The Epoch Times’ Well-Oiled Propaganda Machine

How Twitter is being weaponized to amplify conservative media

Image for post
Image for post
Network graph representation of 44,198 Twitter accounts that tweeted, retweeted, or were mentioned in tweets which include links to “TheEpochTimes.com” (source data: 122,892 tweets from August 16th to August 22nd, 2019)

Background Information

Despite amassing one of the largest social media followings of any news outlet, The Epoch Times’ operations remain tremendously opaque.

Last month, NBC News’ Brandy Zadrozny and Ben Collins wrote a fantastic, investigative piece on the media organization.

Below are some of the key takeaways from their 5-month long investigation:

  1. The Epoch Times is a New York-based nonprofit news outlet that has been around for nearly two decades
  2. Prior to 2016, The Epoch Times generally stayed away from U.S. politics
  3. Their ownership/operation is closely linked to Falun Gong, a Chinese spiritual community with the stated goal of toppling China’s government
  4. The Epoch Times operates alongside digital video outlet New Tang Dynasty (NTD) — both entities are part of the Epoch Media Group umbrella
  5. In the last 6 months, The Epoch Times has spent more than $1.5 million on about 11,000 pro-Trump Facebook ads (more than any organization outside of the Trump campaign itself)
  6. In April (at the peak of their ad spend), videos from The Epoch Times and NTD “combined for around 3 billion views on Facebook, YouTube and Twitter, ranking 11th among all video creators across platforms and outranking every other traditional news publisher, according to data from the social media analytics company Tubular.”
  7. Epoch Media Group’s network of news sites and YouTube channels have functioned as a conduit for conspiracy theories — including anti-vaccination propaganda and QAnon — to reach the mainstream
  8. The Trump family seems to be fond of The Epoch Times — the president’s Facebook page has linked to their content at least 6 times this year and Donald Trump Jr. has tweeted their stories as well
  9. A former journalist with The Epoch Times described working conditions akin to Russian troll farms (and where his articles were edited to remove outside criticism of Trump)
  10. Epoch Media Group’s business has been thriving in the Trump era — The Epoch Times doubled their 2016 revenue in 2017 (bringing in $8.1 million) while NTD grew revenue by 150% over the same period (earning $18 million in 2017)

Whereas NBC News’ research focused on Facebook, I delved into The Epoch Times across Twitter’s platform—pulling 122,892 tweets (inclusive of retweets) that include a link to The Epoch Times’ content (tweets between August 16th and August 22nd, 2019).

This was done to better understand the types of accounts sharing links to The Epoch Times.

In this post, we’ll explore the profile attributes/behaviors of Twitter accounts driving traffic to The Epoch Times.

Let’s jump right into the data.

Below is a network graph representation of 44,198 Twitter accounts that tweeted, retweeted, or were mentioned in tweets which include links to “TheEpochTimes.com” (source data: 122,892 tweets from August 16th to August 22nd, 2019):

Image for post
Image for post
Each dot (node) represents a Twitter account. Lines connecting accounts (edges) represent relationships between accounts (for example, if account A adds account B to a tweet where Account A has also linked to The Epoch Times’ content, then Account A and Account B will appear connected via an edge in the graph)

Here’s a summary of the dataset (44,198 accounts):

Image for post
Image for post
un: maga = “MAGA” appears in account’s username; dn: trump = “Trump” appears in account’s display name; bio: hashtag = account’s bio includes a hashtag; url: qmap(dot)pub = account’s url field links to qmap(dot)pub

Accounts Related to QAnon

The dataset includes ~2K accounts which I have flagged as QAnon-related for one of the following reasons:

  1. Account’s username includes “QAnon”
  2. Account’s display name includes “QAnon”
  3. Account’s bio includes “QAnon”
  4. Account’s profile links to qmap(dot)pub in the URL field
  5. Account’s profile links to qanon(dot)pub in the URL field

Below are a few accounts where profiles link to qmap(dot)pub in the URL field (dataset includes 212 total):

Reviewing the most recent 3.2K tweets for the accounts (@S246278910, @Bubalub1021, @_Luv_MAGA, @Nana4Trump2020), here’s a sampling of accounts that were amplified (retweeted) by each of the 4 accounts (along with the number of retweets):

