Spam Bots Flooding Twitter to Drown Info About #Syria Protests [Updated]

Defining The Issues

People following the #Syria hash tag on Twitter in the recent weeks to track the developments of the Syrian protests and the deadly governmental crackdown on peaceful protesters must have noticed two major annoyances:

First was the proliferation of what tweeps dubbed as the “twitter eggs,” a group of newly created and mostly image-less twitter accounts that cussed out, verbally assaulted, and threatened anyone tweeting favorably about the ongoing protests, or criticizing the regime. Those accounts were believed to be manned by Syrian Mokhabarat[intelligence] agents with poor command of both written Arabic and English, and an endless arsenal of bile and insults. Several twitter users created lists to make it easier for the rest to track and reports those accounts for spam. Here are a couple of examples.

Second, which is more damaging, is the creation of various spam accounts that mainly target #Syria hash tag; flooding it with predetermined set of tweets– every few minutes–about varied topics such as photography, old Syrian sport scores, links to Syrian comedy shows, pro-regime news, and threats against a long list of tweeps who expressed their support of the protests.

Identifying The Cause

At first I thought this was a badly timed annoyance, and several users were already reporting those abusive accounts. However, a couple of users apparently discovered some foul play. The parody account @SyrianPresident tweeted:

Stop it mukhabarat Twitter is not #Bashar’s spam machine! >@TheLovelySyria #Syria #Homs #Aleppo #Damascus #Lebanon http://is.gd/Plii1Z

and @syrianrebels responded:

@SyrianPresident it’s a company in Syria that send automated msgs, a dedicated owner they use server of @eghna check website #Syria branch

I went to investigate the Bahrain based Eghna Developement and Support*, which among other things provides “political campaign solutions.” I searched for any affiliation with Syria, and sure enough, one of the main suspected #Syria spam accounts was featured in their success stories page.

Eghna claims that “LovelySyria is using EGHNA Media Server to promote intersting photography about Syria using their twitter accounts. EGHNA Media Server helped Lovely Syria get attention to the beauty of Syria, and build a community of people who love the country and admire its beauty.” The only problem with that claim is that the lovelysyria.com website is only a Drupal login page void of content. There’s no way of creating a new user account, and therefore any claims of fostering a community are false.

Breakdown Of Research Results

Seemingly unrelated spam accounts, with the exact same modus operandi, have been rapidly coming into existence with only enough content to appear to be legitimate automated twitter accounts instead of spam bots with a very sinister motive behind them.

I have managed to identify at least 7 different accounts that are evidently configured to loop a specific set of tweets at predetermined intervals (usually between 2-5 minutes). Below are links their respective user pages and an explanation of what they tweet about:

  • @TheLovelySyria: As mentioned above, it tweets Flickr links of photos taken in Syria. It uses #Syria hash tag and also rotates between #tags of different Syrian cities. Tweets every two minutes.
  • @SyriaBeauty: Uses same set of tweets as @TheLovelySyria and tweets every two minutes. This means you’ll be bombarded by one tweet a minute of #Syria tweets unrelated to the current pressing issue which is the brutal crackdown on Syrian protesters. Same hash tags scheme.
  • @SyLeague: Tweets Syrian Soccer League match results from seasons 2003-2004 onwards. Matches are selected randomly and bear no significance to the fans of the sport. Same trend as above when it comes to tag usage. Tweets every two minutes.
  • @KaramahClub: Uses same tweet set as @SyLeague. Same #tag trends as all of the above.
  • @SyHumor: Tweets links to episodes and sketches of popular Syrian sitcoms. Same tag usage trend as above. Tweets every 2 minutes.
  • @DNNUpdates: Affiliated with Damascus News Network on Facebook. Pro-Regime.  Tweets a distorted version of the events in #Syria and repeats news about alleged armed gangs and terrorists. Only uses #Syria tag. Tweets every 3 minutes.
  • @MBKing13: Harasses a large number of twitter users who support or tweet positively about the protests. This account tweets about conspiracy theories and threatens twitter users while pretending that there’s a human behind the account. Taking a deeper look at the account shows that there’s a large set of pre-programmed tweets that are used repeatedly and threats are aimed at a set of users. The account is active 24/7  and tweets at 5 minutes intervals. Tags used: #Syria, #Mar15.

Note: if you twitter links appear to be broken you probably need to go to your twitter account settings and enable HTTPS which also enhances your privacy. If the page doesn’t exist it was probably taken down, but I have screenshots that I’d gladly share and I’m sure google will cache those pages for a long time.

