The Voty Twitter Botnet and The Attack on Senator Al Franken by the Alt-Right Army
The manipulation of social media via fabricated users know as “bots” has gained widespread attention over the last few months, especially considering the possibility that such manipulation may have affected the outcome of the 2016 presidential election. Now, in the age of the #MeToo movement, the same technique was used to rile up opposition against Democratic Minnesota Senator Al Franken. This opposition eventually led to his forced resignation.
We discovered an army of Twitter bots that are related both by the timing of their tweets and by the newly built “news” websites they link to.
The Orchestrated Attack on Senator Al Franken
This Medium article by Erin Lank describes how the alt-right, led by Roger Stone, “predicted” then amplified a message stating that Senator Al Franken was a sexual predator.
The article details how known mouthpieces for the alt-right led the way by spreading anti-Franken allegations. It goes on to explain how these messages were spread via thousands of posts on Twitter that caused the #alfranken and #frankenfondles hashtags to trend heavily.
The article describes how the accusations levied against Franken were spread in the alt-right press, and how these articles were amplified by bots. Meanwhile, a statement of strong support from eight former staffers got very little exposure and died in the dark.
1) Publication of propaganda in numerous far-right news outlets, followed by 2) the coordinated use of social media bots to link to the publications and to make the news “trend” on Twitter and Facebook.
This weapon has an unprecedented ability to taint free discourse with false and biased information. Its destructive capabilities cannot be understated.
It’s natural for people to believe what they keep hearing. In news media, a situation in which information, ideas, or beliefs are amplified or reinforced by communication and repetition inside a defined system is known as a metaphorical echo chamber. People are easily convinced that if everybody’s talking about it, it must be true.
Unfortunately, this natural instinct can become a liability in this new age of social media. We don’t really know who “everybody” is anymore. On the internet it is very difficult to differentiate a man from a machine, it’s hard to know which of the voices that pop up in our feeds and on our timelines are sentient beings with their own beliefs, and which are simply dumb clones whose sole purpose is to align you with false beliefs wrapped in a crispy coating of deep-fried rhetoric.
“All that matters is repeated exposure to the message.” That’s exactly what an army of Twitter bots provides.
The Setup — Alt-Right Tweets and Japanese Websites
On November 15th at 10:21 PM, Roger Stone, via the now-suspended @stonezonetweets Twitter account, tweeted the following:
Roger Stone says it’s Al Franken’s “time in the barrel”. Franken next in long list of Democrats accused of “grabby” behavior.
That same day the web domain realusa.site was registered in Japan. The Google Analytics and Apple ID codes on the site link it to a developer named Atsufumi Otsuka. A pseudo-news website was established at that web address.
On November 16th, Leeann Tweeden went public with her story of having been sexually assaulted by Senator Al Franken.
On November 20th, Charles Johnson, a prominent member of the alt-right, said the following in a Twitter thread:
Thinking of offering money to people who go on tv saying Al Frank is a predator
On the same day, a second domain, votyus.me was registered by the same developer — Atsufumi Otsuka — and another pseudo-news website was established. Both websites use the same Google analytics account ID and Apple app ID, and the name servers and registration information for the two domains are nearly identical.
On November 21st at 1:52a.m., Mike Cernovich — another prominent member of the alt-right movement — tweeted the following:
I will fully cover the legal expenses of any VICTIM of a Congressman who wants to come forward.
How are these tweets and these newly built “news” websites related?
This is what we found.
Our Twitterbot Discovery
On December 7, shortly after Senate Democrats had called on Senator Al Franken to resign due to mounting accusations of sexual misconduct, our source, an anonymous security researcher, came across some unusual tweets. Below is a screenshot of these tweets.
The content of these tweets is the title of an opinion piece by Ijeoma Oluo published at theestablishment.co.
With a Twitter following of fewer than 10,000 people, this site itself has modest reach.
But a Twitter search for the article’s title: “Dear Al Franken, I’ll Miss You but You Can’t Matter Anymore” revealed a huge number of Twitter accounts amplifying the title of the story, which urged women and activists to stand down and accept Senator Franken’s resignation. But rather than providing a link to the story itself, the tweets included links to the two “media” sites registered by our friend in Japan.
The interesting part of this discovery? The Twitter accounts linking to the two websites and tweeting the title of the article are all remarkably similar to each other.