Image for post
Image for post
Most recent 3.2K tweets were pulled (on August 31st, 2019) from @S246278910, @Bubalub1021, @_Luv_MAGA, and @Nana4Trump2020 accounts. Data above focuses only on retweets. For example, 70 of @S246278910's most recent 3.2K tweets were retweets of @realDonaldTrump (156 for @Bubalub1021; 246 for @_Luv_MAGA; 137 for @Nana4Trump2020). Combined, the 4 accounts retweeted @realDonaldTrump 609 times. NOTE: the 10th most retweeted account (@drawandstrike; 93 Total RTs) is that of Brian Cates, a columnist with The Epoch Times (Cates formerly wrote for Breitbart)

Separately, it is also worth highlighting “Justice Time” (@JustinTraver3). The account has included a photo or video with their tweets, on average, nearly 50 times per day since being created in March 2018 (functioning to augment their tweets with propaganda that is more visual in nature):

Image for post
Image for post

The 212 accounts that link to qmap(dot)pub have tweeted a combined 5.8 million times.

Moving forward, we’ll limit the dataset to Twitter accounts where the degree is greater than or equal to 10 (doing so will focus the data review to follow on accounts which appear within the dataset with the most frequency) — resulting in 2,667 accounts.

Here’s a summary of the limited dataset (2,667 accounts):

Image for post
Image for post

Accounts Averaging 100+ Tweets Per Day

28% (752) of the 2,667 accounts have, on average, tweeted 100 or more times per day since being created.

Below are 15 examples (including “Conservative Twit Bot”, “Disabled Vet 2”, and “Deb the Nationalist”). Each of these accounts has, on average, tweeted 500 or more times per day since their creation (@ShirleyRinguet5, @ConservTwitBot, and @lacerci65 are averaging more than 1,000 tweets per day!):

Image for post
Image for post
Accounts include: @ShirleyRinguet5 (average tweets per day: 1,245), @ConservTwitBot (1,147), @lacerci65 (1,132), @fasting39 (909), @sunnysuh8 (814), @HTown63840180 (684), @Donna78700883 (679), @Bradd65181646 (663), @Marilyn2617 (632), @IsidorMeyer1 (589), @2Disabled (582), @Kmiele1 (564), @1Howiedubz (563), @DebraMMason1 (546), @Mmarty1230 (526)

The 15 accounts have tweeted a combined 3.9 million times.

Reviewing the most recent 3.2K tweets for the accounts, here’s a sampling of accounts that were amplified (retweeted) by at least 10 of the 15 accounts (along with the number of retweets):

Image for post
Image for post
Data was collected August 31st, 2019. Sorted above by 2nd column (“Total RTs”), largest to smallest

As was the case when tweets from the 4 QAnon-related accounts were reviewed, @realDonaldTrump is the most retweeted account here as well (@JackPosobiec, @charliekirk11, @RealSaavedra, @kbq225, @catturd2, @JudicialWatch, @prayingmedic, @TomFitton, @BreitbartNews, @drawandstrike, @dbongino, @StormIsUponUs, @SebGorka, @QTAnon1, @SaraCarterDC, @Imamofpeace, @ChuckCallesto, @GhostTrumps, and @DonaldJTrumpJr round out the 20 most retweeted accounts).

Accounts With MAGA/Trump In Bios

44% (1,175) of the 2,667 accounts have profile bios which contain “MAGA” and/or “Trump” (923 accounts include “MAGA” in their bios; 691 accounts include “Trump” in their bios).

TRANSLATED: 1,175 accounts that tweeted links to The Epoch Times’ content are accounts which have profile bios containing “MAGA” and/or “Trump”

Below are 15 examples (including “JamieR Army Girl”, “Based Lady”, and “NJ Patriot”):

The 15 accounts have tweeted a combined 3.3 million times.

Reviewing the most recent 3.2K tweets for the accounts, here’s a sampling of accounts that were amplified (retweeted) by at least 10 of the 15 accounts (along with the number of retweets):

Image for post
Image for post
Data was collected September 7th, 2019. Sorted above by 2nd column (“Total RTs”), largest to smallest

The 20 most retweeted accounts based on these 15 accounts are @realDonaldTrump, @prayingmedic, @drawandstrike, @charliekirk11, @JudicialWatch, @SaraCarterDC, @StormIsUponUs, @SebGorka, @EpochTimes, @BreitbartNews, @TomFitton, @RealSaavedra, @JackPosobiec, @TrumpWarRoom, @Jali_Cat, @dbongino, @DavidJHarrisJr, @marklevinshow, and @DonaldJTrumpJr.

Accounts With Hashtags In Display Names

4% (109) of the 2,668 accounts have display names that include hashtags.

