The Voty Twitter Botnet and The Attack on Senator Al Franken by the Alt-Right Army

Share:

The manipulation of social media by bots has gained widespread attention, especially considering the possibility that such manipulation may have influenced the outcome of the 2016 presidential election. Now, in the age of the #MeToo movement, a Twitter botnet was used to rile up opposition against Democratic Minnesota Senator Al Franken. This opposition eventually led to his forced resignation.

We discovered an army of Twitter bots related by the timing of their tweets and by the newly built “news” websites to which they link.

The Orchestrated Attack on Senator Al Franken

This Medium article by Erin Lank describes how the alt-right, led by Roger Stone, “predicted” and amplified a message stating that Senator Al Franken was a sexual predator.

The article details how known mouthpieces for the alt-right led the way by spreading anti-Franken allegations. It also explains how these messages were spread by thousands of posts on Twitter that caused the #alfranken and #frankenfondles hashtags to trend.

The article describes how the accusations against Franken were spread in the alt-right press and how these articles were amplified by bots. Meanwhile, mainstream media largely overlooked a statement of strong support from eight former staffers.

Publication of propaganda in numerous far-right news outlets, followed by
The coordinated use of social media bots to link to the publications and make the news “trend” on Twitter and Facebook.

This weapon has an unprecedented ability to taint free discourse with false and biased information. Its destructive capabilities cannot be understated.

The Twitter Botnet Echo Chamber

It’s natural for people to believe what they keep hearing. A situation in which information, ideas, or beliefs are amplified or reinforced by communication and repetition within a defined system is known as a metaphorical echo chamber. People are easily convinced that if everybody’s talking about it, it must be true.

Unfortunately, this natural instinct can become a liability in this new age of social media. We don’t really know who “everybody” is anymore. On the internet it is difficult to differentiate man from machine. It’s hard to know which of the voices that pop up in our feeds and on our timelines are sentient beings with their own beliefs and which are clones serving up disinformation.

“All that matters is repeated exposure to the message.” That’s exactly what an army of Twitter bots provides.

The Setup — Alt-Right Tweets and Japanese Websites

On November 15th at 10:21 PM, Roger Stone, with his now-suspended @stonezonetweets account, tweeted the following:

Roger Stone says it’s Al Franken’s “time in the barrel”. Franken next in long list of Democrats accused of “grabby” behavior.

On the same day, someone registered the web domain realusa.site in Japan. The Google Analytics and Apple ID codes on the site link it to a developer named Atsufumi Otsuka. A pseudo-news website was established at that web address.

On November 16th, Leeann Tweeden went public with her story of having been sexually assaulted by Senator Al Franken.

On November 20th, Charles Johnson, a prominent member of the alt-right, said the following in a Twitter thread:

Thinking of offering money to people who go on tv saying “Al Frank is a predator.”

On the same day, the same developer, Atsufumi Otsuka registered a second domain, votyus.me. Thus, he had established another pseudo-news website. Both websites use the same Google analytics account ID and Apple app ID. Additionally, the name servers and registration information for the two domains are nearly identical.

On November 21st at 1:52a.m., Mike Cernovich, another prominent member of the alt-right movement, tweeted the following:

I will fully cover the legal expenses of any VICTIM of a Congressman who wants to come forward.

How are these tweets and these newly built “news” websites related?

This is what we found.

Our Twitter Botnet Discovery

On December 7, Senate Democrats called on Senator Al Franken to resign because of mounting accusations of sexual misconduct. Shortly after, our source, an anonymous security researcher, came across some unusual tweets. Below is a screenshot of these tweets.

The content of these tweets is the title of an opinion piece by Ijeoma Oluo and is published at theestablishment.co.

With a Twitter following of fewer than 10,000 people, this site itself has modest reach.

Amplification

But a Twitter search for the article’s title: “Dear Al Franken, I’ll Miss You but You Can’t Matter Anymore” revealed a huge number of accounts amplifying it. The article urged women and activists to stand down and accept Senator Franken’s resignation. Rather than providing a link to the story itself, however, the tweets included links to the two “media” sites registered by our friend in Japan.

