Why is a Botnet spreading pro-republican propaganda?

Matteo G.P. Flora
Matteo Flora
Published in
5 min readMar 20, 2017

A strange application is flooding Twitter with tens of thousands of pro-republican tweets

Some days ago I happened to stumble in a Reddit post citing a hypothetical botnet to “fake support of Republican politicians”.
Here is the complete post:

Reddit post on /r/Twitter

Looking at what user Clayburn Griffin (hey mate, nice catch!) the behaviour of most of those users was really quite strange: they ALL seemed to use the same hashtags, they seemed to use the same (few) words, in the same combination and always expressing profound gratitude to Republican politicians and, in particular, to the Freedom Caucus.

For the noN American citizens (like me):

The Freedom Caucus, also known as the House Freedom Caucus, is a congressional caucus consisting of conservative Republican members of the United States House of Representatives. (wikipedia)

Here some example of tweets:

Not only that, but most users seemed to post a huge amount of almost identical contents, all dealing with the same display of Republican pride and/or support, like user @diberard028.

A user (@diberardo28) with scores of tweets

Certainly a “botnet-like” behaviour, and please be aware than several accounts has the “egg” profile icon and no Bio, but something wasn’t entirely right: some of the supposed “bots”, in fact, appeared to be very active. Some of them have accounts COMPLETELY composed of automated pro-Republican content, such as user “airlinecaptain1”:

The “mistery egg” user totally devoted to pro-republican tweets and retweets

Some users share, by the way, extremely active with more than 100 posts within this propaganda action, and several hundreds other in similar topics:

Most prolific Twitter users sharing propaganda content — data by Crimson Hexagon

Hey Twitter, that’s an App!

While a coordinated effort to convince hundreds of users to post hundreds of messages each is certainly possible, most of these propaganda actions are carried on through dedicated Applications who directly control many hundreds (if not thousands) of accounts.

Although spotting an application is something a little tricky for the common user, using Twitter APIs access can reveal a great deal about the presence of a dedicated application. In this case most of the published content has a precise definition of the “source” application:

Twitter API Console showing “FreedomWorks Advocacy” ad the originating Application

Content is published through an app called “FreedomWorks Advocacy” which declare the App URL as http://www.freedomworks.org.

FreedomWorks defines itself as:

…a national grassroots educational organization with a successful history of joining the principles of freedom with the hard work required to achieve good public policy.

A screenshot of the “Take Action” section of FreedomWorks website

So the website the application claim to be fathering it is a public policy organization devoted to express positions very close to the Republicans.

Interesting…

Quantitative Analysis

We searched the entire Twitter firehose with keywords #ThanksHFC AND #HFC AND #HouseFreedomCaucus from February 18th 2017 to March 20th 2017, with no language filter and no geographic filter.

The research found a whopping 20,669 posts containing our keywords within the firehose, with a peak of almost 6,000 tweets in peak days.

Amount of tweets using hashtags — data by Crimson Hexagon

A VERY strange application…

Many representatives are cited, some of them hundreds of time, in a quite evident effort to manipulate consent perception: even the “dot” (“.”) starting each twitter is an effort not to be filtered by “reply” algorithm.

Most cited Republican congressmen are (thanks, Wikipedia!):

Many more are present and cited thorough the analysis:

Accounts that are most cited by the Application — data by Crimson Hexagon

Author’s distribution is very US-centric:

Accounts geographic distribution— data by Crimson Hexagon

Impression Impact

It is indubitable that the effort to create awareness and/or propaganda feelings has surely received a lot of attention: during the month of analysis we were able to collect more than 7.5 million total potential impressions by the more than 20,000 tweets, with three 3 “peaks” on Feb.24, Mar.2 and Mar.4:

Calculated impressions per day — data by Crimson Hexagon

Something a little odd about the whole business is the messages-to-user ratio: while you’re normally getting a 2-tweets-per-user average in most analysis, here we have a small number of users (<200) making a huge number (>30) posts per day each on average:

Number of unique daily users and average posts-per-author — data by Crimson Hexagon

Conclusions

The action in support of the Freedom Caucus is certainly very strange and we can be quite sure that:

  • This particular action in support of Freedom Caucus has generated more than 20,000 tweets;
  • An extremely insolit number of users are tweeting by an account without Picture and without Bio;
  • Users are publishing tens (if not hundreds) of extremely similar messages in the space of a few hours;
  • Support is expressed to Republican congressman, some of them receiving 600–700 tweets citing them;
  • Most of the tweets are published not directly by the users but using a Twitter App handling the accounts;
  • The Twitter App declare to be named “FreedomWorks Advocacy” and states the following URL for more info: “http://www.freedomworks.org”;
  • FreedomWorks appears to be a “grassroots educational organization with a successful history of joining the principles of freedom with the hard work required to achieve good public policy”;
  • Freedomworks appear to be running public policy campaigns and the position appear to be prevalently pro Republican.

Closing Note

Do you think I missed/misinterpreted something? Did you see something wrong in this analysis? Please contact me in mail (mf@matteoflora.com) or via Twitter (@lastknight) and I’ll try to correct each and every error or imperfection.
And please forgive my spelling and/or grammar: I’m doing my best as a non native speaker (I’m Italian, if you’re curious).

--

--

Matteo G.P. Flora
Matteo Flora

Hacker, Founder of TheFool.it, We use Data for giving you better solutions. Web Intelligence, Reputation Creation & Monitoring, Intellectual property Protection