These Twitter bot accounts mainly tweet mundane stories related to sports, bitcoin, and celebrity news. But sprinkled among these mundane links are a number of articles related to news and politics. At the time we discovered these bot accounts, the article they tweeted related to the Al Franken story.
In general, not every Twitter bot account is involved with the promotion of every weaponized story. It appears someone was dictating how much promotion occurs for any particular partisan story. This indicates that only a subset of Twitter bot accounts from a much larger pool of bot accounts are used for each tweet.
Each Twitter bot account has 30 to 60 followers and many are not following anyone. They all had thousands of tweets, even though all that we check had been created . All of them had a large majority of followers whose profile and all content was in Japanese. More than half of the suspect Twitter accounts had as their first follower either a Japanese or Russian account and many of the accounts used banner images with Russian-language text.
Here is a screenshot of some of the followers of one of these accounts. Why would several hundred Japanese Twitter accounts be so deeply engaged in reporting on the Franken story?
We began to suspect that this legitimate opinion piece published by theestablishment.co had been weaponized for political gain by dozens of twitter accounts, all of them repeatedly tweeting links to the two domains registered in Japan in late November.
This Twitter botnet was still alive and tweeting as of the publication of this story. Our estimates put accounts involved in this Twitter botnet at well over 400, although at any one time only a subset of this total is used to promote a particular story.
Strong similarities between the accounts combined with a clear connection to the two recently-established Japanese websites verified our suspicions. Our source had stumbled upon a sophisticated botnet being used to spread alt-right propaganda.
Our researcher named his discovery the Voty Twitter Botnet.
And it’s still going strong.
The big question is: Who is paying for and running this decidedly alt-right themed Twitter botnet? Someone has to be deciding which articles will be promoted and how much they should be promoted.
What is a Twitter Bot, and How Do You Spot One?
A Twitter bot is a human-machine hybrid. There is a human behind the account that controls the machine, but much of the activity is automated. In many cases the machine behind the attack is a Twitter botnet — a network of computers that have been infected with a virus that causes them to run a program that communicates with Twitter. Each of these computers, unbeknownst to its owner, is “tweeting” propaganda. The exact content of these tweets is controlled by the “owner” of the botnet.
So how can you tell if a twitter account is likely to be a bot?
Our security researcher provided us with some tips*:
- The account has a significant number of tweets and/or likes in a short period of time. This can be in the range of 50–100 tweets or likes per day, or perhaps even more.
- A very small number of personal tweets and media compared to the number of retweets and tweets of existing articles or other content. The account may have thousands of tweets and no media files, for instance.
- Identical tweets appearing in other accounts at the exact same time (see below for how to spot this).
- The account’s Twitter handle consists of a number of random letters and numbers that have no semblance of matching the account name, like the account “emily” with the twitter handle “bakchadur7eyger.”
- Many twitter handles that end in an 8 digit sequence that is not in a date format are fake accounts with computer generated handles. For example, if the account name is James Bundy and his twitter handle is @Jamesbu04926114 you may have a bot on your hands.
- The account has a significant number of foreign accounts as followers even though the account is only sending out content related to a completely different country. The same pattern is usually found in the accounts that follow the suspected bots.
*Note that some legitimate Twitter accounts may have one of these characteristics. You should look for two or more before making a judgement. If a snap judgment is made and a legitimate person is accused of being a bot, then their life and privacy can be deeply affected.
There are public Twitter bot checks but many of these don’t identify these more sophisticated accounts.
An Example
Here are the results of a search for the tweet “Democrat Hypocrites Tell Creepy Al Franken to Stay in Senate.” It’s easy to search for a particular tweet using Twitter’s advanced search function. Notice that we circled the account with the user name “emily”, and also notice her odd, long Twitter handle: “bakchadur7eyger”.
When you click on her profile and check her followers you see something pretty odd. For a Twitter account that seems to tweet mainly about US politics, Emily sure has a lot of Japanese-speaking followers.
Even more odd, besides having an interest in US politics and a lot of Japanese speaking followers, Emily seems to follow a lot of Russian speaking accounts. Maybe she is half Japanese and Half Russian?
Or maybe “emily” is a weaponized propaganda-spreading Twitter bot who needs to be blocked and reported. You decide.
— Mike Farb
Please follow us on Facebook at
