A look into the impersonator accounts fooling real Twitter users

Three false Twitter accounts which impersonated Wikileaks founder Julian Assange have spent months spreading far-right messaging, in a striking example of how easily fakes can drive online content. A fourth was created on September 4, and immediately began spreading more.

All four accounts — @JuliannAssange, @Julien_Assange, @RealAssange and @JulianAssanged — copied the profile of the genuine Assange (@JulianAssange), occasionally claiming to be a “parody” (or “parity”) account when they were exposed. Their content was not parody, however, but a cocktail of far-right propaganda which achieved the greatest impact when it linked itself with Wikileaks.

Some Twitter users appear to have been fooled by these accounts; others claimed not to have been, but supported their efforts anyway.

Three of the four accounts were created in May. By the time the last of them was suspended on September 4, while under investigation by @DFRLab, it had over 25,000 followers. Minutes after the suspension, a new account was created, using the same techniques.

These four accounts serve as a case study in the power of impersonation — and the worrying tendency of some internet users to spread stories even if they believe the sources to be false.

How the fakes were made

The three early accounts warranted studying to see how they operated, how they survived for so long, and how they gained such a following.

Their survival was based on three factors: the exact copying of the real Assange’s profile; the use of a plausible handle; and the temporary use, when threatened with exposure, of the claim that they were parody accounts (or “parity accounts”).

All four fake accounts used the same visuals, including the blue diamond next to the name (this appears to be a reference to the blue check-mark which Twitter itself uses to mark verified accounts). The similarity is most marked in the latest incarnation, @JulianAssanged, as this screenshot demonstrates.

The earlier incarnations were almost perfect matches, but added the words “parity account” or “parody account” once they were accused of impersonation.

The main difference between these four fakes and the genuine article, other than the content which they posted, was the creation date. Both @RealAssange and @JuliannAssange were created on May 4, 2017, at the same minute; @Julien_Assange was created in the same month. @JulianAssanged was created on September 4. The real Assange joined Twitter in October 2011.

When the words “parody” / “parity” were absent — as they were for much of the accounts’ existence — there were no visual clues to indicate that these three accounts were fakes. This can only be considered deliberate impersonation.

Trying to hide

The @Julien_Assange and @JuliannAssange fakes were suspended in mid-August, presumably after Twitter identified them as imposters. The @RealAssange account continued until September 4. However, it was exposed a number of times before then, including by this tweet, posted on August 30:

Lost count of the number of doppelganger sites of Julian Assange I've seen (hint: the one with "real" in the handle is not the real one). pic.twitter.com/44lyCDraXv

— Ben Nimmo (@benimmo) August 30, 2017

Its behavior, once threatened with exposure, is a classic example of the techniques disinformation actors use to defend themselves. The first response, as the above screen-shots show, was to label the account a parody one. In parallel, it attacked its critics with tones ranging from plaintive…

… to blaming journalists and “verified” accounts …

… to blaming Assange himself:

The user even tried to invoke the First Amendment.

Its main defense was the claim to be a parody account. However, as of September 3, the words “parody account” had been dropped from the bio once more. Instead, the background had been changed to include the WikiLeaks logo. This distinguished the account from the genuine Assange in purely visual terms (possibly allowing the account holder to argue that it was not an impersonation), but nevertheless continued the deception.

This was not a parody account; it was an impersonation account which used the label “parody” as a protection when its status was called into question, and then dropped it once the immediate danger of a reaction appeared past.

Moreover, every indication is that the first three fake accounts were created and run by the same user, changing from one to the next as exposure and suspension loomed.

While activated, @RealAssange repeatedly retweeted @Julien_Assange and @JuliannAssange, as screenshots from a machine scan show.

According to a scan of its mentions from May 4 to the end of August, the @RealAssange account only began to pick up significant traffic on August 18, as @JuliannAssange and @Julien_Assange were taken offline.

Twitter users reported the change early on August 19:

The FAKE Account has changed it's name to Julian Assange @RealAssange. I managed to warn a few people before he blocked me!

— Moonlily (@SuzieMoonLily) August 19, 2017

https://twitter.com/henryjackp/status/898715484295753728

Later in the sequence, the link between @RealAssange and @JulianAssanged was made explicit in the new account’s first tweets:

These four accounts are clearly the work of a single individual, aimed at deception and disinformation, not parody.

A fake that worked

Little survives of the @JuliannAssange and @Julien_Assange accounts. However, a number of analysts, including @DFRLab, studied @RealAssange before it was suspended; these analyses indicate that the fake account created significant impact.

According to a study by Twitter user “Caroline O” (@RVAwonk), the fraudulent Assange account had more engagements than any other user on the term “Antifa” in the wake of clashes at Berkeley on the last weekend in August.

@DFRLab identifed a number of tweets from the @RealAssange account which used the term #Antifa in late August, racking up thousands of engagements (retweets and/or likes). Most were deleted before they could be archived, but they achieved hundreds, and sometimes thousands, of engagements.

