Monday, October 22, 2018

Applying SNA to analyze Iranian and Hezbollah Activities outside of the Middle East


Background and Research Question

In a May 21, 2018 speech on US-Iranian relations at the Heritage Foundation in Washington, D.C., the then-recently minted Secretary of State Mike Pompeo declared that “Today, the Iranian Qods Force conducts covert assassination operations in the heart of Europe.”[1] The remark caught security experts off guard.[2] Since the 1991 assassination of Shapour Bakhtiar in France and the 1992 targeted killing of four Iranian-Kurdish dissidents in Germany, Western governments had not publicly accused Iran of carrying out assassination plots in Europe. Following the speech, some analysts suspected that the secretary’s remark, delivered without corroborating evidence and made less than two weeks after President Donald Trump’s decision to withdraw from the Joint Comprehensive Plan of Action, was either meant to signal Iran’s rogue status or that it was an inadvertent disclosure of information that had not been made public.[3]

Although Pompeo never clarified what he meant by his May 21 remark, news reports coming from Europe in the summer of 2018 detailed an alleged Iranian plan to detonate a bomb in Paris. German, Belgian, French, and Luxembourgian authorities accused a Vienna-based Iranian diplomat of being an undercover intelligence officer and providing explosives to an Iranian-Belgian couple to be used in an attack. The alleged target was a rally organized by Mujahideen-e-Khalq (MEK), an Iranian opposition group whom Iran classifies as a terrorist group,[4] in the outskirts of the French capital. On the morning of the rally, June 30, Belgian authorities arrested the couple in Brussels with 500 grams of explosive and a detonator in their car. On the same day, French law enforcement arrested a suspected co-conspirator in Paris. On July 1st, German officers arrested the Iranian diplomat and suspected covert agent as he drove through Germany towards Austria.[5]

Investigations are still underway, and the full scope and context of this incident are not likely to become publicly available anytime soon, but the French government has deemed the likelihood of Iranian involvement to be credible enough to accuse, on October 2nd, the Iranian Ministry of Intelligence and Security (MOIS) of being involved.[6] Iranian authorities have in turn accused MEK operatives of staging a false flag operation in order to damage EU-Iranian relations.[7]

For the past 17 years, analysts have built a significant body of case studies and social network analyses on non-state Sunni terrorist organizations such as Al-Qaeda and the Islamic State in Iraq and Syria. Meanwhile, the existing literature on Iran’s clandestine operations unit, the Qods Force,[8] and on Iranian-sponsored non-state Shiite groups, such as Hezbollah, is relatively meager. Contemporary Western understanding of Iranian covert operations would benefit from a social network analysis of previous incidents in which Iranian MOIS and Qods Force operatives, as well as Hezbollah auxiliaries, were believed to have been involved. 

Hypothesis

While full details and unequivocal confirmation of official Iranian involvement in the MEK rally attack in Paris are not likely to emerge soon and the large scale of this plot deviates from Iran’s 1990s pattern of covert, targeted assassinations in Europe, this is not the first time that Western intelligence agencies have suspected Iranian diplomats and MOIS agents of directing or providing support to bomb attacks outside of the Middle East. In 1992 and 1994, under circumstances that have never been completely clarified, car bomb attacks that closely followed the modus operandi of Hezbollah-attacks in the Lebanese Civil War partly destroyed the Israeli embassy and the Argentine Israeli Mutual Association (AMIA) community center in Buenos Aires, killing 107 people. Some Argentine and American authorities believe that Iranian MOIS agents working under diplomatic cover at the Iranian embassy in Buenos Aires as well as Hezbollah members and sympathizers living in the triple border area between Brazil, Argentina, and Paraguay, were involved in the attacks. Despite their strong suspicion, investigators were never able to produce conclusive evidence linking the Iranian government to the bombings.

In a 2008 article about the AMIA bombing, investigative journalist Gareth Porter reported that both James Cheek and Ron Goddard, who had respectively been US Ambassador to Argentina and deputy chief of mission in Buenos Aires at the time of the attack, told him that evidence of Iranian involvement in the bombing “wasn’t credible” and “the whole Iranian thing seemed kind of flimsy.”[9] Nevertheless, documents compiled and produced by Argentine and American investigators who support the thesis of Iranian involvement provide a solid database from which is possible to devise what a covert, lethal Iranian operation far from the Middle East could look like.

