Assessing Inauthentic Networks Commenting on the US Midterms
This Election Integrity Partnership analysis was co-authored by Renee DiResta, Elena Cryst, and Chris Giles (Stanford Internet Observatory), and Alyssa Kann and Gavin Xu (Digital Forensic Research Lab).
On October 26, 2022, Twitter released six datasets to the Twitter Moderation Research Consortium, consisting of six distinct inauthentic networks with technical links to China and Iran that had tweeted about the United States’ November 2022 midterm elections. In this post, analysts from the Digital Forensic Research Lab and the Stanford Internet Observatory examine the content and tactics of the networks and their activity related to the US midterms. While some of the content posted by these networks and discussed in this blog post would not typically be in scope for the Election Integrity Partnership, commentary alleging election theft and fraud met our threshold for analysis, and for context we included the broader activity of these inauthentic accounts in this analysis.
The content put out by five of the six networks focused primarily on US politics, and particularly the midterm elections slated for November 8, 2022. The sixth focused on a litany of geopolitical issues including the Russia-Ukraine war and America’s foreign policy on China, with some scattered commentary on the midterms. The networks within the dataset were taken down under Twitter’s Platform Manipulation and Spam Policy.
All six networks were made to appear as if they were operating from within the United States based on user reported location [1] and, according to Twitter, some technical indicators. Three of the networks had additional technical indicators suggesting ties to the People’s Republic of China, and the other three had technical indicators suggesting they were located in Iran (with one additionally suggesting Israel). It is important to note that a sophisticated actor may manipulate technical indicators of location to better conceal their true location, and that location is not concrete evidence of state actor involvement. Election Integrity Partnership analysts do not have access to Twitter’s internal technical indicators; therefore, we examine the content and behavior of the accounts in the context of prior examinations of attributed-actor tactics, techniques, and procedures. We attempt where possible to conduct our own attribution, but attribution is not always possible using publicly available data.
The networks did not appear to achieve significant engagement from the online public or strong infiltration within American political-activist networks on Twitter; the most-engaged tweet had 31,303 engagements, and of the 705,864 tweets spanning the six sets, 592,333 had zero likes. While these inauthentic accounts at times participated in conversations alleging fraud in 2020, and commented about concern for the integrity of the midterms, these conversations remain dominated by authentic activity from political influencers, politicians, and the American public. Nonetheless, we present our findings to help inform the American public’s understanding of foreign influence activities, and additionally observe here that the diligence of Twitter’s integrity team ensured that these networks were disrupted before they managed to obtain significant reach.
Key takeaways:
As we have observed with other foreign influence operations targeting American politics over the last five years, motivations appear to include amplifying strong views on polarizing issues in American politics.
The communities and topics chosen for targeting may reflect Iran and China's strategic ends. The Iran-linked operations, for example, primarily expressed positive sentiments toward American progressive-left candidates, who might vote in a way that is more aligned with Iran’s interests. The China-linked efforts included content about American politicians’ comments on Taiwan and stance toward China.
“Follow-back” or “follow train” behaviors were present in these datasets, targeting both right-leaning and left-leaning activist online factions. These follow-for-follow efforts may enable inauthentic actors to integrate themselves into highly-active communities that regularly amplify ideologically-aligned political messaging from fellow participants.
One of the three China-linked networks consisted primarily of right-wing accounts that echoed talking points related to the “Big Lie”, such as references to “2000 Mules” and “stolen election”, while another had left-wing personas that talked extensively about gun control. As analysts have observed in prior China-linked influence operations, content supportive of China’s policies was present, though there was also some content critical of China.
The three Iranian networks primarily consisted of left-leaning personas supporting left-leaning politicians and policies. There were a few right-leaning personas among those datasets, the role of which remains somewhat unclear.
