Abstract. This work provides a quantitative analysis of the cross- platform disinformation campaign on Twitter against the Syrian Civil Defence group known as the White Helmets. Based on four months of Twitter messages, this article analyzes the promotion of urls from differ- ent websites, such as alternative media, YouTube, and other social media platforms. Our study shows that alternative media urls and YouTube videos are heavily promoted together; fact-checkers and official government sites are rarely mentioned; and there are clear signs of a coordinated campaign manifested through repeated messaging from the same user accounts. paper: https://link.springer.com/chapter/10.1007/978-3-030-61255-9_23

1. Twitter Is the Megaphone of Cross-platform
Messaging on the White Helmets
Sameera Horawalavithana, Kin Wai Ng,
and Adriana Iamnitchi
Distributed Systems Group, CSE
University of South Florida

2. White Helmets
2

3. White Helmets (WH) Events Timeline
3
2016
April
Air strike attacks on west
of Aleppo city.
September
WH Netflix Documentary.
2017 2018
February
WH Documentary
wins Oscar.
April
Chemical Attack on
Khan Sheikhoun.
October
OPWC attributed the attacks
to the Syrian Regime
April
Chemical Attacks on
Douma.
July
WH Evacuation to Israel
due to entrapment.

4. Our study
● We study how different categories of digital platforms are shared in Twitter
conversations related to the White Helmets
4
YouTube Twitter

5. Twitter Dataset
● We only consider the Twitter
messages that contain at least a URL
○ We filtered out URLs to Twitter itself (that
typically refer to other tweets) and URLs to
web domains that are mentioned only once
in our dataset (3,025 such urls had no
effect on information diffusion).
○ The shortened URLs are expanded, and
HTML parameters are removed from the
URLs
5
Our Twitter Dataset

6. Classifying Digital Platforms
● We manually classified eight
categories of digital platforms shared
in our Twitter dataset
○ 620 alternative media domains (ALT),
○ 112 mainstream media domains (MSM),
○ YouTube
○ 50 social-media domains (SM),
○ 18 government media outlets (GOV),
○ 4 fact-checking web-domains
(FACT_CHECK),
○ 3 official White Helmets (WH) media
outlets, and
○ 171 other web domains.
6

7. Most URLs are from Facebook and YouTube
● The most shared URLs are from Facebook and YouTube.
● A small number of websites have unusually high popularity and few URLs
○ E.g., rt.com, clarityofsignal.com, zerohedge.com, and 21stcenturywire.com
7

8. Apparent Promotion Campaign
● The majority of URL mentions are
from alternative media domains that
promote anti-WH content (Fig 2.a).
● YouTube URLs are more popular in
shares relative to any other media
category (Fig 2.b and 2.d).
● 25% of URLs are injected via quotes
and replies, suggesting a concerted
promotion effort (Fig 2.c).
○ < 1% URLs that are shared in quotes and
replies in a different Twitter dataset related
to security vulnerability (CVE) mentions.
8

9. Identifying Media Co-sharing Patterns
● Tweet-sharing network: We connect a tweet to the web categories to which
the URLs that appear in that tweet belong, and project this network in the web
category space.
○ This network captures the co-occurrences of different web categories in the same tweet, thus
capturing the potential similarity of the views expressed in the content published in those
categories.
● Cascade-sharing network: We connect a cascade (i.e., a conversation that
starts with a tweet along with replies responding to the original tweet, or a set
of endorsements via quotes and retweets) to the web categories to which the
URLs that appear in that cascade belong, and project this network in the web
category space.
○ This network captures the co-occurrences of different web categories in the same cascade
which might consist of a set of users who hold similar or opposite views. 9

10. Tweet/ Cascade-Sharing Networks
10

11. YouTube and ALT URLs co-appear
● Alternative media URLs are promoted
via exploiting the accessibility of video
content
○ The top alternative web domains that co-occur
with YouTube video URLs are rt.com,
clarityofsignal.com, russia-insider.com, and
21stcenturywire.com
● The top three social media sites that
co-occured with a YouTube URL are
steemit.com, facebook.com and gab.ai.
11

12. Coordinated Campaign
● There are signs of coordination for promoting
URLs for particular domains
○ Users who often shared MSM and ALT URLs in the
same tweet, used the ALT articles as evidence to
debunk the narratives presented in the MSM articles.
● Very few users who tweet an alternative
media or a YouTube video URL share a
fact-checking URL
○ Out of 7,377 users who shared ALT URL, only 32
(0.004%) users shared a fact-checking URL
○ They might disregarded fact-checking sites
collectively. The ALT articles promoted WH as
terrorists even 2 years later after fact-checked.
12

13. Twitter users authored similar messages across
multiple platforms
● There are messages that spread over multiple platforms which are often
authored by the same user identity,
○ A well-known anti-WH voice Vaneesa Beely repeatedly included both URLs to her YouTube
channels and her own articles posted on 21stcenturywire.com in the Twitter messages
○ 32 tweets that share gab.ai and YouTube URLs are promoted by the same usernames in both
Twitter and Gab.
● There are tweets citing the same video which is uploaded in both YouTube, and
Facebook pages.
○ One user shared 22 duplicated tweets that mention Facebook URLs point to her Facebook page,
where the same YouTube videos already shared in their tweets are also found.
13

14. Summary
● YouTube videos are at the center of this campaign, and alternative media
URLs are promoted via exploiting the accessibility of video content
● Other social media platforms in addition to Twitter and YouTube have a
significant role in this campaign (e.g., Facebook URLs are 13%)
● We show signs of coordination for promoting URLs for particular domains
● Our study demonstrates the need to develop intervention techniques to
limit disinformation spread across a broader media ecology than a single
platform in isolation
14

15. Thank you.
Acknowledgement:
DARPA SocialSim Program
15