Ben Nimmo Profile picture
May 27, 2018 11 tweets 4 min read Twitter logo Read on Twitter
#BotSpot

H/t @josh_emerson for the initial tip on this one: an apparently Russian commercial botnet boosting political messages in Mexico.

medium.com/dfrlab/electio…
There have been claims already of Russian bots interfering in the Mexican election.

Most of the scans we've run haven't shown anything of the sort.

Always important to remember: not all bots are Russian. And even genuine Russian bots aren't always there for interference.
But then you come across retweets of stuff like this: a post from the Mexican Green Party.

By Петр Смирнов and Игорь, apparently.
Петр looks weirdly like Kris Allen. Odd, that.

And his username is an alphanumeric scramble. All looks a bit dodgy, really.
Meanwhile, Игорь has a really wide range of interests and languages. Japanese, Arabic, Russian and Spanish... and all of them retweets.
At its peak, the Green Party tweet had 697 retweets. An awful lot of them came from accounts with Cyrillic usernames.

Some of them gave locations in Russia or elsewhere in the former USSR, too.
That said, a lot claimed locations in Venezuela, too. They were clearly part of the same network, because they posted identical retweets.
But they posted Russian-language ads (not retweets) for local services in the former USSR: Clenbuterol in Ukraine, property in Russia, jobs in Belarus.

For a Venezuelan bot, that would be an odd market choice. Looks more like a Russian-language bot assuming a Venezuelan ID.
Main thing: this looks like a commercial botnet. The range of languages and subjects is too wide, and the political posts are too interspersed with other stuff.

Not an influence operation.
But we can expect to see more and more crossover between commercial and political bot use.

This was a Russian, apparently commercial, botnet which got switched to German politics just before the election there:

medium.com/dfrlab/german-…
This was an apparently American (possibly Devumi) botnet amplifying political posts in South Africa, during the ANC leadership race.

Keep your eyes open for more of this. It's going to continue. / Thread ends.

medium.com/dfrlab/electio…

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Ben Nimmo

Ben Nimmo Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @benimmo

Oct 9, 2018
Thread: just a snapshot of the increasing polarisation of the US Twittersphere ahead of the midterms.

Polarised communities proved to be an easy target for influence operations in 2014-18.

medium.com/dfrlab/electio…
Scanned three sets of paired election-related hashtags: #VoteRed / #VoteBlue, #RedWave2018 / #BlueWave2018, #FlipItRed / #FlipItBlue.

First scan covered 48 hours. Overall, pro-Democratic hashtags got significantly higher traffic (79k posts compared with 47k posts).
On this scan, users of pro-Democratic hashtags were roughly double the number of users on pro-Republican hashtags (40k users compared with 21k users).
Read 6 tweets
Oct 5, 2018
I mentioned the Kremlin's standard response technique of dismiss, distort, distract, dismay.

Quite a few of the elements are here, in the latest Russian MFA responses to the OPCW / GRU hacking story.

mid.ru/en/foreign_pol…
Dismiss: insult the critics. Plenty of that in the statement.

"Anti-Russian spy mania."
"Strong paranoia." (Not just "paranoia", you'll note.)
"Absurd anti-Russian attacks."
Interestingly, they didn't use the word "Russophobia" in this one, though it's been the bulwark of Kremlin defences since 2014.
Read 7 tweets
Oct 4, 2018
#OPCW hacking case: we've already had the Russian government trying to dismiss the latest UK / NL claims about the #GRU. That's tactic number 1.

Up next, expect attempts to distort, distract and dismay.
Distort. We saw this with the Skripal suspects, portrayed as "civilians" and snow-shy tourists.

Expect attempts to say that the photos were faked, the evidence was made up, and / or the men were harmless visitors on a diplomatic visit to fix the Embassy wifi.
Distract. Accuse the accusers.

Expect the arguments, "The West hacks people too," or "You killed civilians in Libya / Afghanistan / Vietnam / insert name here."

Which doesn't justify use of CW on civilians, or attempts to cover it up.
Read 4 tweets
Sep 13, 2018
#TrollTracker: interesting troll spike from the pro-Kremlin / pro-Assad gang against @janinedigi.

Image: @Sysomos scan of traffic over the past 7 days.
For those who don't know @janinedigi, here's a list of her awards as a war correspondent.

She reported from places including Grozny, Kosovo, Palestine, Rwanda, Iraq and Afghanistan.

Source: janinedigiovanni.com/awards-and-rec…
Here's the tweet which triggered the storm: a post saying that RT and Sputnik are not journalists.

That's a hell of a call for a genuine award-winning journalist to make, so let's look at evidence.
Read 11 tweets
Sep 6, 2018
Rare decision from @Ofcom here, finding broadcaster Ausaf UK no longer "fit and proper" to hold a licence.

Note that RT is also under scrutiny against the "fit and proper" criteria, but that Ofcom sets a high bar for these decisions.

ofcom.org.uk/__data/assets/…
Particularly striking: Ausaf TV had its licence revoked before it started broadcasting, based on the content of the associated newspaper.

Including glorification of violent jihad and endorsement of listed terrorists.
Rather unwisely, the MD of the TV station initially denied that he was linked to the newspaper, then confirmed that he was.

Making false claims to the regulator is seldom a way to win confidence.
Read 5 tweets
Sep 6, 2018
Looks like someone tried to get hashtag SkripalHoax to trend overnight.

822 mentions. It really didn't do very well.
Let's look at some of the arguments.

Probably the most popular in the pro-Kremlin crowd was the claim that the Met Police photos of the arrival in Gatwick had the same timestamp, and therefore must have been photoshopped.
... unless there's more than one arrival channel at Gatwick, and they were walking together.

(h/t @bleidl for the photo)
Read 10 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(