Conclusion

Relying on the available data it seems that the regime is upping it’s information warfare game. Instead of generating bad PR by blocking websites or solely relying on going after online activists and attempting to hack their accounts. The regime at first attempted bullying and intimidation online by seemingly independent twitter accounts. That failed miserably and ended up being an embarrassment.

Now, they are effectively diluting the discussion and making it much harder to find any info about the protests by bombarding the popular relevant hash tags with badly disguised spam. Those spammy accounts have already been reported by many twitter users for spam, but Twitter has been slow to respond and apply their TOS (terms of service) that clearly prohibit “overloading, flooding, spamming, mail-bombing the Services, or by scripting the creation of Content in such a manner as to interfere with or create an undue burden on the Services.”

Twitter is currently one of the main platforms used by dissidents and activists to disseminate information and videos of the ongoing protests, and uncover the crimes committed by the regime’s security forces against unarmed peaceful protesters. It is of utmost importance to ensure that their voices are heard. We must provide the general public and international media easy access to such information. Crimes unnoticed are crimes unpunished.

Update on April 19, 5:30 pm EST: The above mentioned twitter accounts are still active but their tweets are no longer showing when viewing the #Syria hash tag stream. I think Twitter handled this in a smart manner; the accounts are still viewable to people who are following them but are no longer cluttering Syria related searches. Thanks to everyone who reported this.

* Eghna has responded to the article. Please find their response in the comments below.

Note: This is a cross-post from the author's personal blog.

52 comments

  • [...] tech enthusiast” based in the United States, noted at the GlobalVoices site that a number of Twitter spam accounts had popped up after the beginning of the Syrian protests. The accounts Qteish mentioned posted [...]


  • [...] few days ago, Anas Qtiesh* wrote of spam bots intentionally targeting the #Syria hashtag with neutral or pro-regime messages. I was then asked to [...]


  • In this Article, Mr. Qtiesh tried to link EGHNA (www.eghna.com) to the Syria Government, and adopted false claims about our company and our customers by some twitter “parody” accounts. Mr. Qtiesh published his article without contacting us even trying to verify his accusations, which is an unethical journalistic behavior, and can be considered as an intentional effort to damage our company reputation.

    The following points clarify the real situation regarding our company and the false accusations made in the article:

    1. EGHNA is an IT company that provides technology solutions to multiple sectors, including governments. However, the Syrian government was never one of our customers, and we are not in the process of signing any business agreement with the Syrian Government. Furthermore, we don’t have any relationship with any security or military organization in Syria.

    2. On the contrary to what your articles tries to imply, EGHNA maintains a number of business agreements with non-government parties, and we are proud that our communication and collaboration technology is used to help the people in Egypt, Syria, Lebanon, and Palestine.

    3. EGHNA does not review nor endorse the content of any customer as the article suggests. Your report tries to mislead your readers to think that we stand by the content of some of our customers, which is far from truth.

    4. EGHNA has a strict internal policy against spammers and internet abuse, so we acted upon you report immediately. We investigated the accounts reported by your article. Here are our findings:

    • @TheLovelySyria is tweeting flickr links to some Syria photos. All the links are compatible with the hash tag #Syria.

    • @SyriaBeauty is tweeting flickr links to some Syria photos. All the links are compatible with the hash tag #Syria.

    • Both accounts are operated by real people, their operators respond to incoming messages, and engage in active discussions, which make them real virtual citizens, not “spam bots” as your article falsely states in clear words.
    • Both accounts are not sending any political information, and cannot be classified as a political campaign by any reasoning.

    • Both accounts are far from reaching Twitter’s flood limit, so the “flooding twitter” claim is unfounded.

    • Both accounts have an active follower community, and their tweets are re-tweeted by many others.

    • Both accounts are compatible with Twitter’s automation policy, which says clearly “We welcome feeds that are used for community benefit or provide non-commercial information to a niche group of users, such as local weather feeds or transit information.”

    • Many of the accounts mentioned in your report are not linked to us, and we have no relation with them. The way the article is written however suggest linking these accounts to our company.

    5. As part of our internal investigation, we have contacted our customers for their response on your claims, and they confirmed the following:

    • They are not linked to any Syrian government organization in any way.

    • Their only intention is to promote Syria as a place for love and beauty.

    • They don’t interfere with political events, and have no political agenda.

    • They never attacked the Syrian revolution, nor supported the Syrian Government. They can’t understand how the article links them to the Syrian Authorities.

    • They never posted any feed to the Syrian revolution hash tag #Mar15 to avoid any interference with the people following the events.

    • They are completely independent and their motives are well-intended.

    • They refuse to take part in the bloodshed that is happening in Syria.

