Twitter has taken down three separate nation-sponsored influence operations, attributed to the People’s Republic of China (PRC), Russia and Turkey. Collectively the operations consisted of 32,242 bogus or bot accounts generating the content and various amplifier accounts that retweeted it.
“Every account and piece of content associated with these operations has been permanently removed from the service,” according to the company, in a posting on Friday. “In all instances, accounts were suspended for various violations of our platform-manipulation policies.”
Researchers told Threatpost meanwhile that while the efforts are commendable, there are questions to consider, such as how pervasive influence campaigns are in general, and the role of individuals to apply critical thinking to the information they consume.
Three Disinformation Campaigns
The China-led operation consisted of 23,750 core accounts that were “involved in a range of manipulative and coordinated activities,” according to Twitter. “They were tweeting predominantly in Chinese languages and spreading geopolitical narratives favorable to the Communist Party of China (CCP), while continuing to push deceptive narratives about the political dynamics in Hong Kong.”
The good news is that the core accounts didn’t manage to gain much traction, according to the microblogging service: “They were largely caught early and…typically holding low follower accounts and low engagement.”
In addition to the core accounts, the operation also consisted of around 150,000 “amplifier” accounts, which generated no content themselves but simply retweeted the work of the core profiles.
“The majority [of these] had little-to-no follower counts either and were strategically designed to artificially inflate impression metrics and engage with the core accounts,” according to Twitter.
As for the Russian operations, 1,152 suspended accounts were associated with a media outlet called “Current Policy,” known for pushing state-backed political propaganda within Russia, said Twitter.
“A network of accounts related to this media operation was suspended for violations of our platform manipulation policy, specifically cross-posting and amplifying content in an inauthentic, coordinated manner for political ends,” according to Twitter. “Activities included promoting the United Russia party and attacking political dissidents.”
And finally, the Turkish-backed activity emanated from 7,340 related accounts that were seen “employing coordinated inauthentic activity” that was mainly targeted at domestic audiences within Turkey.
“Based on our analysis of the network’s technical indicators and account behaviors, the collection of fake and compromised accounts was being used to amplify political narratives favorable to the AK Parti, and demonstrated strong support for President Erdogan,” according to Twitter. “The broader network was also used for commercial activities, such as cryptocurrency-related spam.”
However, the accounts that were taken down also included some profiles associated with organizations critical of President Erdogan and the Turkish government. The accounts had been compromised, and were being used by the state actors to push their own agenda.
The core accounts have been placed into a public archive that includes information on impression counts, in an “attempt to further measure the tangible impact of information operations on the public conversation.” The 150,000 Chinese amplifier accounts however weren’t placed in the public archive.
Researchers: Does Twitter Go Far Enough?
Since the 2016 presidential election, Twitter has been engaged in eliminating accounts that engage in disinformation, fake news, false narratives or outright lies in the name of achieving political influence.
Banned activities on Twitter include spam and platform manipulation (defined as the use of Twitter to mislead others and/or disrupt their experience by engaging in bulk, aggressive or deceptive activity); coordinated activity (which creates the illusion of legitimate consensus on a given issue or spreads disinformation); fake accounts; attributed APT activity; distribution of hacked materials; and ban evasion. The social-media giant has steadily removed accounts it believes are violating the rules.
“This account removal is not the first time Twitter has taken this action to protect its users from information that manipulates or disrupts people’s experience, which is providing disinformation.” James McQuiggan, security awareness advocate at KnowBe4, told Threatpost. “Recently, in late 2019, they removed accounts from several countries that were providing disinformation to users.”
This has not been without controversy, with criticism coming both from those who believe the platform doesn’t go far enough, as well as from those who say the suspensions could be seen as censorship.
Josh Bohls, CEO and founder at Inkscreen, falls into the former camp, noting that it’s too easy for fake accounts to be set up in the first place.
“Twitter’s focus on user growth and engagement has led it to ignore the infiltration of fake accounts over the years,” he told Threatpost. “It’s good to see the platform finally start to pull some weeds from the Twitter garden. The social discourse on the platform would be further improved if the company began doing true account verification.”
Paul Bischoff, privacy advocate with Comparitech, meanwhile wonders if Twitter is being aggressive enough.
“Every time I see a social network announce a new account purge, I wonder about the true scope of the problem,” he told Threatpost. “Sure, 32,000 accounts sure sounds like a lot, but is it? Twitter’s efforts could have eliminated half of state-linked propaganda accounts, or it could have removed 1 percent of them – we just don’t know how big this issue really is.”
Chris Hauk, consumer privacy champion with Pixel Privacy, is however more concerned with the potential for censorship.
“While Twitter’s recent moves in removing state-linked accounts form the service makes perfect sense, I am concerned about possible future implications for Twitter users,” he told Threatpost. “Great care must be taken to ensure that users do not have tweets removed from the service or see their accounts completely removed, simply because they state an unpopular opinion, or because they disagree with a social network’s own world views.”
Regardless of Twitter’s role, ultimately consumers of social media should take their own steps to identify and then ignore influence operations, according to Chris Clements, vice president of Solutions Architecture at Cerberus Sentinel.
“The nature of social media networks makes them a compelling target for influence campaigns by state intelligence agencies,” he explained in an email interview. “By registering hundreds or thousands of fake accounts, it is possible to generate ‘trending’ content aimed at furthering government goals that is displayed widely on normal user feeds. It’s important for users of any social media accounts to understand that they are being bombarded with influence campaigns and be skeptical of the motives of any posts they see, especially if the content appears designed to be inflammatory in nature.”
Bischoff added succinctly, “Ultimately, users shouldn’t rely on Twitter to police misinformation. It’s up to individuals to critique messages, vet sources and report abuse.”
Are you on top of the shifting insider threats within your business? On June 24 at 2 p.m. ET, join Threatpost and our panel of experts for a FREE webinar, “The Enemy Within: How Insider Threats Are Changing.” Get exclusive insights on how remote working has increased the risk of insider threats, and how to gain visibility into employee behavior while striking the right balance between privacy and ease of use. Please register here for this Threatpost webinar.