With the explosive accusations against Republican candidate Roy Moore in the special election to fill the position United States Senate position vacated by Attorney General Jeff Sessions, Twitter users have gone to war.

Activists launched hashtag campaigns to attack or defend Moore, and those supporting or opposing him. Russian “bots” (automated accounts which masquerade as humans) reportedly entered the fray.

Newsweek headline on #BoycottKeurig, November 13. (Source: Newsweek)

Bots, indeed, made an appearance, as they do in the vast majority of political debates on Twitter. However, more traffic appears to have been generated organically by coordinated activism, with groups of apparently human users, many of them anonymous, posting and re-posting furiously to give their hashtags the appearance of popularity.

This pattern of activity, which is considerably more sophisticated than the simple use of bots, shows the likely way in which Twitter users will seek to influence voters in Alabama, and in next year’s mid-term elections.

It also reveals the American Twittersphere’s ongoing vulnerability to outside interference. Much of the traffic was carried by anonymous, hyper-partisan accounts. As recent events have shown, this is the (dis)information space in which Russian operatives flourished throughout the 2016 election cycle. It remains wide open to potential abuse.

Hashtags

A number of hashtags emerged after the Washington Post quoted an Alabama woman named Leigh Corfman, who accused Moore of an nonconsensual sexual encounter with her when she was 14. The online campaign against this act, which used the hashtag #MeAt14, launched on November 10.

The post which launched #MeAt14. (Source: Twitter)

The traffic intensified after another woman, Beverly Young Nelson, accused Moore of a sexual assault when she was 16. Quickly, traffic using her name exploded; defenders of Moore began posting #StandWithMoore in reply.

Critics of Moore then called for a boycott of coffee maker Keurig for running commercials on Fox host Sean Hannity’s show, after Hannity was seen as defending Moore.

The first post to call for a boycott of Keurig, in protest at its commercials on Hannity. (Source: Twitter)

Under pressure from such posts, Keurig pulled its commercials from Hannity’s show.

Keurig’s confirmation that it had pulled its ad from Hannity’s show. (Source: Twitter)

Moore supporters reacted with outrage, taking over the hashtag and generating massive traffic on it.

The first pro-Moore tweet on #BoycottKeurig. (Source: Twitter)

As the #BoycottKeurig hashtag snowballed, Moore’s opponents pushed out #DrinkKeurig. Then, as reports emerged that Moore’s challenger, Democrat Doug Jones, was climbing in the polls, #DigDoug also picked up traffic.

The tweet which launched #DrinkKeurig. (Source: Twitter)

These hashtags performed very differently. #StandWithMoore was the least successful, generating just over 6,500 tweets from November 11–17. By far the most successful was #BoycottKeurig, with almost 440,000 tweets.

Traffic on pro- and anti-Moore hashtags, from machine scans, November 11–16.

Putin, popular, or pushed?

While the traffic was flowing, Newsweek reported that “Russian bots” were amplifying #BoycottKeurig. The basis for its claim was the Hamilton68 dashboard, which tracks “600 Twitter accounts linked to Russian influence efforts online”.

This claim should be viewed with caution. Hamilton68 tracks a range of sources, from Kremlin-run outlets such as RT (which registered as a “foreign agent” in the US on November 10), through self-proclaimed Kremlin supporters, to users who amplify Kremlin themes without necessarily realizing that they are doing so. The fact that a hashtag appears on the dashboard could simply mean that American users with a history of amplifying Kremlin tropes are pushing it.

It is, however, possible to verify whether the hashtags were genuinely popular, or artificially amplified. To do so, @DFRLab conducted machine scans of the launch phase (the first 100,000 tweets) of #BoycottKeurig and “Beverly Young Nelson” and full scans of the other hashtags.

We looked for the presence of bots, and broader signs of “astroturfing”, a process by which small groups try to make themselves look larger through coordinated tweeting and retweeting, the selective use of bots, and very high rates of posting.

The scans suggested that both sides used astroturfing techniques — not just bots but also coordinated human activity.

Bots give way to cyborgs

We identify bots by looking at individual accounts’ activity, anonymity, and amplification. If an account posts many dozens of times a day, shows no verifiable personal information, and only shares other users’ posts, it is botlike.

Botlike behavior showed up on both sides of the debate.

