweet volume. A couple brief observations based on a set of 200K tweets, which covers a span of just 18 hours. . .
The 200K #WalkAway tweets in this sample came from 58475 accounts. Of these, 4440 (7.6%) use the default profile pic (somewhere in the neighborhood of 3% is average for datasets we examine). This doesn't mean all these accounts are bots, but does suggest bot activity.
Are the #WalkAway tweets truly from Democrats who recently abandoned the party? To test this, let's compare the hashtags used in recent tweets from the #WalkAway accounts with their tweets from years past.
The sentiment that Democrats are revolting against Nancy Pelosi has been floating around the last few days. Let's take a look at the associated Twitter activity.
We downloaded recent tweets containing the phrase "revolt against Pelosi" and filtered out the retweets of @tburages's tweet commenting on the phenomenon, leaving us with 1582 tweets from 1471 accounts.
Kremlin troll? Probably not, but all's fair in love and Infowars.
The Capital Gazette shooting spawned various #FalseFlag theories. Here's a look at a Twitter account promoting them: @truthismaster. We aren't 100% sure this is an agitprop account, but it sure acts like one.
Hopefully this thread provides some insight into the process of investigating suspicious social media activity.
A Twitter account theoretically belonging to Rod Rosenstein has been getting a decent amount of attention lately. There are, however, some reasons to question the legitimacy of this account. First up: "Rosenstein" is spelled incorrectly in the account name (@RodRosenstien).
Can we find evidence that the @RodRosenstien account is not actually being operated by Rod Rosenstein? One thing the Deputy Attorney General is unlikely to do is retweet flattering tweets directed at himself while at a hearing in the House of Representatives. Let's take a look.
I wasn't able to find anything documenting the precise ending time of the hearing, but it's possible to deduce by looking at a couple of videos. This CNN clip establishes that the "there's no way to subpoena phone calls" comment occurred at 11:28 AM EDT.
We've looked into social media activity related to secession movements before, primarily #Calexit (btw, #CalexitIsStillAKremlinConJob). Let's divert our attention to the Lone Star state and check out automated Twitter traffic around #Texit for a change of pace.
Repeated tweets are one distinct sign of automation, and a Twitter search for #Texit doesn't disappoint. Refining the search to "Good morning GregAbbott_TX. We're ready for a vote on #Texit." reveals a pair of accounts (@JohnDuBose6 and @RCC_JDGIV) that tweet this text every day.
For this thread, we'll focus on the tracking technology used by usareally(dot)com. Looking at the HTML source code for the articles, the site uses Yandex Metrica. There are other analytics services available with similar capabilities.
We created a website and signed up for Yandex Metrica (it's free and all you need is an email address). Hooking the site up was relatively easy; all it involves is copy/pasting a chunk of code similar to the one in the previous slide into one's own site's HTML.
In mid-February, @Imperator_Rex3 demonstrated his top-notch talent for stealth and opsec by migrating to the newly created @_VachelLindsay_ account and telling everyone about it on Twitter. This will surely throw left wing nutjob assassins and antifa supersoldiers off his track.
Meet @veteranhank. This account has 154K followers, and would like you to know that it is not a Russian bot. It is, however, accurate to describe this as an automated account that followed popular Russian propaganda accounts operated by the Internet Research Agency.
This tweet from @SenJohnMcCain received a barrage of spammy replies crammed with as many hashtags as possible. There's some variety, but all seem to contain #opmayflower2018. (Thanks @Shaun7559 for the tip.)
Looking at replies to McCain containing #opmayflower2018 results in 4808 tweets (including retweets) from 397 accounts; 983 original tweets from 47 accounts. The activity started at 6:30 PM Central on 5/11; volume is high for a little over an hour.
This table shows the frequency of the various hashtags included in the #opmayflower2018 tweets. We'll come back to the ones highlighted in blue (cyan?) later.
This chart is based on tweets from the official English-language accounts of Russia Today, Washington Post, and the New York Times containing the words "protest" or "rally" from 2011 to present. Food for thought in several directions. . .