    6. In your report, you accuse us of providing false information in our success story, and this is another totally false claim. The mentioned customer has built a community of over 250 followers, many other people re-tweeting the photos they send, and many people have contributed new photos for them. Your accusation here as well is totally false and preposterous. You based your arguments only on the site being “under-construction” and deliberately tried to hide the truth taking your reader’s attention away from the facts.

    We find your report completely biased and far from the truth, and we consider this report as defamation. The fact the Global voices did not approach us before publishing this report to clarify the facts shows malice or at least negligence the author, both of which are illegal and unwelcomed in a site that promotes transparency.

    EGHNA remains faithful to its mission of providing cost-effective IT solutions to help customers reduce their costs and increase their revenue. EGHNA will continue to provide solutions that help the people communicate and collaborate, and is totally committed to ethical and anti-spam rules in business.

    • - The article did not suggest or imply points 2 and 3. We make no claims as to whether EGHNA or its clients have a formal relationship with governmental, commercial, or nongovernmental organizations in Syria. We simply observed an “affiliation with Syria”, the country, based on EGHNA’s text on their success stories page. We do not have more information about the client running these hashtags, but would be interested to know.

      We do not assert that EGHNA endorses the content of its customers. EGHNA’s behavior is not the point of the article; the behavior of its customers is.

      - As for point #4, I suggest reading twitter’s guidelines when it comes to spamming to ensure providing your customers with the best service possible. http://goo.gl/VpNfg

      I quote: “Some of the factors that we take into account when determining what conduct is considered to be spamming are: If your updates consist mainly of links, and not personal updates; if you post duplicate content over multiple accounts or multiple duplicate updates on one account; your account may be suspended for Terms of Service violations if any of the above is true.”

      Those accounts were guilty of the above among other things I did not list to keep this response as short as possible. Please note again that the accounts behave as if they were automated, posting on a steady schedule of two or five minutes, 24 hours per day, with text that is not contextualized or responsive to the conversation on the relevant hashtags. Our analysis shows that only a fraction of the texts seem generated by humans. It may be the case that your clients are actually posting these texts by hand, but they were behaving as if they are machines.

      - As for point #5, Regardless of the intent of the owners of the accounts, their behavior affected the experience of other Twitter users. There were calls to report those accounts for spam days before this post was written – in fact, those calls are why the post was written. I’m aware of Twitter’s flood limits, and agree that the total number of tweets was less than the flood limit, but please note that flooding and spamming are different concepts. See Twitter’s guidelines on automation http://goo.gl/n3f6h : “Posting to current trending topics in an automated fashion can degrade the experience for other users, and may result in your account being automatically filtered from search.”

      - As for point #6, I respect and commend Eghna’s commitment to their “mission of providing cost-effective IT solutions” and would like to quote the twitter guidelines one last time http://goo.gl/sd922 : “if you decide to automate any account actions, you will need to manage your automations carefully to avoid violating the Twitter Rules. Violating these rules may result in account suspension or termination, or your account being filtered from search, regardless of whether you performed the violation manually, or allowed an automation to do so!” It is indisputable that Twitter itself has decided that Eghna’s customer accounts breached at least two of the rules, as they have filtered the accounts in question from search. We are, with this article, pointing out that fact. If you have a dispute about the nature of that filtering, then it is with Twitter, not with this article, or with Global Voices Advocacy.

  • [...] April 18, Anas Qtiesh wrote about spambots targeting the #Syria hashtag in an effort to drown out speech calling for, or [...]


  • [...] a estos mensajes, han surgido dos tipos de usuarios pro-gubernamentales, como explica el bloguero sirio Anas Qtiesh en Global [...]


  • [...] a estos mensajes, han surgido dos tipos de usuarios pro-gubernamentales, como explica el bloguero sirio Anas Qtiesh en Global [...]


  • [...] a estos mensajes, han surgido dos tipos de usuarios pro-gubernamentales, como explica el bloguero sirio Anas Qtiesh en Global [...]


  • [...] y nada más”. Frente a estos mensajes han surgido dos tipos de usuarios pro-gubernamentales, como explica el bloguero sirio Anas Qtiesh en Global [...]


  • [...] to subscribe to the RSS feed for updates on this topic. [Translate] TweetLe 18 avril, Anas Qtiesh a publié ce billet [en anglais] sur les  “spambots” (robots envoyant des spams), qui ciblent les [...]


  • [...] To counter these messsages, two new kind of pro-government twitter users have emerged, as Syrian blogger Anas Qtiesh explains: [...]


Join the conversation

Authors, please log in »

Guidelines

  • All comments are reviewed by a moderator. Do not submit your comment more than once or it may be identified as spam.
  • Please treat others with respect. Comments containing hate speech, obscenity, and personal attacks will not be approved.