Twitter and disinformation in Iran
23/06/09 09:15 Filed in: Analysis | Security | Technology
Over the past week there has been a lot of media coverage of the relationship between Twitter
, the hybrid online/mobile communication service, and its impact on post election events in Iran. The argument that Twitter service in Iran is a critical opposition activist tool is already over-hyped so I won’t rehash them here. Rather, I think its worth shedding some light on how Twitter is being used to spread disinformation and who is doing it. Twitspam
has a continually updated list of suspected fake accounts that may have connections with Iranian security. I used some of these account names as a starting point for a quick and dirty analysis of their networks.
Suspected AlJazeera English producer impersonator “AJE_Producer” appears to be trying to lure Twitter users in Iran into communicating with him directly through email or telephone with the intent of entrapping them. The diagram below illustrates how easily the suspected impostor was able to disseminate his requests for contacts. It shows only recent ‘active’ direct connections between AJE_Producer and twenty Twitter users and the recent active connections between those twenty users and their contacts. It does not show retweets
nor does it reflect how many people may have simply read a message from AJE_Producer.AJE_Producer network
Although some of the connections are from people trying to challenge AJE_Producer’s methods there were a surprising number of people who took AJE_Producer at face value including some who actually appeared to be residing in Iran. Given the current level of violence in Iran this is alarming to say the least.
Expanding the network of connections one iteration further gives a somewhat rosier picture. The chart below shows AJE_Producer’s (center of chart) deception being overshadowed by a number of well connected Twitter users (top of chart) who appear to be trying to out AJE_Producer and other fake Iran election Tweeters.
AJE_Producer extended network
Analysing the Twitter networks of other disinformation purveyors from Twitspam’s list highlights some developing tactics. Iransource and iransource45 are likely the same person. The content of the tweet streams is remarkably similar and composed mostly of overt propoganda. These two entities dominate the chart below because they send tweets directly to other Twitter users and reply to queries. Their relatively innocuous names may be an attempt to reassure potential followers. It is interesting to see the cluster of five anti-spammers trying to counter them.Iranian Twitter disinformation network overview
If we take a closer look at the network on the bottom left we can see a different tactic developing. Ebrahim Ansari (AKA Persian_Guy) uses fake retweets to spread disinformation and confusion. Essentially he is putting his words in the mouths of other users, both real and imagined. The AhmediNej accounts are primarily used to retweet Ebrahim’s content, probably in an attempt to bypass users trying to block
obvious proganda. They don’t have a lot of active connections, likely because the account names themselves are so obviously inflammatory.Close-up view showing AhmedNej and Ebrahim Ansari networks
For the moment it appears that activists in Iran have the edge when it comes to making use of Twitter to get their message out . However the propagandists are trying to close the gap. They hope to trap gullible users, spread disinformation, and create distrust.
If you want to counter them I suggest you go to Twitspam and block the those on the “Obvious Disinfo” list. Certainly you should not retweet anything from these people.