Below are 15 examples (including “#45Cultist”, “#FINISHTHEWALL”, and “#MakeDCListen”):

Image for post
Image for post
Accounts include: @svagdis (“#VoteRed #RepealNCVIA #Vaxxed #KAG2020”), @griff4d1 (“dennis g #MAGAveteran”), @deronda_sears (“Deronda Sears #MAGA”), @GiselleSmith19 (“Giselle Smith#MAGA”), @Becky19531 (“Becky#QFDShadowbanned”), @KarrieFleetwood (“Karrie #MAGA #Trumplican #KAG2020”), @dfal182 (“Denise F #DeportThemAllNow”), @LyndaG1963 (“#45Cultist”), @ChgocadChic (“#MakeDCListen”), @HLAurora63 (“ALS 1963 #MSMSUCKS”), @ARealPrincesa (“Olga #PuertoRicans4Trump2020”), @DoriMuetz (“#Trump_Gal_2.0 Dori Muetz #MAGA”), @Hoya97 (“#FINISHTHEWALL”), @4djt2016 (“#KAG2020”), @freenaynow (“DARREL NAY #QAnon”)

The 15 accounts have tweeted a combined 3.3 million times.

Reviewing the most recent 3.2K tweets for the accounts, here’s a sampling of accounts that were amplified (retweeted) by at least 10 of the 15 accounts (along with the number of retweets):

Image for post
Image for post
Data was collected September 2nd, 2019. Sorted above by 2nd column (“Total RTs”), largest to smallest

The 20 most retweeted accounts based on these 15 accounts are @realDonaldTrump, @charliekirk11, @JudicialWatch, @TomFitton, @StormIsUponUs, @prayingmedic, @drawandstrike, @SaraCarterDC, @RealSaavedra, @WhiteHouse, @DonaldJTrumpJr, @dbongino, @catturd2, @ScottPresler, @SebGorka, @freenaynow, @Jali_Cat, @Thomas1774Paine, @JackPosobiec, and @DrREpstein.

Iranian-Focused Propaganda & MAGA & The Epoch Times, Oh My!

In June, The Intercept’s Murtaza Hussain uncovered that “Heshmat Alavi” (@HeshmatAlavi) is a persona — a fake account being run by a team of Mujahadeen-e-Khalq (MEK) operatives.

Although Twitter initially suspended the account in response to The Intercept’s investigation, the suspension was short-lived. “Heshmat” is now back to using Twitter as a conduit for spreading propaganda (and attacking journalists in the process). Meanwhile, my account remains suspended — for calling attention to the coordinated inauthentic activity of “Heshmat” (and others).

Meet Brian Cates

Brian Cates (@drawandstrike) is a columnist with The Epoch Times. Mr. Cates’ account appears several times in the data reviewed earlier, as his tweets are often retweeted by the same accounts that share The Epoch Times’ content.

The @ShirleyRinguet5 account (first account that appears in the “Accounts Averaging 100+ Tweets Per Day” section), for example, retweeted @drawandstrike more than 20 times between August 25th and August 31st, 2019 (@ShirleyRinguet5 has, on average, tweeted 1,200+ times per day since the account was created in December 2018):

Image for post
Image for post
Twitter profile of @ShirleyRinguet5 (screenshot captured September 3rd, 2019)

In May 2018, Mr. Cates replied to a tweet from “#TrumpMyPresident” (@MulcahyA) stating that he’s “good at RT’ing those other 3 guys” (where the ‘3 guys’ being referenced are @HeshmatAlavi, @ThomasWictor, and @Debradelai):

Image for post
Image for post

Ironically, “Heshmat” is the only account (of the 3) still active today:

Image for post
Image for post

Earlier this summer, “Heshmat” celebrated my account’s (unjust) suspension with a thread (which, of course, was amplified by a bunch of fake accounts):

Image for post
Image for post
In June, The Intercept uncovered that @HeshmatAlavi is a fake account (run by a team of MEK operatives)

In the thread, “Heshmat” tags 10 accounts — one of them being @drawandstrike (@almostjingo, @steph93065, @CarrollQuigley1, @GeorgWebb, @eyad1949, @EmadAlmudaifer, @HNIJohnMiller, @rising_serpent, and @SayWhenLA round out the group).

Back in July 2018, Mr. Cates was tweeting his support for “Heshmat” — once again, a fake account run by a team of MEK operatives:

Image for post
Image for post

Here’s the million dollar question: how are The Epoch Times/Mr. Cates and the MEK/“Heshmat Alavi” connected?

