Spam Bots Flooding Twitter to Drown Info About #Syria Protests [Updated]

Defining The Issues

People following the #Syria hash tag on Twitter in the recent weeks to track the developments of the Syrian protests and the deadly governmental crackdown on peaceful protesters must have noticed two major annoyances:

First was the proliferation of what tweeps dubbed as the “twitter eggs,” a group of newly created and mostly image-less twitter accounts that cussed out, verbally assaulted, and threatened anyone tweeting favorably about the ongoing protests, or criticizing the regime. Those accounts were believed to be manned by Syrian Mokhabarat[intelligence] agents with poor command of both written Arabic and English, and an endless arsenal of bile and insults. Several twitter users created lists to make it easier for the rest to track and report those accounts for spam. Here are a couple of examples.

Second, which is more damaging, is the creation of various spam accounts that mainly target #Syria hash tag; flooding it with predetermined set of tweets– every few minutes–about varied topics such as photography, old Syrian sport scores, links to Syrian comedy shows, pro-regime news, and threats against a long list of tweeps who expressed their support of the protests.

Identifying The Cause

At first I thought this was a badly timed annoyance, and several users were already reporting those abusive accounts. However, a couple of users apparently discovered some foul play. The parody account @SyrianPresident tweeted:

Stop it mukhabarat Twitter is not #Bashar’s spam machine! > @TheLovelySyria #Syria #Homs #Aleppo #Damascus #Lebanon http://is.gd/Plii1Z

and @syrianrebels responded:

@SyrianPresident it’s a company in Syria that send automated msgs, a dedicated owner they use server of @eghna check website #Syria branch

I went to investigate the Bahrain based Eghna Developement and Support*, which among other things provides “political campaign solutions.” I searched for any affiliation with Syria, and sure enough, one of the main suspected #Syria spam accounts was featured in their success stories page.

Eghna claims that “LovelySyria is using EGHNA Media Server to promote intersting photography about Syria using their twitter accounts. EGHNA Media Server helped Lovely Syria get attention to the beauty of Syria, and build a community of people who love the country and admire its beauty.” The only problem with that claim is that the lovelysyria.com website is only a Drupal login page void of content. There’s no way of creating a new user account, and therefore any claims of fostering a community are false.

Breakdown Of Research Results

Seemingly unrelated spam accounts, with the exact same modus operandi, have been rapidly coming into existence with only enough content to appear to be legitimate automated twitter accounts instead of spam bots with a very sinister motive behind them.

I have managed to identify at least 7 different accounts that are evidently configured to loop a specific set of tweets at predetermined intervals (usually between 2-5 minutes). Below are links their respective user pages and an explanation of what they tweet about:

  • @TheLovelySyria: As mentioned above, it tweets Flickr links of photos taken in Syria. It uses #Syria hash tag and also rotates between #tags of different Syrian cities. Tweets every two minutes.
  • @SyriaBeauty: Uses same set of tweets as @TheLovelySyria and tweets every two minutes. This means you’ll be bombarded by one tweet a minute of #Syria tweets unrelated to the current pressing issue which is the brutal crackdown on Syrian protesters. Same hash tags scheme.
  • @SyLeague: Tweets Syrian Soccer League match results from seasons 2003-2004 onwards. Matches are selected randomly and bear no significance to the fans of the sport. Same trend as above when it comes to tag usage. Tweets every two minutes.
  • @KaramahClub: Uses same tweet set as @SyLeague. Same #tag trends as all of the above.
  • @SyHumor: Tweets links to episodes and sketches of popular Syrian sitcoms. Same tag usage trend as above. Tweets every 2 minutes.
  • @DNNUpdates: Affiliated with Damascus News Network on Facebook. Pro-Regime.  Tweets a distorted version of the events in #Syria and repeats news about alleged armed gangs and terrorists. Only uses #Syria tag. Tweets every 3 minutes.
  • @MBKing13: Harasses a large number of twitter users who support or tweet positively about the protests. This account tweets about conspiracy theories and threatens twitter users while pretending that there’s a human behind the account. Taking a deeper look at the account shows that there’s a large set of pre-programmed tweets that are used repeatedly and threats are aimed at a set of users. The account is active 24/7  and tweets at 5 minutes intervals. Tags used: #Syria, #Mar15.

Note: if you twitter links appear to be broken you probably need to go to your twitter account settings and enable HTTPS which also enhances your privacy. If the page doesn’t exist it was probably taken down, but I have screenshots that I’d gladly share and I’m sure google will cache those pages for a long time.

Conclusion

Relying on the available data it seems that the regime is upping it’s information warfare game. Instead of generating bad PR by blocking websites or solely relying on going after online activists and attempting to hack their accounts. The regime at first attempted bullying and intimidation online by seemingly independent twitter accounts. That failed miserably and ended up being an embarrassment.

