On September 11, 2021, Twitter shared with the Stanford Internet Observatory accounts and tweets associated with eight distinct takedowns. These datasets were made public today. They include:

1. Venezuela: 277 accounts that tweeted 860,060 times. Twitter describes this network as a political spam operation in support of the Venezuelan government and its official narratives. 

2. Mexico: 276 inauthentic accounts and 19,277 tweets that shared civic content and supported government initiatives related to public health and political parties.

3. Tanzania: A network of accounts that were supportive of the Tanzanian government and used copyright reporting adversarially to target accounts belonging to Tanzanian activists.

4. China (Government Attribution):  2,016 accounts produced 31,269 tweets in an operation boosting Chinese Communist Party (CCP) narratives about Xinjiang. The network received minimal engagement from accounts outside the takedown dataset, and largely amplified Chinese state media. 

5. China (Changyu Culture): 112 accounts and 35,924 tweets spreading pro-CCP narratives related to Xinjiang, attributed to the company Changyu Culture. Only a small portion of the tweets were about politics, but the takedown reflects the first time Twitter has attributed a pro-China influence campaign to a private production company.

6. Internet Research Agency - East Africa: A network of accounts linked to previously removed activity from the Internet Research Agency. This network shares tactical similarities to the Internet Research Agency - North Africa network. The accounts claimed to be in sub-Saharan Africa. Twitter assesses that the operation originated in East Africa. 

7. Internet Research Agency - North Africa: A network of accounts linked to previously removed activity from the Internet Research Agency.  The network was most notable for the high portion of accounts that had their tweets embedded in news articles from the Yevgeny Prigozhin-linked publication RIA FAN (“Federal News Agency”), in some cases the Russian state media outlet Sputnik, and a wider ecosystem of websites from around the world. The accounts claimed to be in the Middle East and North and sub-Saharan Africa. Twitter assesses that the operation originated in North Africa.

8. Uganda: A network that tweeted content favorable to the National Resistance Movement political party and the armed forces ahead of Uganda’s 2021 election

We are publishing five reports covering 1) Venezuela, 2) Mexico, 3) Tanzania, 4) the China networks, and 5) the Internet Research Agency - North Africa network. A summary of the first four reports are below. The Internet Research Agency - North Africa network is discussed in a separate blog post.

Venezuela Takedown

Twitter announced that it had suspended a network of accounts that engaged in a political spam operation in support of the Venezuelan government. According to Twitter’s attribution language, real people were encouraged to engage in spammy behaviors to show their support for Nicolás Maduro and his political party. According to Twitter, financial compensation may have been offered to accounts for sufficient engagement in bolstering Maduro’s messaging. 

The network included accounts that reported locations in Venezuela, Colombia and Mexico, and engaged in automated tweeting behavior through the use of bots and feeds. Our assessment of the accounts shared suggested that the set may be more accurately characterized as four or five distinct groups linked to each other only by mentions of common public figures or popular hashtags and by behavior that violates similar parts of Twitter’s policies. The three regional groups were distinct and tweeted about different topics. We could not verify that any of the accounts were directly paid as part of tweet-for-hire schemes, however, some account behavior mimicked prior tweet-for-hire campaigns.  The Venezuelan accounts engaged in behavior similar to that shown in other tweet-per-hire schemes in Venezuela, as described here by DFRLab researchers. The Mexican accounts in the network shared behavior similar to more commercial tweet-for-hire schemes: they promoted a mix of commercial brands and political hashtags. The accounts that reported their location as Mexico specifically engaged in behavior that amplified support for regional Mexican politicians. Shortly before Twitter suspended the network, a small cluster of new accounts accounts furiously tweeted for the release of Alex Saab, a close ally of the Venezuelan president who was recently extradited from Cape Verde and is currently awaiting trial in Miami on charges of money laundering

The network was most active in 2013 and 2014 – a period of some political turmoil in Venezuela after the death of President Hugo Chavez on March 5, 2013. The accounts that Twitter suspended had another smaller spike of activity in 2021; accounts amplified tweets from gubernatorial candidates in Mexico, and separately tweeted hashtags advocating for Saab’s release. This dataset is noteworthy for the large number of unique Twitter clients used to post. Overall, 121 Twitter clients were used, including clients called “PSUV,” “RedTuiteros” (translation: Network of Tweeters), and OlaBolivariana (Bolivarian Wave), as well as a series of accounts used only in 2014 that all bore the names of native Venezuelan animal species.