While the AMIA bombing is removed from the alleged MEK rally bomb plot in space and time by thousands of miles and nearly a quarter of a century, and acknowledging that Western intelligence has not confirmed direct Iranian involvement in either events beyond a doubt, a closer study of the AMIA case might provide important insight into how Iran might organize and conduct its clandestine operations. The trove of publicly available legal documents, news articles, and books in Spanish and in English regarding the bombing provide enough material for an analyst to compile identifying information on the main suspects, build network graphs, and conduct social network analyses of the event.      

Data and Methodology

I will compile information from sources such as Argentina’s AMIA bombing indictments, US Treasury Department’s designations of implicated South America-based Hezbollah members, and open source reporting on the incident to map out the network of individuals Argentine and American authorities suspect were involved in the attack. My starting point will be Matthew Levitt’s 2013 book Hezbollah: The Global Footprint of Lebanon's Party of God. In this book, Matthew Levitt, a fellow at the Washington Institute for Near East Studies who served as deputy assistant secretary for intelligence and analysis at the Treasury Department’s Office of Terrorism and Financial Intelligence from 2005 to 2007, uses publicly available American and foreign official documents, reporting, and interviews he conducted with US officials to describe Hezbollah’s global operations, including a chapter on the AMIA bombing. His chapter on AMIA contains extensive description of how and when suspects interacted in the months leading up to the bombing and after.

Limitations

Due to the clandestine nature of the operation and given that Iranian involvement has not been unequivocally confirmed, it is not possible to verify the accuracy of the allegations levied against the individuals identified in this analysis. Instead of trying to conduct a comprehensive investigative project on the AMIA bombing, my objective is to construct, with the information available publicly in analyses, news articles, and official reports, a graphic representation of the network of Iranian-linked individuals whom American and Argentine authorities have singled out as suspects.

It is possible that this analysis will be more historically-oriented and descriptive than policy-oriented and predictive. In the 24 years that have transpired since the AMIA attack, Iran’s goals, methods, and behavior, at the strategic as well as tactical levels, are likely to have changed. Nevertheless, an understanding of its early operations might provide insights into the organizational development and methods of Iran’s covert actions abroad.  



[4] MEK was classified as a terrorist organization by the European Union until 2009 and by the United States from 1997 to 2012.
[8] In 2007, the Treasury Department sanctioned the Qods Force as a Specially Designated Global Terrorist. https://www.treasury.gov/press-center/press-releases/Pages/hp644.aspx.


Topic: Using Social Network Analysis to Study the Network of Illicit Transfers of Small Arms and Light Weapons (SALW) in Africa



[I am not taking the second module]



Background



The widespread proliferation and availability of small arms and light weapons (SALW) are key facilitators of armed violence and conflict and continue to pose a systemic and ubiquitous threat to the long-term social and economic development of countries, particularly small developing states. The high volumes of trade of SALW pose a significant threat to international peace and security. The proliferation of low-intensity conflicts around world are the root cause for the global increase in demand and consequent flow of SALW.



Africa in particular has become an area of high demand and illicit transfers of SALW, due to porous border, and prevalent armed conflict, violence and organized crime in the region. It is estimated that “out of 640 million circulating globally, 100 million are found in Africa of which about 30 million are found in sub-Saharan Africa and 8 million in West Africa.  The majority of these SALW (around 59%) are in the hands of civilians, 38% are owned by government armed forces, 2.8 % by police and 0.2% by armed groups.”[1] This influx of small arms and light weapons has hampered the socio-economic development of African nations, and has resulted in the rise of transnational criminal violence, terrorist campaigns, gender-based violence and most importantly protracted conflicts in the region, notably South Sudan’s civil war.[2]

While a large share of arms trafficking appears to be carried out by private entities, certain Governments also contribute to the illicit trade by providing arms to proxy groups fighting against enemy governments, terrorist organizations and other non-state armed groups with similar ideological and political agendas. These types of arms transfers are prevalent in Africa where conflict is common. For instance, in recent years, the Small Arms Surveys have revealed that governments have delivered SALW to various armed groups in Somalia. Similarly, the Sudan Government’s stockpiles are major sources of supply of SALW to non-state armed groups both through deliberate arming and battlefield capture.[3] 

