At the start of last week, Twitter lit up with outrage at a thread posted by John O’Connell – founder and editor of Far-Right Watch. In the thread, he purports to have found evidence that the Department of Health and Social Care (DHSC) had set up 128 fake Twitter accounts – or ‘sock-puppets’ – as nurses to push for “herd mentality (sic)".
O’Connell stated that the accounts had been set up using the social media management tool Hootsuite – with one person registered to the account and four people as contributors. He went on to claim that he had pressed DHSC for comment and sought legal advice on how to proceed, as well as quoting figures for the number of nurses whose images had been used without their consent.
The thread seems almost engineered for maximum outrage and virality. At the time of writing, it has nearly 25,000 retweets and 33,000 likes, as well as numerous shares across Facebook, Reddit, and message boards. The story has also been enthusiastically picked up by partisan news outlets such as The Canary.
Despite the buzz around the thread, mainstream and reputable news outlets remained silent as the story broke, in spite of its wide social media coverage and precedent for deceptive social media activity by the governing party as well as a recent scandal involving misleading 'illustrative' testimonies about the efficiency of the benefit system. Looking a little closer at O’Connell’s thread, it’s easy to see why; several details revealed cause for doubt over his serious claims – such as a reluctance to provide his dataset to independent fact checkers, his reliance on one account as public ‘proof’, and insistence that he legally cannot reveal all his info. The BBC, The Guardian, Gizmodo and others have all since covered the ‘scandal’, pointing out the holes in O’Connell’s story.
O'Connell has addressed these criticisms in a recent post on Far Right Watch, stating that "various media outlets have stated that 'no evidence has been supplied as yet.' I have no problem with these articles, they are, indeed, factual in saying so" while insisting that there is still "data analysis to be done." Curiously, O'Connell has not yet provided any further proof, and instead insisted further that a shroud of secrecy should be placed over his work at this time for legal reasons.
This article is less about showing why O’Connell’s claims are spurious (you can look through the stories linked above for that) and more about using this example to show you how to cast a critical eye over similar claims and check accounts you think may be sock-puppets using quick and easy investigative methods.
Spotting a Fake-Fake NHS Nurse Scandal
O’Connell’s approach is an excellent illustration of how not to conduct an investigation of this kind. To start with, though O’Connell never reveals his process or methods for his investigation, it appears to be based around OSINT (Open-Source INTelligence) techniques. OSINT, by definition, uses open sources, meaning that the information is there for anyone to legally access should they have the knowledge and tools; there is no ‘hacking’ required. A reluctance to share an OSINT dataset with others when there should be no legal issues with doing so is quite the red flag. O’Connell claims that the data needs to be packaged in a way for “non-geeks” to understand, and while the files and formats used by OSINT and data visualisation software can look scary, refusing to collaborate with the wider community of investigators and fact checkers to help parse this information makes no sense. Similarly, this tweet claiming that legal protection akin to the Cambridge Analytica whistleblowing is necessary does not ring true; the analogy with OSINT work just doesn’t hold up. No NDAs are being breached and this information should be freely available online. O’Connell repeatedly declines to name or tag any of the 128 ‘confirmed’ sock-puppet accounts he claims to have identified – a simple, clear, and legal way of showing his findings – all of which, according to him, have since conveniently been deleted in one fell swoop.
Another red flag at odds with standard OSINT methods is his claim that he could see the accounts attached to Hootsuite. To see this information for Hootsuite, Tweetdeck, or similar with OSINT (ie. from the outside looking in), is impossible. Claims such as this should be regarded as an attempt to ‘dazzle’ the layman with technical know-how, or an outright admission of legally dubious methods of investigation.
Spotting a Real-Fake NHS Nurse (or any sock-puppet or bot)
Of course, as with any good con, a kernel of truth must be contained in the set up in order for people to fall for it. For O’Connell, this comes in the form of ‘NHS_Susan’ – a fake profile set up earlier this month using a stolen picture of a nurse from the Unison website (with Mia on her nametag). O’Connell quite rightly holds this account up as a fake, but instead spins the scandal around it with no further evidence. In fact, as others have noted, the account appears to be independent: a crude parody of left wing talking points rather than one node in a network of fake accounts.
If you suspect an account you are interacting with is a sock-puppet, or you have discovered a bot, there are a few ways to check out your hunch. The first is to conduct a reverse-image search on their profile picture. If a result comes back for someone entirely different across a number of social media platforms and accounts, then chances are your target has stolen someone’s photo for their sock-puppet. This method of first-check is quick and easy but is becoming less reliable as sites such as This Person Does Not Exist provide AI generated headshots, although they can sometimes be recognized through the very consistent style of close-up and bokeh (blurred background) used by the AI.
The next step is to examine the content and tweeting style of the account. For NHS_Susan, a cursory glance at her account (which, though deleted, can be accessed via Google’s cache) shows a downplaying of the current PPE scandal, but also poor attempts at parody such as:
People ask me what I’ll be happy about when Covid 19 is gone...? I’ll tell you, the clapping for the NHS. As a deaf junior doctor, I must say it’s not inclusive for people like me, and children who go to bed early and also dogs who have sensory overload. #bantheclap
The latter part of this tweet would blow the cover of any sock puppet account as it is clearly a send-up of leftist talking points from a supposedly sincere perspective. A more likely conclusion about NHS_Susan is that the account is a right wing troll rather than part of a co-ordinated effort to sway public opinion.
If an account appears to seriously be pushing a particular agenda and not slipping up with bad parodies, then the next step is to look for patterns in tweet times. Does the account appear to be active only at certain times of the day or on certain days full stop? This could be a sign that they are one of a number of accounts managed by the operator.
In addition to sock-puppet accounts that are operated by real people behind a fake profile, there are also Twitter ‘bots’ that are scripted to tweet and retweet a certain agenda. Bots are a bit easier to spot than sock-puppets, often having a far higher frequency of tweets for the age of the account than is normal. They will also have suspicious follower amounts for their age too. The Observatory for Social Media has set up a ‘Botometer’ that can quickly check this information and give accounts a ‘bot’ rating on how likely they are to be automated.
For more in-depth checks, tools such as Spoonbill allow you to see changes to Twitter user’s bio – a good way to see if a bot or sock-puppet has been used for multiple agendas over its lifetime. Even more in-depth, Tweetbeaver allows you to find as much open-source information as you’d like about a user, from converting their name to a Twitter ID to finding conversations between two accounts or downloading an account’s follower list.
Of course, this is more than most people would need to check claims and information they come across, but a combination of tools, techniques, and above all, common sense will grant you a far better sense of when you are being misled by a supposed exposé. This should help you rise above the “herd mentality” O’Connell cited in his initial thread – an ironic typo on “herd immunity” given how far his unevidenced claims travelled.
Copied!