Incident Update 1︱Bot Campaign most likely the work of an amateur, reports CDMRN partner The Social Media Lab
Author : Philip Mai (The Social Media Lab)
Disclaimer - August 26th, 2024
Incident response involves ongoing updates. We aim to be transparent about how our knowledge has evolved throughout this response cycle. The analysis and findings below reflect an early assessment of the incident. Further research has shown some of the initial impressions of the incident are incorrect. Specifically:
- We find that there was a floor of 437 and as many as 7000 bots that produced messages [IU6].
- The messages were not copy-pasted and instead were generated by an LLM that was likely a budget (e.g. GPT-2) or low parameter (e.g. Llama3.1:8b) model. It is also possible the prompt is not well designed to produce posts for 𝕏 [IU6].
- 98% of the accounts were created in the week preceding the incident [IU6].
- That the bot activity focusing on the rally was likely the product of a data pipeline that ingested recent news stories [IU6].
Did a single person create the suspected bot attack in which hundreds of users posted about the Conservatives’ rally in Kirkland Lake, Ontario?
CDMRN partner member The Social Media Lab (SML) at Toronto Metropolitan University conducted a rapid assessment of the suspected bot campaign associated with Pierre Poilievre’s recent speaking event in Kirkland Lake, Ontario. They released their findings this week.
Based on a manual review of the posts from the Kirkland Lake bot attack, the SML estimates that about 200 bot accounts were involved, most of which had been created within the last two months.
The SML also explored whether the attack extended to other social media platforms but did not find any similar campaigns.
The campaign was an example of a simple copypasta: a block of text that is copied and spread widely online, often as a sarcastic reply, to take up comment space or to confuse those who don’t recognize the joke. Both the opening monologue and the entire screenplay of the 2007 animated film, Bee Movie, have been used as a classic copypasta with users on numerous platforms copying the entire script as status updates and comments to the others’ posts.
The SML found that, given its extent and format, the Kirkland Lake campaign was likely evidence of the work of an amateur, unlike the 2023 “Spamouflage campaign” that has been linked to China, during which a bot network left thousands of comments in English and French on the Facebook and X/Twitter accounts of Canadian Members of Parliaments (MPs) over the course of several weeks.
The SML–among other experts–report that identifying who might be responsible for a cyber attack and what their motivation might have been can be notoriously difficult. Recent changes to the X platform have made it less transparent and the watchdog that enforces Canada’s federal election laws, Canada Elections, is hampered in its ability to investigate foreign interference.
The CDMRN is actively investigating this information incident. Further findings regarding how significant the event was and the extent to which Canadians were exposed will be forthcoming as part of the information incident protocol and shared on the CDMRN Information Incident site.
For more information about the report or about The Social Media Lab, please reach out to Philip Mai. For information about CDMRN or media requests, please reach out info@cdmrn.ca and isabelle.corriveau2@mcgill.ca.