The content from one Iran-linked network (referred to as MENA3 in this blog post) included posts from an account masquerading as a progressive advocacy organization that issued endorsements of progressive candidates, including in down-ballot races, and boosting of some ActBlue fundraising pages. We have not previously observed inauthentic networks linked to Iran engaging in down-ballot commentary at the level of County Commissioner.
Networks discussing US elections
Names in parentheses (ex: MENA3) are the names used by Twitter to identify these networks. We provide them for other researchers interested in conducting further analysis.
10Votes Network (MENA3)
This was a small network of five accounts and 5,832 tweets; Twitter’s researcher consortium release notes, which names this network MENA3, states that its investigation into the network was initiated based on a tip from an industry partner. Nearly all of the activity came from two accounts posting between December 2021 and September 2022. One had various #MAGA community hashtags in his bio, including #1A, #2A, and #IFBAP (I Follow Back All Patriots). It engaged in “train” posting behavior (retweeting lists of names for others in the community to follow), amassed 5,345 followers, and sporadically discussed the midterms in the context of the 2020 election being allegedly stolen.
The other account, 10Votes81, whose name references the 10 votes by which Bernie Sanders won his first election in 1981, appeared on the surface to be a progressive political advocacy organization. It tweeted support for progressive political policies, while additionally endorsing and boosting ActBlue fundraising links for some of the candidates. We observed one candidate, for a County Commissioner position in Texas, sharing their endorsement meme on his Facebook page, suggesting that some targeted members of the community found the content convincing.
The 10Votes81 account’s content was somewhat evocative of the 2016 Russian Internet Research Agency efforts, in that it appears to be a front advocacy organization with particular branding prominent in its memes and endorsement posts. It leveraged hashtags to call attention to particular congressional races, including #PASen, #WISen, and congressional districts #MI11, #NY03, #OH11, and #TX38, as well as left-leaning political hashtags such as #StopRepublicanAbortionBans. Martin Luther King was a recurring figure in its memes, as were Senators Joe Manchin (D-WV) and Kyrsten Sinema (D-AZ), who were presented unfavorably as GOP pawns.
A meme shared by the 10Votes81 account shows senators Kyrsten Sinema (D-AZ) and Joe Manchin (D-WV) with “GOP” covering their mouths.
A meme advocating for a progressive policy; this format was reused for a variety of issues.
While it only amassed 2,244 followers and its highest-engagement tweet received 612 engagements, 10Votes81 regularly engaged in replies with politically-aligned individuals. It supported particular candidates past and present via hashtags such as #TeamFetterman and several related to Bernie Sanders. The account tagged an array of political figures and left-leaning organizations, including John Fetterman, Jamaal Bowman, Jan Schakowsky, Senator Ed Markey, Senator Jeff Merkley, Peter Welch, Nina Turner, Rep. Alexandria Ocasio-Cortez, Marie Newman, Our Revolution, Democratic Coalition, the Teamsters, and Occupy Democrats. Several of the progressive entities it boosted, including candidate John Fetterman, replied to 10Votes81 with thanks for its support. The replies from the candidates who responded were primarily pro forma rather than suggestive of substantive or sustained engagement.
Based on branding and content overlap, as well as a Linktree page, we noted several additional social media sites that appear to be tied to the 10Votes81 Twitter account. The YouTube account and Instagram profiles on the Linktree had already been deactivated before we located the profiles, but an account was still present on TikTok with the username @10.votes, with small reach (a few hundred views per video on average) and a small following (122 users). The TikTok account repurposed campaign videos and news coverage, but no individuals appeared on camera as representatives of the organization. It engaged with its audience by liking comments.
A Linktree page for @10Votes links out to already-suspended Twitter, YouTube and Instagram accounts. At the time of this analysis, a linked TikTok page and Reddit account were still active. Screenshots taken October 31, 2022.
10votes81 also appears to have used the handle 10votes on Reddit. The account was created in February 2021, and achieved a Karma level above 150,000. It was a highly active poster and appeared to be a moderator in r/Political_Revolution, where it shared content that was often identical to its Twitter content, and participated in conversations with candidates.