Now, they are effectively diluting the discussion and making it much harder to find any info about the protests by bombarding the popular relevant hash tags with badly disguised spam. Those spammy accounts have already been reported by many twitter users for spam, but Twitter has been slow to respond and apply their TOS (terms of service) that clearly prohibit “overloading, flooding, spamming, mail-bombing the Services, or by scripting the creation of Content in such a manner as to interfere with or create an undue burden on the Services.”

Twitter is currently one of the main platforms used by dissidents and activists to disseminate information and videos of the ongoing protests, and uncover the crimes committed by the regime’s security forces against unarmed peaceful protesters. It is of utmost importance to ensure that their voices are heard. We must provide the general public and international media easy access to such information. Crimes unnoticed are crimes unpunished.

Update on April 19, 5:30 pm EST: The above mentioned twitter accounts are still active but their tweets are no longer showing when viewing the #Syria hash tag stream. I think Twitter handled this in a smart manner; the accounts are still viewable to people who are following them but are no longer cluttering Syria related searches. Thanks to everyone who reported this.

* Eghna has responded to the article. Please find their response in the comments below.




  1. [...] lists to make it easier for the rest to track and reports those accounts for spam. Here are a couple [...]

  2. [...] lists to make it easier for the rest to track and reports those accounts for spam. Here are a couple [...]

  3. Sandor says:

    So if the tweet is against the protest it must be created by Syrian Mukhabarat (Intelligence agency)??!!
    This is ridiculous, who gets to decide that?? what if there are a lot of people against the protest and WITH the government??
    The fact is Tweeter is massively supported by US intelligence agency and it is used for destabilizing other countries.

    • Anas says:

      Tweeting against the protests is fine. What’s not is threatening people, and breaking twitter’s terms of service by creating spam bots to flood certain hash tags with repetitive crap every minute of every day. This is abuse and should be stopped.

      If you read carefully, this post wasn’t against anyone who’s “WITH the government” but against spammers who want to silence people who are against the government.

      The fact is, twitter is a popular platform and is used by many people and organizations for very different things. Another fact, spam is wrong, regardless of the cause. Please read more carefully next time before jumping to leave a comment. Everyone has the right to their opinions and freedom of speech. However, spammer violate those rights and freedoms and must be stopped.

  4. hazrid says:

    Contrary to the list, I think MBking13 and DNN updates are not spambots. MB seems to only be on during the evenings, and I’ve seen him respond in what could be called a… human manner.
    Other than that, yeah, they stopped all the badmouthing and threatening accounts. I’m sure the #kafaleh (قفلة) might have overloaded them…

    • Anas says:

      Check the twitter accounts of the two accounts you said were not spambots:
      DNN updates has tweeted in the last 3,6,9,12,15,18,21 minutes, or more accurately once every three minutes non-stop. Most of their tweets are rehashing of their old Facebook updates time and time again. Their manner is unmistakably spammy, regardless if their content appears to be legitimate.

      As for @MBking13, your are mistaken, he is on all the time, scroll down its twitter stream and you’ll find that it’s been tweeting non-stop several times an hour sometimes at 5 minute intervals for the past 72 hours. It’s just not possible for it to be human. No way. Like you said, the tweets appear to be a human manner, but it’s just a list of somewhat intelligently designed tweets to look as if they were human. Dig deeper and you’ll see that he repeats the same tweets over and over and the list gets updated periodically. Also, the account’s responses aren’t @replies to specific tweets by other people, but instead it also has a programmed list of people to target with those periodical tweets.

      The latter case is a smarter spam bot but still not enough to be undetected.

      • hazrid says:

        I’m convinced. Also note rumors of Indian and Korean (not sure if South or North Korean) experts and companies brought in by the government for digital surveillance, especially outlets such as Facebook, Twitter and Youtube. Supposedly, they’ve rented a few buildings in Mezzeh 84 district for them to live in and work out of.

  5. Anon says:

    A Syrian guy named Al-Ayham Saleh is behind Eghna and this spam. Evidence:

    - His Facebook account lists Eghna as his employer:
    https://www.facebook.com/alayham

    - His Twitter account generates spam in the same manner:
    https://twitter.com/#!/alayham

    - His personal site also uses Drupal:
    http://www.alayham.com/

    - He’s one of the first few users to follow two of the spam accounts.

    O shame. I’ll work on adding him to the lists of shame.

  6. [...] First was the proliferation of what tweeps dubbed as the “twitter eggs,” a group of newly created and mostly image-less twitter accounts that cussed out, verbally assaulted, and threatened anyone tweeting favorably about the ongoing protests, or criticizing the regime. Those accounts were believed to be manned by Syrian Mokhabarat[intelligence] agents with poor command of both written Arabic and English, and an endless arsenal of bile and insults. Several twitter users created lists to make it easier for the rest to track and reports those accounts for spam. Here are a couple of examples. [...]

