WHO Director-General Attacked on Twitter with CCP-Related Memes
Tedros Adhanom Ghebreyesus, the Director-General of the World Health Organization (WHO), tweets daily out of WHO headquarters in Geneva, Switzerland. But within minutes of many of his tweets going live, he is flooded with personal attacks, memes, and slurs.
While social networks like Twitter should be a space for legitimate criticism of institutions like the WHO, messages spread by inauthentic accounts en masse and in a coordinated manner distort public debate and prevent honest discussion in the digital space.
We therefore wanted to find out: Do the tweets targeting Dr. Ghebreyesus’s account come from inauthentic accounts, or genuine human frustration? What types of attacks are addressed at Tedros, and are there patterns that might hint to a larger coordinated network of accounts? In scraping a collective 15,000+ tweets from over the course of two months, we attempt to answer these questions, and to illuminate how Twitter disinformation disrupts the activities of one of the world’s most prominent public health officials.
The Meme Timeline
Over a period of ten days, from June 2 to June 12 2020, we captured a dataset of all the replies to Tedros’ Twitter handle, totalling 7912 tweets. The data was captured using the Python tool Tweepy by filtering through tweets at “DrTedros” for ones with a reply ID matching his Twitter ID.
Out of the 7912 tweets collected in our dataset, an incredible 2427 tweets contain an image attachment.
The image attachments are almost exclusively memes. Thousands of crude images, associating Tedros as a puppet of the Chinese Communist Party, have been posted in his reply section within eleven days. Here are some examples:
The memes often depict a cartoon representation of the Chinese president and a submissive Tedros, drawing upon criticism that the WHO has been submissive to Chinese interests. Further analysis shows that a limited quantity of images are reposted, with a small set of ten to fifteen images used repeatedly.
More examples of frequently posted memes replying to @DrTedros
We can track the first appearances of the images using a reverse image search engine like Yandex. For example, the meme with Winnie the Pooh and a cart first started appearing on Twitter in late April.
Another frequently reposted meme was first published as a political cartoon on April 17th. The cartoonist, Antonio Branco, is known for his conservative, deep state conspiracy-driven work.
Many of the memes appear alongside the hashtags #ChinaLiedPeopleDied, and #TedrosLiedPeopleDied, allegations that China and the World Health Organization misrepresented and downplayed the coronavirus pandemic.
According to FirstTweet, an OSINT tool that searches through Twitter for the first appearances of a hashtag, #TedrosLiedPeopleDied emerged on Twitter on April 6, 2020. The date is very close to early appearances of the Tedros memes, correlating April as when the memes first emerged.
#ChinaLiedPeopleDied, in contrast, first appeared two months prior, on February 5, 2020.
Flooding the Reply Section
Judging by the memes, a significant portion of tweets replying to @DrTedros demonstrate inauthentic Twitter behavior, with many being problematic attacks on Tedros. The real percentage is likely higher, with large quantities of insults present, even without an image attachment.
By sorting our collection of tweets by account names, we identify a pattern of repeated bursts of spam towards @DrTedros — three to five messages sent within the short time frame of a minute.
The tweets with blue hyperlinks contain image attachments that can be viewed on Twitter.
For example, within the span of a minute, the following image was tweeted three times by @Tedros_dog as replies to three separate @DrTedros tweets:
The spam operation disrupts @DrTedros’ Twitter community, where the large quantity of memes and insults simply overwhelms any genuine content within @DrTedros’ reply section.
Sleepless Spammers
We investigated whether the spammers show signs of inauthentic account behavior by counting their Twitter replies, and putting each account through the ageless OSINT test — “humans tend to sleep.”
Between June 2 and June 12, 1488 Twitter accounts tweeted a collective 2427 memes to @DrTedros. Using a Python dictionary, we count the number of times each of the accounts posted one of those memes.
While the majority of handles only posted once, the top 3% (most active fifty accounts) are responsible for 23% of the memes.
The fifty handles that tweeted the most memes are plotted below. Collectively, they are responsible for 564 tweets.
This flow diagram was made with Plot.ly. The sizes of the boxes on the left represent how many memes an account posted in proportion to the total number of tweets on the right
The most frequent poster of memes is @Jonas_Jewels, responsible for 64 memes during our data collection period. @Jonas_Jewels exhibits strong patterns of inauthentic behaviour with a fake profile picture and tweets exclusively about the coronavirus.
Screenshot of @jonas_jewels Twitter profile taken July 26, 2020
Example of a meme posted by @jonas_jewels replying to @DrTedros on June 4, 2020
We further investigated @Jonas_Jewels by entering the handle into Foller.me, a Twitter tool that plots out the times of an account’s 100 most recent tweets.
The longest window of time for @Jonas_Jewels to sleep is three hours, implying inauthentic tweeting behavior.
Tweeting times of 100 most recent tweets of @Jonas_Jewels. Screenshot taken on June 12, 2020
Using this technique we can similarly flag many other accounts within our list as inauthentic, including the second and third-most frequent tweeters, @babbabang and @biologist_robert.
