Fake Assanges Drive Far-Right Messages

A look into the impersonator accounts fooling real Twitter users

Screenshots from profiles of three of the fake accounts, @Julien_Assange, @JuliannAssange and @JulianAssanged.

Three false Twitter accounts which impersonated Wikileaks founder Julian Assange have spent months spreading far-right messaging, in a striking example of how easily fakes can drive online content. A fourth was created on September 4, and immediately began spreading more.

All four accounts — @JuliannAssange, @Julien_Assange, @RealAssange and @JulianAssanged — copied the profile of the genuine Assange (@JulianAssange), occasionally claiming to be a “parody” (or “parity”) account when they were exposed. Their content was not parody, however, but a cocktail of far-right propaganda which achieved the greatest impact when it linked itself with Wikileaks.

Some Twitter users appear to have been fooled by these accounts; others claimed not to have been, but supported their efforts anyway.

Three of the four accounts were created in May. By the time the last of them was suspended on September 4, while under investigation by @DFRLab, it had over 25,000 followers. Minutes after the suspension, a new account was created, using the same techniques.

These four accounts serve as a case study in the power of impersonation — and the worrying tendency of some internet users to spread stories even if they believe the sources to be false.

How the fakes were made

The three early accounts warranted studying to see how they operated, how they survived for so long, and how they gained such a following.

Their survival was based on three factors: the exact copying of the real Assange’s profile; the use of a plausible handle; and the temporary use, when threatened with exposure, of the claim that they were parody accounts (or “parity accounts”).

The genuine Assange’s profile page, from a screenshot on August 17. The salient features remained unchanged as of September 4.

All four fake accounts used the same visuals, including the blue diamond next to the name (this appears to be a reference to the blue check-mark which Twitter itself uses to mark verified accounts). The similarity is most marked in the latest incarnation, @JulianAssanged, as this screenshot demonstrates.

Screenshot of the @JulianAssanged profile page. Note the creation date on September 4. Archived on September 4. Other than the creation date and the number of followers, the profile is identical with the real account.

The earlier incarnations were almost perfect matches, but added the words “parity account” or “parody account” once they were accused of impersonation.

Screenshot of the @Julien_Assange profile page, showing the same visuals, taken on August 17. The words “parity account” were a recent addition; previously, the biographical text had been identical with that of the real Assange. Note that this account had over 14,000 followers.
Screenshot of the @JuliannAssange profile page, from an archive created on August 13, 2017. Again, the words “parity account” were a recent addition.
Left, screenshot of the @RealAssange account from an archive created on August 31; note the bio, with the “parody account” line. Right, detail screenshot of the account’s bio, created on August 30, before it had been exposed as a fraud. Note the lack of the “parody account” phrase.

The main difference between these four fakes and the genuine article, other than the content which they posted, was the creation date. Both @RealAssange and @JuliannAssange were created on May 4, 2017, at the same minute; @Julien_Assange was created in the same month. @JulianAssanged was created on September 4. The real Assange joined Twitter in October 2011.

When the words “parody” / “parity” were absent — as they were for much of the accounts’ existence — there were no visual clues to indicate that these three accounts were fakes. This can only be considered deliberate impersonation.

Trying to hide

The @Julien_Assange and @JuliannAssange fakes were suspended in mid-August, presumably after Twitter identified them as imposters. The @RealAssange account continued until September 4. However, it was exposed a number of times before then, including by this tweet, posted on August 30:

Its behavior, once threatened with exposure, is a classic example of the techniques disinformation actors use to defend themselves. The first response, as the above screen-shots show, was to label the account a parody one. In parallel, it attacked its critics with tones ranging from plaintive…

Screenshot of one of the fake account’s replies, archived on September 3, 2017.

… to blaming journalists and “verified” accounts …

Screenshot of one of the fake account’s replies, archived on September 3, 2017.

… to blaming Assange himself:

Screenshot of another reply from the fake account, archived on September 3, 2017.

The user even tried to invoke the First Amendment.

Screenshot of a desperate response, archived on September 3, 2017.

Its main defense was the claim to be a parody account. However, as of September 3, the words “parody account” had been dropped from the bio once more. Instead, the background had been changed to include the WikiLeaks logo. This distinguished the account from the genuine Assange in purely visual terms (possibly allowing the account holder to argue that it was not an impersonation), but nevertheless continued the deception.

