We all know that there are countless thousands of bots on Twitter, and today I spent some time getting to know a little more about a few of them. My interest was piqued by a tweet from Eliot Higgins, a researcher at King’s College London and founder of the fascinating investigative journalism site BellingCat.com. Eliot’s tweet showed a group of nearly identical tweets announcing Russian UN Ambassador Vitaly Churkin’s death, all posted at almost exactly the same time this morning:
I decided to take a look at these Twitter accounts, just to satisfy my own curiosity. First step was a few searches to locate a sample of these Churkin tweets. The sample I came up with includes the ones Eliot had in his collage plus a few more, for 20 total. I’m sure I could have found many more, but I wanted to have a small enough sample that I could scroll through their timelines without wasting all day on this little project. (A goal I didn’t quite meet, as it turned out.)
I captured a screenshot of each tweet, to make a note of them:
Then the fun began. To be clear, I had no particular goal in mind, I was just rooting around to get a feel for how these things work. And this is not a rigorous analysis, just a high-level overview of a few aspects of these accounts. If you want to read a truly outstanding analysis of Twitter bot activity, check out Lawrence Alexander‘s 2015 article “Social Network Analysis Reveals Full Scale of Kremlin’s Twitter Bot Campaign.”
The first thing to note is that all of these tweets were posted at the same time, 10:13AM PST today. And none of them are retweets — each one is an “original.” The timing appears coordinated, either a planned “tweet at this time” approach, or perhaps all of these tweets were posted by the same bot software as a single batch.
Here’s one way the tweets vary: they don’t all link to the same web page. The articles they link to are essentially the same, but hosted on three different web sites: RT.com (Russia Today, the Pravda of our time), thebodyhealthy.com, and twittcloud.com.
The latter two sites were both created in the fall of 2016 (presumably to host content about Hillary Clinton’s scary email server), and they have no navigable content. The home pages just have what is essentially “coming soon” messages (one is a WordPress blog), and they’re both in Spanish. So these sites aren’t intended for human audiences, they’re just repositories of articles.
By the way, I’d not recommend surfing around those sites: there are many reports of them trying to install software and doing similar nasty things. For that reason, I’ve not linked to them here, and for similar reasons I won’t be linking to the bot accounts. But I’ll be showing all the Twitter usernames below, so you can go look at them if you’re curious.
So ... what's the point?
Why would anyone engage in an orchestrated attempt to spread the news of Churkin’s death? That’s not clear to me, but I don’t really care very much either. I was interested in what they’re doing and how they’re doing it, not why.
Looking through the posts on these timelines, there’s a consistent pro-Trump/pro-Russia/anti-liberal tone to most of their posts, with a few other random topics thrown in here and there. Is the Churkin post in the latter category? I doubt it, because it’s hosted on their go-to web sites, the ones they link to for the majority of their pro-Trump tweets.
These bots are extremely busy, as we’ll see below when we look at the numbers. So I guess it was inevitable that they’d start spreading a new story before I could even finish capturing screenshots of the Churkin tweets. Here’s the first one that I saw in real time (and there have been many more in the hours since):
That tweet appeared on several of the 20 timelines almost simultaneously.
A sample of 20 bot accounts
Here’s some information about the accounts in my sample, sorted by the date of the first tweet from each one:
And here are a few observations about things I found interesting in each column …
Username. Most of the account names are clearly intended to look like Trump fans. Note that there are some variations on MAGA, such as M4GA or Mega, as well as misspellings of common names (“Sussan”), which were apparently necessary because real human beings had already used handles such as EmmaMAGA or Susan_D. And several of the names use varela; perhaps due to the Spanish-speaking pedigree of the sites they are pushing?
The first account seems to be a real human being. So is that a person who volunteers to help out? A personal account that was conscripted into the pool of accounts that are being driven by this coordinated campaign? They post in Russian, so I have no idea what they’re saying, but unlike the others on the list they reply to others, retweet others, and Like the tweets of others.
Tweets. Check out the magnitude of those numbers! These bots are busy. And most of them have posted thousands of times without ever replying to anyone else’s tweets or retweeting anyone else. (I’ve also come across bots that spew out a variety of random attacks and insults based on keywords, without ever posting links to articles, but those are a topic for another day.)
