Trump Tweets and Retweets Suspect Accounts

Share:

By tweet and retweet, Trump amplifies his attacks using Twitter. Leading up to the 2016 election, Russian-linked bots amplified Trump to the tune of 470,000 retweets. Even since 2016, a notable amount of Trump’s interactions are with clearly fake or, at least, suspect accounts. Let’s look at a recent example.

Trump Retweets Suspect Account

On December 28, Trump retweeted an account that had tweeted the alleged name of the whistle-blower.

Professor David Carroll astutely observed that the “Sophia” account used a Getty stock photo as its profile image (a common trait of fake accounts). But, upon closer inspection, we found a number of other oddities.

Pick a Face, Any Face (or occupation, or name)

In 2013, “Sophia” claims to be a historian.

In 2015, with a different person in the profile picture, “Sophia” claims to be an educator and image model.

And in 2018, “Sophia” claims to be named Evonne.

By 2019, “Sophia” has no profile description. Notice the images continue to look a lot different.

But the names and faces don’t stop there! Since our write-up, “Sophia” has gone through a couple of more iterations–and has created an additional Twitter account. (See the Update below.)

The Suspect Account’s GRU-IRA Interactions

One of the most notable oddities to the “Sophia” account, however, is its early interactions. Below, you can see that the suspect account frequently tags other accounts (a tool known to be used by coordinated networks). The highlighted account in these examples is particularly interesting—not just because it’s been suspended.

It turns out that LodiSilverado was one of the top-10 accounts that the Twitter-identified GRU-IRA trolls retweeted.

But LodiSilverado wasn’t the only GRU-IRA favorite that this account liked to tag. Linda Suhler was also a top-10 retweet for the GRU-IRA trolls.

Jared Wyand was another top-10 retweet for the Russian trolls. My, oh my. Interesting how engaged “Sophia” (I mean, “Evonne”) was with GRU-IRA pet accounts.

The GRU-IRA connections aren’t too surprising when you read the account’s Timeline. It has been incendiary since account creation.

So, what do we know about this account that tweeted the whistle-blower’s (alleged) name and that Trump retweeted? We know that its profile has changed dramatically over the years; it has a habit of interacting with some of the GRU’s favorite accounts; and it has been incendiary since account creation.

Trump’s Tweets and Retweets–This is Not Normal

None of this is normal. But are these oddities simply coincidences? Is this possible that “Sophia” is an American account unduly influenced by Russian propaganda? Or, perhaps, is the account part of the Russian GRU-IRA network? Twitter could find out. If it wanted to. In lieu of that, we are left with what we know.

In addition to the suspect account detailed above, we know that Trump continues to have inexplicable Twitter interactions. These interactions are not only with accounts seemingly connected to the Network Mueller investigated, but with accounts that are only a day or so old. Accounts that have no clear explanation for how Trump would even see them.

It is starting to look more and more like Trump is strategically using a fake network to post for the point of interaction. After all, it would be far safer for a fake account to expose the alleged whistle-blower than for Trump himself to do it. Then, all he must do is retweet it and have it amplified by the 30+ million fake accounts that follow him. In minutes, Trump’s messaging trends and becomes news.

How is this anything but propaganda? And when the President retweets an account with significant ties to the Russian GRU-IRA, we need to start thinking that there is something more concerning here.

How close is Russia connected to Trump’s daily messaging? Who’s running the fake accounts that amplify him? And why is nothing being done to stop it?

Twitter’s Loopholes Give Trump a Free Pass

Twitter allows all of this. Trump can threaten anyone at any time and and pay no price. The platform’s “newsworthy” exemption effectively means that there are no Terms of Service for Trump. By stoking the fires of hate, Trump is getting people hurt and putting them in fear for their safety. The platform doesn’t seem to care.

Trump is an impeached President being protected and amplified by a network of fake Twitter accounts. And, yet, all of this is being ignored by the platform. We, the real, TOS-abiding users, see the results of this every day.

Update

Since our write-up, the “Sophia” account first changed its profile picture to Trump. Additionally, you can see from the before and after images, that the account has gained a number of followers since Trump retweeted it.

Shortly after changing the profile picture, “Sophia” changed its handle to @2Samson67 and the name to Emma, all accompanied by a creepy propaganda picture of Trump and Jesus. *Thanks to a couple of sharp followers for the tip!*

And, not long after the “Emma” change, the account changed to “Leona” (@2Leona65).

And then it changed its handle again. This time to @4Shereene4.

Going above and beyond the call of duty, however, the handle for the account formerly known as “surfermom77” (aka “Sophia,” “Evonne,” “Emma,” “Leona”) has been placed on a brand-new account. First, the account’s name was “R.”

How do we know this account is connected to “Sophia” “Evonne” “Emma” “Leona”? Well, we have a couple of distinct clues. First, it only follows Trump.

But, most tellingly, it’s very first like was about the “Sophia” account changing its name to “Emma.”

Once this account was exposed, it changed its name to “J” and then “e” (along with a profile and background pic changes). As you can see, the first likes are the same as the initial “R” account.

One reason why this account may have been created is to protect the network with which it is affiliated. New searches for the handle would take a user to the new, clean account. It would, effectively, serve as a mask.