Analysis Summary
ISIS supporters will create a new account, usually under a very similar name, almost immediately after their profile is suspended by Twitter. The new user handle is then promoted by other ISIS-related Twitter accounts.
Despite Twitter’s efforts to shut down accounts, the number of users that talk favorably about ISIS since August 20, 2014 (post-release of the James Foley video) is still quite large at over 27,000 accounts.
Recorded Future’s sentiment and network link analysis can identify Twitter accounts that belong to the same user.
Over the past few months, the Islamic State of Iraq and Syria (ISIS) has quickly become the most feared terrorist organization in the world. One of their most effective strategies for spreading terror globally is their savvy application of social media.
Almost every organization around the world employs social media to build brand awareness. It’s convenient, free, and offers easy access to a large number of people. So it’s no surprise ISIS has become a sophisticated user of platforms like Twitter, Facebook, and YouTube to recruit and spread propaganda. Their use of Twitter-integrated apps such as Fajer Al Bashaer (Dawn of Good Omens/Tidings) is a prime example.
As a result, social media websites attempt to shut down accounts that violate their content policy. For example, The Twitter Rules state:
Violence and Threats: You may not publish or post direct, specific threats of violence against others.
Unlawful Use: You may not use our service for any unlawful purposes or in furtherance of illegal activities. International users agree to comply with all local laws regarding online conduct and acceptable content.
However, ISIS still succeeds at spreading its message. So, how do they do this?
Investigating Twitter Activity Related to ISIS
Of course, Twitter is only one of many services used by ISIS. Others include YouTube, Facebook, Tumblr, Scribd, and JustPaste.it. For this analysis we’ll focus on Twitter only.
Recorded Future collects and organizes hundreds of thousands of public web sources including social media, blogs, forums, news, etc. We used our system to identify over 60,000 social media authors, on Twitter in particular, who discuss ISIS and their violent activities in a favorable way. From there, we ranked those Twitter user handles to identify the top six (6) that appear to most closely mimic ISIS’s official pronouncements.
Our first graph visualizes the activity per week during 2014 for each of the six Twitter accounts. Note the decline is partly due to accounts being shut down. For this first graph, we have not included the accounts which took over when others were shut down.
Our second graph shows the distribution of the top services these Twitter accounts were linking to (e.g. what sources they were referring or promoting on Twitter). We see the bulk of the references are to social media (Twitter, Facebook, JustPaste.it, etc.) and to a much smaller extent references to traditional media sources. This indicates the material they are promoting is not traditional journalistic reporting but rather material produced by ISIS and its supporters.
We then created a graph showing all the sources referenced by our top Twitter accounts. As can be seen, these accounts are to a large extent promoting the same sources, and also referring to each other.
On closer inspection, our algorithms also detected some accounts that were behaving very similarly, and/or had names that resembled each other. For example, @abubakral_janab, @abubakraljanabi, and @alansarialjanab, or @mujahid4life and @mujaahid4life.
Further investigation revealed a process where once an account was shut down by Twitter because of improper content, a new account with a similar name was almost instantly created. This new user handle was then promoted by other ISIS-related Twitter accounts. In this way, the ISIS supporters are able to circumvent the ongoing efforts by Twitter to remove them.
This process is easily seen in the following graph, which shows the number of tweets per day for three different accounts, which our analysis suggests have the same owner.
All these account are now suspended by Twitter. We assumed there might be another account used for the period July 7-29, and used our system to query for Twitter authors who had been active during that period, but not before or after. This revealed the user @abualibaghdadi which perfectly fits this pattern.
After investigating Twitter activity related to six ISIS fanboys, accounts not overtly affiliated with ISIS but clearly very pro-ISIS, we discovered these supporters will create a new account – usually under a very similar name – almost immediately after their profile is suspended by Twitter.
While Twitter has made progress, our system shows there are still over 27,000 pro-ISIS accounts tweeting since the murder of James Foley. Accounts supporting ISIS continue to appear so it’s obvious Twitter’s current enforcement tactics are struggling to keep up.
An automated approach that utilizes techniques similar to those we have presented here – sentiment and network link analysis – could be used to successfully block improper content that violates The Twitter Rules. Although, such an automated process may accidentally shut down accounts that haven’t done anything wrong.
No comments:
Post a Comment