Twitter disclosed on June 11 three new state-linked information operations that have been taken place on its platform this year, including one in Turkey that’s linked to the ruling Justice and Development Party (AKP).
The U.S.-based social media company said these accounts consisted of a network of echo chambers, used to push propaganda, spread misinformation or attack critics of the government.
The biggest network of these accounts was linked to China, with 23,750 that were further boosted by 150,000 “amplifier” accounts.
The Turkish and Russian networks were much smaller, with 7,340 and 1,152 accounts respectively.
The accounts and their content have been removed from Twitter, but will be archived on a database for research.
A network in Turkey was determined to be pushing politically-themed tweets aimed at Turkish-speaking users.
“Based on our analysis of the network’s technical indicators and account behaviors, the collection of fake and compromised accounts was being used to amplify political narratives favorable to the AKP, and demonstrated strong support for President [Recep Tayyip] Erdoğan,” Twitter said, adding that it believes the accounts were operated by the youth branch of the AKP.
Furthermore, this network didn’t include just bots but also compromised accounts. Twitter said the hacked accounts were previously associated with organizations critical of President Erdoğan and the Turkish government, which made their new pro-government tweets stand out.
“These compromised accounts have been repeated targets of account hacking and takeover efforts by the state actors identified above,” Twitter said. “The broader network was also used for commercial activities, such as cryptocurrency-related spam.”
According to information shared by Twitter with Stanford Internet Observatory, across about 37 million tweets, the network promoted the AKP and criticized the opposition Peoples’ Democratic Party (HDP) and Republican People’s Party (CHP).
The report by Stanford Internet Observatory said that batches of fabricated personalities, all created on the same day, with similar usernames were found and several pro-AKP retweet rings were observed.
Tweets supporting Turkish intervention in Syria
Tweets were seen to have promoted the 2017 Turkish constitutional referendum, which consolidated power in Erdoğan and worked to increase domestic support for Turkish intervention in Syria. There were also English-language tweets that attempted to increase the international legitimacy of Turkey’s offensive in northeastern Syria in October 2019.
The 7,340 accounts included in the takedown dataset were created between June 9, 2008 and January 18, 2020, with spikes on particular days, such as October 28, 2014, when dozens of accounts with similar profiles emerged.
“Accounts in the dataset include some that appear to be leaders of local AKP branches, others that look like digital marketing firms and sport fans, and yet others that are clearly fabricated personalities or members of retweet rings,” the report said.
Sixty of the accounts had over 100,000 followers, though most of the accounts had a very small following – 4,534 accounts had fewer than 500 followers. Accounts had on average 4,274 followers, and the median number of followers was 207. The average tweet received 3.7 engagements.
The accounts frequently engaged with other accounts in the network, suspended accounts that are not included in this takedown, and accounts of public figures that are still live. The accounts frequently retweeted Lokman Ertürk, a local AKP politician.
Erdoğan’s Twitter account was either mentioned or retweeted 1.7 million times. Other accounts that the network frequently retweeted or mentioned included the AKP’s, presidency’s, Treasury and Finance Minister Berat Albayrak’s, Justice Minister Abdülhamit Gül’s and former Ankara Mayor Melih Gökçek’s.
#CumhurbaşkanıErdoğan, or #PresidentErdoğan, was used almost 13,000 times in this takedown dataset. Prior to 2019, there were two notable spikes in the hashtag: the first is on Jan. 6, 2015—the day of the Istanbul suicide bombing—and the second is on Sept. 29, 2016—when President Erdoğan announced that he would extend Turkey’s state of emergency for three months following an attempted coup. Most of the tweets received no engagement.
Elon Musk impersonators
Although not the focus of the takedown, some accounts in the network seemed designed for financial gain. @eIunmosk and @eIanmusk impersonated Elon Musk in July 2018. They responded to tweets that mentioned the real Elon Musk and shared links to a supposed cryptocurrency giveaway.
Both accounts stopped tweeting on July 16, 2018, suggesting that they may have been suspended around that date. Interestingly, the accounts frequently tweeted in Turkish prior to these impersonation tweets.
According to Twitter, many of the accounts in this dataset were compromised.
Retweet rings in the dataset often had political names. The names of some rings include “AK,” referring to AKP supporters’ preferred notation of the AKP as AK Party. One ring was called “AK Davam,” meaning “My AK Cause.”
A second, “AK Hilal,” translates to “AK Crescent.” The crescent is an Islamic symbol on the Turkish flag and is used frequently by AKP supporters. The AK Hilal and AK Davam networks each appear to be highly coordinated.