The Cyber Policy Center is part of the of the Freeman Spogli Institute for International Studies.
On June 11, 2020, Twitter announced the takedown of 1,152 accounts engaged in coordinated inauthentic behavior, attributing the activity to actors affiliated with Current Policy. These 1,152 accounts represented several clusters of activity pursuing various political, commercial, and promotional aims. The politically engaged accounts, which revolved around the @Current_policy account, were primarily engaged in publishing pro-Kremlin, anti-opposition, and anti-Western content. The largest and most popular accounts in this takedown, however, appeared to be tied to twishop.ru, a website that sold retweets and tweeted links.
On June 11, 2020, Twitter announced the takedown of a collection of 23,750 accounts attributed to the People’s Republic of China (PRC), with technical indicators linking the operation to the same actor responsible for the network of 200,000 accounts suspended in August 2019. Most of the 23,750 accounts in this disclosure were caught relatively quickly and thus failed to gain traction on the platform. Twitter’s assessment of the operation notes that these accounts were themselves part of a larger network, the remainder of which primarily served to retweet the core; the amplifiers were not included in the public takedown data set.
On Thursday, June 11, Twitter announced the takedown of 7,340 accounts that tweeted about 37 million times. Twitter attributes the network to the youth wing of the Justice and Development Party (AKP), Turkey’s ruling party. The network generally targeted Turkish citizens, and aimed to promote the AKP and criticize the opposition Peoples’ Democratic Party (HDP) and Republican People’s Party (CHP). The network included several pro-AKP retweet rings along with single-issue batches of fake accounts. According to Twitter, the network included both compromised accounts, which were centrally managed, and fake accounts. The takedown includes accounts linked to groups that were critical of the government, but targeted repeatedly by hackers.
This is not the first Twitter disinformation campaign that targeted Turkish citizens and pushed content supportive of the ruling party. As a response to the widespread anti-government uprising in the summer of 2013, the AKP formed a team of 6,000 members to shape public opinion and counter government critics on social media. The group, called AK Trolls, has organized “online lynching” campaigns targeting journalists, politicians and government critics. Like the network in the June 11 takedown, the AK Trolls were known to compromise social accounts. Additionally, in October 2019 DFRLab identified a network of inauthentic accounts that aimed to mobilize domestic support for the Turkish government’s fight against a Kurdish militia in Syria.
On April 2, 2020 Twitter announced the takedown of a collection of data sets attributed to state influence operations in several countries. One of those datasets was attributed to actors within Egypt – specifically, accounts linked to the El Fagr newspaper. El Fagr has previously been named in coordinated inauthentic activity takedowns on Facebook and Instagram, which took down a network related to their pro-Egyptian government activity in October 2019.
As with several other influence operations executed in the MENA region pre- viously attributed to Saudi Arabia, Egypt, and the UAE, the content consisted of a mix of auto-generated tweets from religious apps, commercial content, news content (often propaganda in support of the party or politician behind the operation), as well as subversive political astroturfing content created by accounts that appear to be fake people. The political astroturf identities were often created within a tight time cluster and subsequently deployed towards a particular topic, often the discussion of a specific incident, with very little additional chatter or any significant persona development.
This takedown assessment explores the tactics, techniques, and themes unique to this Egypt-attributed Twitter network, and discusses several commonalities with El Fagr’s past coordinated inauthentic behavior.
In December 2019, the Stanford Internet Observatory alerted Twitter to anoma- lous behavior in the hashtag السراج خائن ليبيا (“Sarraj the traitor of Libya”); Fayez al-Sarraj is Libya’s Prime Minister. The distribution pattern of the hashtag looked suspicious, and the images that appeared with the hashtag looked similar to those that Twitter removed in September 2019 as part of a takedown of a prior state-backed influence operation originating in the UAE and Egypt. Twitter confirmed that many accounts creating content with the “Sarraj the traitor of Libya” hashtag were related to that prior network, and took them down. Following extensive additional investigation based on the tip, Twitter shared with us a network of 36,523,977 tweets from 5,350 accounts that have been taken down. Facebook then shared with us 55 Pages linked to this Twitter network; we analyzed these Pages before Facebook removed them. We title this report “Blame it on Iran, Qatar, and Turkey”, given the prominent theme of lumping blame on these three countries for everything from terrorism throughout the Arab world to the disappearance of Malaysia Air Flight 370 to the spread of COVID-19.
Twitter reports that the network has links both to the digital marketing firm that was previously known as DotDev, which operated (or continues to, in other incarnations) out of Egypt and the UAE, and Smaat, a Saudi Arabian digital marketing firm. In December 2019 Twitter announced its largest ever state- tied takedown of a Saudi operation tied to Smaat. This new network revealed a link between the September 2019 DotDev takedown and the December 2019 Smaat takedown.
On March 26, 2020 Twitter announced a takedown of accounts targeting Ser- bian Twitter users. Twitter reported that this network—consisting of approxi- mately 8,500 accounts and more than 43 million tweets—acted in concert to cheerlead for President Aleksandar Vučić and his party, to attack his oppo- nents, and to boost the popularity and visibility of other content serving these ends. In this paper, we describe the contours of this operation and the tactics it used to achieve its aims.
On April 2, 2020, Twitter announced a takedown of datasets attributed to the social media manager of Honduran president Juan Orlando Hernández Alvarado (commonly referred to by his initials “JOH”). Among the over 3,000 accounts pulled down were the accounts of the Honduran government-owned television station Televisión Nacional de Honduras, several content creator accounts, accounts linked to several presidential initiatives, and some “like-for-likes” accounts likely in the follower-building stage. Interestingly, a subset of accounts in the dataset are related to self-identified artists, writers, feminists and intellectuals who largely posted tweets critical of the Honduran president.