According to Small Arms Survey’s definition, small arms include revolvers, pistols, rifles and carbines, sub-machine guns, assault rifles and light machine-guns. Light weapons comprise heavy machine guns, hand-held under-barrel and mounted grenade launchers, portable anti-aircraft guns, portable anti-tank guns, recoilless rifles, portable launchers of anti-tank missile and rocket systems; portable launchers of anti-aircraft missile systems (MANPADS); and mortars of calibres of less than 100 mm, single-rail-launched rockets and 120 mm mortars as long as they can be transported and operated as intended by a light vehicle.[4]





Research Questions



The objective of the study is to conduct a preliminary examination of the structure of the illicit arms flows into, out of and within Africa, and to identify the central actors within the network. Social network analysis methods will be used to demonstrate the supply chain and relational characteristics between the individual actors within the network to reveal vulnerabilities within the supply chain that enable the illicit transfer of SALW.  Such a network analysis can be used to add another dimension and support findings of a larger qualitative analysis of the SALW transfer and proliferation network in Africa.





Data collection and Methodology



SALW Data



This study will rely on the SALW transfer database and case studies maintained by the Norwegian Initiative on Small Arms Transfers (NISAT)[5], located at the International Peace Research Institute in Oslo. In addition to quantitative data regarding legal SALW transfers, NISAT also maintains a Black Market File Archive[6] which includes a collection of investigative reports and news stories on cases of illicit arms trade. Some of these reports contain detailed accounts of illicit arms transfer including the manufacturer, purchaser, intermediate dealers, brokers and shipping agents. This information can be coded for the purpose of social network analysis.



Other source of data includes the Small Arms Survey conducted by the Graduate Institute of International Studies in Geneva. The Survey conducts an annual analysis of various aspects of the both the legal and illicit SALW trade including in-depth country-based analysis. Some of the tools maintained by the Small Arms Survey that are useful data resources include the Weapons ID Database, Publications for each African country, Small Arms Survey Yearbook and the Transparency Barometer.[7]



Hypothesis and Methodology



Social Network Analysis (SNA) is a tool that facilitates better understanding and identification of patterns in a dataset by enabling the visualizations of important connections in a network.  SNA methods are applied under the assumption that a group of actors that are being studied constitute a network. In proliferation networks, the most notable actors include buyers and sellers, brokers, insurance and financial agents, government licensing and export officials, and transportation agents and aircraft operators.[8]



Illicit networks for the transfer of small arms and light weapons exhibit more decentralized structures because such weapons are not difficult to manufacture, and therefore there is abundant surplus and the distribution is not closely regulated. These networks are more diffused than others, number of actors in these networks is far greater and their location is distributed in far more states. Therefore, more sub-groups in the form of cliques are likely to emerge in which nodes are directly connected to each other than indirectly through hubs. However, when the analysis is conducted on the State level, some state locales are more active as organizations and destinations, transit and trans-shipment points of illicit SALW.[9] For example, in the SALW supply chain to conflict zones in Africa, Eastern European sates emerge as central nodes and therefore are important geographic hubs in an otherwise dense global network of SALW trade.[10]



The NISAT and Small Arms Survey data can be used to construct a one mode directed network within which the nodes will represent state locales i.e. geographic spaces from which, to which, or through which illicit SALW shipments have moved. The lines connecting the nodes i.e. the ties will represent the incidents of illicit arms-transfers. If the lines are thicker i.e. the ties are stronger if more illicit arms transfer events occurred between the two nodes geographic locales). The ties between the nodes will be directed in the sense that it represents the flow of SALW from one State locale to the other. Since in a network some nodes/actors are more prominent that the other with respect to the number and types of social ties they maintain with other nodes, centrality measures such as In-Degree and Out-Degree, closeness and betweenness can be used to identify the key suppliers, African importing locales, middlemen etc.



·      In-Degree: The number of State locales from which of SALW to a State locale has been shipped

·      Out-Degree: The number of other State locales that were recipient of a State’s SALW exports.

·      Betweenness: This measure can be used to identify the brokers, high stress points and hubs within the network as this centrality measure the state locales that are on the most paths between other state locales.