Tweeting times for @babbabang. Note the longest available interval for sleep is two hours
Tweeting times for @biologistrobert. The interval available for sleep is four hours. This one is less clear, possibly representing a human with unregulated sleeping patterns, but still suspicious
In contrast, here is what the tweeting pattern looks like for a confirmed human, @DrTedros. Notice the reasonable seven hours available for sleep between 22:00 UTC to 05:00 UTC, and a gradual increase in tweeting activity that builds towards his local evening time:
Tweeting times of a human account (@DrTedros). Screenshot taken July 26,2020
The Tedros Meme Network
To find out whether the three most frequent posters in our dataset have common connections and might therefore be part of a larger network, we scraped the followers of @Jonas_Jewels, @Babbabang, and @BiologistRobert and visualized the network using D3 Javascript code.
The nodes (blue dots) are Twitter accounts, and edges (grey lines) are follower relationships. This visualization demonstrates strong connections among our spammers, where @babbabang (bottom left), @jonas_jewels (upper left), and @biologistrobert (right) not only follow each other, but have a number of mutual followers.
Another pattern in the network is the similar account generation dates. Recently created accounts can be a red flag for bot presence; the account generation months of several of the most frequent posters are listed below.
@jonas_jewels: May 2020
@biologist_robert: May 2020
@babbabang: May 2020
@flavinkins: Jun 2020
@biotechlifeline: May 2020
@oogidoogiboogi: April 2020
Not all accounts on our list are in this network. One of the outliers is @sharonkuo12, the fifth most frequent poster of Tedros memes.
@sharonkuo12’s feed largely consists of pro-Taiwan content. Among the outliers, a theme emerges with many of the accounts retweeting content related to pro Hong Kong independence and pro-Taiwan movements.
Another example is @qidaitianlian, an account tagged to China with a fake name that translates into “Awaiting Light in the Sky.” @qidaitianlian’s exudes inauthentic behavior, where all of its tweets in the dataset are images without any text.
There are also several authentic accounts among the ones tweeting pro-Hong Kong and pro-Taiwan content. For example, @CforChinazi, unlike @qidaitianliang, engages in complex sentences in its retweets, and is likely operated by a human despite its fake profile picture.
More Memeists Enter the Network
In addition to our original dataset from June 2 to June 12, we captured a second dataset containing 6740 tweets from all twitter replies to @DrTedros between July 4 and July 14.
Are the same accounts responsible for posting memes in June and July? The diagram below demonstrates a high turnover rate in the most frequent perpetrators. The top twenty perpetrator accounts for the two months and their Twitter activity in June is plotted on the left, and in July on the right.
Several notable accounts in early June, such as @sharonkuo12 and @chrislook, completely stopped posting memes in early July. The most frequent posters in June, such as @jonas_jewels and @babbabang and @biologist_robert, have also significantly decreased their online activity.
In contrast, several new accounts that were not present at all in June emerge among the most frequent memeists in July. In the following diagram, we tag these accounts by connecting them with a “new accounts” label:
Many of the new accounts have recent creation dates in May, June, or July of 2020 and are connected to our network of meme accounts. For example, @poopyjonah was generated in June 2020 and engages with older accounts in the network such as @biologist_robert and @jonas_jewels.
Twitter profile of @poppyjonah, a new account spamming @DrTedros
Meme posted by @poppyjonah that was previously posted by @jonas_jewels in June. The images across accounts are identical in cropping and resolution (720 x 480 pixels)
@jonahpoppy was generated in June and started spamming @DrTedros in July. The messages closely resemble previous spam efforts in June from accounts like @jonas_jewels.
The creation of new accounts helps fuel the coordinated network, which has continued its operations spamming @DrTedros even into August.
Conclusion
Tedros is far from the only health official experiencing hate on Twitter. In the U.S., #FireFauci has trended for weeks, referring to the distinguished virologist Anthony Fauci. This is happening alongside similar insinuations targeting outgoing Brazillian health minister Nelson Teich, UK Chief Medical Officer Chris Whitty, and many of their global counterparts.
We strongly encourage you to conduct similar analyses on the activities and feeds of your local public health officials — you may just uncover a coordinated network of inauthentic accounts.
Another source of great data are hashtags targeting public health officials, many which offer insights into related conspiracy theories and messages. For example, #FireFauci, which emerged on April 6 according to FirstTweet, trended in June and July.
Some of the hashtags that appeared frequently alongside #FireFauci include:
#Openamerica
#Plandemic
#Exposebillgates
#Deepstateplants
#Billgates
#Qanon
#Nomasks
This list was produced through collecting all tweets with the #FireFauci hashtag over a period four days (July 16 to July 19) using Twint. 2059 tweets were collected, with 820 hashtags appearing alongside #FireFauci. The most frequently used hashtags and the number of times they appeared in the dataset are listed below.
#FaucitheFraud – 82
#Firebirx – 60
#Openamerica – 43
#Covid19 – 42
#Nomasks – 41
#Fireredfield – 41
While criticism of public health officials on social media is rooted in genuine human frustration, our analysis of account behaviors and connections reveals the presence of a coordinated network of inauthentic accounts targeting @DrTedros on Twitter. As of today, these accounts continue to spam @DrTedros with memes.
This author would like to thank Johanna Wild for her help with this piece.