Some of these tweets linked the term #Antifa with billionaire George Soros, who is regularly attacked by far-right (and pro-Kremlin) conspiracy theorists. Others attacked CNN and Black Lives Matter, two other perennial targets of the far-right.

@RealAssange also supported United States President Donald Trump’s pardon of Sheriff Joe Arpaio.

Its best-performing tweets, however, came when it appeared to promise Wikileaks revelations, and to attack former Democrat presidential candidate Hillary Clinton:

The numbers should not be taken at face value: some of the accounts which amplified these posts show a suspiciously high proportion of retweets in their content, suggesting a degree of automation. However, other users were clearly individual; the tweets also received a significant number of replies, indicating a degree of impact.

The account’s deceptive nature was also demonstrated by real users’ reactions. On at least one occasion, a genuine reporting outlet was fooled by the account, and initially ran a story quoting it, before correcting:

Replies by Twitter users also suggest they took the fake Assange as the real one, especially when the account appeared to flag WikiLeaks content. The following tweets were some of the many posted in response to the fake account’s “Wikileaks has duplicates” post.

https://twitter.com/Destinbeach22/status/902913843004887041

https://twitter.com/john_ship67/status/902846540691202048

Thank goodness for Assange and Wikileaks. 👍🏽👍🏽👍🏽

— ⚡️⭐️I. C.🚒🚒 (@2HemiDude2) August 30, 2017

On some occasions, other users pointed out the fake, and were acknowledged.

Some users appeared to retweet the account even though they knew (or claimed they knew) that it was fake.

https://twitter.com/euniverse1/status/903049840929775616https://twitter.com/euniverse1/status/903050189111513089

https://twitter.com/AtomasVictory/status/903197051529211904

https://twitter.com/AtomasVictory/status/903198589245022209

Political messaging

While the identity of those behind the account cannot be established by open sources, their purpose can. The fake Assange accounts routinely attacked centrist and left-wing politicians, especially the Democrats and Clinton, while defending and espousing far-right conspiracy theories.

When the account was first activated, @RealAssange posted and shared attacks on French presidential candidate (now President) Emmanuel Macron. Such tweets have been captured by machine scan.

It also shared posts from a range of far-right commentators, and appeared to try to connect with them via its tweets.

Other posts attacked the mainstream media, Clinton, and reporting on Russia’s attempted interference in the U.S. election.

All these place the user firmly in the ideological world of the far right of U.S. politics. This is the same world in which the earlier fake account, @JuliannAssange, operated, as the following screenshots from the archive make clear.

The new account, @JulianAssanged, followed on in the same tone, with the same conspiratorial arguments, and even the same image.

Most of its early tweets, however, were retweets of the genuine Assange, apparently in an attempt to give it verisimilitude.

The network

A final point of interest in this cluster of impersonation accounts is the amplification network. The first post from the @JulianAssanged account was a retweet of a post from an account called @BostonMAGA23, advertising the fact that @RealAssange had been shut down, and inviting followers.

This is not coincidence. In a machine scan of all posts mentioning @RealAssange from May 4 to August 18, @BostonMAGA23 was the most active user, other than @RealAssange itself, to mention the account.

Just over two weeks earlier, on August 16, @RealAssange appealed to its followers to follow @BostonMAGA23, having been suspended for “supporting Trump” — a very similar phrase to the excuse @JulianAssanged gave for having been caught impersonating Assange.

@BostonMAGA23’s own first tweet, meanwhile, mentioned the second fake account, @JuliannAssange.

A subsequent tweet mentioned the third fake in the family, @Julien_Assange.

@BostonMAGA23, too, joined the attacks on “Antifa”, and copied them to @RealAssange.

In its early days, this account achieved very few engagements, despite the advertisement from @RealAssange. By September 4, it had under 1,000 followers, marking it as an otherwise insignificant player.

However, its launch of @JulianAssanged, and the way that @RealAssange launched it, indicate that it is connected with the network of fakes. The fact that it had had at least one previous account shut down also indicates that it is part of the aggressive family of accounts on the far right of U.S. politics.

Conclusion

All the fake Assange accounts are (or were) based on the same modus operandi: accurate impersonation of the real Julian Assange account, the occasional adoption of the “parody” tag for camouflage, and aggressive far-right messaging.

Their longevity is surprising. Created in May, two of the accounts lasted until mid-August; a third lasted exactly four months. The fate of the fourth, @JulianAssanged, will be watched with interest.

These accounts achieved some degree of impact. Their tweets were widely amplified, gaining thousands of retweets and hundreds of replies (not all favorable); they deceived many Twitter users and researchers.

Perhaps most disturbingly, some posts were shared and amplified by commentators who thought that the account was fake, but approved of its message. This is a timely reminder that one of the key challenges of fake news and accounts is that of the audience which is willing to be duped, and to dupe, in the pursuit of a higher goal.

---

Follow along for more in-depth analysis from our #DigitalSherlocks.

Editor’s note: This article highlights and distills a challenge in today’s information space, and should not be taken as advocating for or supporting any specific group.