Inauthentic Twitter Accounts Continue Pushing For War With Iran

How Twitter’s negligence allows nefarious actors to distort the public debate

Here goes nothing..

I don’t want to have to write this post. Really, I don’t.

I would much prefer tweeting what I am about to share, only I can’t.

You see, Twitter suspended my account last July, stating that I had engaged in “abusive behavior.” In short, my account was suspended from Twitter for using the words “idiot” and “moron” in response to tweets from @LisaMar91564392 (aka “Lisa the Nationalist for Canada”):

@LisaMar91564392 is a sockpuppet (an account created to mislead/deceive)

My ultimate preference, however, would be not having to (repeatedly) publicly call out Jack Dorsey (and Twitter, by extension) for allowing their platform to wreak such tremendous havoc across the world. I would much prefer that Twitter actually implement the proactive approach to mitigating against platform manipulation/information operations that they tout.

Writing this post is unpleasant for reasons that extend well beyond my hatred of writing.

I am putting my life in danger by writing this post, but it’s something that absolutely needs to be done.

As a direct result of calling attention to platform manipulation efforts that Twitter refuses to acknowledge (let alone properly address), I have received numerous death threats, I have been doxed, and my Twitter account was frequently the target of (unjust) mass reporting.

In October, I wrote “State-Sponsored Twitter Accounts Pushing For War With Iran,” where, among others, this graph appears:

The post provides a high-level overview of some of the key individuals and groups involved in a massive information operations effort — supported by State Department funding — that has been pushing for war with Iran.

Over the past few days, there has been lots of discussion on Twitter about the legitimacy of the Trending #IraniansDetestSoleimani hashtag.

<ASIDE>

Yoel Roth is Twitter’s Head of Site Integrity. I can objectively say that he is failing. Miserably, in fact.

Seems Twitter may finally be realizing this as well given Yoel’s recent tweet:

I would love to know how many people Twitter currently has functioning in that capacity (“senior investigators”), because it certainly feels like the answer is zero.

<ASIDE>

Social Forensics sampled over 100K tweets (from Jan 6th and 7th) that include the #IraniansDetestSoleimani hashtag.

Next, we compared the accounts from that dataset with the accounts appearing in the graph shared earlier in this post.

Of the 5,454 (active) accounts from said graph, 998 (18%) resurfaced when looking into the #IraniansDetestSoleimani hashtag.

Translated: nearly 1/5th of the accounts (998) identified in our post from October have recently tweeted, retweeted or were mentioned in tweets where #IraniansDetestSoleimani appears

The below graphic highlights accounts that have re/tweeted #IraniansDetestSoleimani a minimum of 10 (291 accounts), 50 (74 accounts), and 100 times (27 accounts), respectively. It then cycles through 4 accounts (@pedare_soshia, @sHahgol_iran, @hashemasa, @khazaei_parvi) — all of which have tweeted and/or retweeted #IraniansDetestSoleimani more than 100 times — while linking to accounts each highlighted account is Following:

Filtering the dataset to include accounts with a minimum of 100 re/tweets (27 accounts) and reapplying visual clustering yields this graph:

There are 22 accounts above (rather than 27) as 5 lack Follower/Following relationships with the others (i.e. this graph only includes connected accounts)

Here are profiles of the 22 connected accounts from the graphic above (usernames available here):

I am certain accounts like @chooooooole, for example, represent the sentiments of authentic Iranians (aren’t you?):

Worth noting that each of the 22 accounts were Following @IranDisinfo when the (connections) data was sourced. That account belongs to the Iran Disinformation Project, a state-funded initiative that had their funding ($1.5 million grant from State Department) suspended in May, as a result of trolling activists (myself included).

Social Forensics can state with confidence that these 22 accounts continue to engage in coordinated inauthentic activity. Moreover, the graph featured in this post contains thousands of accounts that violate Twitter Rules.

Gaming #IraniansDetestSoleimani

The hashtag took off after this tweet from @mohmd_mozafari on Jan 6th at 11:29am (EST):

Here are 10 high engagement tweets that all took place within minutes after @mohmd_mozafari’s tweet (each was posted at 11:30am or 11:31am):

These tweets come from the accounts of both real people (@mohmd_mozafari, for example) and also sockpuppet/inauthentic accounts (@pedare_soshia, for example).

It’s important to mention that accounts of real people often benefit (knowingly) from artificial amplification (and where it’s also common for those behind said accounts to operate multiple sockpuppet accounts/networks).

I find it difficult to believe that @mohmd_mozafari is not involved with the vast information operations at play here, given each of his tweets is heavily amplified by inauthentic accounts (at the very least, he has to be aware that this is taking place).

Additionally, @mohmd_mozafari has opted to follow a material number of inauthentic accounts, which certainly is interesting, considering many are the very same ones that regularly contribute to the artificial amplification of his tweets (in turn, creating the illusion of support; number go up).

Next, we’ll take a closer look at the @pedare_soshia account:

On several occasions in the past month, the account has churned out 86 to 192 tweets per hour (192 tweets per hour = tweeting every 19 seconds.. for an hour):

Allegedly

Here are @pedare_soshia’s tweet counts — broken out by hour — from Jan 6th and Jan 7th (16th hour on Jan 6th is when the account started heavily pushing the #IraniansDetestSoleimani hashtag):

Moreover, the account has been on a retweet binge as of late. This is common of accounts engaging in inauthentic activity, particularly when they are actively contributing to gaming hashtags:

Allegedly

The account tweeted 1,440 times Monday and Tuesday.

Considering it has averaged 57 tweets per day over the last month (excluding Jan 6th and 7th), this most certainly is atypical, and most definitely resembles coordinated inauthentic activity.

Over the last month, the @pedare_soshia account has tweeted 3.2K times, and where 75% (2.4K) of said tweets were retweets.

Here are the accounts that were most commonly amplified by @pedare_soshia (along with the number of times each account was retweeted):

To spare you some time, the majority of accounts above are sockpuppets (which, by definition, are in violation of Twitter Rules).

Sockpuppets retweeting sockpuppets. Creating ad inventory in the process, which Twitter then monetizes. Yep, that’s Twitter in a nutshell.

Geoff Golberg is an NYC-based researcher (and entrepreneur) who is fascinated by graph visualization/network analysis — more specifically, when applied to social networks and blockchain activity. His experience spans structured finance, ad tech, and digital marketing/customer acquisition, both at startups and public companies.

Geoff is the Founder/CEO/Janitor of Social Forensics, where he spends (far too much of) his time developing techniques and building tools to identify social media manipulation (of various flavors!).

Read about Geoff’s war with Twitter here!