Following and Followers. The lack of variation in these numbers looks strange to me. They’re all following a few thousand accounts, and a few thousand are following back. That makes them look like real accounts — nothing screams BOT! like having no followers or only a few.
In actual practice on Twitter, things are much more varied. For example, if we set aside the one that I think is a human, the follower/following ratios for the other 19 are all between 0.4 and 1.2. As a point of comparison, there are 96 accounts that I currently follow myself which follow between 2000 and 5000 other accounts each, and only half of those fall within that range and others go as low as 0.05 or as high as 2518 (go Rachel Maddow!).
I thought that perhaps these are members of a network of a few thousand accounts that all follow each other, but I spot-checked a few of them and they don’t seem to follow each other. It might be interesting to see whether they all follow sets of accounts with significant overlap, or random accounts, but I didn’t dig into that.
Likes. Two telltale signs of a bot account, in addition to a lack of followers, are not having a profile pic, and not having any Likes. Based on the Like counts, the first two accounts on the list look like they could be humans. There are six others that have one Like each, and that’s just a Like of their own pinned tweets. More on those later.
Created and First Tweet. The second and third accounts on the list have gaps of over five years between when the account was created and when it was first used. Other than those two, all of the accounts started posting on the day they were created.
Those two also have a couple of other quirks that don’t match the other accounts. For example, they both have a pinned tweet that points to the “National News” page on Facebook, but unlike the other accounts that link to that Facebook page, they do include a location (United States and Estados Unidos).
Tweets/Day. I was surprised at the extreme consistency in these numbers. For example, there are three accounts that were created on February 4 which all have the same total of 18,300 tweets to date. (Twitter rounds off tweet counts to the nearest 100 when the numbers are that big.) Do all three of those have the exact same tweets, 18,300 times in a row? At a glance, it looks like they might. And note that there are eight accounts created over the weekend of February 4/5, each of which has averaged between 1000 and 1200 tweets per day since then.
Location. The lack of a location is another thing that can give away bot accounts. As Lawrence Alexander notes in his analysis linked above, bots are less likely to specify a location than real accounts. But most of these have locations that are specific well-know US cities. Hey, if you’re going to pretend to be a Trump supporter, might was well pretend to be one in Washington, DC or Boston, areas that voted overwhelmingly against him.
Patterns and groupings
There are several distinct groups within this set of accounts, each of which appears to have been set up by the same person, or at least with a similar approach. For example, consider this group of accounts, all of which have a pinned tweet at the top of their timeline that points to the same “fake news” site on Facebook:
And there are other similarities between these five accounts. They often have both an image and a link in their tweets, and many of the images are exactly the same size: 1200×630 pixels. None of them have ever replied to anyone else’s tweets. Their cover images all include either a photo of Trump or Trump/Pence text, and their profile pics are all big-busted young white women in tight shirts or bikinis. One of those profile pics is Angie Varona, a teen who infamously had her photos hacked in 2007, whereas another is a model who has been described as “Israel’s Angie Varona.” Good grief, the guy who set these ones up seems to have a type, or at least he thinks his target audience of Trump supporters does.
Another group is the six accounts I mentioned above that have exactly 1 Like each. Those likes are to their own pinned tweets, all of which are identical. Just this image, with no caption:
That Spanish language graphic, the Spanish language on the home pages of the two web sites mentioned earlier, and the fact one of those domains has a registrar in Venezuela makes me wonder if these accounts were set up by a contractor in Venezuela. Who knows. By the way, this guy’s “type” seems to be mostly women in hats:
Well, I’m down to making fun of the profile pics so I guess I’m out of things to say about this little sample. As one final thought, it seems to me that it would be pretty easy for Twitter to identify sets of obviously non-human coordinated accounts and eliminate them if they really wanted to. I find it hard to imagine how this sort of activity helps the platform in any meaningful way. Are Twitter execs compensated based on total number of tweets and retweets, so they’re not motivated to invest in eliminating it?
Like so many things about social media these days, I think I probably don’t want to know. [UPDATE: within 24 hours, all of these bot accounts had been suspended. My cynicism may have been misplaced.]