Now on Demand Ransomware Resilience & Recovery Summit - All Sessions Available
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Research Shows Twitter Manipulation in Weeks Before EU Elections

This is an age of large scale political social engineering through social media, both by advertising and the presentation of misleading data. International social engineering became frontpage news with the 2016 US presidential elections, but has not abated since. Researchers with the Sherpa project analyzed the use of social media as a recommendation system — specifically Twitter — ahead of the European elections in May 2019.

This is an age of large scale political social engineering through social media, both by advertising and the presentation of misleading data. International social engineering became frontpage news with the 2016 US presidential elections, but has not abated since. Researchers with the Sherpa project analyzed the use of social media as a recommendation system — specifically Twitter — ahead of the European elections in May 2019.

The Sherpa project comprises a consortium of 11 partners (academia, industry, civil society, standards bodies, ethics committees) across six European countries. Its purpose is to analyze and understand the ways in which smart information systems and big data can impact ethics and human rights issues. As part of this project, F-Secure’s Andy Patel — a researcher in its artificial intelligence center of excellence — analyzed political tweets in the weeks leading to the EU elections.

After examining tweets that included official EU election hashtags, such as ‘#EUElections2019’, “We stumbled upon some highly political tweets that received a great deal of suspiciously inorganic engagement,” reports Patel. Inorganic engagement can be defined as manipulated engagement, while organic engagement comes from the normal interaction of friends and interested parties. The former is typified by a high percentage of retweets — often from fake accounts — while the latter tends to have a higher percentage of ‘likes’.

The report focuses on two particular inorganic tweets. The first, posted by NewsCompact, shows a video of “A muslim #migrant destroying a statue in #Italy, because part of the body is showing.” In fact, the video was taken in Algeria; but nevertheless, it was retweeted by thousands of far-right accounts.

The second tweet came from an account operated by PartisanDE: “More evidence how inhuman #Macron’s #France is in 2019. A disabled protester was humiliated by #regime forces, her walker was knocked out of hand. She fell down.” This tweet received more than 6,000 retweets. 

These two accounts are connected — the operator of PartisanDE identifies as the CEO of NewsCompact. Both have a high number of following accounts that were created within the last 18 months. “They share a great deal of politically inflammatory content, racist content, and mistruths,” writes Patel. “The accounts also share many URLs to sources such as VoiceOfEurope, RT, Sputnik, and some other non-authoritative ‘news’ domains.”

The research discovered 200 accounts engaged in posting political content relating to the EU, all of which had been created on 20 and 21 May 2019 (two days before the UK started the EU voting). All these accounts retweeted a PartisanDE tweet saying “#Brussels poster boy #Macron now has a disapproval rating of a staggering 68% after weeks of chaos following his dreadful mishandling of the #GiletJaunes.” This tweet was stamped with the leave.eu logo — the official campaign operation for the ‘leave’ side during the Brexit 2016 referendum.

At the time of compiling the report, this tweet had received 388 retweets, including the 200 identified new accounts. Looking at those 200 accounts, Patel discovered that they have also retweeted legitimate “verified accounts (such as justinsuntron, paulwrblanchard, and Mark_beech), selling products (including books an health supplements), people in the music industry, a fashion blogger, finance ‘experts’, ‘social influencers’ (surprise, surprise), and even ‘CEOs’.”

Advertisement. Scroll to continue reading.

Patel’s conclusion is that not only political factions, but apparently verified accounts can and do freely purchase retweets, followers, and therefore influence. Nevertheless, they also showed a strong political element that seemed to be aimed at galvanizing the right wing throughout Europe in the days prior to the EU elections. These two accounts (PartisanDE and NewsCompact), writes Patel, “are heavily fabricating engagement and, at least PartisanDE is also purchasing retweets.”

Interestingly, the ‘muslim migrant’ tweet and the ‘disabled protester’ tweet seem to be specifically targeting Italy and France respectively. In both countries, the far-right parties won the biggest slice of votes in the subsequent election — Matteo Salvini’s League party in Italy, and Marine Le Pen’s National Rally outscoring President Macron’s party by 23.31 percent to 22.41 percent.

In the UK, Britain’s Brexit party led by Nigel Farage, formed only a few months ago, was the clear winner with 28 seats. While this current research from Patel does not highlight UK political tweets, Patel conducted similar research examining Brexit in March 2019. The basic conclusion then was that loosely related far-right groups from both within and outside Europe were still attempting to keep the Brexit flag flying.

The research does not attempt to find the ultimate source of this political tweeting, whether influenced by foreign governments or just right-wing agitators. Nor can it say whether such tweets have any effect on votes. All that can be said is that the use of social media by nearly all political parties for large-scale political social engineering is continuing, and shows no sign of abating despite public avowals from the social networks that they are clamping down.

Related: Facebook Closes Hundreds of ‘Inauthentic’ Russia-Linked Pages 

Related: Facebook Uncovers Political Influence Campaign Ahead of Midterms 

Related: Google Blocks Accounts in ‘Influence Operation’ Linked to Iran 

Related: How China Exploits Social Media to Influence American Public 

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

People on the Move

Bill Dunnion has joined telecommunications giant Mitel as Chief Information Security Officer.

MSSP Dataprise has appointed Nima Khamooshi as Vice President of Cybersecurity.

Backup and recovery firm Keepit has hired Kim Larsen as CISO.

More People On The Move

Expert Insights

Related Content

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.