The reworked profile page of @RealAssange, showing the absence of the “parody account” line. Screenshot taken on September 4 from an archive made on September 3.

This was not a parody account; it was an impersonation account which used the label “parody” as a protection when its status was called into question, and then dropped it once the immediate danger of a reaction appeared past.

Moreover, every indication is that the first three fake accounts were created and run by the same user, changing from one to the next as exposure and suspension loomed.

While activated, @RealAssange repeatedly retweeted @Julien_Assange and @JuliannAssange, as screenshots from a machine scan show.

Some of the many retweets of @JuliannAssange by @RealAssange, from a machine scan…
… and retweets of @Julien_Assange.

According to a scan of its mentions from May 4 to the end of August, the @RealAssange account only began to pick up significant traffic on August 18, as @JuliannAssange and @Julien_Assange were taken offline.

Mentions of @RealAssange from August 9 to August 31, 2017. From May to August, the account was minimally active, tweeting, but achieving little impact.

Twitter users reported the change early on August 19:

Source: Twitter / @SuzieMoonLily. Archived on September 4.
Source: Twitter / @henryjackp. Archived on September 4.

Later in the sequence, the link between @RealAssange and @JulianAssanged was made explicit in the new account’s first tweets:

The first post from @JulianAssanged on September 4. Archived the same day. Note the self-aggrandizing explanation for the suspension, which is actually likely to have been triggered because the account was fake.

These four accounts are clearly the work of a single individual, aimed at deception and disinformation, not parody.

A fake that worked

Little survives of the @JuliannAssange and @Julien_Assange accounts. However, a number of analysts, including @DFRLab, studied @RealAssange before it was suspended; these analyses indicate that the fake account created significant impact.

According to a study by Twitter user “Caroline O” (@RVAwonk), the fraudulent Assange account had more engagements than any other user on the term “Antifa” in the wake of clashes at Berkeley on the last weekend in August.

Clip from the analysis by Caroline O.

@DFRLab identifed a number of tweets from the @RealAssange account which used the term #Antifa in late August, racking up thousands of engagements (retweets and/or likes). Most were deleted before they could be archived, but they achieved hundreds, and sometimes thousands, of engagements.

Some of these tweets linked the term #Antifa with billionaire George Soros, who is regularly attacked by far-right (and pro-Kremlin) conspiracy theorists. Others attacked CNN and Black Lives Matter, two other perennial targets of the far-right.

Sample tweet from @RealAssange, archived on September 3, 2017.

@RealAssange also supported United States President Donald Trump’s pardon of Sheriff Joe Arpaio.

Archived on September 4, 2017. Note the number of engagements.

Its best-performing tweets, however, came when it appeared to promise Wikileaks revelations, and to attack former Democrat presidential candidate Hillary Clinton:

Tweet from @RealAssange, archived on September 3. Note the high engagement rate.
Another typical post from @RealAssange, with fewer shares. Archived on September 3, 2017.

The numbers should not be taken at face value: some of the accounts which amplified these posts show a suspiciously high proportion of retweets in their content, suggesting a degree of automation. However, other users were clearly individual; the tweets also received a significant number of replies, indicating a degree of impact.

The account’s deceptive nature was also demonstrated by real users’ reactions. On at least one occasion, a genuine reporting outlet was fooled by the account, and initially ran a story quoting it, before correcting:

Screenshot from the article by ivn.us, acknowledging the fake.

Replies by Twitter users also suggest they took the fake Assange as the real one, especially when the account appeared to flag WikiLeaks content. The following tweets were some of the many posted in response to the fake account’s “Wikileaks has duplicates” post.

Archived on September 4. (Source: Twitter / @Destinbeach22)
Archived on September 4. (Source: Twitter / @John_ship67)
Archived on September 4. (Source: Twitter / @Kholt22Hol)

On some occasions, other users pointed out the fake, and were acknowledged.

(Source: Twitter / @InjectDLL)
(Source: Twitter / @VerasRoses)

Some users appeared to retweet the account even though they knew (or claimed they knew) that it was fake.

Archived on September 4. (Source: Twitter / @euniverse1)
Archived on September 4. (Source: Twitter / @euniverse1)
Archived on September 4. (Source: Twitter / @AtomasVictory)
Archived on September 4. (Source: Twitter / @AtomasVictory)

Political messaging

While the identity of those behind the account cannot be established by open sources, their purpose can. The fake Assange accounts routinely attacked centrist and left-wing politicians, especially the Democrats and Clinton, while defending and espousing far-right conspiracy theories.

