The war on fake social media accounts

There will be a fascinating and urgent game of cat and mouse in the coming years between social media networks and fake accounts operated by governments and their arms.

The world has witnessed the power of social media in elections and regime change, both in true grassroots communication and in fake news / propaganda.

Governments have realised that getting their story out on social media can’t be left to chance, it has to be ‘created’.

The fake accounts usually fall into these categories:

1. Fake journalism - the accounts purport to be credible news sources, using a name that sounds something like a newspaper or news channel, with content that appears newsworthy.
2. Bot accounts - these are fake accounts that are created and crafted. After creation, they will post innocuous content for months or years (cute animals and porn are popular) while amassing followers. Once activated, they slowly begin to post propaganda.
3. Hacked accounts. These accounts once belonged to a real person. At some point they were hacked (often after the user had abandoned it) and repurposed for propaganda.

Recently, the social media networks have been on a spree of identifying the blocking the accounts. The scale is incredible.

In relation to the Hong Kong protests, Twitter accounted that it had identified a ‘spammy’ network of 200,000 accounts pushing Chinese propaganda, and even released the full data on the most active 936 accounts so that the content could be analysed.

Other recent blocks on govt-linked fake accounts: 4500 accounts from UAE 4700 - Iran 4500 - Russia 259 accounts linked to a political party in Spain

Who is fake? permalink

The big challenge for the networks is identifying the fake accounts. Lots of genuine accounts regularly share views that can support the government, and many real accounts may be inadvertently sharing the content from the fake accounts. Real people do change what they tweet about over time, or sometimes change country or change language. Banning real accounts for sharing political views would generate accusations of bias and censorship.

One primary tool for identifying the fake accounts for now is engagement mapping. Many of the accounts have been happily tweeting for years, but suddenly see an uptick in engagement when fake news needs to be pushed out as they are liked/shared by other accounts in the network to build momentum around the narrative. A simpler tools is IP mapping - finding clusters of accounts that are operated from the same IP address.

What’s next? permalink

Clearly, the government accounts are not giving up. They will become more sophisticated, working to prevent the fake accounts from being identified. They will create more randomness in the activity and look at ways to get more engagement from real users, to blur over the fake engagement. They will use more VPNs to hide the IP addresses.

The cost of acquiring stolen credentials or opening fake accounts is so low and so much of the effort can be automated that there is no reason to stop trying.

So the game continues!