·      Closeness:  State locales that are connected to many others through short distance paths. This centrality measures will be useful to identify the mobilizers in the network.



Additionally, for African States, where more data regarding detailed-accounts of illicit arms transactions are available, separate two-mode network maps can be created wherein the nodes can be the actors involved in these transactions and maybe connected through affiliations with the same organization or events. With such detailed and well-developed illicit arms transfer datasets, attribute data can also be developed including nationality and role (supplier, broker, financer, transportation agent, government official).[11]  Such a network analysis would be more useful to study the SALW illicit transfer network in Africa, therefore a more detailed and robust illicit arms trafficking dataset will need to be built with the help of NISAT black market archive and other investigative news sources.[12]



Limitations



Quality of data is fundamental for the utility of any SNA. While information on the legal-interstate trade of conventional arms is well developed, data regarding the transfer of SALW is limited, incomplete, sometimes distorted and often subjected to selection bias as transfers of such weapons are regulated and restricted by law and policy. Consequently, the central actors of the supply chain of SALW include clandestine networks of individuals and organizational actors, and therefore it is difficult to trace the networks through which illicit flows of small arms take place and identify the central actors that facilitate the illicit transfers. Furthermore, due to the lack of data, it is a big challenge to have complete information about the nodes and the links between them, and identify characteristics and central features of these networks which are particularly important when the aim is to model network vulnerabilities.[13]  








[1] Africa: The Influx of Small Arms, Light Weapons." AllAfrica.com. February 22, 2018. Accessed October 22, 2018. https://allafrica.com/stories/201802220192.html.


[2] Bowler, Tim. "Which Country Dominates the Global Arms Trade?" BBC News. May 10, 2018. Accessed October 22, 2018. https://www.bbc.com/news/business-43873518.


[3] "Illicit Trafficking." Small Arms Survey - . February 22, 2018. Accessed October 22, 2018. http://www.smallarmssurvey.org/weapons-and-markets/transfers/illicit-trafficking.html.


[4] "Definitions." Small Arms Survey - Definitions. April 15, 2013. Accessed October 22, 2018. http://www.smallarmssurvey.org/weapons-and-markets/definitions.html.


[5] Peace Pesearch Institute Oslo PRIO. NISAT - Norwegian Initiative on Small Arms Transfers. Accessed October 22, 2018. http://nisat.prio.org/Trade-Database/.


[6] Peace Pesearch Institute Oslo PRIO. NISAT - Norwegian Initiative on Small Arms Transfers. Accessed October 22, 2018. http://nisat.prio.org/Document-Library/Theme/.


[7] "Mission." Small Arms Survey - Mission. August 29, 2018. Accessed October 22, 2018. http://www.smallarmssurvey.org/about-us/mission.html.


[8] Curwen, Philip A. 2007. “The Social Networks of Small Arms Proliferation: Mapping an

Aviation Enabled Supply Chain.” Masters Thesis, Naval Postgraduate School.


[9] Kinsella, David, and Alexander H. Montgomery. 2016. "Arms Supply and Proliferation Networks." Oxford Handbooks Online, doi:10.1093/oxfordhb/9780190228217.013.33.


[10] Kinsella, David. 2014. “Illicit Arms Transfers to Africa and the Prominence of the Former Soviet Bloc: A Social Network Analysis.” Crime, Law and Social Change, August, 1–25. doi:10.1007/s10611-014-9531-9.


[11] Curwen, Philip A. 2007. “The Social Networks of Small Arms Proliferation: Mapping an

Aviation Enabled Supply Chain.” Masters Thesis, Naval Postgraduate School.


[12] Kinsella, David 2006. “The Black Market in Small Arms: Examining a Social Network.” Contemporary Security Policy 27 (1): 100–117. doi:10.1080/13523260600603105.

[13] Kinsella, David, and Alexander H. Montgomery. 2016. "Arms Supply and Proliferation Networks." Oxford Handbooks Online,  doi:10.1093/oxfordhb/9780190228217.013.33.

