Twitter shuts down bots pushing pro-Saudi message

Twitter has suspended a network of accounts that appeared to be pushing pro-Saudi messages about the Jamal Khashoggi scandal, a person familiar with the situation told CNN Friday. The accounts were behaving like typical spam accounts, the person said, adding that Twitter had been aware of them for some time. Twitter said it has no evidence the accounts were pro-Saudi or Saudi government-backed. The move came after internet analysts such as Josh Russell, a systems analyst and programmer at Indiana University and a part-time Russian troll hunter, identified a surge in suspected botnet activity promoting pro-Saudi lines around the Khashoggi case, as first reported by NBC News.

Khashoggi’s disappearance and apparent killing has created a diplomatic rift between Riyadh and the West. Turkish officials believe Khashoggi was killed inside the Saudi consulate in Istanbul, and that suspicion arose within hours of his entering the consulate, CNN has learned.

Arabic hashtags praising the kingdom’s crown prince, Mohammed bin Salman, and calling on users to “unfollow enemies of the nation” were among the top trends globally in the past few days, presumably boosted by bots as well as real users.

Researchers detected bots that were sharing the same content, in the same order, using the same hashtags, suggesting a network-wide automated or semi-automated effort.

Marc Owen Jones, a lecturer in the history of the Gulf Arabian Peninsula at Exeter University, UK and researcher on bots and cybersecurity in the Gulf countries, told CNN one of the tactics these accounts used was to “start patriotic or banal hashtags that replace potentially critical hashtags.” Those include, according to Jones, hashtags such as one that roughly translates as “message of love for Mohammed bin Salman”.

“Hashtags about Kashoggi did not last long at all. Many of these trends are boosted by verified and highly followed accounts, but also supported by bots,” he said.

Another analyst, Ben Nimmo of the Atlantic Council, tweeted that an Arabic-language hashtag translating to “unfollow enemies of the nation” was used more than 100,000 times on October 16 and October 17.

According to Nimmo, 96.3% of the uses of that hashtag were retweets, suggesting a coordinated effort from either a retweet farm or bots, he said. Nimmo believes many of those accounts were dormant for years.




“They were created by genuine users in the early days, then abandoned, hacked, and sold on the dark web,” he told CNN. “There’s a big market for aged accounts.”

However, it’s really hard to work out who is running botnets, Nimmo said. “The bot action is clearly pro-regime, but some of the bots look commercial, rented for the occasion.”

“They’re amplifying real people, often verified users, and there’s a degree of genuine grassroots support for the hashtags; impossible to tell how much at this stage, but it’s not all bots,” he concluded.

Jones says propaganda troll accounts are becoming more common.

“Although Twitter claimed they suspended some botnets this is relatively trivial, the bots suspended were crude and likely to have been identified as part of Twitter’s routine spambot roundup,” he said.

“I’ve identified similar networks for years and Twitter rarely make a fanfare of getting them removed. Indeed, there are existing botnets spreading pro-regime propaganda that have existed since 2012 and that are still going strong.”

Source: cnn.com