A screenshot of posts from the Reddit account r/10votes. Screenshot captured October 31, 2022.
The 10Votes81 account was interested in facilitating collective action online and offline, and posted about this across its social media accounts. One tweet boosted a petition opposed to the Mountain Valley Pipeline organized by a network of progressive organizations; in that instance, it does not appear to have been listed as a sponsoring organization. However, it also boosted a collective effort called “Deliver for Voting Rights”, sponsored by several authentic organizations, which listed the 10TenVotes logo on its partner page; a tweet from 10Votes81 about the event was quoted in press coverage by NBC News Channel 4 in Washington, DC. Additionally, two of its Linktree links, to March On for Voting Rights and March For M4A (Medicare for All) include its logo on their advocacy organization lists.
10votes81 Twitter content promoting a Deliver for Voting Rights event.
EvenPolitics Network (MENA1)
This was a small network of 37 accounts and 109,410 tweets, active from 2020 to 2022. Key hashtags included #Trump, #FreePalestine, and #Afghanistan. This network, labeled MENA1 in the Twitter data release, was previously discussed by cybersecurity company Mandiant, which linked it to a website with the domain evenpolitics[.]com. Mandiant observed a collection of coordinated and inauthentic social media accounts, and made a low-confidence assessment of the operation being “in support of Iranian political interests.” In cases such as this, when an outside research team identifies something suspicious and inauthentic, the platform (Twitter, in this case) additionally assesses the flagged network to look for indicators around its presence on their platform; Twitter’s release notes for researchers suggest that there were technical indicators tying the Twitter accounts to an Iran location.
Most of the accounts in the network impersonated American “resistance” liberals – for example, accounts with bios like “#ProudDemocrat #BLM” or “#Democrat #Resist #antiracist #BLM #LGBTQIA+ #Equality”. Content shared by the left-leaning accounts focused on issues like January 6, Trump, BLM, and COVID-related mask usage. In addition to American politics, many of the accounts talked about the liberation of Palestine, and wrote about their support of Palestine in their bios. The accounts self-identified on Twitter as being from a variety of places, mostly in the US, including Arizona, Ohio, Buffalo, New York, Montana, and Washington DC. Some of these accounts appear to have actively been tweeting out questions about American politics, perhaps in an attempt to generate engagement. These included "Should Trump be allowed to use Twitter freely like others?", "And tell me how you feel about Hershel Walker?", "Do you think marijuana should be legal in all the states?", and "Who is the main character in the next election?", among others. One account appeared to identify as a MAGA supporter, sharing anti-Biden and anti-Obama content as well as links to evenpolitics[.]com.
Twenty of the 37 accounts shared content from the website evenpolitics[.]com. Three of the accounts identified themselves as EvenPolitics contributors in their bios. One of the accounts in the network was EvenPolitics’ official account, which was linked from the EvenPolitics website. This account included the bio, “Digging the multi-faced politics of the world deep. Website Finally Up and Running! Subscribe to our newsletter to receive the latest updates.”
Another account appeared to be a back-up account for EvenPolitics, with its self-identified location set as the United States. In addition to sharing articles from the EvenPolitics website, both accounts shared a lot of original tweets with political advocacy content from a liberal American perspective. Topics of these accounts’ original tweets included the January 6 select committee, various wrongdoings and scandals of Donald Trump, advocacy for better gun control to stop mass shootings, the US withdrawal from Afghanistan, US income inequality, and the police killings of Black Americans, including Breonna Taylor and George Floyd. Some of these tweets used fluent English similar to a native speaker, while others used words or phrases slightly non-colloquially. For example, one tweet included the awkward use of the word “the” when it wrote, “Happy Birthday President Trump. Wish you a long life behind the bars #TheLoser.” It seems notable that the majority of both of these accounts’ tweets were original, not retweets, including 97 percent (1362 of 1407 total tweets) from the official accounts and 52 percent (196 of 377 total tweets) from the back-up account.