Sunday, October 21, 2018

Isolated Militancy or Global Terror? Using SNA to Identify Potential External Support and Influence in Ongoing Terror Attacks in Northern Mozambique


SITUATION
During the early morning of 5 October 2017, a large group of armed men launched a coordinated attack on the three police stations within the small port city of Mocimboa da Praia in Northern Mozambique effectively taking control of the remote district capital for nearly two days.  The men were part of an Islamic organization that during their brief control of the city demanded the immediate implementation of Sharia law in Northern Mozambique, warned all citizens to stop using any government services (schools and hospitals), threatened any westerners and western organizations in the area, and declared the authority of the federal government nonexistent in the region.  The government soon retook the police stations and established authority in the city but one year later the attacks continue[1].

Following the initial attack on Mociomboa da Praia, there have been countless attacks throughout the Cabo Delgado province varying in size, target, and intensity leaving hundreds dead and more displaced (see FIG 1.1 for June 2018 causality map). Militants often target government forces, officials, and institutions to establish legitimacy but have also raided and pillaged villages killing civilians for not adhering to their standards of Islam or for cooperation with the government.  Little is known about the extremist group, Ansar al-Sharia, also called al-shabab and different organizations and publications speculate about their connection to larger global jihadist franchise networks, specifically al-shabab in Somalia[2].  Inversely government officials deny the link to terror and state that the actions are simply those of criminal smugglers attempting to regain freedom of maneuver through historic east/west smuggling for their various enterprises[3].  The African Union even reported that the attacks were the work of a new chapter of the Islamic State (IS).

To complicate matters many of the attacks are occurring less than 10 miles from Pemba, the site of recently discovered expansive Liquid Natural Gas (LNG) reserves that two US based multinational corporations are developing through partnerships with the Government of Mozambique, projects with multibillion-US Dollar price tags[4].  Many analysts have identified many similarities to the current situation in the Cabo Delgado Province and in Maiduguri in 2005 when Boko Haram began its rise to power[5] .  

QUESTIONS
(1)    Are the militants who are currently operating within the Cabo Delgado province a standalone Jihadist Organization or are they part of greater global jihadist franchise, i.e. ISIS or Al-Shabab and or influenced by these larger organizations?
(2)    Are the individuals conducting violence in Northern Mozambique not militant jihadists but rather members of a criminal organization as theorized by government officials?

HYPOTHESIS
Ansar al-Sharia’s ability to sustain offensive operations over a yearlong period throughout the Cabo Delgado province indicates that there is a possible larger support network in place.  Furthermore, throughout this period Mozambican security forces have actively targeted and engaged Ansar al-Sharia, denying them access to areas of material and personnel support, further indicating external assistance. 

Two different external networks of actors support and influence Ansar al-Sharia, regional trafficking organizations provide material support and extremist groups in the Horn of Africa provide influence the actions and underlying violent principles.  

METHODOLOGY
To test the abovementioned hypothesis and research questions I will utilize Social Network Analysis (SNA) to identify the overall Ansar al-Sharia network operating in northern Mozambique as well as subsets of active Eastern African Violent Extremist Organizations (VEO) and Transnational Criminal Organizations (TCO).   Within the Ansar al-Sharia network focus will be on identifying key nodes or individuals that serve as facilitators of information, influence, or resources; the centrality measure of betweenness, eigenvector, and closeness will be a key analytical functions in identifying these individuals. Measures of homophily will be applied to all traits of actors within the Ansar al-Sharia network understand subgroupings that form within the organization’s network.

VEOs or TCOs mentioned in reporting of violence in northern Mozambique will be added to the overall network to measure the potential influence and support of external regional and global networks. SNA emphasis will be on identifying bridges and cut points between these networks as well as measuring their strength and credibility.  These ties and connections are critical to answering the overall research questions but can only be analyzed and potentially identified once the Ansar al-Sharia network has been mapped. In addition to the above mentioned unimodal network(s), I will create a multimodal network of attack location and individual actor participation to further identify geographic or tactical patterns within Ansar al-Sharia’s operations in Northern Mozambique.