For example, @whenyourastar posted the hashtag #DrinkKeurig 236 times in 34 minutes on November 12 (local time). Every single one was a retweet. The account was set up on October 29; by November 17, it had posted 3,257 tweets and likes, at an average rate of 163 engagements per day. As of the same date, all of its last 100 posts were retweets. This is botlike behavior.

Profile page for @whenyourastar; note the creation date. (Source: Twitter)

On the other side, @EHFoundation237 posted six retweets of #BoycottKeurig on November 12. Created in January, this account had posted 658,000 times by November 17, at an average rate of 2,253 posts a day — clearly botlike.

These both behave like bots, but there is no evidence to suggest that they are Russian bots. @whenyourastar focuses on anti-Trump U.S. politics; @EHFoundation237 shares a wide range of apparently commercial posts, often with an African angle.

Much more of the traffic on these hashtags appears to have been generated by cyborgs — accounts which post at botlike rates, but periodically tweet authored content, in a sign that a human being is in control, at least temporarily.

For example, the most prolific tweeter in the scan on #BoycottKeurig, @KriensL, posted 252 times in a single hour. Of those, 251 were retweets and one was a reply to another user.

The reply from @KriensL. (Source: Twitter)

Overall, @KriensL has posted 40,000 tweets and 34,400 likes since its creation in September 2016, for a botlike average rate of 180 engagements per day. However, a significant number of posts appear to be authored. This is likely a semi-automated cyborg, used to artificially boost Twitter traffic.

Profile page for @KriensL. (Source: Twitter)

On the other side, @Ryanjac01791467 posted 250 times on #MeAt14; every one was a retweet, which is botlike behavior. This account was created in October 2015, but, curiously, only appears to have begun posting in March 2017. It does, however, post a significant proportion of replies. This marks it as a cyborg or activist account, rather than a bot.

Profile page of @Ryanjac01791467; note the combination of posts and retweets. (Source: Twitter)

Throughout the sample scans, accounts such as this were far more active than simple bots. Such accounts would typically post 50–250 retweets on their chosen hashtag, interspersed with a handful of authored posts (often just one).

This suggests that the traffic was not driven primarily by bots, but by groups of human users agreeing on a hashtag, posting their own tweets and then re-posting one another’s. This is known to be a favorite tactic of the far right in the United States; it appears to have been adopted by their opponents too.

Distortion by design

Some idea of the degree of coordination can be gathered by studying two factors: the percentage of tweets generated by the fifty most active users and the average number of tweets per user in the overall scan.

Analyzing the impact of the top fifty users shows how much a small group is driving or distorting traffic; analyzing the average number of posts per user shows whether the traffic is driven by (and thus, probably, seen by) a large number of casual users, or a small number of dedicated ones.

Taken together, these factors allow us to compare the relative extent to which traffic on different phrases is distorted. It does not distinguish between bots, cyborgs, and real people, nor should it be taken as a binary “distorted or not distorted” judgement. Rather, it allows us to compare different Twitter movements. In general, a low score indicates a more organic pattern of traffic (fully organic movements typically score 5 or lower); a high score suggests a deliberate attempt to inflate traffic.

According to this scan, traffic on the name “Beverly Young Nelson” was entirely organic, with the top fifty tweeters representing just 2.1 percent of traffic, and an average of 1.8 tweets per user. #MeAt14 scored somewhat higher, at 5.5, suggesting a relatively minor attempt at distortion.

All the other hashtags, from both sides of the debate, showed significant signs of distortion. #BoycottKeurig scored 7.6, largely due to the very high activity of the top fifty users. Since the scan covered 100,000 tweets, these accounts posted almost 5,000 times, a clearly unnatural pattern. #StandWithMoore scored even higher, again largely due to the top fifty.

By far the most distortion, however, affected #DigDoug. Twenty percent of all the traffic — almost 8,500 tweets — came from just fifty accounts. On average, each user in the scan posted 4.8 times. These are classic indicators of distorted traffic, with a dedicated user group trying to make themselves look larger.

The tweets themselves explain why. The most-retweeted post on #DigDoug came from an account called @pmaalai. It called for a “Twitter storm”, linked to a Facebook event and a “Tweetsheet”, and was retweeted 1,792 times.

The call for a “Twitter storm”. (Source: Twitter)

The “tweet sheet” was a Google document with instructions on how to post pro-Jones tweets using a click-to-tweet URL shortener, together with advice to “average about one tweet per minute so Twitter doesn’t lock you out.”