Bot-like Turkish accounts complement military operation in Syria

As Turkey prepared to take large swaths of northeast Syria, pro-Turkish Twitter accounts waged a parallel information campaign

@DFRLab
@DFRLab
Oct 16, 2019 · 5 min read
(Source: : @ZKharazian/DFRLab

As Turkish forces continued to bombard the Kurdish militia allied with the United States in its counter-Islamic State campaign in northeastern Syria, Turkish accounts waged a parallel hashtag campaign on Twitter: #BabyKillerPKK.

The campaign was a reference to the Kurdistan Worker’s Party (PKK), a militant political organization in Turkey that the country and many of its allies, including the United States and European Union, have designated as a terror group. The Turkish government does not distinguish between the PKK in Turkey and the Kurdish People’s Protection Units (YPG) operating in Syria, viewing the latter as an offshoot of the former. The United States, in contrast, has been allied with the YPG in its counter-ISIS campaign but has also previously acknowledged a link between the PKK and the YPG, while never officially designating, or even referring to, the latter as a terrorist organization.

Tweet from Turkish President Recep Tayyip Erdoğan announcing Turkey’s military operation against PKK and YPG forces. (Source: @RTErdogan/archive)

While other investigators in this space have now identified the same network, the DFRLab independently found evidence to suggest a portion of the hashtag traffic was driven by bot-like accounts. These accounts exhibited three of the key indicators of bot-like activity: a suspiciously high volume of activity, anonymous profiles, and amplification of other tweets promoting similar narratives.

In the methods it employed, the campaign resembled the June 2019 information operation that supported Libyan warlord Khalifa Haftar’s offensive to take Tripoli. Like the pro-Haftar campaign before it, this anti-PKK operation demonstrated that some actors choose to employ online astroturfing operations as complements to ongoing military offensives.

#BabyKillerPKK began trending on Twitter in Turkey on October 10, 2019, registering roughly 118,000 mentions over a period of 12 hours.

The hashtag #BabyKillerPKK trended on October 10, 2019. (Source: @ZKharazian/DFRLab via BrandWatch)

The accounts tweeting the #BabyKillerPKK also pushed a narrative equating the Syrian Kurds and the PKK, often referring to both simply as “YPG/PKK,” and cast both Kurdish entities as terrorist groups that regularly kill innocent civilians, including children.

Eyüp KILIÇ, a verified Twitter user, posted an infographic of “children massacred by the PKK/YPG-PYD” and added that “YPG is the same organization as the PKK.” (Source: @anlamayacalisan/archive)

Some of the accounts used graphic photos of children they claimed were murdered by Kurdish forces; others sought to contrast the “YPG/PKK,” which “uses babies and civilians as live shields” with the Turkish military, which “protects infants and civilians.”

A tweet contrasting the Turkish military with the “YPG/PKK.” (Source: @merakli_kurtcuk/archive)

While many of the users tweeting under the hashtag were authentic — some were even verified with tens of thousands of followers — a portion of the traffic appeared to come from bot-like accounts, some of which tweeted out the hashtag roughly a hundred times over the span of a few hours.

Top authors for #BabyKillerPKK on October 10, 2019, by volume of mentions. (Source: @ZKharazian/DFRLab via BrandWatch)

The benchmark for suspicious activity varies, but the DFRLab considers 72 tweets per day to be generally suspicious; all of the above accounts achieved that volume.

Volume of activity alone is not a conclusive indicator of automation, however, and a closer look at the accounts confirmed that they exhibited other indicators as well. Some of the accounts were incredibly primitive, with alphanumerical handles and no profile pictures, indicating that the operators had likely used automation software to generate the accounts without bothering to personalize them further.

Three automated accounts responsible for boosting the #BabyKillerPKK hashtag on October 10, 2019. (Source: @Ramazan37681876/archive, left; @John39508941/archive, center; @Samet20180582/archive, right)

Other accounts put in more of an effort to avoid detection, albeit not by much. While these accounts had uploaded profile pictures, those pictures were often either cartoons or generic Turkish nationalist symbols. In other words, they maintained anonymity.

Anonymous accounts boosting the #BabyKillersPKK hashtag. (Source: @Theboringbelin1/archive, left; @irem/archive, center; @1903ali80/archive, right)

Using Sysomos, the DFRLab then obtained a random sample of 4,502 unique accounts that tweeted the hashtag. Filtering the accounts by creation date revealed that 137 had been created in September 2019, while 125 had been created in October 2019. Of those accounts, many were created on the same date:

Account creation dates for a sample of the pro-Turkish accounts. (Source: @ZKharazian and @AlyssaKann/DFRLab)

The most common account creation date was October 10, 2019: the day the hashtag began trending.

These accounts’ recent creation dates, coupled with the fact that they almost exclusively tweeted or retweeted #BabyKillerPKK and related hashtags, suggested that the operators likely created these accounts for the express purpose of boosting this campaign.

The DFRLab cannot attribute the #BabyKillerPPK campaign to a particular entity, although it coincided with the Turkish military’s offensive on Syrian Kurdish forces and overwhelmingly supported the Turkish government’s narrative. And while a number of the accounts exhibited bot-like behavior, it is possible that the campaign was run by a group of dedicated human users who acted in concert to boost the hashtag.

Regardless, these accounts’ activity, anonymity, and amplification suggested that the #BabyKillerPPK campaign was not wholly organic.


Zarine Kharazian is Assistant Editor with the Digital Forensic Research Lab (@DFRLab) and is based in Washington, DC.

Alyssa Kann is an intern with @DFRLab and is based in Washington, DC.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

More From Medium

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade