Jul 24, 2017
Polish Astroturfers Attack… Astroturfing
Coordinated Twitter campaign accuses others of coordination
On July 22, a crop of hashtags suddenly began trending on Twitter in Poland, all attacking the thousands of demonstrators who have been protesting against a proposed reform to the Supreme Court.
The hashtags — #AstroTurfing, #StopAstroTurfing, and #StopNGOSoros — claimed that the protests were not a genuine grassroots movement, but a fake “astroturf” imitation funded by Hungarian billionaire George Soros.
Many of the tweets used the same text, which proclaimed, “I am against the use of the #AstroTurfing mechanism to manipulate Poland.” (Sprzeciwiam się wykorzystywaniu mechanizmu #AstroTurfing aby manipulować Polską!)
Many also showed the same image, which included yellow text on a black background proclaiming: “It’s not an uprising, it’s a coordinated and paid-for marketing campaign for political #Astroturfing. It was banned in the USA and the UK. We in Poland are witnesses to one of the most massive attacks of this type in history. At the end of this whole rumpus there will be Soros. And that’s exactly what it is about.”
“Astroturfing” is a term used to describe fake grassroots movements that may, in fact, be directed by a single coordinating actor.
Ironically, the anti-astroturf hashtag campaign gives every indication that it itself was astroturfed by a small group of hyperactive users — some almost certainly automated “bots.”
High speed, high volume, low turnout
To analyze the traffic, @DFRLab conducted a machine scan of all tweets mentioning either #StopAstroTurfing or #StopNGOSoros on July 22–23. In all, the scan collected 15,882 tweets from 2,408 users.
The activity was not constant over time, nor did it grow organically. Instead, activity on the hashtag trickled very slowly until 19:00 UTC (21:00 local time in Poland) on July 22, at which point it shot up from a rate of around three tweets per minute to over 200 tweets per minute.
This intensity was sustained for less than an hour. By 20:00, the rate was below 100 posts a minute, and by 22:00 it had dropped back to under 10 posts per minute.
This profile is characteristic of a coordinated — and probably partially automated — hashtag drive, rather than an organic movement.
That impression is reinforced by the level of activity of individual users. On average, each user who tweeted the two hashtags did so 6.6 times (a figure generated by dividing the total number of tweets by the total number of users). This is an unusually high level of activity per user; the rate of engagement of users in organic Twitter movements is usually much lower, on the order of 1.5–3.5 tweets per user.
Equally strikingly, the 50 most active users to post the two hashtags tweeted 5,568 times, accounting for over one-third of all the tweets in the scan (35.17 percent). This confirms that the Twitter traffic was significantly shaped by a relative handful of hyperactive users.
Indeed, in just two hours, between 19:00 and 21:00 on July 22, the 10 most active users posted a staggering 1,804 tweets. In other words, just 10 accounts managed to post one tweet every four seconds over a two-hour period.
Perhaps most strikingly of all, out of the more than 15,000 tweets which used the two hashtags, over 11,000 used the exact phrase “Sprzeciwiam się wykorzystaniu mechanizmu” (“I am against the use of the mechanism”).
None of these indicators are consistent with the casual, organic, grassroots growth of hashtag movements. Instead, they are typical of coordinated and artificial hashtag drives amplified by highly dedicated — and possibly automated — Twitter users attempting to make hashtags appear more popular than they actually are.
Hyperactive users
Some of the top users have every appearance of being at least partially automated, judging by the degree of activity, anonymity, and amplification they show.
The account @annawitme, for example, joined Twitter on December 9, 2016; by July 23, it had posted 67,700 tweets, for an average of almost 300 tweets per day.
The account gives no verifiable personal information; on July 22, it posted 199 tweets in the space of just over two hours, between 19:00:07 and 20:58:17.
Of those, 95 were retweets without any comment; the others were retweets with just the anti-astroturf hashtags, or with the full “I am against” text, as these examples show:
This behavior is consistent with that of an automated “bot” account.
Much the same can be said of the account @ZawszePolska, which was created on January 1, and had, by July 23, posted 25,400 tweets (and had made more than double that number of likes), at an average rate of almost 125 tweets per day.
On July 22, this account posted 45 tweets on two of the anti-astroturf hashtags — all of them either retweets, hashtags, or the “I am against” text.
Another of the most active tweeters, @MichalAlex1975, managed to post 154 tweets using the hashtag on the evening of July 22. Of those, 148 were retweets, and the others, again, were identical uses of the same “I am against” wording, with the same black and yellow image:
The vast majority of the retweets from this account produced the same text yet again, from numerous other users:
Indeed, the pattern throughout this hashtag storm was for numerous users to tweet exactly the same text, and then to retweet each other. Perhaps the clearest example comes from the account @Oziunia, whose mentions of the hashtags #AstroTurfing and #StopAstroTurfing were retweeted almost 700 times on July 22.
@Oziunia did not use the hashtags in just one tweet: the account posted the same, standard text literally dozens of times, of which these are a sample:
It then posted the same phrase many more times, with two words added:
These posts, in turn, were retweeted by accounts such as @_boryeko_, who shared them 22 times in less than an hour:
In total, @_boreyko_ posted the survey hashtags 137 times between 19:00 and 20:21. Every one was a retweet.
Conclusion
The hashtags #AstroTurfing, #StopAstroTurfing, and #StopNGOSoros appear to have been driven by a very simple recipe. A number of activist accounts tweeted them repeatedly, most often using exactly the same turn of phrase. Those accounts then retweeted one another, and a shell of apparently automated accounts amplified all of them, creating explosive growth.
This behavior is consistent with other astroturf hashtag drives, which @DFRLab has analyzed, and with broader strategies of coordination and automation in social media. The effect was to drive traffic on the hashtag to a very high level — 13,000 tweets between 19:00 and 21:00 alone.
However, the hashtags failed to create a self-sustaining trend. By 22:00, traffic had dropped back to almost zero. The hashtags were not picked up by a wider pool of users; they did not survive once the initial blast of amplification was over.
Moreover, the attempt was blatant. The repeated tweeting of identical phrases, and the machine gun-like retweeting of hundreds of posts in a couple of hours, are clear fingerprints of artificial traffic, rather than a grassroots movement.
It is thus even more ironic that the campaign should have called the Polish demonstrators “astroturf,” when the same title can legitimately be applied to the Twitter campaign itself.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DRFLab).
Follow along for more in-depth analysis from our #DigitalSherlocks.
This post was updated on July 24 at 0700 UTC to correct the translation of “zakazany” to “banned”. Thanks to Jakub Bażela for pointing out the error.