When the account was first activated, @RealAssange posted and shared attacks on French presidential candidate (now President) Emmanuel Macron. Such tweets have been captured by machine scan.

Early tweets and retweets from @RealAssange on Macron, from machine scan.

It also shared posts from a range of far-right commentators, and appeared to try to connect with them via its tweets.

Early tweets from @RealAssange, on May 6, from machine scan.

Other posts attacked the mainstream media, Clinton, and reporting on Russia’s attempted interference in the U.S. election.

Some of the August tweets from @RealAssange on Russia.

All these place the user firmly in the ideological world of the far right of U.S. politics. This is the same world in which the earlier fake account, @JuliannAssange, operated, as the following screenshots from the archive make clear.

Screenshot from the archive of @JuliannAssange.
Screenshot from the archive of @JuliannAssange.

The new account, @JulianAssanged, followed on in the same tone, with the same conspiratorial arguments, and even the same image.

Archived on September 4. (Source: Twitter / @JulianAssanged)

Most of its early tweets, however, were retweets of the genuine Assange, apparently in an attempt to give it verisimilitude.

Screenshot of three retweets from the real Assange (as shown by the handle, @JulianAssange), from the latest impersonation account. All can be seen on the archive.

The network

A final point of interest in this cluster of impersonation accounts is the amplification network. The first post from the @JulianAssanged account was a retweet of a post from an account called @BostonMAGA23, advertising the fact that @RealAssange had been shut down, and inviting followers.

Screenshot of @JulianAssanged’s first posts. The tweet can be viewed here; the archive, here.

This is not coincidence. In a machine scan of all posts mentioning @RealAssange from May 4 to August 18, @BostonMAGA23 was the most active user, other than @RealAssange itself, to mention the account.

The top mentioners of @RealAssange, May 4 — August 18, showing the prominence of @BostonMAGA23.

Just over two weeks earlier, on August 16, @RealAssange appealed to its followers to follow @BostonMAGA23, having been suspended for “supporting Trump” — a very similar phrase to the excuse @JulianAssanged gave for having been caught impersonating Assange.

Tweet from @RealAssange calling for follows for @BostonMAGA23. Captured by machine scan before the @RealAssange account was suspended.

@BostonMAGA23’s own first tweet, meanwhile, mentioned the second fake account, @JuliannAssange.

@BostonMAGA23’s first tweet, archived on September 4.

A subsequent tweet mentioned the third fake in the family, @Julien_Assange.

@BostonMAGA23’s mention of @Julien_Assange, archived on September 4.

@BostonMAGA23, too, joined the attacks on “Antifa”, and copied them to @RealAssange.

Source: Twitter / @BostonMAGA23. Archived on September 4.

In its early days, this account achieved very few engagements, despite the advertisement from @RealAssange. By September 4, it had under 1,000 followers, marking it as an otherwise insignificant player.

Profile page for @BostonMAGA23, archived on September 4.

However, its launch of @JulianAssanged, and the way that @RealAssange launched it, indicate that it is connected with the network of fakes. The fact that it had had at least one previous account shut down also indicates that it is part of the aggressive family of accounts on the far right of U.S. politics.

Conclusion

All the fake Assange accounts are (or were) based on the same modus operandi: accurate impersonation of the real Julian Assange account, the occasional adoption of the “parody” tag for camouflage, and aggressive far-right messaging.

Their longevity is surprising. Created in May, two of the accounts lasted until mid-August; a third lasted exactly four months. The fate of the fourth, @JulianAssanged, will be watched with interest.

These accounts achieved some degree of impact. Their tweets were widely amplified, gaining thousands of retweets and hundreds of replies (not all favorable); they deceived many Twitter users and researchers.

Perhaps most disturbingly, some posts were shared and amplified by commentators who thought that the account was fake, but approved of its message. This is a timely reminder that one of the key challenges of fake news and accounts is that of the audience which is willing to be duped, and to dupe, in the pursuit of a higher goal.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.

Editor’s note: This article highlights and distills a challenge in today’s information space, and should not be taken as advocating for or supporting any specific group.

Show your support

Clapping shows how much you appreciated @DFRLab’s story.