We started looking at the data set of tweets from banned Internet Research Agency accounts recently released by @FiveThirtyEight. This thread is intended as initial observations rather than exhaustive analysis.
In addition to a larger number of tweets (2973371 vs 203468), this dataset contains some information not in the set released by NBC - @FiveThirtyEight's team has classified them into several categories, and the follower counts at the time the tweets were captured is also present.
This chart shows the follower growth for several of the more prominent IRA troll accounts. Most were created (or at least started gaining followers) in late 2015 as the 2016 campaigns were getting underway - @JennAbrams was an outlier, having been active earlier.
Here's the tweet activity broken down into six of the categories identified by @fivethirtyeight ("non-English" and "other" are excluded.) Note that the "commercial" category is only prominent for three months, contradicting claims that the troll tweets were largely "clickbait"
We generally use retweet count to estimate audience/engagement for accounts and tweets. That metric is absent from the dataset, but we do have the number of followers each account had at the time of the tweets in question, so let's use that value instead.
This chart shows an estimate of the exposure each category received, calculated by aggregating the number of followers at the time of each tweet. The left and right-wing troll groups had similar tweet volume, but the right got far more attention (as did the news feed accounts.)
What did the accounts tweet about? These charts show the frequency of various terms in the right, left, and news feed categories. Immigration, terrorism, and Hillary Clinton are common themes on the right, while activist movements such as BLM and NoDAPL are prominent on the left.
Let's go back to this chart and look more closely at the spike in activity from the right-wing trolls in summer 2017.
Zooming in, the right-wing Kremlin troll activity accelerated massively in the 15 days leading up to the 2017 #UniteTheRight rally. The sudden dropoff in activity is likely the result of several of the major accounts (including @TEN_GOP) being banned in late August.
Here are some examples of the IRA tweets related to the #UniteTheRight rally, drawn from a dataset of tweets containing the hashtag from last year. Of particular note are the early tweet from @lilaastrs and @TEN_GOP's retweet of 4chan's @polNewsInfinity the day before the rally.
(Old #UniteTheRight thread posted at the time of the 2017 event.)
Updating this thread following a closer look at IRA troll account @TEN_GOP's involvement in the #UniteTheRight traffic. First, here's the retweet traffic for @polNewInfinity's #UniteTheRight tweet; it appears that @TEN_GOP gifted it with a second wave of attention.
Second, @TEN_GOP posted three #UniteTheRight tweets of its own on August 12th, 2017, the day of the rally. They highlight the chaos, were retweeted a combined total of 3310 times, and @bakedalaska even got his own shout-out. #AltWankers
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Meet @ShawneeDeaver. This account's first tweet - and only non-reply tweet - is 2scEY0T, an apparently random 7-character alphanumeric code. The rest of the tweets are replies sent within hours of its creation; the collage is representative. (Thanks @OlgaNYC1211 for the lead).
We decided to look for more accounts like it. We started by harvesting the recent replies to the accounts that @ShawneeDeaver replied to, and filtering the results to accounts with a 7-character code as their first tweet and all subsequent tweets being quickly-launched replies.
Let's take an updated look at the traffic related to Russia Insider, a Russian news site featuring sections such as "Western Collapse", "The Jewish Question", "Free Assange", "Russiahoax", and "EU Conservative Uprising".
(previous Russia Insider thread in which failed Congressional Candidate Paul Nehlen featured prominently)
While looking for streams of the Kavanaugh confirmation cloture vote yesterday, we stumbled on @Seekandfind, an account that linked Russia Today's stream. Spoiler alert - this account is (at least presently) a bot with signs of some human interjections.
This account is extremely high-volume (900+ tweets per day at present) and uses a massive cornucopia of different automation tools to tweet (mostly Microsoft PowerApps, Buffer, Integromat, IFTTT, and Zapier).
What does @Seekandfind tweet about? 37.1% of tweets contain one or more of the keywords shown in this chart - the Trump, Hillary Clinton, MSM/fake news, and deep state categories being the most prominent.
On October 2nd, the news came out that envelopes containing suspected ricin had been mailed to the Pentagon and the White House. We downloaded tweets containing the word "ricin" a few hours after the news broke, resulting in 45007 tweets from 29308 accounts.
Here's the retweet network for "ricin" on 2018-10-02. It consists almost entirely of right wing accounts, most of which are speculating that the ricin mailing was left-wing terrorism.
We tested a sample of 10000 of the accounts with ricin tweets for automation (based on either 24/7 activity or 90%+ of tweets being posted via automation services/custom apps). 817 (8.2%) were flagged as bots. Let's look at a few of them.
Yesterday (2018-10-02), four members of the white supremacist group known as the "Rise Above Movement" were arrested by the feds for their part in the violence at the #UniteTheRight rally in Charlottesville in August 2018. Let's take a look at related Twitter traffic.
(previous thread on the Twitter activity surrounding the #UniteTheRight hashtag leading up to and during the rally last year.)
We downloaded tweets containing "Charlottesville" and "arrests", resulting in 15082 tweets from 12331 accounts beginning with the first report of the arrests (from @HenryGraff).
How does one go about detecting Twitter bots (automated accounts)? Let's take a look at three different tests for detecting signs of automation, and try them on three different sample sets of accounts.
The first two tests may be familiar from previous threads:
1. 24/7 tweet activity - this could point to multiple human operators, but is usually the result of automation/tweet scheduling. 2. Use of automation services such as IFTTT or custom apps built with the Twitter API.
The tweet schedule plots shown in the previous tweet can be used to visually perform both these tests. You can generate them yourself for accounts of interest here: makeadverbsgreatagain.org/allegedly