We do the research, you get the alpha!
Why are so many twitter accounts shared by a Saudi Arabia disinformation campaign, and the XRP Army?
The Friday before Christmas, Twitter dumped millions of tweets worth of data for researchers to pore over—which got the attention of noted analyst of social network sites, Geoff Golberg of Social Forensics.
In a post today, Golberg linked a surprising number of those Saudi accounts to the XRP Army, a swarm of over 40,000 Twitter accounts devoted to spreading the gospel of XRP. Though that sounds pretty fascinating—why in the world would the Saudis care about Ripple?—the explanation might be more prosaic.
Twitter said it had traced “the source of the [Saudi] coordinated activity to Smaat, a social media marketing and management company based in Saudi Arabia. Our in-house technical indicators show that Smaat appears to have created, purchased, and/or managed these accounts on behalf of — but not necessarily with the knowledge of— their clients.”
(For the record, Smaat’s CEO Sami Al-Rasheed, denied any wrongdoing, called Twitter’s allegations “false” and vowed to take Twitter to court: “We will take all necessary legal actions against Twitter’s arbitrary decision, which had a direct effect on our brand, name, reputation, and business in the market,” he said.)
Nonetheless, Golberg speculated that if Smaat, or whomever, had bought followers for a Saudi Twitter campaign, it's possible it used the same third party that supplies the XRP Army with its fake followers. “It's not to say that there's somebody in Saudi Arabia that's behind the XRP army,” he said. But then again, Golberg said he has absolutely no idea who’s pulling the strings.
Here’s the background on Golberg’s detective work.
Gumshoe detective
In August 2018, Golberg dissected the Twitter account of @GiantGox, an account that tweets in Japanese to almost 40,000 followers (including the Twitter account of Ripple, the team that created XRP) that he claims is one of the most prominent accounts of the XRP army.
Its large follower count would seem to give it legitimacy. Its followers, however, are mostly spurious. “These accounts function solely to inflate the follower counts of some accounts,” Golberg told Decrypt.
Communities connected to GiantGox are separated into distinct groups, and Golberg found that one of the groups contained a large concentration of Arabic language accounts, despite GiantGox tweeting exclusively in Japanese.
Golberg compared Twitter’s dataset to the 1,187 Arabic language accounts connected to GiantGox, and discovered that 70% were retweeted by accounts that Twitter determined were connected to the state-backed Saudi Arabian operation.
“The link is [that] they share followers,” said Golberg. “It's all deeply interconnected,” he said, referring to Twitter’s “underbelly of inauthentic accounts.” Indeed, after Twitter’s audit in December, 28% of the Arabic language accounts connected to GiantGox no longer exist or were suspended by Twitter.
Twitter had previously deleted core accounts of the XRP Army, including @XRPTrump. But “It’s too little, too late, it’s still superficial. The XRP Army still exists on a massive scale,” Golberg said. “This has not put a dent in it at all.”
Twitter’s not doing enough
Golberg claims that Twitter’s data dump is “nothing more than a PR play;” 88,000 shut down accounts are a drop in the ocean compared to the “millions” of accounts that form disinformation campaigns on Twitter. If anything, said Golberg, the data dump just revealed the surface of Twitter’s vast network of disinformation campaigns.
“This is just a byproduct of Twitter doing such a shit job at policing and cleaning their platform, he said. “Twitter says they're going to proactively mitigate against platform manipulation and information operations...and Twitter is not doing that in practice.”
The danger of such campaigns, he said, is that it can unfairly bolster the image of certain accounts. People might trust an account with 1 million followers more than one with 100 followers, and journalists or politicians might look to Twitter to get a pulse on what’s happening as news breaks, using Twitter’s trending feature as a proxy for what the public is thinking about.