ميدان_التحرير_الان — hashtag visualizations
Fake accounts bombarded top trending hashtags in Egyptian Twitter with obvious, automated spam while protests were breaking out on the ground.
Around 5pm EST on September 21, I noticed some suspicious accounts that were spamming hashtags trending in Egypt using IFTTT (“If This Then That”), a web service that automates social media posting.
“If This Then That, also known as IFTTT, is a free web-based service to create chains of simple conditional statements, called applets. An applet is triggered by changes that occur within other web services such as Gmail, Facebook, Telegram, Instagram, or Pinterest.”
I collected a sample of 10,732 tweets for hashtag ميدان_التحرير_الان. (“Tahrir Square now”) and found that 2,139 tweets had been sent using IFTTT. An additional 69 tweets were sent by one obviously fake/spam account using Twitter Web App. In total, 37 fake accounts tweeted 2,228 tweets. 21% of my dataset originated from obviously fake accounts that bombarded protest-related hashtags with what seemed to be ISIS content.
I was surprised to see automated ISIS spam in trending hashtags because Twitter aggressively bans all ISIS content and these tweets were extremely obvious. Is ISIS really spamming Egyptian hashtags or is something else going on here?
Lobna Gouda noticed the fake accounts and denounced them earlier in the day on Saturday.
Lobna also told me that whoever is operating the fake accounts is closely monitoring the protests and changing the hashtags as trends evolve. If a word is added to a hashtag, the spam accounts adjust their tweets in order to keep the spam inserted into the trending topics.
This is a deliberate campaign targeting the protests in Egypt.
I isolated the fake accounts and made a graph of the hashtags they were targeting.
I also made a graph of the fake accounts and the sources they used to tweet — mainly IFTTT. Many of the fake accounts used western-sounding, female first and last names, others used a series of letters such as IIIIIIIIIlII12 — with a number on the end. They were not subtle.
Here are samples of the suspicious accounts that tweeted spam using IFTTT.
I found one spammy fake account that was not using IFTTT but was tweeting using the same patterns, bombarding Egyptian protest hashtags with repeater tweets containing ISIS spam.
These tweets were very obviously spam and followed a similar format which included several hashtags, a date & time and videos with suspiciously high view counts in the tens or hundreds of thousands.
Several tweets had videos with a red, animated arrow such as the tweets below. These tweets followed a similar pattern using many different hashtags and included a date and time. Again the videos had suspiciously high view counts.
Several of the spam accounts which I manually checked were old accounts but had unusual tweet histories. The accounts appeared to have few or zero tweets previous to this weekend and recently “woke up” and started tweeted automated ISIS spam. Either someone scrubbed their tweet history or these accounts have been dormant since their creation dates and just started tweeting.
The spam is very obvious in Gephi graphs. Due to the high level of activity, the fake accounts stand out like stains in the network.
I spoke with, Ganzeer, one of Egypt’s most famous street artists, about the fake accounts. He also noticed the obvious fakery and told me he thought it was possible that Egyptian state security services could be using some kind of bot technology to flood all protest-related hashtags with Islamist/Daesh/ISIS propaganda to make it look like the protests are Islamist-motivated and thus allowing the state to play the terrorism-crackdown card to which it often resorts.
The fake accounts were the top users for hashtag ميدان_التحرير_الان which at the time I began collecting tweets was the #1 trending hashtag in Egypt. Several of these accounts are now suspended.
Social media researcher Marc Owen Jones also found anomalies in Twitter data relating to the protests in Egypt and tweeted a thread with his findings:
Unfortunately, it’s not possible to determine who was operating the fake ISIS accounts but someone is attempting to disrupt the digital trends that correspond to the protests in Egypt. The protesters do not know who is behind the campaign and it’s entirely possible that this is black propaganda, not associated at all with the protests and designed to discredit and malign the protesters by attempting to link them to terrorists.
Update: Monday September 23
The spam campaign continued throughout the day today.
IFTTT responded on Twitter advising they had deactivated the accounts and were working to prevent similar, future activity.
But I checked shortly after and found several new accounts still actively spamming the hashtag انزل_انت_مش_لواحدك
Notes: Gephi graphs in this blog were created using OpenOrd and Force Atlas 2 layout algorithms and Tweets were collected using Tweet Archivist from 2019–09–21 21:04:22 UTC to 2019–09–22 19:35:14 UTC.