There's been a recent surge in discussion of conspiracy theories related to 2015's Jade Helm military exercise, following an interview where former CIA/NSA director Michael Hayden asserted that Kremlin social media propaganda encouraged hysteria over the topic on the right.
This chart shows the time of the first tweet mentioning the recent #JadeHelm story from the prominent accounts that discussed it. The majority are news organizations and left-wing users. Let's go back to 2015 and see what Twitter activity around Jade Helm looked like then. . .
I accidentally ran across various and sundry bots while searching on the #GamerGate hashtag, so here's a quick thread.
Searching the most recent 10 days worth of #GamerGate tweets for accounts that tweet 24/7 and have used the hashtag more than once in that timespan yields 20 accounts.
This table shows the apps/services used to post the automated tweets to these accounts. Cheap Bots Done Quick and twittbot are both services where one can configure one's own Twitter bot; we will likely look at these in more detail later.
We were recently made aware that @alhousedems had received a barrage of unexpected followers that look like bots. Scrolling through the recent followers, this does indeed appear to be the case. (Thanks @DePoInLa and @bweaver!)
The bots in this set are easily identifiable - they all use the default color scheme but have changed their picture, usernames are lowercase and end in numbers with 3 or fewer digits, no bio, and no tweets. @TwitterSupport
The bots follow users other than @alhousedems, and checking the recent followers of the other accounts they follow reveals that @alhourdems is not the only target. We're still rounding out the set, but have found 29838 so far after looking at 20 accounts.
Something spammy turned up in Twitter search results this morning for the Nashville Waffle House shooting. Let's take a closer look. . .
As of noon today, 684 accounts had linked to an article on verifiedtasks(dot)com titled "Travis Reinking: 5 Fast Facts You Need to Know". 620 of these have default profile pics and all seem to link the same posts on verifiedtasks. Also, they all post their tweets via IFTTT.
Immediately following the chemical attack in #Douma, Syria, the usual suspects are lining up to push the theory that it was a false flag.
This isn't the only time in the last couple of months we've seen "false flag" theories pushed in the wake of a chemical attack. In one case, the prime suspect is Assad's government, a Russian ally, and in the other the Russian government itself.
We downloaded recent tweets containing the hashtag #FalseFlag; the majority are related to the attack in Syria. 1744 of 1950 (89%) of the accounts involved also have #Novichok tweets on their timelines.
Let's look at this from another angle. I've noted before that people who buy into the personas of these fake accounts tend to get attached. Is there a way to quantify and visualize these relationships? #InformationWarfare#Catfishing
Among the accounts with still-visible replies to the top 10 banned IRA accounts, there are 22156 with at least 10 replies over a span of at least 90 days. Most continued their interactions with their nonexistent "friends" right up until the trollfarm accounts were banned.
Adding some numbers to this thread based on this technique: the idea is to estimate the number of retweets the trollfarm accounts generated for the accounts they boosted based on the average number of RTs the trollfarm accounts' own tweets received.
In the wake of the #Novichok nerve agent attack on Sergei #Skripal and his daughter in #Salisbury, a variety of suggestions that anyone other than Vladimir Putin’s government is responsible have been circulating on Twitter. #Whataboutism
I downloaded recent tweets for the hashtag #Novichok, which started seeing significant traffic March 12th. This yielded 15371 tweets from 10668 accounts. I classified the top 50 accounts by retweet volume (74% of tweets in the set) based on their attribution of the attack.
This chart shows the volume for #Novichok tweets, classified by the perspective being expressed. Note that the portion of the volume in the “whataboutism” category has increased greatly over the past 12 hours.
We downloaded tweets going back to July 2015 containing the hashtag #IStandWithIsrael. There are several spikes, including two in mid-2016. Let's focus on those.
Restricting the time range to tweets between 5/1 and 9/1/2016 leaves 25404 unique tweets (73373 including retweets) from 989 accounts. Of the 20 that received the largest number of RTs, 14 have #PJNET in their profiles.