Facebook, Twitter in a losing game of Whack-A-Troll
Just months after Twitter and Facebook said they had removed hundreds of accounts used to undermine Hong Kong’s protest movement, the social media trolls are back.
Researchers, including at the startup Astroscreen, have identified suspicious accounts that suggest takedowns in August didn’t stop online activity targeting the protesters. Instead, some accounts with suspected links to the Chinese government that were removed have been replaced by different ones, engaging in similar types of tactics, the researchers said.
The findings highlight challenges Facebook, Twitter and YouTube face in trying to dismantle disinformation campaigns that operate through their platforms. They also underscore growing concerns about governments and other political actors using social media platforms to sway popular opinion or silence their critics.
“This arms race between platforms and malign actors isn’t going away,” said Jacob Wallis, a senior analyst at the Australian Strategic Policy Institute’s International Cyber Policy Centre, who authored a report on the matter in September. “Hyper-connectivity creates vulnerabilities that actors with various motivations will continue to exploit.”
Social media companies said they are working to curb campaigns to spread disinformation. Facebook is co-operating with other tech companies and security researchers to remove manipulation campaigns from its platforms, a spokesperson said. A Twitter spokesperson said platform manipulation has no place on its service, and the company will take enforcement action to stop it.
But keeping disinformation off platforms is proving no small task. Twitter said in August it had suspended 936 accounts linked to a China-backed operation, as well as a network of 200,000 other accounts. Facebook and YouTube announced similar moves the same month.
Still, researchers from Astroscreen, as well as Nisos Inc., FireEye Inc. and Graphika Inc., have found evidence suggesting that digital activity targeting the Hong Kong protests continued after the removals.
They cautioned that gauging the scope of any kind of apparently co-ordinated, inauthentic activity — and tying it to China or any other entity — is difficult without additional data like IP addresses, which social media companies generally don’t disclose.
While accounts may appear suspicious, it doesn’t mean they are controlled by any specific actor, such as a state.
In response to a request for comment, China’s Ministry of Foreign Affairs referred to an earlier statement by the Cyberspace Administration of China criticizing U.S. social media companies’ previous takedowns as censorship. Astroscreen, a London startup that monitors social media manipulation, studied what it considered suspicious activity on Twitter. It analyzed 30,000 Twitter accounts that were against the protesters in Hong Kong and found that a third were created between August and October.
The recently created accounts tend to follow a similar pattern, said Donara Barojan, who runs Astroscreen’s operations. Many have fewer than10 followers, use a generic photo for a profile picture without providing an identity, and tweet primarily about the protests. Many post in English in an apparent bid to sway global opinion, she said. The accounts purged by Twitter were typically older, automated accounts that appeared to be bought on the open market and repurposed for targeting the protests.
Many of the Twitter accounts Astroscreen studied pushed Chinese state narratives, such as the idea that protesters are being paid by the U.S. or other foreign actors. The accounts use generic hashtags like #HongKongProtest or #HongKong to avoid detection by Twitter, and retweet official media videos or articles with added phrases that toe the Chinese state line, Barojan said.
This tactic is a “way to discredit the protest movement and provide popular messaging that people around the world who are against American intervention can identify with,” Barojan said. “It creates a false consensus, a key tactic of propaganda actors.”
Researchers at cybersecurity firms Nisos and FireEye said they too found evidence that new accounts resembling the disabled accounts became active in antiHong Kong protest content following the August take downs.
Creating new accounts is a “low cost, low risk,” move for trolls, according to Cindy Otis, a former Central Intelligence Agency officer who serves as the director of analysis at Nisos. “There is no incentive for them to stop trying.”
The accounts she found used tactics such as copying and pasting messages or retweeting them, and using memes and images to paint the protesters as violent, Otis said.
“Hyper-connectivity creates vulnerabilities that actors with various motivations will continue to exploit.” JACOB WALLIS SENIOR ANALYST AT THE AUSTRALIAN STRATEGIC POLICY INSTITUTE’S INTERNATIONAL CYBER POLICY CENTRE