Articles shared from evenpolitics[.]com focused on a variety of topics relevant to American and global politics; its About Page states, “We publish thoughts, opinions, and investigative articles about diverse issues from adept points of view.” The website is still actively producing content, including in response to breaking news items. Hours after news broke on October 28, 2022 that House Speaker Nancy Pelosi’s husband was attacked, EvenPolitics updated its site with a story about the alleged attacker. The stories on the website, however, seem largely to be plagiarized from sources like the Guardian, Newsweek, and the Los Angeles Times, despite its About Page declaring “Who writes for us? Professional and amateur writers who have topped off their proficiency.”
An article published on evenpolitics.com (left) and the original source of the article published by the Guardian (right).
Notably, evenpolitics.com published several supportive stories about Iran’s women’s rights protests that were plagiarized versions of opinion pieces in the LA Times and the Guardian. According to Whoxy, the website was registered on June 13, 2020. The site has a donation form on their page; according to its source code, it appears to accept those donations in bitcoin. Apart from this Twitter network, evenpolitics[.]com articles did not seem to have been shared widely on other platforms.
Follow Back Resistance Network (MENA2)
This was a small network of 16 accounts and 24,579 tweets with 1,359,772 total likes and 324,258 total retweets. The accounts were active in April 2022, and flagged to Twitter by government partners, per the research consortium disclosure statement. Twitter’s release notes for researchers on this network noted technical indicators suggesting a location in Iran as well as Israel.
Frequent hashtags included #FreshWords (436 times), #FBRParty (302 times), #FBR (278 times). “FBR” is shorthand on Twitter for “Follow-Back Resistance”, a phrase used within left-leaning communities on Twitter. The “Resistance” portion was prominent among communities opposed to President Donald Trump; “Follow-Back” is a call to follow like-minded members of the community, in order to grow the numbers. This is a parallel to right-leaning “Trump Train” behavior, which we observe in other networks in this collection of six. Inauthentic actors interested in amplifying their messages are incentivized to integrate themselves into highly activist online factions who regularly retweet and amplify aligned political content. As members of these communities, they can produce content and have a higher chance of it being seen by the activist community members, who retweet content bearing community hashtags.
Other recurring topical content included left-leaning takes on political issues that ran the gamut (such as #FreePalestine, #RoeVWade, #TrumpCrimeFamily, and #MattGaetzIsAPervert). The network retweeted left-leaning political influencers such as Southern Sister Resister (@ResisterSis20 - retweeted 766 times), BrooklynDad (@mmpadellan), and Don Winslow (@donwinslow). It retweeted liberal and progressive politicians like Joe Biden, and left-leaning clickbait accounts like OccupyDemocrats.
This network did appear to generate some engagement: one account, @AliciaSmith987 amassed 24,319 followers, and had several dozen tweets pass 5,000 engagements. Her bio read, “Your limitation—it’s only your imagination” and her username included “#FBR”. The account’s most liked tweet, noting Ukrainian President Volodymyr Zelenskyy’s rejection of asylum in Europe, amassed 29,120 likes, and 574 replies. Its most retweeted tweet, which garnered 24,981 likes and 5,452 retweets reads “Remember when Stephen King suggested the best horror story? Trump's America.” The tweet included an image of Stephen King with a quote. Other images the account tweeted out included memes of Trump.
A meme shared in the MENA2 dataset.
A meme shared in the MENA2 dataset.
Some of @AliciaSmith987’s tweets explicitly mentioned the US midterms – for example, a May 3, 2022 tweet stated “70% of Americans favor the right to abortion yet American Taliban has voted to overturn abortion rights[.] If this is true & the ruling is released before the midterms, that should be a BIG motivator to get team blue off their asses. #ProLife #GOPHandsmaidsTale #FreshWords.”
