Inside Geoff Golberg’s war against the Twitter bots and the XRP Army

Throughout 2018, data scientist Geoff Golberg was doxxed repeatedly and received numerous death threats. His crime? Exposing the numbers of inauthentic and automated (bot) accounts on Twitter.

The issue of fake accounts has plagued Twitter, especially in relation to meddling in the U.S. Presidential election. In July, 2018, the social network said it had wiped tens of millions of fake accounts from the platform. Yet Golberg has continued to point out the numbers of suspicious accounts, related to an Iranian political organization, the Billboard Music Awards and even the notorious XRP Army.

The XRP Army is the name given to the legions of supporters of the cryptocurrency XRP—which was developed by the people at Ripple, a for-profit company. Many of the followers are real, and are hardcore devotees. But there are tens of thousands of Twitter accounts that just don’t seem real.

By exposing them, Golberg put himself in the line of fire.

Golberg is the co-founder of Elementus, a blockchain data analytics provider, which has released analyses of hacks from major crypto exchanges Cryptopia ($3-13 million) and CoinBene ($105 million). He left that company and recently founded a project called SocialCartograph, which provides analysis of social media manipulation. A respected analyst and economics major at the University of Pennsylvania, his work has appeared in the BBC, CNN and Quartz.

Ahead of Ethereal and Consensus during New York Blockchain Week, Decrypt caught up with Golberg to find out what really went on.

How to identify fake accounts

First, Golberg said we need to understand the difference between “inauthentic” and “automated or bot” accounts.

An inauthentic account is, simply, an account set up by a real person—usually someone influential or an influencer wannabe—who buys legions of fake followers, and tweets at will. By contrast, a bot account doesn't necessarily have many or any followers, but is run by computer program and typically spews forth hundreds of tweets a day.

Golberg got interested in probing the seamy underbelly of social networks after building up his own social network of video followers—and got disgusted with the unbridled power that the big platforms exercise.

“I used to do a lot of live video streaming on Meerkat and Twitter-owned Periscope. My idea was to build analytics software for live video. As I was learning, I started doing live streaming and became this accidental content creator—even covered a Heineken event at the Rio Olympics.”

However, in April, 2017, Periscope booted him from the network citing violations of the community guidelines. That’s what sparked Golberg’s interest in blockchain technology, and its potential to subvert the tech monopolies such as Facebook, Google and Twitter. “Big tech has so much power, they can opaquely and unaccountably remove someone from their platform, just like this.”

Yeah, he was angry at being de-platformed.

So Golberg started delving further into fake accounts on Twitter—and it became a bigger deal than he was expecting. “This analysis of inauthentic accounts came about from a ‘fuck you Twitter,’ but soon turned into a ‘holy shit this stuff is really scary.’”

And, like any intrepid explorer, he went further.

In early 2018, Golberg decided to go back and take a look at his own history. In 2016, some unknown person bought 10,000 Twitter followers for Golberg's account. Rather than be thrilled at his sudden, seeming boost in popularity, Golberg says he was dismayed, and contacted Twitter support. With no help forthcoming, he hired expert data visualiser Max Galka to try to figure out how to isolate, and remove the fake followers.

The result was this medium post and this image:

What can be seen clearly in this image is two sets of followers (in green, on the left) who are barely linked to the rest of his followers. That’s a clear sign, says Golberg, that they are inauthentic accounts.

Golberg focuses on the XRP Army

Next, Golberg decided to apply his analytics approach to the notorious XRP Army. He was about to ruffle some feathers.

Late last spring, the XRP Army had threatened Ryan Selkis, the founder of crypto data provider Messari, after it published a report that claimed the XRP market cap was wildly overstated. Some XRPers actually threatened Selkis’s family, and later, in May, Selikis’ phone was hacked and his Twitter account reported.

So, Golberg decided to have a look.

During the course of his analytic investigation, he got to chat with Ripple CTO David Schwartz, who agreed to change his profile picture to a robot if Golberg could back up his claims that the “XRP Army” was largely a bunch of bots. Despite presenting persuasive findings, Schwartz has not yet changed his picture. Nonetheless, in a Medium post, Golberg convincingly showed:

1. Many of the accounts that follow key XRP figures are inauthentic.
2. Typically, inauthentic accounts will follow the same few people, especially Ripple executives and prominent XRP Twitter accounts.
3. Inauthentic followers are used to increase “social credit,” making someone look like they have a bigger following.
4. Inauthentic accounts typically have similar header images, a lack of tweets, no display image, and a username consisting of random digits.
5. A key sign of an automated amount is a high number of daily tweets.
6. Automated accounts are used to retweet and “like” posts, making the XRP community look bigger, encouraging more people to buy XRP.

Said Golberg: “When I looked at the Twitter handles in the data set, I was floored by the number of accounts with XRP in their names. They have this stuff for every country, for all major cities. They’re trying to billboard Twitter with the XRP army.”

He gives as an example GiantGox, an XRP fan account with 39,000 followers. Running the numbers, he found 15,000 connections with a similar account, known as XRP Trump (which was just a name—the bots are apparently not related to Trump’s own bot army). Of these, two thirds were in a completely disconnected cluster. This meant these were probably inauthentic accounts used to boost activity.

He added that many of the accounts had names made up of iterations of the words “XRP” and “Ripple.” One user is “xrpxrpxr,” which follows a handful of Ripple executives and has barely tweeted. This account has since been deleted.

“There appears to be this hugely strong robust XRP community, but it’s not real. They’re trying to create the impression that there are many more XRP followers than really exist,” he explains.

It remains unclear who is behind the XRP Army. Theoretically, anyone can purchase inauthentic accounts and get them to follow, like or retweet posts from any Twitter user. Considering the accounts are designed to boost the following of XRP supporters and Ripple executives, it is possible the people behind them are XRP investors. But it is even more likely that we will never know.

When Golberg reported his findings in the Medium post and on Twitter, it put him in the XRP Army’s crosshairs.

“This was the first time I got swarmed by the XRP Army,” he said. Weirdly, this was a great turn of events, as far as he was concerned because, “it’s the best way for me to learn about these inauthentic networks. I often put myself in the middle of these shitstorms. It's a good way to collect the data. But this was the most intense one I had experienced since they tend to twist your words a lot.”

The XRP Army continuously reported many of Golberg’s tweets but never managed to suspend his account.

Comparing the XRP Army to Iranian militants

More recently, Golberg has been reporting on inauthentic accounts belonging to the Iranian political-militant organization called the People's Mujahedin of Iran (MEK). He noted there were some similarities between this organization and the XRP Army. “They always employ similar tactics. In the Iran case, they attack journalists in the same way the XRP Army attacks journalists.”

Golberg constantly refers his findings to Twitter, but he says he always is met with indifference: “I’ve shared Twitter death threats I’ve received from drawing attention to this stuff. I’ve been in touch with several folks at Twitter about the XRP Army. Unfortunately all to no avail.” We reached out to Twitter and have yet to hear a response.

But, regardless of all the disharmony, we ask if he is a shameless XRP holder.

“Big bagholder.” He says slyly, implying that he owns a lot of XRP. Then in true Elon Musk style, he clarifies, “Zero."