Accounts advocating for Alex Saab’s release from prison in Cape Verde.

Mexico Takedown

According to Twitter, the Mexican network contained inauthentic accounts that shared primarily civic content, in support of government initiatives related to public health and political parties. The Mexico network was a relatively small and low engagement network, with a median of just 31 tweets per account, and average engagement per tweet (calculated as the total number of quote tweets, retweets, replies and likes) of 2. The dataset contained a mix of political ideologies, though accounts that support different political opponents do not necessarily work at cross purposes. SIO’s analysis found that the network of accounts engaged in some level of coordinated posting, handle switching, and cheerleading for the Mexican president Andrés Manuel López Obrador. Many of the accounts showed support for brands and entities under the umbrella of the Mexican conglomerate Grupo Salinas, which is owned by Ricardo Salinas Pliego, an advisor to López Obrador. Those accounts trolled some of both Salinas Pliego and López Obrador’s opponents, and defended Grupo Salinas’s justifications for keeping stores open during lockdown. 

An account in the dataset that handle switched. @ddc_aza was the account for a Mexican TV show from 2011-2014. It changed its handle some time before 2019 to @vaqueropolitico and adopted a decidedly different tone.

Tanzania Takedown 

Twitter suspended a network of 268 accounts that were supportive of the Tanzanian government and used copyright reporting adversarially to target accounts belonging to Tanzanian activists and an opposition politician. This Tanzanian operation worked by first taking text or images tweeted by accounts that criticized the ruling Chama Cha Mapinduzi party, then putting the same content on WordPress sites and modifying the date to make it appear as if the WordPress post preceded the tweet. Fake accounts pretending to be Tanzanians or South Africans then reported the content to Twitter for violations of the US Digital Millennium Copyright Act (DMCA). Twitter then notified the accounts of the reported copyright claim. To counter such DMCA takedowns, however, the accused copyright infringer must share their personal information with Twitter. At least one of the targeted accounts relied on anonymity for safety, possibly making it undesirable for them to counter through Twitter’s process. This operation succeeded in getting Twitter to suspend at least two of the targeted accounts, though both have since been reinstated.

China Takedown

Twitter suspended two networks of accounts that operated from China—the first dataset, which we will refer to as CNHU, was attributed to the Chinese government;  the second, which we will refer to as CNCC,  was attributed to the non-governmental entity Changyu Culture, a private production firm. Both of the networks included messaging related to Xinjiang (an autonomous region in northwest China) and the Chinese government’s treatment of Uyghurs, albeit at different portions of total tweets. Beyond the topical overlap, however, the Stanford Internet Observatory did not find activity linking the two networks.

The CNHU dataset consisted of 2,016 accounts that were created between April 2019 and February 2021, with a large number of accounts created on a handful of days in March and April 2021. Content shared by the CNHU network focused heavily on Xinjiang and is consistent with disavowals and alternative narratives pushed by Chinese government officials. Much of the content is in English; the accounts boosted English-language articles and messages originally spread by Chinese state media outlets, and used English-language hashtags, likely in an effort to reframe global debate or to crowd out critical or adversarial narratives. Narratives included that Uyghurs are treated well in Xinjiang, that Xinjiang policy is necessary to combat terrorism, and that Western media and politicians are lying or hypocritical about human rights abuses in China. The dataset is noteworthy for its overlap with existing reporting, including by ProPublica and The New York Times. 
 

Accounts in the CNHU dataset posted memes critical of the United States and claiming Western media was lying about Chinese treatment of Uyghurs in Xinjiang.

The CNCC dataset consisted of 112 accounts and 35,924 tweets. 101 of the 112 accounts had few or no followers, and were minimally active for a few days after they were created (after which they were no longer active at all). A separate cluster of accounts had already-established followings derived from tweeting about things other than Xinjiang prior to 2021; they were then seemingly repurposed, purchased, or hacked for Xinjiang-related messaging. The majority of the tweets in the CNCC dataset were not political, and were posted by the small cluster of accounts. The most notable feature of the dataset is the attribution itself; it is the first time, to our knowledge, that Twitter has attributed a pro-China influence operation to a non-governmental organization within China.