This dataset additionally contained a second collection of accounts that seemingly did not overlap or interact with the US politics cluster. It shared and amplified content about the Hackers of Savior group and their exploits targeting Israel to benefit Palestine, with content in multiple languages, including English and Hebrew. Hackers of Savior is a pro-Iran hacker group that has previously targeted Israeli radio stations, and claims to have targeted the Bank of Israel.
A small number of accounts did not fit into either this bucket or the American liberal persona cluster – one account described itself as a ”Proud #conservative #AmericaFirst #patriot.” Like the MENA1 network, many of these other accounts described themselves as supporting Palestine.
Florida Anti-Rubio Network (APAC1)
This small network, labeled APAC1 in the data release, contained only 3 accounts and 396 tweets, and was active from April 2022 to October 2022. In addition to the tweets in the dataset, this network was active on Facebook, which took it down and offered a public overview in a September 2022 Coordinated Inauthentic Behavior report. EIP analysts additionally reviewed the underlying Facebook content and we make some observations on the full scope below.
The three accounts in this Twitter network appeared on the surface to be left-leaning Americans from Florida who tweeted positively about gun control and abortion access, and tweeted support of Val Demings, the democratic candidate for the Florida senate seat currently held by Marco Rubio. The profile pictures for all three accounts show up elsewhere online, including on Ukrainian dating sites and a blog post about Invisalign. The accounts had low follower counts (two had just over 1,000 followers and the third had none), and engagement with their tweets was low, with the highest engagement being just 78 likes.
The most prevalent hashtags were #Floridiansactnow, #RubioChildrenKiller, and #NRABloodMoney. Two accounts in the group actively engaged in pro-choice messaging from May 5-May 23, specifically advertising their planned participation in a May 12, 2022 rally at the Florida Capitol Building in support of Roe v. Wade, and a May 14 rally in Washington, DC. organized by Planned Parenthood. Activity picked up significantly following the May 24, 2022 mass shooting of schoolchildren in Uvalde, Texas, as gun control became the accounts’ significant area of focus.
Despite purporting to be Americans from Florida, several tweets made language errors that may be inconsistent with a native English speaker. One tweet read: “I'm a family of the victims in previous gun shooting. I felt ill to my stomach when seeing these republican senators support NRA. I beg you remove Cruz, Rubio, Romney... so that we can have a safe school for our kids”.
One account directly tweeted at the accounts of two local organizing groups in Tallahassee, the local branch of the International Workers of the World and the Tallahassee Community Action Committee, about a jointly organized May 12 rally at the state Capitol regarding reproductive rights. The account asked how to join the protest and then after receiving information from the organizers replied “Terribly sorry. I was told to go on a business trip tomorrow so I can't show up. Do you have any links for me to involve in online? I really want to do sth for reproductive rights. Thx a lot!”
The network showed some overlap in both themes and messaging with the network removed by Facebook, including one nearly identical post and image shared by the removed Facebook Page “Defend our Rights” and by one of the accounts in the Twitter set. The post read “Marco Rubio supported banning almost all abortions in a newly uncovered 2010 questionnaire. The questionnaire, from the National Pro-Life Alliance, asked whether Rubio would support 10 of their priorities. He replied "yes" to all of them.” This was shared by the Twitter account roughly 19 hours before it was shared by the Facebook Page.
Conservative #LeadFromWithin Network (APAC2)
This was a small network of 22 accounts and 255,604 tweets. The accounts were most active between March 2022 and September 2022. One of the accounts, created in October 2020, with 732 followers, produced over 300 retweets per day, primarily of right-leaning influencers and politicians during its period of activity from Aug 6 to October 11, 2022. These included Representative Lauren Boebert (R-CO), Republican House candidate Lavern Spicer, and others.
