Online Synchronization, the Synchronized Action Framework and Case Studies
By Lynnette Ng
& Thomas Magelinski
Tags: Online synchronization, synchronized action framework
Image credit: Pstock image from FreePik
Recent Publications:
Magelinski, T., Ng, L., & Carley, K. (2022). A Synchronized Action Framework for Detection of Coordination on Social Media. Journal of Online Trust and Safety, 1(2). . Direct link to paper, published Feb 28, 2022:
Ng, L. H. X. & Carley, K. M. (2022). Online Coordination: Methods and Comparative Case Studies of Coordinated Groups across Four Events in the United States. . Direct link to paper, published June 26, 2022:
Coordinated Online Behavior
Coordinated online behavior is defined as: A set of users working together to amplify a message or story. While genuine coordination is good, coordinated behavior is misleading and manipulative. Villages of users have been recognized to manipulate the media in their , create polarized networks in the , and reveal .
A lot of these users may look normal and will not be discovered using most bot detectors. That’s because to identify users that participate in coordinated behavior, one needs to look at the population level. We developed a framework for detecting deliberate coordinated behavior by using the synchrony of posts as a population-level feature.
The Synchronized Action Framework for detecting Coordination
While normal coordination mobilizes people to talk about certain topics on certain days, users performing highly synchronized coordination take the same actions within minutes of one another. These actions artificially inflate the popularity of narratives, ideas or topics, which can be used to manipulate people. We focus on detecting highly synchronized actions.
In order to find coordination between users, we focus on high synchronization between users in several dimensions.
A synchronized action occurs when two users take the same action at the same time. We assess the degree of synchronization based on the timescale in which actors operate.
An action is a measurable behavior that a user exhibits to be localized in a particular point in time, such as tweeting with a hashtag. These actions form up the dimensions of coordination. The dimensions we consider in our studies are: semantic coordination through same hashtags, referral coordination through same URLs, social coordination through same @-mentions. We consider users that have these same behaviors (i.e. same URL). In our studies, we use a 5-minute time window for synchronized/coordinated actions.
Caption: Illustration of behaviors exhibited in a tweet. Created by Thomas/Lynnette with powerpoint.
Templated vs Covert Coordination Campaigns
Using this method, we discovered two types of campaigns in the 2020 ReOpen America Protests campaign. Templated campaigns are intentionally public facing, clearly coordinated and result in strong network structures such as disconnected components and extremely strong edges. Covert coordination campaigns are much more murky, with no well-defined components and user clusters.Our approach is effective in identifying templated campaigns. Tweets in such campaigns follow a specific pattern and are thus easy to verify as part of a coordinated effort. An example of this is the 7News Australian news network. 12 of the news accounts shared the same message a total of 180 times, with the same time stamp. Their tweets often mention the reporter, using the story’s URL and adding hashtags like #7News. We infer that the news network used automated methods to push out the same message through different account channels and the target audience is the corresponding city in Australia. The coordination between local accounts broadens their geographic coverage and reinforces the popularity of URLs and hashtags.
Caption: 7News component of multi-view coordination network. Link widths correspond to coordination strength. Blue, red and green lines correspond to URL, mention and hashtag coordination respectively. Source: Thomas/ Lynnette (paper on A Synchronized Action Framework for Detection of Coordination on Social Media. Journal of Online Trust and Safety, 1(2). )
Covert coordination campaigns are more messy. An example is the Reopen protests network. Focusing on the strong connections within the densest cluster. The most central node in terms of total degree centrality is @FedUpUSA, a self proclaimed media account committed to bring “truth about what is really happening, as opposed to the fodder that is shown in the mainstream media”. The coordinated activity around it is far murkier than the templated campaign, demonstrated by the lack of absence of any strongly connected clique.
