Today Twitter announced the takedown of several state-linked operations. The Stanford Internet Observatory analyzed the accounts and tweets associated with these operations.

• Cuba: 526 accounts that tweeted 4,802,243 times. Twitter attributes this operation to youth organizations with ties to the Cuban government, including Unión de Jóvenes Comunistas (UJC) and Federación de Estudiantil Universitaria (FEU). 

• Internet Research Agency: 5 accounts that tweeted 1,368 times. The accounts were linked to the fake news agency PeaceData.

• Saudi Arabia: 33 accounts that tweeted 220,254 times. Twitter says this operation has ties to the Saudi government.

• Thailand: 926 accounts that tweeted 21,385 times. Twitter attributes this operation to the Royal Thai Military.

• Iran: 104 accounts. A network of compromised accounts operating from Iran. We cover this operation in a separate blog post. 

In this post we summarize our analysis of four of these operations. We have also written in-depth reports on three of these operations, and a blog post on the forth, all of which are linked at the top of the page. 

The Cuba Operation

The network that Twitter shared with the Stanford Internet Observatory included 526 accounts and over 4.8 million tweets. 64% of the tweets were posted between January 1, 2019 and May 13, 2020, when many of the accounts in the network were suspended. Cuba’s dramatic expansion of 3G access access in December 2018 likely contributed to the growth of activity. The thematic dialogue overall aligned with the Cuban government’s political and ideological stances. Accounts generally tweeted content supportive of President Miguel Díaz-Canel and former presidents Fidel and Raúl Castro. They further celebrated national heroes, especially Ernesto “Che” Guevara and the nineteenth-century poet José Martí. The profile descriptions shared patriotic messages, with many users identifying as “revolutionary youth,” “100% Cuban” or “Faithful follower of Fidel/Martí/Che.” Many accounts self-identified as students, professors, engineers, doctors, and lawyers.

A tweet from @DeZurdaTeam reads: “Yankee Imperialism continues to blockade the Cuban people but #CubaSavesLives in every corner of the planet. #DeZurdaTeam invites you to inundate the networks to demonstrate that #TheBlockadeKills.” The attached images reads “April 6 / Mobilize yourself on Twitter!”

The largest network in the dataset was united around the hashtag #DeZurdaTeam. The term “De Zurda Team” is used in the profile descriptions of 126 of the accounts, and 366 of the 526 accounts either mention De Zurda Team in at least one of their tweets or retweet a tweet using the phrase. The @DeZurdaTeam account organized weekly hashtags that invited the network to share their (usually patriotic) thoughts on topics such as “Today I want to applaud ___” or “I dedicate this month to ___.” 

Key Takeaways:

• The largest network unified around “DeZurdaTeam” – both an account and a hashtag – also had a linked Facebook Page, Facebook Group and Instagram page. Users included the hashtag in their profile description along with emojis that may have been used to organize groups within the network.

• DeZurdaTeam used their platform and network to push weekly hashtags encouraging users to share their thoughts on a topic. While the hashtags themselves were generally apolitical, the responses were strongly patriotic in nature.

• With the emergence of COVID-19, there were an increasing number of Tweets focused on Cuba’s medical diplomacy. Content related to COVID-19 praised the quality of Cuban doctors and the Cuban medical system. 

• The accounts pushed patriotic, pro-Cuba and anti-U.S. content, especially discussing the ongoing U.S. trade embargo against Cuba.

• Several of the primary accounts have been restored on Twitter and many more have respawned since the takedown. A Twitter search for #DeZurdaTeam yields hundreds more accounts that use the hashtag in their profile description.

The Internet Research Agency Operation

The IRA takedown from Twitter is tied to the takedown of Internet Research Agency assets that Facebook announced on September 1, 2020. Five accounts were removed, with 1,368 tweets, all tied to the PeaceData operation investigated by Graphika in this report. These accounts correspond to those mentioned in the report by Graphika - three ostensible “editors” (Albert Popescu, Alex Lacusta, Alice Schultz) and Peace Data’s main and Arabic-language Twitter accounts. Lacusta’s account, interestingly, was created in April 2014, and @peacedata_ itself was created on December 25, 2019. The others were created around the time the operation commenced, in May 2020. 

Most of the content has already been thoroughly discussed in Graphika’s report, and the five Twitter accounts spent most of their time tweeting PeaceData headlines and promoting its content (including by retweeting its contributors). The unique content in the tweets primarily consists of extensive attempts at networking - a veritable who’s who of left-wing and conspiratorial media properties. 

