Defining The Issues
People following the #Syria [1] hash tag on Twitter in the recent weeks to track the developments of the Syrian protests and the deadly governmental crackdown [2] on peaceful protesters must have noticed two major annoyances:
First was the proliferation of what tweeps dubbed as the “twitter eggs,” a group of newly created and mostly image-less twitter accounts that cussed out, verbally assaulted, and threatened anyone tweeting favorably about the ongoing protests, or criticizing the regime. Those accounts were believed to be manned by Syrian Mokhabarat[intelligence] agents with poor command of both written Arabic and English, and an endless arsenal of bile and insults. Several twitter users created lists to make it easier for the rest to track and reports those accounts for spam. Here are a couple [3] of examples [4].
Second, which is more damaging, is the creation of various spam accounts that mainly target #Syria hash tag; flooding it with predetermined set of tweets– every few minutes–about varied topics such as photography, old Syrian sport scores, links to Syrian comedy shows, pro-regime news, and threats against a long list of tweeps who expressed their support of the protests.
Identifying The Cause
At first I thought this was a badly timed annoyance, and several users were already reporting those abusive accounts. However, a couple of users apparently discovered some foul play. The parody account @SyrianPresident [5] tweeted [6]:
Stop it mukhabarat Twitter is not #Bashar’s spam machine! >@TheLovelySyria [6] #Syria #Homs #Aleppo #Damascus #Lebanon http://is.gd/Plii1Z
and @syrianrebels [7] responded [8]:
@SyrianPresident [9] it’s a company in Syria that send automated msgs, a dedicated owner they use server of @eghna [10] check website #Syria branch
I went to investigate the Bahrain based Eghna [11] Developement and Support*, which among other things provides “political campaign solutions.” I searched for any affiliation with Syria, and sure enough, one of the main suspected #Syria spam accounts was featured in their success stories page [12].
[13]
Eghna claims that “LovelySyria is using EGHNA Media Server to promote intersting photography about Syria using their twitter accounts. EGHNA Media Server helped Lovely Syria get attention to the beauty of Syria, and build a community of people who love the country and admire its beauty.” The only problem with that claim is that the lovelysyria.com website is only a Drupal login page void of content. There’s no way of creating a new user account, and therefore any claims of fostering a community are false.
[14]
Breakdown Of Research Results
Seemingly unrelated spam accounts, with the exact same modus operandi, have been rapidly coming into existence with only enough content to appear to be legitimate automated twitter accounts instead of spam bots with a very sinister motive behind them.
I have managed to identify at least 7 different accounts that are evidently configured to loop a specific set of tweets at predetermined intervals (usually between 2-5 minutes). Below are links their respective user pages and an explanation of what they tweet about:
- @TheLovelySyria [15]: As mentioned above, it tweets Flickr links of photos taken in Syria. It uses #Syria hash tag and also rotates between #tags of different Syrian cities. Tweets every two minutes.
- @SyriaBeauty [16]: Uses same set of tweets as @TheLovelySyria and tweets every two minutes. This means you’ll be bombarded by one tweet a minute of #Syria tweets unrelated to the current pressing issue which is the brutal crackdown on Syrian protesters. Same hash tags scheme.
- @SyLeague [17]: Tweets Syrian Soccer League match results from seasons 2003-2004 onwards. Matches are selected randomly and bear no significance to the fans of the sport. Same trend as above when it comes to tag usage. Tweets every two minutes.
- @KaramahClub [18]: Uses same tweet set as @SyLeague. Same #tag trends as all of the above.
- @SyHumor [19]: Tweets links to episodes and sketches of popular Syrian sitcoms. Same tag usage trend as above. Tweets every 2 minutes.
- @DNNUpdates [20]: Affiliated with Damascus News Network on Facebook. Pro-Regime. Tweets a distorted version of the events in #Syria and repeats news about alleged armed gangs and terrorists. Only uses #Syria tag. Tweets every 3 minutes.
- @MBKing13 [21]: Harasses a large number of twitter users who support or tweet positively about the protests. This account tweets about conspiracy theories and threatens twitter users while pretending that there’s a human behind the account. Taking a deeper look at the account shows that there’s a large set of pre-programmed tweets that are used repeatedly and threats are aimed at a set of users. The account is active 24/7 and tweets at 5 minutes intervals. Tags used: #Syria, #Mar15.
Note: if you twitter links appear to be broken you probably need to go to your twitter account settings and enable HTTPS which also enhances your privacy. If the page doesn’t exist it was probably taken down, but I have screenshots that I’d gladly share and I’m sure google will cache those pages for a long time.
Conclusion
Relying on the available data it seems that the regime is upping it’s information warfare game. Instead of generating bad PR by blocking websites or solely relying on going after online activists and attempting to hack their accounts. The regime at first attempted bullying and intimidation online by seemingly independent twitter accounts. That failed miserably and ended up being an embarrassment.
Now, they are effectively diluting the discussion and making it much harder to find any info about the protests by bombarding the popular relevant hash tags with badly disguised spam. Those spammy accounts have already been reported by many twitter users for spam, but Twitter has been slow to respond and apply their TOS [22] (terms of service) that clearly prohibit “overloading, flooding, spamming, mail-bombing the Services, or by scripting the creation of Content in such a manner as to interfere with or create an undue burden on the Services.”
Twitter is currently one of the main platforms used by dissidents and activists to disseminate information and videos of the ongoing protests, and uncover the crimes committed by the regime’s security forces against unarmed peaceful protesters. It is of utmost importance to ensure that their voices are heard. We must provide the general public and international media easy access to such information. Crimes unnoticed are crimes unpunished.
Update on April 19, 5:30 pm EST: The above mentioned twitter accounts are still active but their tweets are no longer showing when viewing the #Syria hash tag stream. I think Twitter handled this in a smart manner; the accounts are still viewable to people who are following them but are no longer cluttering Syria related searches. Thanks to everyone who reported this.
* Eghna has responded to the article. Please find their response in the comments below [23].
Note: This is a cross-post from the author's personal blog [24].