Fakes, Bots, and Blockings in Armenia

A snapshot of online manipulation on the eve of a parliamentary vote

@DFRLab
@DFRLab
Apr 2, 2017 · 5 min read
Source: Twitter. Accounts posting the same wording and image ahead of the Armenian election.

Armenians go to the polls on April 2 for the first election under a new law which marks the transition towards a parliamentary system of rule.

The days before the election saw a spike in manipulative behavior on Twitter, including fakes, bots, and the targeted blocking of key accounts.

Fake e-mail

Source: Pastebin, via Onnik J Krikorian / Twitter

The email was debunked by the US Embassy in Yerevan, which pointed out grammatical and spelling mistakes in the text, and the implausibility of a genuine USAID email coming from a gmail account:

Source: US Embassy Yerevan / Facebook. As of the evening of April 1, the post was unavailable.

A new version of the email, with the mistakes corrected and the gmail address cropped out was then shared on Pastebin on March 29. Nonetheless, on the eve of the election a significant number of accounts began posting the earlier, more obviously fake, email again on Twitter.

Its promotion was led by accounts tweeting in Russian, which all posted a screenshot of the fake email:

Source: various users / Twitter.

Although the text accompanying the image varied, at least 43 accounts that shared the image used “НПО готовятся сорвать выборы в Армении,” which translates to “NGOs prepare to disrupt elections in Armenia.”

Source: Twitter. A sample of tweets that used “NGO prepares to disrupt elections in Armenia” in their posts.

These accounts had a number of features which gave them the appearance of a network of automated “bot” accounts, rather than genuine users. One, had an avatar image copied from a stock online photo of actress Barbara Mori, as a reverse image search revealed:

Left: Twitter profile of “Nataliya Ershova”. Right, partial results for reverse image search of the picture. (The search revealed over 100 other uses of the same photo.)

All the accounts in question had similar patterns of activity. They were created over a year ago (many in spring 2015), numbered only a few tweets (often under 200), had almost no followers, and followed only a handful of accounts:

Source: @AnnaFilatova83 / Twitter
Source: @ZinaidaIlyina52 / Twitter
Source: @Poljakov5Sergej / Twitter.

The account @Poljakov5Sergei is particularly striking. Having tweeted 89 times, it records no followers and no follows since May 2015.

While lethargic, these accounts have all recently tweeted on another political issue, namely the March 26 anti-corruption protests in Russia, using the hashtag #ДимонОтветит (“Dimon will answer,” a reference to Prime Minister Dmitry Medvedev, as the DFRLAb explains here). In this case, the tweets were limited to the hashtag and memes whose relation to the protests was unclear, giving the impression that their purpose was to flood the hashtag with irrelevant content:

Source: @ZinaidaIlyina52 / Twitter. The translation reads, “‘We’re all standing up to cancer, are you?’ Except him.”
Source: @ViktorSinitsyn4 / Twitter
Source: @Poljakov5Sergey / Twitter. The caption reads, “Only a week to summer! Noice.” (The misspelling is deliberate.)

Low activity and a low follower / follow count are not, in themselves, particularly suspicious qualities. However, the fact that so many of the accounts which tweeted the same phrase all had these qualities, and also tweeted random images on the ДимонОтветит hashtag, gives the impression that this is a small botnet at work.

Twitter account suspension

Source: @aramiggs / Twitter.
Source: Radio Azalia / Twitter.

Four accounts known to have been blocked were:

@reportearm — a journalist and producer

@civilnettv — a prominent media organisation

@hetq_trace — a network of investigative journalists

@stepangrig — director of the Analytical Center on Globalization and Regional Cooperation

The accounts were unblocked approximately two hours later, after Armenian civil society activists started tweeting @support asking to unblock them.

Source: @KarenaAv / Twitter
Source: @ditord / Twitter.

While the reason for the suspensions is not clear, suspensions in other areas have reportedly been triggered by bot-led attacks which send multiple complaints about the accounts’ activities.

Hacking attempts

DerGrigorian, who has been outspoken about the upcoming elections on social media, reported on Twitter that attempts had been made to hack his email and Facebook accounts.

Source: @Babken / Twitter.
Source: @Babken / Twitter

Conclusion


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (DFRLab). Donara Barojan is a Digital Forensic Research Associate at the DFRLab.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store