A bot doesn’t need to talk like a bot for Twitter to notice

Twitter is tracking accounts’ behavior — and not necessarily the content they disseminate — to determine whether a user is misrepresenting their identity, a possible indication the account is used to amplify information operations.

The approach is an attempt to solve a problem that keeps changing as nation-states look for any edge in cyberspace. While hackers continue to breach international networks to steal trade secrets and conduct espionage, they also use trusted social media outlets to exploit users in a way that is re-defining cyberwar, according to a panel of experts at the RSA cybersecurity conference.

“This practice … may be having a greater outcome than what we think of as traditional cybersecurity,” said political scientist Peter W. Singer. “Is [cybersecurity] about critical infrastructure, or the poisoning of democracies?”

Twitter examines accounts by assessing whether they are part of a larger network of users pushing the same types of information, said Del Harvey, Vice President of trust and safety. The company also checks to see if accounts are connecting through the same IP address or networks, she said. From there, Twitter builds a file that can help determine whether a user is participating in propaganda efforts.

“All these signals, when taken in isolation, don’t give you a clear snapshot,” Harvey said. “But when you can take all these weak ties together, you can build it into a profile.”

Of course, computers play a big role in doing all this work. As NSA senior adviser Rob Joyce said during the panel discussion, “Automation is very good at finding automation.”