The interesting part of this discovery? The Twitter accounts linking to the two websites and tweeting the title of the article are all remarkably similar to each other.

Tweeting Style

These Twitter bot accounts mainly tweet mundane stories related to sports, bitcoin, and celebrity news. But sprinkled among these mundane links are a number of articles related to news and politics. At the time we discovered these bot accounts, the article they tweeted related to the Al Franken story.

Not every Twitter bot account is involved with the promotion of every weaponized story. It appears someone was dictating how much promotion occurs for any particular partisan story. This indicates that only a subset of Twitter bot accounts from a larger pool of bot accounts are used for each tweet.

Follower Numbers

Each Twitter bot account has 30-60 followers and many are not following anyone. They all had thousands of tweets. All of them had a large majority of followers whose profile and all content was in Japanese. More than half of the suspect Twitter accounts had as their first follower either a Japanese or Russian account and many of the accounts used banner images with Russian-language text.

Here is a screenshot of some of the followers of one of these accounts. Why would several hundred Japanese Twitter accounts be so deeply engaged in reporting on the Franken story?

We began to suspect that this legitimate opinion piece published by theestablishment.co had been weaponized for political gain by dozens of twitter accounts. All of the accounts were repeatedly tweeting links to the two domains registered in Japan in late November.

This Twitter botnet was still alive and tweeting when we first published this article. By our estimate, there are well over 400 accounts in this Twitter botnet. Though, at any one time, only a subset of this total is used to promote a particular story.

Strong similarities between the accounts and a clear connection to the two, recently-established Japanese websites verified our suspicions. Our source had stumbled upon a sophisticated botnet being used to spread alt-right propaganda.

Our researcher named his discovery the Voty Twitter Botnet.

And it’s still going strong.

The big question is: Who is paying for and running this decidedly alt-right themed Twitter botnet? Someone is deciding which articles will be promoted and how much they should be promoted.

What is a Twitter Bot, and How Do You Spot One?

A Twitter bot is a human-machine hybrid. A human is behind the account that controls the machine, but much of the activity is automated. In many cases, the machine behind the attack is a Twitter botnet. A botnet is a network of computers infected with a virus. The virus causes them to run a program that communicates with Twitter. Each of these computers, unbeknownst to its owner, is “tweeting” propaganda. The “owner” of the botnet controls the exact content of these tweets.

So how can you tell if a twitter account is likely to be a bot? Our security researcher provided us with some tips.*

Tips

The account has a significant number of tweets and/or likes in a short period of time. This can be in the range of 50–100 tweets or likes per day.
Few personal tweets and media compared to the number of retweets and tweets of existing articles. The account may have thousands of tweets and no media files, for instance.
Identical tweets appearing in other accounts at the same time (see below for how to spot this).
The account’s Twitter handle is a series of random letters and numbers that don’t at least resemble the account name. For instance, the account “emily” has a twitter handle “bakchadur7eyger.”
Many twitter handles ending in an 8-digit sequence and not in a date format are fake accounts with computer generated handles.
The account has a lot of foreign account followers even though the account only tweets content related to a different country. The account’s followers often exhibit the same pattern.

*Note that some legitimate Twitter accounts may have one of these characteristics. We recommend looking for two or more before making a judgement. If a person makes a snap judgement and accuses a legitimate person of being a bot, the person could impact the legitimate person’s life and privacy.

There are public Twitter bot checks. Many of the checks don’t identify more sophisticated accounts like this botnet, however..

An Example

Here are the results of a search for the tweet “Democrat Hypocrites Tell Creepy Al Franken to Stay in Senate.” It’s easy to search for a specific tweet using Twitter’s advanced search function. Notice that we circled the account with the user name “emily.” Also notice her odd, long Twitter handle: “bakchadur7eyger.”

When you click on her profile and check her followers, you see something odd. For a Twitter account that tweets mainly about US politics, Emily has a lot of Japanese-speaking followers.

Besides having an interest in US politics and a lot of Japanese speaking followers, Emily also follows a lot of Russian-speaking accounts. Maybe she is half Japanese and half Russian?