DATA
All data sources will be assigned a numerical score for credibility/correctness(C/C) on a scale of 1 to 3 due to the historically inaccurate and biased reporting that has come from certain Eastern African news sources.  Data C/C scores will allow additional analysis at various levels of certainty to show definitive and speculative links and relationships.  Primary sources of data for this project will be:

(1) Open source news reporting, both international and regional sources to include both print and online mediums

(2) Twitter and other available social media postings by individuals and organizations detailing the ongoing violence in northern Mozambique, as well as any statements over social media made by the militants

(3)  Development and project data form Nongovernmental Organizations (NGOs) and Intergovernmental Organizations (IGOs) that are currently working in and round the Cabo Delgado province

(4) Reports and Analysis conducted by Defense, Security, Extremism, Intelligence and other online organizations such as STRATFOR, African S and Global Risk .

(5) Press releases by Exxon Mobil, Anadarko, Eni, and other multinational corporations currently or planning on establishing LNG operations in and around Pemba

(6) US Department of State travel advisory warnings and press releases
CHALLENGES
Northern Mozambique is vast, rural and underdeveloped severely reducing the capacity of modern mass media to provide regular updates and reports and most residents rely on local newspapers, small band radio, and word of mouth as their primary new source. Additionally the region is linguistically diverse with three major languages Portuguese, Kiwanee, and Swahili spoken in various villages and communities along with various lesser-used local dialects.  The violence and situation in Cabo Delgado has been underreported in the western news media, with only a few sources in South Africa and Portugal providing any semblance of in-depth coverage.  See FIG 1.2 for a comparison of Google News searches for Mocimboa da Praia, Cabo Delgado Province, and Boko Haram; an active VEO in Western Africa who’s genesis has drawn comparisons to recent events in Cabo Delgado.  This lack of western reporting has led to a lack of sources and knowledge of the situation. Finally, Mozambique ranks 99 out of 180 countries on the Press Freedom Index, earning a Noticeable Problems rating, potentially limiting the ability of journalists to accurately report and publish stories about the ongoing insurrection[6].  



[1] (West 2018)
[2] (Pirio, Pittelli and Adam 2018)
[3] (Issufo 2018)
[4] (Vukmanovic 2018)
[5] (Wholley n.d.)
[6] (Reporters Without Borders 2018)

FIG 1.1


















FIG 1.2









Bibliography:

Issufo, Nadia. Mocímboa da Praia: problem with controlled attacks? September 5, 2018. https://www.dw.com/pt-002/moc%C3%ADmboa-da-praia-problema-com-ataques-controlado/a-43724524 (accessed October 18, 2018).

Pirio, Gregory, Robert Pittelli, and Yussuf Adam. The Emergence of Violent Extremism in Northern Mozambique. March 25, 2018. https://africacenter.org/spotlight/the-emergence-of-violent-extremism-in-northern-mozambique/ (accessed October 16, 2018).

Reporters Without Borders . 2018 World Press Freedom Index. 2018. https://rsf.org/en/ranking (accessed October 16, 2018).

Vukmanovic. Exxon beefs up Mozambique LNG project to cut costs ahead of bank talks. June 2018, 2018. https://www.reuters.com/article/us-exxon-mozambique-lng/exxon-beefs-up-mozambique-lng-project-to-cut-costs-ahead-of-bank-talks-idUSKBN1K22PG (accessed October 19, 2018).

West, Sunguta. Ansar al-Sunna: A New Militant Islamist Group Emerges in Mozambique. June 14, 2018. https://jamestown.org/program/ansar-al-sunna-a-new-militant-islamist-group-emerges-in-mozambique/ (accessed October 17, 2018).

How Russian Twitter Trolls behave and attempt to influence mainstream media


Background:
Foreign actors–both independent and state-sponsored–are increasingly using the Internet as a tool of subversion in order to foment distrust in American institutions. The recent Director of National Intelligence report asserts the U.S. intelligence community’s confidence that Russian President Vladimir Putin ordered an influence campaign in 2016 that was intended to undermine public faith in the U.S. democratic process.[i] Much of this influence campaign took place on social media platforms, leading to congressional inquiries and requests for increased transparency. In response to those requests, Twitter has released a substantial dataset related to this alleged foreign interference in political conversations on Twitter in an effort to improve, through research, our ability to detect, understand, and neutralize disinformation campaigns as quickly and robustly as technically possible.