The three most liked Tweets by users of this network (with over 10,000 likes each) include a congratulations to Herschel Walker on his nomination, a celebration of Trump’s generosity on 9/11, and a criticism of Pelosi suggesting that she was willing to risk starting a war with China over computer chips (hashtagged #Taiwan). Tweets in this network had a total of 486,189 likes and 199,667 retweets.
Within this network, users retweeted author Lolly Daskal (@LollyDaskal) the most, at 12,396 times, followed by Donald Trump Jr. (@DonaldJTrumpJr) and Jack Posobiec (@JackPosobiec) at 2,741 and 2,474 times respectively. As a whole, the network’s tweets and retweets contained the hashtags #Leadership 4,040 times and #LeadFromWithin 2,726 times, primarily because of a single account, Hatha Goue (@HsiangLu1), that repeatedly retweeted author Lolly Daskal’s commentary about her book.
The accounts in this network that tweeted about US politics primarily took the form of fake right-wing, pro-Trump American personas, using language familiar in “MAGA” online communities, such as references to “2000 Mules” ("When will all 2000 plus mules be arrested ?"), “rigged elections” ("When they rigged the elections they declared war on the American people.👊"), and the influence of businessman George Soros in American democracy. Super Ultra Bella (@SimplyBellaH) is one such account, with a following of 26,473 people. This account overshadows the others in this network in social influence; it posted the aforementioned top tweet about Herschel Walker and many of its tweets were the highest performing in this network. Overall the network’s tweets during the midterm campaigns focusing on supporting Trump allies, and attacking more left-leaning views on gender identity and voter ID policies, received the most likes.
Although most accounts were right-leaning personas, one account had a strong left-leaning persona. In a tweet posted in August 2022, for example, it voiced that Trump was not above the law, even if he were a former president. The network also included some content related to China that we do not delve into in this primarily election-focused analysis.
Networks primarily targeting non-US topics
Pro-China Network (APAC3)
This was a network of 1,872 accounts and 310,043 tweets, predominantly in English and Mandarin, and a smaller proportion in Spanish, Japanese, Russian, Bengali and Korean. Some of the accounts were created as far back as 2009, but were overwhelmingly active between December 2021 and early October 2022. Analysts have previously observed the repurposing of old accounts in several China-linked influence operations. Additionally, Twitter’s dataset release notes mention technical indicators suggesting Hong Kong and Singapore.
This network primarily focused on pro-China and anti-Western content. Accounts in this network expressed support for pro-China positions relating to Hong Kong, Taiwan’s unification with the mainland, and the downplaying of rights abuses in Xinjiang, topics which have appeared in several prior China-linked influence operations. The most prevalent hashtags included #China, #VladimirPutin, and #AmazingChina. Many China-linked influence operations in the past have included strongly pro-China content; we have discussed that strategic approach in prior research. In the dataset, 1,189 tweets related to US president Joe Biden, including discussion around his position on Taiwan and China and remarks about the president’s age and cognitive abilities.
The most active accounts in the network made references to China, with the use of Chinese flag emoji, or with mentions to China in their usernames or location. The other accounts in the network had disparate naming conventions; a proportion had names followed by sequences of numbers. Other accounts claimed to be based in the US.
We consider most of the content of this network out-of-scope for an Election Integrity Partnership assessment of foreign influence attempts in the midterms, and will not delve into it here. However, searching the dataset for “election” turns up some tweets from July and August 2022 describing the decline of American society, and the “mercenary” nature of American politicians. This content had small amounts of engagement compared with the content about more global geopolitical issues.
Conclusion
We hope that this assessment of inauthentic activity on Twitter offers useful visibility into the tactics of incentivized foreign parties who wish to influence the American political discourse, particularly around elections. Despite the comparatively small number of engagements that these networks achieved, operations such as these reinforce that foreign interference is ongoing, and that platform integrity teams working alongside researchers to find, assess, and disrupt these manipulative operations remains critical to stopping them while they are still small.
Notes
[1] Twitter accounts may include a location in their bio, or turn on geolocation.
