Alpha Team Research: Studying an Information Operation Campaign

Alpha Team Research: Studying an Information Operation Campaign - Hong Kong and Twitter

On 19 August, Twitter disclosed a ban wave of approximately 200,000 accounts associated with anti-Hong Kong propaganda. The specific disclosure contained account information and tweets from 936 accounts. In the disclosure, Twitter outlined that this campaign broke multiple terms of service agreements within the platform, and that this botnet was attempting to undermine the legitimacy of the Hong Kong protests. Twitter used a combination of the network data from these accounts, such as source IP addresses, as well as studying the interaction of these tweets and accounts, in order to get high enough confidence to ban these accounts.

Recommendations

Monitor keywords and protected accounts for any signs of automated behavior
Work with your ZeroFOX Account Manager and Platform Specialists to spot fake accounts and issue takedowns

Details

ZeroFOX Alpha Team downloaded the accounts and tweets disclosed by Twitter in order to study the campaign. This is arguably the first publicly disclosed information operation provided by the networks, so studying how China performed this operation. Twitter released the accounts and tweets in two sets, referred to as Set 1 and Set 2.

Findings:

Set 1, 744 users and 1,906,832 tweets
- 54 languages total, Top 10:
  - Indonesian (in) 794088
  - English (en) 377943
  - Not specified 220931
  - Portugeuse (pt) 183518
  - Chinese (zh) 115283
  - Undetermined (und) 74328
  - Spanish 32818
  - Tagalog (tl) 19603
  - Korean (ko) 13168
  - Estonian (et) 8801
- 311 separate Twitter apps that were posting these tweets, Top 10:
  - IFTTT (If This Then That) 829112
  - TweetDeck 238272
  - Twitter for Android 159262
  - Twitter Web Client 157521
  - Web 121651
  - Google 118223
  - Zapier 75311
  - Twitter for iPhone 48442
  - TweetCaster for Android 23057
- Account Creation bucketed by year:
- Set 2, 196 users and 1,708,079 tweets
  - 59 languages total, Top 10:
    - Not specified 717192
    - Arabic (ar) 591104
    - English (en) 167573
    - Undetermined (und) 63166
    - Chinese (zh) 54440
    - Spanish (es) 48024
    - Portugeuse (pt) 21259
    - Tagalog (tl) 21030
    - French (fr) 4300
  - 386 separate Twitter apps that were posting these tweets, Top 10:
    - Twitter for iPhone, 687420
    - Web, 353236
    - IFTTT, 73377
    - Twitter Web Client, 64809
    - Twitter for Android, 64388
    - PreggTweets, 28377
    - TweetDeck, 282128
    - Mobile Web, 19460

Based on this quick study, one can see that a "botnet" on a network like Twitter could involve nurturing accounts so that they varying creation dates in order to not draw suspicion from automated account filters. Many of these accounts and tweets use languages from all over the world, which could implicate that the Chinese government wanted to spread propaganda in languages that consume Twitter data the most or they did not care where their purchased or nurtured accounts originated.

Next, automation is key for a massive-scale propaganda machine. IFTTT is a service that helps automate posting and engagement for its users, so its natural that if you want to run a large campaign that will quickly react to news stories or force sentiment or engagement on users, then its a good choice. The Twitter for iPhone and Web were also interesting data sources, but its been known that click farms are a great way to inflate engagement metrics and have been sold for years before this.

Lastly, the ratio of users to tweets is astonishingly high. Set 1 had 2562.94 tweets per account, and Set 2 had 8714.68 tweets per user. Its clear that these accounts broke ToS and circumvented the Twitter automation filter, but the data also shows that what the community considers a botnet may have different implications on a social network. These networks value automation to help improve user experience for their users. End users also have incomplete information - one of the ways Twitter caught these accounts was due to having access to data such as Source IP, which end users cannot get. With this information, though, some heuristics start to emerge, such as the source app and creation dates, and monitoring keywords and analyzing relationships between accounts can be beneficial for finding information operation campaigns.

ZeroFOX Alpha Team will continue to study this dataset and publish research as we dissect it more.