Download China Whitepaper: "Sockpuppets Spin COVID Yarns"
Download Turkey Whitepaper: "Political Retweet Rings and Compromised Accounts"
Read Russia Report: "Dispatches from the June 2020 Twitter Inauthentic Activity Takedown"

On June 3, 2020 Twitter shared with the Stanford Internet Observatory accounts and tweets associated with three distinct takedowns. These include:

• China: 23,750 accounts that tweeted 348,608 times. Twitter attributes the operation to the People’s Republic of China (PRC), the same state actor responsible for the approximately 200,000 accounts suspended in August 2019.

• Russia (Current Policy): 1,152 accounts that tweeted 3,434,792 times. Twitter attributes the operation to actors affiliated with Current Policy, a group of social-media accounts primarily engaged in publishing pro-Kremlin, anti-opposition, and anti-Western content.

• Turkey: 7,340 accounts that tweeted 36,948,524 times. Twitter attributes the operation to the youth wing of the ruling Justice and Development Party (AKP). The operation, for the most part, targeted Turkish citizens.

In this post we summarize our analysis of these operations. We have also written in-depth whitepapers on the China and Turkey operations, linked at the top of the page, with Russia to follow.

The China Operation

Image

Key Takeaways:

• Tweets were topically divided among four main groups: the Hong Kong protests; COVID-19; exiled Chinese billionaire Guo Wengui; and Taiwan (a smaller but still significant set).

• Tweet activity around COVID-19 ramped up in late January 2020 and spiked in late March. The majority of accounts were created mere weeks before they began tweeting in late January; however, some were created as early as September 2019, remaining dormant until they began tweeting about COVID-19 in March.

• Narratives around COVID-19 primarily praise China’s response to the virus, and occasionally contrast China’s response against that of the U.S. government or Taiwan’s response, or use the presence of the virus as a means to attack Hong Kong activists. The English-language content included pointed reiterations of the claim that China - not Taiwan - had a superior response to containing coronavirus. 

• Similar to Twitter’s August 2019 PRC-attributed takedown, the accounts used in this operation were not well developed personas: most accounts had fewer than 10 followers and no bios. Batches of accounts were created on the same day with similar naming conventions or bio patterns. 

• Tweets about Hong Kong and Guo clustered around significant events, and focused on countering pro-democracy narratives in Hong Kong and denouncing Guo’s business contract with former White House chief strategist Steve Bannon.

The Current Policy Operation

Accounts in the network were tied to local news sites for several Russian cities: Ufa, Yaroslavl, Arkhangelsk, Krasnoyarsk, and Omsk.

Key Takeaways:

• Twitter attributed this takedown of 1,152 accounts and 3,434,792 tweets to actors affiliated with Current Policy. This group of social-media accounts is primarily engaged in publishing pro-Kremlin, anti-opposition, and anti-Western content. The Current Policy Twitter account began tweeting in early 2013 and tweeted almost 58,000 times, gaining over 150,000 followers before it was taken down in November 2019.   

• The politically engaged accounts in the network focused on amplifying pro-government activity and cheerleading for President Vladimir Putin and his party, United Russia. Several of the accounts purported to represent official government offices, such as the Moscow Construction Bureau and the Voronezh branch of the United Russia party. Others purported to represent United Russia politicians, including members of the Duma and the Moscow City Duma.

• Accounts worked to direct attention to and boost the popularity of Federal initiatives such as “Leaders of Russia,” a contest intended to identify “future leaders” and reinvigorate various branches of government, and Skolkovo, an “innovation center” modeled after Silicon Valley.

• Anti-opposition activity was additionally present in the form of caricature accounts, attacks on Navalny and the Anti-Corruption Foundation, and amplification of allegations that the opposition cheated in last year’s contentious Moscow Duma elections. One of the accounts posed as a polling company “independently studying Russian public opinion” and used leading questions to elicit pro-government and anti-opposition responses.

• Another group of accounts was tied to a network of news sites aimed at several Russian cities: Ufa, Voronezh, Omsk, Krasnoyarsk, and Arkhangelsk. This network is owned and operated by the media conglomerate Hearst Shkulev Media; while some of the affiliated Twitter accounts for sites in this network were included in the takedown, others were not, and the connection between Hearst Shkulev Media and the actors behind Current Policy is presently unclear. 

• Finally, many of the most popular accounts were involved in a commercial operation called twishop that sold retweets and tweeted links. These accounts ranged from humor accounts to photography accounts and were typically not politically engaged.

The Turkey Operation

Image

Key Takeaways

• We found batches of fabricated personalities, all created on the same day, with similar usernames. We also observed several pro-AKP retweet rings. 

• The takedown included centrally managed compromised accounts that were used for AKP cheerleading.

• Some of the suspended accounts were linked to organizations that were critical of the government. According to Twitter, they are included in the takedown because their accounts were compromised by this network.

• Tweets were critical of the Peoples’ Democratic Party (HDP), and accused it of terrorism and social media ploys. Tweets were also critical of the Republican People's Party (CHP).

• Tweets promoted the 2017 Turkish constitutional referendum, which consolidated power in Turkish President Recep Tayyip Erdoğan.

• Tweets worked to increase domestic support for Turkish intervention in Syria. There were also English-language tweets that attempted to increase the external legitimacy of Turkey’s offensive in northeastern Syria in October 2019.