Sockpuppets Target Nagorno-Karabakh

On February 23, 2021, Twitter announced a takedown of 35 accounts created in order to advance narratives that were critical of Azerbaijan and favorable to the Armenian government. Twitter shared this network with the Stanford Internet Observatory on February 12, 2021. The network included 72,960 tweets dating back to 2014, with most of the tweets occurring before 2017, and several accounts going dormant for months or years and then posting a high number of tweets in a short period of time. Accounts quoted official Azerbaijani state messaging with intermittent pro-Armenian messaging in an attempt to masquerade as Azerbaijani accounts. Most of the accounts had low tweet activity and engagement. The most noteworthy tactic in this network was the creation of accounts pretending to be Azerbaijani government officials. One of these accounts was created in 2014, and changed its handle in 2020 to impersonate the Minister of Foreign Affairs. This is not the first time this tactic has been used. In October 2020 Twitter announced the suspension of a network of accounts linked to the government of Saudi Arabia that created accounts pretending to be an interim Qatari government in exile. One of these accounts, @QtrGov, was created in 2016 and had over 90,000 followers, and there is strong evidence that it did not use this handle prior to 2020. By combining an old creation date and handle switching, information operations can create the impression of account legitimacy. It is possible that @QtrGov used spammy follow-back behavior to grow its following, then wiped its tweets and changed its handle. On the one hand, there are reasons to not be too worried about this tactic. In both operations, Twitter users called out the accounts as fake. And for the operation described in this report, the fake government accounts got at most a few hundred followers. At the same time, this tactic has potential to mislead people. Several of the government officials impersonated in this network lacked their own official Twitter accounts, creating a search vacuum. In an example described in Section 4.2, a Google Knowledge Panel for one of these government officials linked to the fake Twitter account. Key takeaways:
• This network created sockpuppet accounts impersonating Azerbaijani government officials to push contentious messaging aligned with the Armenian perspective in the Nagorno-Karabakh conflict. In one case, the impersonation dated back to 2016.
• Accounts in this network increased activity around several flash points in the ongoing conflict between Armenia and Azerbaijan over the Nagorno- Karabakh region. The accounts used a mix of Azerbaijani propaganda and Armenian propaganda, posting under Azerbaijani account names to mock Azerbaijani figures and criticize actions by the Azerbaijani government.
• Accounts used common Azerbaijani hashtags such as #JusticeforKhojaly and #StopArmenianAggression, but coupled them with Armenian hashtags like #Artzakh (the Armenian name for the disputed republic).
• Multiple accounts posted the same tweets at similar times, indicating coordination (or shared managers) across the accounts. • Accounts posing as news sites primarily shared Azerbaijani news articles through RSS feeds, but periodically tweeted original content using different Twitter clients. These original tweets were largely pro-Armenian.
• We also observed a specific, low-engagement astroturfing campaign in 2019 that targeted the anniversary of the Khojaly Tragedy.