#FireMcMaster, explained

How alt-right media and a handful of Twitter bots tried to get the United States National Security Advisor fired

@DFRLab
@DFRLab
Aug 8, 2017 · 7 min read
Image for post
Image for post
(Source: Twitter)

On August 3, a handful of Twitter accounts launched a media campaign under the hashtag #FireMcMaster. The hashtag appeared in response to United States National Security Advisor H.R. McMaster’s recent personnel decisions at the National Security Council (NSC) and his recently leaked letter to former President Barack Obama’s National Security Advisor Susan Rice.

The ensuing social media campaign to #FireMcMaster spread virally and, ultimately, forced President Trump to affirm support for his closest advisor on matters relating to national security and foreign policy, for now. Mobilization across alt-right social media platforms is commonplace, and this case shows another correlation between their mobilization and high-performing bot networks.

In the past week, McMaster fired Rich Higgins, the NSC’s Senior Director for Strategic Planning, because of a memo Higgins wrote alleging a conspiracy or political warfare against Trump, including from “globalists, bankers, the ‘deep state,’ and Islamists.” McMaster also fired two other senior officials brought to the NSC by General Michael Flynn, who preceded McMaster in the National Security Advisor position.

McMaster also extended the top secret clearances to all of his predecessors as National Security Advisor, including Susan Rice, who alt-right in the media has accused of politically-motivated requests to unmask portions of sensitive intelligence sources, during the 2016 United States presidential elections. The practice of extending security clearances for former National Security Advisors and unmasking certain aspects of intelligence are commonplace and routine for any United States National Security Advisor.

Both actions led to a coordinated campaign, spearheaded by known alt-right figures, to fire McMaster. The anti-McMaster campaign was initiated by large, alt-right media platforms — primarily Infowars and Breitbart, as well as alt-right Twitter activists including Paul Joseph Watson and Jack Posobiec, both of whom are associated with Prison Planet, another website operated by Alex Jones.

Between August 2 and August 6, Infowars and Breitbart published 14 negative stories about McMaster and his relationship to President Trump.

Infowars

Aug 4: ‘Everything the president wants to do, McMaster opposes’ former NSC official says

Aug 4: General McMaster panics as journalists expose him as greatest national security threat

Aug 3: McMaster purging key Trump Allies

Aug 3: Report: McMaster fired National Security Council official for penning memo on globalists

Breitbart

Aug 6: McMaster worked at think tank backed by Soros-funded group that helped Obama sell Iran nuclear deal

Aug 4: Trump meets with McMaster amid reports he cleared Susan Rice, purged loyalists

Aug 4: Brigitte Gabriel: ‘Politically correct’ H.R. McMaster ‘doesn’t see eye-to-eye’ with Trump on how to defeat Islamic State

Aug 4: Report: H.R. McMaster ‘increasingly volatile’ and ‘frequently blows his top’

Aug 3: Report: H.R. McMaster gave ‘explicit instruction’ not to mention Obama ‘holdovers’ in Trump admin

Aug 3: Allen Roth: H. R. McMaster ‘at odds’ with Trump on Iran nuclear deal

Aug 3: H.R. McMaster promised Susan Rice she could keep her security clearance in secret letter

Aug 3: NSC Purge: McMaster “deeply hostile to Israel and to Trump”

Aug 3: Report: H. R. McMaster believes Susan Rice did nothing wrong in unmasking requests

Aug 2: Report: H. R. McMaster fired National Security Council official for penning memo on globalists

These were quickly picked up by other alt-right media outlets. Below is an example of how one of those stories — “Report: McMaster fired National Security Council official for penning memo on globalists” — spread:

Image for post
Image for post
(Source: @DFRLab)

Other articles on Infowars and Breitbart had similar amplifying networks behind them.

The Twitter campaign #FireMcMaster was led by a traditional group of alt-right activists, among whom were Prison Planet’s Paul Joseph Watson and Jack Posobiec:

They, however, were not as effective as Lee Stranahan. Stranahan is the founder of Populist.TV and a co-host of the Sputnik news show Fault Lines. Sputnik is a Russian government media outlet that frequently recurs in @DFRLab reporting.

Image for post
Image for post
(Source: Twitter)

In a recent interview with The Atlantic, Stranahan said: “I’m on the Russian payroll now, when you work at Sputnik you’re being paid by the Russians.”