  7. [...] that dynamic very well. Syrian blogger Anas Qtiesh has a fascinating post looking into some of the annoyances facing people following the #Syria hashtag:   First was the proliferation of what tweeps dubbed as the “twitter eggs,” a group [...]

  8. [...] Company's Neal Ungerleider points to the news from expatriate Syrian tech blogger Anas Qtiesh, who has been tracking the fake [...]

  9. Eghna says:

    In this Article, Mr. Qtiesh tried to link EGHNA (www.eghna.com) to the Syria Government, and adopted false claims about our company and our customers by some twitter “parody” accounts. Mr. Qtiesh published his article without contacting us even trying to verify his accusations, which is an unethical journalistic behavior, and can be considered as an intentional effort to damage our company reputation.

    The following points clarify the real situation regarding our company and the false accusations made in the article:

    1. EGHNA is an IT company that provides technology solutions to multiple sectors, including governments. However, the Syrian government was never one of our customers, and we are not in the process of signing any business agreement with the Syrian Government. Furthermore, we don’t have any relationship with any security or military organization in Syria.

    2. On the contrary to what your articles tries to imply, EGHNA maintains a number of business agreements with non-government parties, and we are proud that our communication and collaboration technology is used to help the people in Egypt, Syria, Lebanon, and Palestine.

    3. EGHNA does not review nor endorse the content of any customer as the article suggests. Your report tries to mislead your readers to think that we stand by the content of some of our customers, which is far from truth.

    4. EGHNA has a strict internal policy against spammers and internet abuse, so we acted upon you report immediately. We investigated the accounts reported by your article. Here are our findings:

    • @TheLovelySyria is tweeting flickr links to some Syria photos. All the links are compatible with the hash tag #Syria.

    • @SyriaBeauty is tweeting flickr links to some Syria photos. All the links are compatible with the hash tag #Syria.

    • Both accounts are operated by real people, their operators respond to incoming messages, and engage in active discussions, which make them real virtual citizens, not “spam bots” as your article falsely states in clear words.
    • Both accounts are not sending any political information, and cannot be classified as a political campaign by any reasoning.

    • Both accounts are far from reaching Twitter’s flood limit, so the “flooding twitter” claim is unfounded.

    • Both accounts have an active follower community, and their tweets are re-tweeted by many others.

    • Both accounts are compatible with Twitter’s automation policy, which says clearly “We welcome feeds that are used for community benefit or provide non-commercial information to a niche group of users, such as local weather feeds or transit information.”

    • Many of the accounts mentioned in your report are not linked to us, and we have no relation with them. The way the article is written however suggest linking these accounts to our company.

    5. As part of our internal investigation, we have contacted our customers for their response on your claims, and they confirmed the following:

    • They are not linked to any Syrian government organization in any way.

    • Their only intention is to promote Syria as a place for love and beauty.

    • They don’t interfere with political events, and have no political agenda.

    • They never attacked the Syrian revolution, nor supported the Syrian Government. They can’t understand how the article links them to the Syrian Authorities.

    • They never posted any feed to the Syrian revolution hash tag #Mar15 to avoid any interference with the people following the events.

    • They are completely independent and their motives are well-intended.

    • They refuse to take part in the bloodshed that is happening in Syria.

    6. In your report, you accuse us of providing false information in our success story, and this is another totally false claim. The mentioned customer has built a community of over 250 followers, many other people re-tweeting the photos they send, and many people have contributed new photos for them. Your accusation here as well is totally false and preposterous. You based your arguments only on the site being “under-construction” and deliberately tried to hide the truth taking your reader’s attention away from the facts.

    We find your report completely biased and far from the truth, and we consider this report as defamation. The fact the Global voices did not approach us before publishing this report to clarify the facts shows malice or at least negligence the author, both of which are illegal and unwelcomed in a site that promotes transparency.

    EGHNA remains faithful to its mission of providing cost-effective IT solutions to help customers reduce their costs and increase their revenue. EGHNA will continue to provide solutions that help the people communicate and collaborate, and is totally committed to ethical and anti-spam rules in business.

  10. [...] in the middle east. The last thing we have been introduced lately in the Syrian revolution was to the Syrian Spam bots. It is a challenge not only to activists but to developers and normal users as well when it comes to [...]

  11. najwa says:

    مقال مفيد! لكن عادوا للظهور عند البحث عبر #Syria للأسف!

  12. [...] are learning about new tactics, like Anas Qtiesh’s post on Twitter spam as a form of signal jamming in Syria, and there have been new reports released on the topic, such [...]

Leave a Reply