As researcher Jonathan Albright notes, “The state of the modern information ecosystem — including our dilemma addressing misinformation, propaganda, security, and hate speech — are manifestations of intrinsic misalignments within an increasingly hybridized global information system.”[ii] As we work to find solutions to these new challenges, we must better understand the movements of the content that comprises influence operations and the behaviors of those who propagate it.

Of particular interest is those cases where Russian trolls were successful in infiltrating U.S. news and establishing direct engagement with American Twitter users. One such account, with the username @cassishere, posted a photo of a Putin banner on the Manhattan Bridge that won a credit from The New York Daily News.[iii] There are also allegations that Michael Flynn Followed Russian troll accounts and pushed their messages in the days leading up to the 2016 election.[iv] Twitter itself even informed 1.4 million people that they had interacted with Russian trolls.[v] By looking at the behaviors of these Twitter accounts in closer detail, we can determine whether patterns exist that might help us defend against foreign influence operations in the future.

Two researchers at Clemson University have already begun to analyze the data. To date, they have divided the Russian Twitter trolls into five distinct categories: Right Troll, Left Troll, News Feed, Hashtag Gamer and Fearmonger. My SNA will build off of their research.

Research Question: How do identified Russian trolls engage with mainstream U.S. media accounts on Twitter?
-       Sub-Question: Based on an identified number of cases (TBD[vi]) in which trolls successfully infiltrated mainstream news coverage (i.e. were quoted in a news article), do “successful” trolls exhibit unique characteristics within the troll network?
-       [Based on existing data sets or previous SNA studies] Does the Russian Twitter troll network mirror mainstream news media Twitter networks, “normal” Twitter user networks, and/or known terrorist networks on Twitter?

Why SNA?
Social network analysis is uniquely positioned to begin exploring new questions about influence operations via social media. While this is an area of increasing academic and political inquiry, there is very little established literature due to the contemporary nature of the topic and the difficulty in studying it. While there are many limitations to any political science research about trust, influence, and behavior (see below), we can use SNA to identify patterns in the behavior of these “bot” accounts. Such patterns can help social media companies decide how to handle their presence on their platforms, and can help the wider public learn to defend against political manipulation online.

Hypothesis:
I predict that Russian trolls engaged directly with mainstream news media accounts on a regular basis, in order to push content to those entities. However, I believe the most successful trolls would work through third-party actors (“real” Twitter users) in order to erase their trace and make the information appear more believable. I believe that Russian trolls’ ultimate goal is to sway the beliefs of large portions of the American population by having their message picked up by trusted mainstream news channels. When it comes to the “successful” cases, I hypothesize that the strategies used varied widely—a deliberate attempt by Russia trolls to obfuscate and avoid any potential pattern recognition. I predict that the “successful” cases were pushing content that was more closely aligned with public opinion or other sources, suggesting that trolls are more likely to succeed if they stick closer to reality. Finally, I hypothesize that Russian Twitter troll networks are visually unique from known networks (for mainstream media, “normal” Twitter users, or even terrorists) when looking at patterns of interactions (both mentions and retweets). I believe this would give us the most useful insight into potential ways to identify troll accounts in the future.

Methodology:
For my SNA, I plan to identify a list of mainstream news media Twitter accounts, based on the news organizations Americans most commonly turn to receive their news.[vii] I plan use my larger dataset to identify “levels” of interaction, identified as general tweets (perhaps with certain keywords, yet to be determined), “mentions” that include either another identified Russian troll or one of the established mainstream news accounts I have identified, or “retweets” of any of the aforementioned users’ tweets. While the cohesion measures of this network itself

I also plan to look at the ego networks of a few specific Twitter handles which have been identified in prior research and investigation as having “successfully” infiltrated U.S. news or interacted with public figures (assumed to have wider influence).

Data Collection:
The initial dataset is publicly available on GitHub thanks to Clemson University researchers Darren Linvill and Patrick Warren. Linvill and Warren gathered this data using custom searches on Social Studio, a tool owned by Salesforce and contracted by Clemson’s Social Media Listening Center. The directory contains nearly 3 million tweets from Twitter handles that were found to be connected to the Internet Research Agency, a Russian “troll factory” that was implicated in special counsel Robert Mueller’s February 2018 indictment. Twitter provided Congress with 2,752 handles that were connected to the IRA in November 2017, and added an additional 946 handles in June 2018 (at which point they also removed 19 handles from the original list).[viii] The majority of the tweets in this data set were posted between 2015 and 2017, though I may limit this timeframe as necessary upon further review of the data. The full data file includes 2,973,371 tweets from 2,848 Twitter handles.

