Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Ben Nimmo Profile picture
Ben Nimmo
@benimmo
Writer, linguist, diver. Global Threat Intel Lead @Meta. Investigating, analysing and exposing influence ops. RT ≠ endorsement.
2 subscribers
Oct 9, 2018 • 6 tweets • 4 min read
Thread: just a snapshot of the increasing polarisation of the US Twittersphere ahead of the midterms.

Polarised communities proved to be an easy target for influence operations in 2014-18.

medium.com/dfrlab/electio… Scanned three sets of paired election-related hashtags: #VoteRed / #VoteBlue, #RedWave2018 / #BlueWave2018, #FlipItRed / #FlipItBlue.

First scan covered 48 hours. Overall, pro-Democratic hashtags got significantly higher traffic (79k posts compared with 47k posts).
Oct 5, 2018 • 7 tweets • 3 min read
I mentioned the Kremlin's standard response technique of dismiss, distort, distract, dismay.

Quite a few of the elements are here, in the latest Russian MFA responses to the OPCW / GRU hacking story.

mid.ru/en/foreign_pol… Dismiss: insult the critics. Plenty of that in the statement.

"Anti-Russian spy mania."
"Strong paranoia." (Not just "paranoia", you'll note.)
"Absurd anti-Russian attacks."
Oct 4, 2018 • 4 tweets • 2 min read
#OPCW hacking case: we've already had the Russian government trying to dismiss the latest UK / NL claims about the #GRU. That's tactic number 1.

Up next, expect attempts to distort, distract and dismay. Distort. We saw this with the Skripal suspects, portrayed as "civilians" and snow-shy tourists.

Expect attempts to say that the photos were faked, the evidence was made up, and / or the men were harmless visitors on a diplomatic visit to fix the Embassy wifi.
Sep 13, 2018 • 11 tweets • 6 min read
#TrollTracker: interesting troll spike from the pro-Kremlin / pro-Assad gang against @janinedigi.

Image: @Sysomos scan of traffic over the past 7 days. For those who don't know @janinedigi, here's a list of her awards as a war correspondent.

She reported from places including Grozny, Kosovo, Palestine, Rwanda, Iraq and Afghanistan.

Source: janinedigiovanni.com/awards-and-rec…
Sep 6, 2018 • 5 tweets • 2 min read
Rare decision from @Ofcom here, finding broadcaster Ausaf UK no longer "fit and proper" to hold a licence.

Note that RT is also under scrutiny against the "fit and proper" criteria, but that Ofcom sets a high bar for these decisions.

ofcom.org.uk/__data/assets/… Particularly striking: Ausaf TV had its licence revoked before it started broadcasting, based on the content of the associated newspaper.

Including glorification of violent jihad and endorsement of listed terrorists.
Sep 6, 2018 • 10 tweets • 4 min read
Looks like someone tried to get hashtag SkripalHoax to trend overnight.

822 mentions. It really didn't do very well. Let's look at some of the arguments.

Probably the most popular in the pro-Kremlin crowd was the claim that the Met Police photos of the arrival in Gatwick had the same timestamp, and therefore must have been photoshopped.
Sep 5, 2018 • 4 tweets • 3 min read
Less traffic on the word "Skripal" than you might think today, given the news.

Per @Sysomos, around 20k mentions. Most of the 10 most-retweeted posts are breaking news coverage from, inter alia, @AP and @MarkUrban01.

Honourable mention to @RVAWonk, too.
Sep 5, 2018 • 5 tweets • 2 min read
Crown Prosecution Service: "there is sufficient evidence to provide a realistic prospect of conviction and it is clearly in the public interest to charge Alexander Petrov and Ruslan Boshirov" with the attempted murder of the Skripals.

cps.gov.uk/cps/news/cps-s… Met Police: "CCTV shows them in the vicinity of Mr Skripal’s house"

news.met.police.uk/news/counter-t…
Sep 4, 2018 • 4 tweets • 3 min read
Wow. Traffic on @Nike after they announced that @Kaepernick7 will be the face of the anniversary #JustDoIt campaign.

If they were aiming for attention, it worked. Average of 1.4 tweets per user.

66.2% retweets.

Consistent with organic traffic flows, not substantially gamed traffic.
Aug 29, 2018 • 20 tweets • 9 min read
Thread: how a cluster of websites laundered Iranian regime messaging and passed it around the network @FireEye exposed last week.

medium.com/dfrlab/trolltr… One of the interesting things about the original network was how often they cited a website called IUVMPress. (The acronym stands for the International Union of Virtual Media.)

Here's Instituto Manquehue, one of the sites identified by FireEye, listing them as an author.
Aug 29, 2018 • 5 tweets • 2 min read
Catching up: interesting finding from @Ofcom on a pro-Saudi advert which broke the ban on political advertising.

