Cybersecurity & Tech Democracy & Elections

Is There a Targeted Troll Campaign Against Lisa Page? A Bot Sentinel Investigation

Christopher Bouzy
Wednesday, January 22, 2020, 7:14 PM

I am the founder and CEO of Bot Sentinel, a platform that uses machine learning and artificial intelligence to classify inauthentic and problematic Twitter accounts. Even I was shocked by what we discovered.

Source: Flickr/

Published by The Lawfare Institute
in Cooperation With

“Homewrecker.” “Traitor.” “Tramp.” These are just some of the insults flung at Lisa Page—the former FBI lawyer whom President Trump has targeted for her text messages critical of him during the 2016 election—in the almost 4,000 responses to a tweet she posted on Jan. 18.

Phrased like this, such insults might seem unsurprising, if gross. Public figures often receive online abuse, after all. But the replies to Page’s tweet stand out. They likely represent a targeted trollbot attack—one that nobody has reported on until now.

I operate Bot Sentinel, a platform that uses machine learning and artificial intelligence to classify Twitter accounts that exhibit toxic troll-like repetitive behavior—that is, misleading or coordinated posting. Because of my experience, I see a lot of bile from trolls and inauthentic accounts on Twitter. But when my team examined the responses to Page’s tweet, even I was shocked by what we discovered.

The tweet in question was pretty mild for such an aggressive response. It read:

Over the weekend, Lawfare’s Benjamin Wittes brought to my attention a suspicious pattern of replies to Page’s tweet. A significant number of replies invoked the same oddly specific misogynistic epithet: “homewrecker.” He wondered: Could these odd replies be a part of an automated attack against Page? Plugging the usernames of the responding accounts into Bot Sentinel’s service, Wittes showed that the overwhelming majority of the users tweeting hostile replies had a relatively high resemblance to automated trollbot accounts.

I showed my team his thread, and we decided to run an analysis of the totality of replies to Page’s tweet, using in-house tools that enable us to analyze a large volume of accounts. You can read our full report on the replies here. What we found was surprising and highly unusual.

More than one in four of the replies to Page’s tweet come from accounts likely to be trollbots. Of the 3,891 accounts that replied to her tweet, a staggering 28.42 percent of them received Bot Sentinel “Trollbot rating” of 75 percent—the threshold for accounts that we classify as “alarming.”

We classify accounts using a four-tiered structure, with a percentage calculated to reflect how likely it is that the account is a trollbot: normal (0-24 percent), moderate (25-49 percent), problematic (50-74) and alarming (75-100). We calculate an account’s score based on several factors, including an account’s propensity to retweet known misleading news and to engage in repetitive bot-like behavior.

Only the worst accounts receive a rating above 75 percent. Such high a rating is indicative of an inauthentic account that participates in coordinated swarms on a particular tweet or user.

Ordinary accounts can occasionally receive such a high rating if they engage in toxic behavior or share misinformation in a highly repetitive fashion, but those accounts that exceed 75 percent are largely inauthentic.

The proportion of these “alarming” accounts replying to Page’s tweet is highly abnormal. Of the total number of accounts analyzed by Bot Sentinel within a 24-hour time period, on average only 15 percent receive an “alarming” trollbot rating. The proportion among those accounts replying to Page’s tweet is nearly double that: 28 percent of the accounts replying to Page meet the threshold of likely trollbots.

It’s exceedingly rare to see such a large percentage of trollbot-like responses on a tweet like Page’s. We see swarms like this several times a month, but they almost always target tweets linked to a major news event. For example, on the day the Senate began the impeachment trial, swarms of inauthentic accounts targeted House impeachment managers and shared disinformation about Democrats and the Ukraine scandal. Although Page’s tweet relates to her ongoing litigation against the Department of Justice, it has no ties to a high-visibility event like the impeachment proceedings. So our team was very surprised to see her tweet attract such a swarm of trollbots.

But that’s not what surprised us the most. Our team was most struck by the sheer vitriol of the trollbot attacks against Page. It is our job to identify and examine inorganic activity on social media platforms; we sift through vulgar and toxic content all the time. Yet the replies to Page’s tweet stood out for their unusually vile quality.

This analysis doesn’t definitively prove a coordinated campaign against Page. However, the suspicious activity associated with her tweet has all the characteristics of such a campaign: a swarm of inauthentic accounts using the same toxic language and repetitive activity. It looks a lot like the coordinated campaigns we witnessed during the 2016 election, when a swarm of accounts would suddenly begin tweeting the same toxic messaging.

All this raises a question: Who is behind the apparent trollbot activity against Page?

Christopher Bouzy is the founder and CEO of Bot Sentinel. He started coding at the age of nine on an Aquarius computer. His encryption product Cloak was acquired by Avanquest Software, and he has had several additional products acquired since then.

Subscribe to Lawfare