Twitter has removed six sets of accounts that the site has deemed to be devoted to coordinated, state-backed propaganda activities – totaling about 5,000 accounts in all.
“We believe that people and organizations with the advantages of institutional power and which consciously abuse our service are not advancing healthy discourse but are actively working to undermine it,” said Yoel Roth, head of site integrity for Twitter, in a recent blog post. “By making this data open and accessible, we seek to empower researchers, journalists, governments and members of the public to deepen their understanding of critical issues impacting the integrity of public conversation online, particularly around elections.”
Banned activities on Twitter include spam and platform manipulation (defined as the use of Twitter to mislead others and/or disrupt their experience by engaging in bulk, aggressive or deceptive activity); coordinated activity (which creates the illusion of legitimate consensus on a given issue or spreads disinformation); fake accounts; attributed APT activity; distribution of hacked materials; and ban evasion. Over the last year or so, the social-media giant has steadily removed accounts it believes are violating the rules. Last August for instance, it suspended 248 accounts it alleged were part of a broad-ranging Iranian influence campaign.
Most of the removed accounts in this latest crop also originated in Iran — 4,779 of them, according to Roth. He said that all of the accounts are believed to be directly backed by or associated with the Iranian government.
One of the sets, consisting of 1,666 accounts, has cumulatively tweeted nearly 2 million times, mostly global news content “with an angle that benefited the diplomatic and geostrategic views of the Iranian state,” according to Roth, who added that Twitter found this to be platform manipulation. A second set of 248 accounts took the same approach, but focused in on discussions related to Israel specifically.
And a third set of 2,865 accounts were suspended for allegedly using various false personas to steer conversations about political and social issues in Iran and globally.
The Iranian accounts follow pattern of propaganda operations uncovered by FireEye, which the security firm said make use of a complex and deep network of coordinated disinformation pages linked across multiple social-media and web networks worldwide. The firm concluded that the efforts are an alleged attempt to sway public opinion towards pro-Iran stances on various issues, such as the nuclear deal.
Iran wasn’t the only country to be hit by Twitter’s house-cleaning. The site also pinpointed four Russian accounts believed to be connected with the Russian Internet Research Agency (IRA), and removed them. And, it suspended 130 fake accounts originating in Spain that were, according to Roth, directly associated with the Catalan independence movement, specifically Esquerra Republicana de Catalunya.
“They were primarily engaged in spreading content about the Catalan Referendum,” Roth noted. “The network includes fake accounts which appear to have been created with the intent to inorganically influence the conversation in politically advantageous ways. Setting up fake accounts is a violation of the Twitter Rules, full stop.”
And finally, Twitter removed 33 accounts allegedly associated with Venezuelan state-run enterprises, which Roth said were also engaging in platform manipulation targeted outside of the country. These additional accounts are directly connected with a previous group of 764 Venezuelan accounts removed in January, he added.
“While there were initial indications that these accounts were associated with the Russian Internet Research Agency, our further analysis suggests that they were operated by a commercial entity originating in Venezuela,” Roth said.
Twitter and other tech giants that have removed accounts for content reasons have come under fire from some corners – including from President Trump – as an overreach that verges into censorship.
Chris Olson, CEO of The Media Trust, said via email that influence operations have the potential to do real damage, but that Twitter is going about combatting them in the wrong way.
“These state-sponsored Twitter accounts, among others, are a clear signal that adversaries are executing campaigns to disinform the public for the express purpose of disrupting democratic processes and sowing division are afoot,” he noted. “Censorship is not the solution to this growing problem. In fact, by focusing on the message instead of the mechanisms used to spread the message, we are losing sight of how we can effectively stop these campaigns.”
He added that focusing on the third-party code that facilitates the spread of false or fraudulent content geared toward influencing our votes is a better course of action.
“While securing our elections systems is extremely important, officials and the public should pay just as much attention to an even greater threat: adversaries’ use of the digital ecosystem to undermine our democratic processes,” he said. “If we address the context, the content will stop.”
Ransomware is on the rise: Don’t miss our free Threatpost webinar on the ransomware threat landscape, June 19 at 2 p.m. ET. Join Threatpost and a panel of experts from Malwarebytes, Recorded Future and Moss Adams as they discuss how to manage the risk associated with this unique attack type, with exclusive insights into new developments on the ransomware front and how to stay ahead of the attackers.