(Page 9 onwards.)

ofcom.org.uk/__data/assets/… One-minute clip. Repeated 56 times from March 6-8.

Wording included, "Led by King Salman and Crown Prince Mohammed Bin Salman, these action-oriented goals are within reach."

This during MBS' visit to the UK.
Aug 27, 2018 • 7 tweets • 3 min read
Interesting sample of #DissolveTheUnion over the past week, as highlighted by @jennifermjones.

10k tweets, from just over 2k users. Average: 4.9 tweets / user.

In spontaneous traffic, the average is usually below 2.2. Higher usually shows bots or coordinated action. Here's why. The ten most active accounts contributed 2,247 tweets. Almost a quarter of the total sample.

Oh, and 11,534 hashtags.
Aug 27, 2018 • 22 tweets • 8 min read
Thread: analysing content on the Iran-linked websites which @FireEye exposed last week, h/t @LeeFosterIntel.

Triangulated identification was based on registrant emails, Iranian phone nos for Twitter accounts, and content.

medium.com/dfrlab/trolltr… Here's Instituto Manquehue, ostensibly a Latin American think tank, reporting a Morales attack on US SecDef Mattis' visit to the region.

The LatAm subject is understandable, but the language is identical with Iranian state outlet HispanTV, writing two days before.
Aug 22, 2018 • 7 tweets • 4 min read
Top takeaway from #IranDisinfo: the US' polarisation on social media makes it a sitting target for foreign influence attempts.

Here's another one. Unlikely to be the last. Entertaining to see LibertyFront sharing Sputnik.

Birds of a feather...
Aug 21, 2018 • 4 tweets • 2 min read
Microsoft takes down spearphishing sites created by Fancy Bear.

Ahead of the US midterms, the pace is accelerating. But 2020 is the big target out there.

Remember, the original troll factory had two and a half years to build up.

blogs.microsoft.com/on-the-issues/… Targets this time:

@IRIglobal
@HudsonInstitute
US Senate (three domains)
Office 365

Compare with the probable troll farm accounts taken off Facebook at the end of July, which targeted liberals.
Aug 16, 2018 • 26 tweets • 9 min read
Thread: more analysis on the accounts Facebook took down two weeks ago, including their origins, how they interacted with Americans, and how they tried to cover their tracks.

Three posts. First one here: medium.com/dfrlab/trolltr… We don't have 100% attribution. They hid their tracks better than the original Russian troll farm (more on that later).

Various pieces of evidence point to the probability this was the troll farm / Internet Research Agency again.

newsroom.fb.com/news/2018/07/r…
Aug 15, 2018 • 15 tweets • 5 min read
Thread: If you want to know how fake likes, loves and follows get industrialised on #Facebook, here's a good example from #Brazil.

The fakes boosted hyper-partisan posts in Mexico ahead of the election.

Fake engagement's an international business.

medium.com/dfrlab/electio… Here are the reactions to two hyper-partisan Mexican posts, on different pages.

Note the number of accounts in common. Looks like an organised brigade.
Aug 2, 2018 • 8 tweets • 4 min read
One of the interesting things about the latest Mueller indictment: it looks like there were two Russian troll operations targeting the US in 2016, not just the Internet Research Agency one.

medium.com/dfrlab/trolltr… The GRU used the persona of "Alice Donovan" to create the DCLeaks Facebook page.

There's a lot of research been done on that persona, but having it linked so directly to DCLeaks is interesting.
Aug 1, 2018 • 4 tweets • 2 min read
OK, here's where it gets interesting with the latest takedown of FB accounts.

Main question was whether they were the Russian troll farm.

Left, troll farm a/c "Native Americans United." Right, Aztlan Warriors.

(H/t @UsHadrons for the spot. See medium.com/@ushadrons/thi…) And another one.

Left, troll farm account "feminism_tag". Right, the Resisterz page, taken down this week.

(See medium.com/@ushadrons/thi…)
Jul 31, 2018 • 32 tweets • 11 min read
Thread: The accounts which Facebook exposed today as being inauthentic focused on divisive issues and polarising topics in the US.

@DFRLab had a look at them before the takedown.

medium.com/dfrlab/trolltr… Here's the most eyecatching: "Resisters." Posed as feminist, progressive and anti-Trump, and said it was "amplifying the voices from targeted communities."

Clunky use of language there...
Jul 25, 2018 • 6 tweets • 2 min read
Interesting from @Ofcom: 2018 survey of news consumption in the UK.

TV still beats online as a news source over all age groups, but for 16-24s, internet predominates.

ofcom.org.uk/__data/assets/… TV the most popular news source, used by almost 80% of adults.

Internet used by around 2/3.

Radio and newspapers below 50%.