Caption: FedUpUSA multi-view coordination ego network. Red lines denote mentions; green lines correspond to hashtag coordination. Nodes are sized by their total degree. This diagram represents a covert coordination campaign. Source: Thomas/ Lynnette (paper on A Synchronized Action Framework for Detection of Coordination on Social Media. Journal of Online Trust and Safety, 1(2). )
Ethical implications of coordination detection
Given the increase in interest in social media manipulation, it is important to detect coordinated users on the platforms. However, while doing so, we must have an understanding of distinguishing “good” and “bad” coordination. Ideally, coordination detection algorithms identify meaningful sets of users that are cooperating in some way on the online space.
Social media has evolved into an effective tool for alternative reporting, giving the public the power to directly report events as they experience them. As law enforcement and government agencies engage in the surveillance of social media by policing online actions, power can shift from the public to these agencies. Unrestricted coordination detection thus runs the risk of exacerbating imbalances in power against the public, especially for minority communities that already face large power imbalances (References: , ).
Theme Discovery and User Analysis
We extend the Synchronized Action Framework to identify groups in the resultant coordinated networks through Louvain clustering. We then discover themes by combining the discovered groups with further analysis: performing Latent Dirichlet Allocation on tweet texts to discover narratives, analyzing URL content to discover shared interests and uncover user support through screen name commonalities.
In this blog post, we focus on one of the events, the US Election Primaries 2020. There are two key narratives identified through semantic analysis: the Democratic and Republican support. This shows how our method can sieve out the key narrative threads. 39.7% of the users that participated in the Republican discourse were suspended by the platform six months later. The key themes in this event is promotion of Republican candidate Donald Trump via links to YouTube and Periscope videos. In terms of social coordination, this event revealed users that overtly support Trump and Biden, the two key candidates for the Presidential race. The number of users that exhibit Democrat support through their user names was than the Republican support. These users put terms in their screen names to demonstrate their support.
Caption: Example of coordination across dimensions in the US Elections Primaries 2020 and the identified themes of clusters (Source: Lynnette Ng & Kathleen M. Carley, "").
We perform similar case studies across four events: US Election Primaries, Reopen America, Capitol Riots, COVID Vaccine. Performing coordination studies across case studies not only explores single behaviors in isolated contexts but also evaluates if certain types of coordination are related and the user types that participate in them. A handful of users engage in multiple types of coordination within the same event. This percentage, while small (<0.8%), is still noteworthy because these numbers are huge at a large scale. For example, the proportion of users engaging in all three types of coordination in the COVID Vaccine event is 0.1%, which translates to 1200 users. This is a scale that can potentially do harm, given that a recent study on open-source datasets of bots discussing COVID19 range from 48 to 1427 users. (Source: Himelein-Wachowiak et al, "").
The proportion of users participation in two coordination types are visualized in a cross-tabulation table in the Figure below. A larger proportion of users engage in two coordination types than three coordination types. Screen name entropy is a measure of how random the characters of the screen name are in the universe of screen names on Twitter. We collected over 3.7 million screen names and formed a database of screen names, then calculate the entropy/randomness of screen names of users engaging in coordination. The of users that engage in 1-type of coordination is significantly less than users engaging in 2-types (p=0.004) and 3-types (p=0.004) of coordination. For users that coordinate 2-ways, the users that were later suspended had higher strength of coordination (p=0.002).
Caption: User analysis of the proportion of users participating in multiple types of coordination. (Source: Lynnette Ng & Kathleen M. Carley, "").
Conclusions and Future work
The Synchronized Action Framework makes use of grouped sliding windows and multi-view clustering to find coordinated users across user behaviors in a simultaneous fashion. This framework has been applied to several case studies and we identified user groups and discussion trends.
In the Reopen America conversation, coordinated users were found pushing to reopen California and North Carolina.
Future work seeks to improve behavior identification, in which weighting schemes like TF-IDF (Term Frequency-Inverse Document Frequency) could be explored to eliminate false positives and over-representation of popular actions (i.e., hashtags that are trending).
We hope that this work will shed light on new techniques to identify coordinated groups of users on social media, and will be adapted to sieve out malicious coordinating groups attempting to influence the narratives in the social network.