In an exciting update, on Wednesday, October 17, 2018 Twitter released an even more substantial archive of Tweets and media that “resulted from potentially state-backed information operations” on the platform. The dataset includes information from 3,841 accounts believed to be connected to the Russian Internet Research Agency, and 770 accounts believed to originate in Iran. These datasets include all public, nondeleted Tweets and media (e.g., images and videos) from accounts believed to be connected to state-backed information operations, including more than 10 million Tweets and more than 2 million images, GIFs, videos, and Periscope broadcasts.

Limitations:
In Twitter’s recent release, some account-specific information is hashed in the dataset for accounts with fewer than 5,000 followers in order to protect user privacy. I do not expect this to affect my SNA, since I do not plan to analyze normal user accounts other than the Russian trolls themselves. Also missing from this dataset is the reciprocal Twitter data of mainstream media accounts, which would provide crucial evidence as to how exactly news organizations engaged, if at all, with Russia trolls on Twitter. Without this piece, influence can only be assumed from the limited data available.

Most importantly, the impact of this information is still largely unknown, and incredibly difficult to measure. Despite knowing that these Russian troll accounts existed (and likely still exist, in different forms, today), we do not and cannot know if and to what extent their presence influenced American beliefs, much less American voter behavior in the 2016 election. For that reason—and to limit the scope of this project—I will not look at user interaction with these Russian trolls. Rather, I will focus on the behaviors of Russian trolls and their interactions with mainstream news media. This analysis will be admittedly one-way in nature, but I can use external sources to corroborate my findings through network analysis.

One area of future research would be to track, in real time (using NodeXL), the behavior patterns of other networks of Twitter users (e.g. politicians, news media accounts, or average users with respect to a specific trending topic) surrounding specific events (namely the upcoming 2018 midterm elections). Since Twitter data is constantly changing and users are able to delete tweets, the best way to analyze data is to use Twitter’s API in real time. Even this strategy is limited, though, because it only captures public accounts (not those who make their accounts private). However, public, “verified” accounts are a good representation of potential influence due to their high follower counts. Another area of future research would be to assess the traction of the Russian trolls identified as being influential by searching Media Cloud's open source text aggregation, indexing, and analysis tool of online information sources for references to that username.

I am taking the second module of this course.



[i] Office of the Director of National Intelligence, Intelligence Community Assessment, Assessing Russian Activities and Intentions in U.S. Elections, January 6, 2017.
[ii] Albright, Jonathan. “Web no.point.0: rise of the Splintr.net,Medium, 17 October 2018. < https://medium.com/tow-center/web-no-point-0-rise-of-the-splintr-net-d45869aa1b8>
[iii] Shane, Scott and Mark Mazzetti. “The Plot to Subvert an Election: Unraveling the Russia Story So Far,” New York Times, 20 September 2018 <https://www.nytimes.com/interactive/2018/09/20/us/politics/russia-interference-election-trump-clinton.html>
[iv] Collins, Ben and Kevin Poulsen. “Michael Flynn Followed Russian Troll Accounts, Pushed Their Messages in Days Before Election,” Daily Beast, 1 November 2017 < https://www.thedailybeast.com/michael-flynn-followed-russian-troll-accounts-pushed-their-messages-in-days-before-election>
[v] https://blog.twitter.com/official/en_us/topics/company/2018/2016-election-update.html
[vi] Shane, Scott and Mark Mazzetti. “The Plot to Subvert an Election: Unraveling the Russia Story So Far,” New York Times, 20 September 2018 <https://www.nytimes.com/interactive/2018/09/20/us/politics/russia-interference-election-trump-clinton.html>
[vii] I plan to use the list of sources used by Pew Research Center in its 2014 study of Political Polarization and Media Habits: <http://www.pewresearch.org/wp-content/uploads/sites/8/2014/10/Political-Polarization-and-Media-Habits-FINAL-REPORT-7-27-15.pdf>
[viii] https://democrats-intelligence.house.gov/news/documentsingle.aspx?DocumentID=396