Image

They additionally requested permission to repost articles: “@TheDuran_com Hello, we are a young nonprofit dedicated to exposure of war crimes and corruption. We ask for your permission to republish some of your articles giving full cred, of course. Your DM is disabled for non-followings. Could you, please, answer me via DM?”

There were a total of 3 tweets from the editor personas that were not shares of the content or retweets of other accounts; two were political hot takes. “Please remember, they didn't mind attacks on Sasha and Malia AT ALL. I haven't heard a single word in defense of president's family before 2016.”  And the final was a simple “#DNC2020”. 

The most-liked tweet - 19 Likes - was the promotion of an article about Venezuela “Operation Gideon Should Remind Americans That  U.S. Aggression Against Venezuela Isn’t About Human Rights https://t.co/Inywb7zejW” The most retweeted - 28 retweets - was a share of an article about US troops arriving at a Saudi Arabian air base.

We recommend a read of Graphika’s report to understand the full scope and context of this operation. 

The Saudi Arabia Operation

The most prominent suspended account in the network, a fake account for Fahad bin Abdullah Al-Thani, a dissident member of the Qatari royal family who lives in Qatar.

In this brazen operation, accounts assumed the identity of dissident Qatari royals and an exiled Qatari transitional government. One of these accounts had over a million followers, and several had tens of thousands. In May 2020 several accounts in the network pushed unsubstantiated rumors of a supposed coup attempt in Qatar. Much of the network appears to have been suspended in that same month. This report builds on investigations Marc Owen Jones (an assistant professor at Hamad bin Khalifa University, in Qatar) conducted at the time, when he independently discovered a portion of this network and verified that the coup attempt rumors were fabricated. 

Key takeaways:

• The operation created fake Twitter accounts that assumed the identity of dissident members of the Qatari royal family, including Fahad bin Abdullah Al-Thani, who lives in Saudi Arabia. Prior to its suspension, Al-Thani’s account had more than one million followers. 

• The operation also included a number of accounts that pretended to represent a Qatari government in exile. We believe that one of these accounts, @QtrGov, was the first user to mention the unsubstantiated rumor of the Qatar coup attempt on Twitter.

• Several of these accounts appear to have changed their usernames over time and wiped their earlier tweets. These tactics can increase account legitimacy; for example, the accounts could have engaged in spammy audience-building tactics (such as follow-back rings) for years, wiped those tweets, and then changed their name to, e.g., @QtrGov. 

• While tweets about the supposed coup attempt received a few thousand interactions (quote retweets + retweets + replies + likes), Marc Owen Jones, an academic researcher, quickly identified and publicized the inauthentic network.

• The network spread fabricated Amnesty International and Human Rights Watch statements alleging that Fahad bin Abdullah Al-Thani was tortured in a Qatari prison.

The Thailand Operation

Tweets over time for a domestic information operation by the Royal Thai Army targeting Thai Twitter users. Activity is heavily concentrated in February 2020, and spikes around key events including the Korat shooting and the disbanding of the Future Forward Party.

The network of 926 accounts removed by Twitter and attributed to the Royal Thai Army engaged in a domestic information operation targeting Thai Twitter. The network was used primarily to promote pro-government and pro-military positions and accounts on Twitter and to attack political opposition, particularly the Future Forward Party and Move Forward Party (FFP and MFP, respectively). Activity was heavily concentrated in February 2020 with notable spikes around the Korat shooting, a mass shooting in which a soldier killed 30 people, and the dissolution of the FFP. This was a coordinated but low-impact operation: most accounts had no followers and the majority of tweets received no engagement. This might be due in part to the operation’s limited duration: most of the accounts were created in January 2020 and all but two accounts stopped tweeting by March 2, 2020. 

Key takeaways:

• The removed network engaged in a domestic information operation that promoted the Royal Thai Army and criticized Future Forward Party and Move Forward Party candidates.

• Tweets often focused on particular events, such as court cases over a loan to the Future Forward Party (resulting in its subsequent disbandment) and the Korat shooting. In the latter case, the network tried to redirect criticism away from the Army, distance the Army from the shooter, and highlight how well the Army responded to the crisis.

• Most of the 926 accounts were created in either December 2019 or January 2020, and most tweets were from February 2020. Only two accounts continued tweeting after March 2, 2020. We believe Twitter caught the operation relatively soon after creation.

• This was a relatively unsophisticated social media influence operation with limited reach. The network’s overall Twitter engagement was low: 684 accounts had no followers, and average engagement per tweet was just 0.26 engagements. 

• The accounts tended to rely on a few basic tactics, such as replying en masse with supportive messages to tweets from Army PR accounts and dogpiling onto tweets from opposition-aligned accounts. Overall, the accounts were thinly backstopped: many of them had empty bio sections and used stolen profile pictures.