<<START: OPTIONAL SECTION>>

Below is a network graph representation of accounts that “Heshmat” follows (235; i.e. Following when viewing the profile of @HeshmatAlavi) — where each node (dot) represents one of the 235 accounts and where edges (lines) represent Following/Follower relationships:

Image for post
Image for post
Nodes appear sequentially based on the order in which they were followed (earliest to most recent). Nodes are sized by (degree) connectivity. Communities (colors) are algorithmically determined based on interconnectivity (modularity class). When an account is highlighted, the lit up edges represent accounts being followed by highlighted account (hence “Heshmat” connects to each node when highlighted)

There’s a ton of information (and a great story to tell!) packed into that graphic, but I’ll save that for another time (aside from calling attention to one of the more central accounts, namely Security Studies Group).

For the time being, I would like to highlight the green community (top of the graph). Below I have isolated this community (45 accounts), and then reapplied visual clustering (keep in mind that each node/account here is an account being followed by “Heshmat”):

Image for post
Image for post
Image for post
Image for post
Accounts highlighted in red consist of individuals affiliated with The Epoch Times — @drawandstrike (Columnist), @themarketswork (Writer), and @IvanPentchoukov (Deputy Chief Editor, Digital)

<<FINISH: OPTIONAL SECTION>>

Conclusion

After reviewing the profile attributes/behaviors of Twitter accounts driving traffic to The Epoch Times’ content, I can state with confidence that coordinated inauthentic behavior is involved.

As the data examined illustrates, the accounts most frequently being amplified (retweeted) largely consist of conservative media outlets, influencers, and politicians.

The heavy overlap of accounts appearing in each set of reviewed accounts, for example, is not indicative of organic/authentic activity.

I would also like to call attention to the work of @conspirator0, who recently mapped out the backbone of the #MAGA Twitter network in this thread:

As you can see, The Epoch Times is quite central. Moreover, there is significant overlap with accounts identified in this post (including The Epoch Times’ @drawandstrike and @themarketswork):

Image for post
Image for post
Mutual retweet network for the top 100 #MAGA accounts. Graph credit: tweet from @conspirator0

I am very familiar with Steph (@steph93065) — the account from which @conspirator0’s thread stems.

In Nov 2018, I called attention to Christie (@ChristieC733), another core account in the #MAGA amplification network (Christie has even been retweeted by @realDonaldTrump):

Image for post
Image for post

At that time, Christie’s account was suspended. This prompted me to tweet that the account operated as a core node in a MAGA-focused network engaging in coordinated inauthentic activity (and that it should have been suspended long ago).

The tweet included an image (presenting data) and tagged a number of other core nodes in this MAGA-focused community (that for years have violated Twitter Rules). Additionally, I added Twitter’s Head of Site Integrity, Yoel Roth (@yoyoel), and a number of other Twitter executives/employees:

Image for post
Image for post

Among those tagged was Steph, who immediately chimed in to support Christie:

Image for post
Image for post

Similar to the “Heshmat” account, Christie’s suspension was short-lived (the account was later mysteriously reactivated).

Finally, we can identify (further) evidence suggesting automated activity by observing repetition in timecodes of tweets from accounts appearing in The Epoch Times’ dataset.

Take @souljahsingh, for example — an account that has, on average, tweeted 243 times per day since being created (more than 10 years ago):

Image for post
Image for post

Such a high volume of tweet activity generally is indicative of automated activity. Given the account consistently churns out multiple (non-retweet) tweets with identical timecodes, it’s fair to assume the account exists solely to weaponize Twitter’s platform:

Image for post
Image for post

In closing, it is important to emphasize that the amplification of propaganda often occurs without the knowledge of the individuals/organizations being amplified. To be clear, I am not asserting that The Epoch Times is funding/behind (or even has knowledge of such efforts) — I am merely illuminating blatant platform manipulation/information operations.

Although Twitter claims to proactively mitigate against such behavior, the reality is there remains a huge disconnect between their words and their actions.

Geoff Golberg is an NYC-based researcher (and entrepreneur) who is fascinated by graph visualization/network analysis — more specifically, when applied to social networks and blockchain activity. His experience spans structured finance, ad tech, and digital marketing/customer acquisition, both at startups and public companies.

Geoff is the Founder/CEO/Janitor of Social Forensics, where he spends (far too much of) his time developing techniques and building tools to identify social media manipulation (of various flavors!).

Read about Geoff’s war with Twitter here!

Written by

CEO & Founder, Social Forensics | Previously: Co-Founder, Elementus | Featured in BBC, CNN, BuzzFeed, and Quartz, among others | SocialForensics.com

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store