Stranahan was heavily involved in the #FireMcMaster campaign. Between August 3 and August 7, Stranahan used #FireMcMaster 25 times. During the same time, he only used #FaultLines (the name of his show) 12 times.

Apart from that, Stranahan posted a video on Periscope in which he called on alt-right Twitter users to retweet #FireMcMaster. He also urged Trump supporters to get on the phone, call the White House, and ask President Donald Trump to fire McMaster.

On top of that, he published three videos on his YouTube channel urging his subscribers to call the White House and ask for McMaster to be fired:

#FireMcMaster on Twitter appears to have been the most well-organized campaign in the history of the alt-right. A total of 136,292 tweets using the hashtag #FireMcMaster were posted between August 3 and August 6, with two thirds posted between August 3 and August 4.

Image for post
Image for post
(Source: @DFRLab via Twitter)

@DFRLab analyzed a sample of 6,064 tweets posted during the period of August 3 and August 6. We found that 1,278 tweets using #FireMcMaster were generated by a mere 86 accounts, with the most active account managing to post 69 tweets using the hashtag. Our random sample indicates that less than 8 percent of all accounts sharing #FireMcMaster was responsible for 20 percent of all traffic on the hashtag.

Image for post
Image for post
This is a sample of public Twitter accounts. The list is a quantitative measurement of users who engaged on #FireMcMaster, and does not label leanings of each account.

The following are some of the most active Twitter accounts to converse using the hashtag #FireMcMaster.

Twitter user @MarieMa49685063 posted 34 tweets using #FireMcMaster. Overall, in just four days, the account posted more than 3,000 tweets, 90 percent of which were retweets. It’s highly likely that this account is a bot.

Image for post
Image for post
(Source: twitonomy.com)

Similarly, @Hrenee80 posted 34 tweets using the hashtag, and posted 3,195 tweets in total last week (the week of August 1), of which 90 percent were retweets. Such volume indicates the account is likely a bot.

Image for post
Image for post
(Source via twitonomy.com)

@RescueTracker81 mentioned the hashtag 69 times, but this account is less likely to be a bot. It posts an average of 156 tweets a day, of which 74 percent are retweets.

Image for post
Image for post
(Source via twitonomy.com)

@GeneralDefense appears to be a bot. It was created a few weeks ago, and it posts 226 tweets a day on average.

Image for post
Image for post
(Source via twitonomy.com)

More importantly, #FireMcMaster makes up 68 percent of all hashtag usage by the @GeneralDefense account. In total, the account has posted 98 tweets with the hashtag.

Image for post
Image for post
(Source: twitonomy.com)

@tamaraleighllc is another account that appears to be at least partially automated. It tweets 332 tweets a day, 98 percent of which are retweets.

Image for post
Image for post
(Source via twitonomy.com)

The spread of the call for McMaster’s dismissal, and the spread of accompanying media articles, did not stop with Twitter, but also proliferated heavily on Facebook. Data from Buzzsummo suggests that anti-McMaster articles from Circa, Breitbart, Liberty Writers News, The Daily Caller, and Young Conservatives (@TheYoungCons) garnered 126,000 engagements on Facebook alone.

Image for post
Image for post
(Source: buzzsummo.com)

Due to Facebook’s limited API (application program interface), it’s hard to tell how organic the engagement was, but if the Twitter campaign is any indication, the articles were likely spread by fake or automated accounts.

Redditors on /r/TheDonald, an alt-right forum of Reddit dedicated to discussions of President Trump, also actively engaged in spreading the hashtag and the articles associated with it.

Redditors were sharing the hashtag #FireMcMaster and encouraging others to spread it more widely:

Image for post
Image for post
(Source via reddit.com)

Links to tweets using the hashtag were also shared on the subreddit to prompt others to retweet and like them:

Image for post
Image for post
(Source via reddit.com)

This, by far, is one of the most organized and widespread alt-right campaigns to date, spanning across Twitter, Facebook, Reddit, and other social media. This shows the alt-right’s capacity to organize and amplify on several platforms simultaneously, and it signals the community’s growing digital capabilities.

The success of the campaign forced Trump’s administration to respond. Only two days after the start of the campaign, the White House issued a statement saying President Trump supports H. R. McMaster. The case shows how effective a group of well-organized bots, trolls, and cyborgs can, in extremis, force the White House’s hand in internal policy matters or at least shape public posture.

Donara Barojan is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store