• Disarm Disinfo

Resistance troll detection - the lib-trolls

Updated: Aug 22, 2019

Heading into primary season and the 2020 elections, we need to be mindful of trolls in all shapes and sizes. Important things to remember:

Trolls aren't just the conservative folks.

Trolls don't have a political leaning.

Trolls are there to divide and cause chaos.

There will be much division to be had in the upcoming primary. Let's assume there will be many left-leaning trolls in our midst. Let's call them the lib-trolls.

Lib-troll diagnostics are teachable moments. Let's look.

Rule #1: Be generally suspicious all the time. It is an absolute jungle out there. Would you trust any stranger meandering your way in the darkness of night? No way. Be appropriately paranoid at all times.

When you get notification of someone following you, enjoy the dopamine hit for a moment, then check the account. This is especially true if you're managing a group account for any concern that is politically-leaning. Any legitimate Indivisible group account is a target.

Let's walk through the thinking process with one:

Today's suspicious follower is "ResistNow-Today" with the handle @today_resist. This names are generic enough to get looking a little further. It looks like the account is likely a few days old.

The first easy thing is to do a quick botcheck. The link will take you to a free tool that can be installed on your browser and linked to your twitter account. Once this tools is installed, then a bot icon will appear below any account name. Click the icon to see if an account is a likely bot. botcheck is not infallible, and it will not catch trolls. It is designed to catch accounts that are likely to be automated by software.

It turns out this account is too new to be classified by botcheck. The next thing to look at is the graphics, specifically the account's profile picture.

Overall the graphics seem generic (you'll learn to trust your gut). The profile image is oddly both ornate and generic. Is the "Join the Resistance" logo original artwork for this group, or is it something that someone picked up from the internet? Let's check.

To see how/where an image has been used, do a "reverse image search".

Place your cursor on the logo, art, or whatever image file you want to check then right-click your mouse (if you're on a Mac, you may need to do control+click) and select "Copy Image Address"

Once you've selected "Copy Image Address" then go to a reverse image search site, such as Tin Eye ( and then paste that address into the search bar. You can also download the image and then upload to the search, but just using the image address is faster.

Next you'll see a display of where the image has also been used. If it is used numerous times, over numerous years, for very different types of accounts that's a hint.

In this case "Join the Resistance" looks like a cropped version of the logo for an automotive parts store. I wonder what the cars were resisting in 2017?

Tin Eye reports the same logo was found 162 other times. Not an original. It has also been used for a few other Twitter accounts, a nataliekelley3 and Mean_Adam. Let's take a look at one of these accounts.

The @nataliekelley3 account also smacks of being a lib-troll. There are troll give-aways. The name IAM WE_ARE seems off. There is something "too much" about the Resistance Logo at the top. It's trying too hard. The sheer numbers of tweets and likes is high.

Doing a quick botcheck on @nataliekelley3 turns up a likely bot on the three bot-indicators: tweet frequency, retweet frequency and polarization of content. Is Natalie/IAM WE_ARE both fake and automated? Probably. This is another account to flag for later for reporting to Twitter.

Let's get back to the original possible lib-troll, @today_resist.

We know that the image has a long and sordid history.

Let's look at what @today_resist has been tweeting. Initially some timely tweets about hurricane Barry making landfall in New Orleans. Continue scrolling. A few tweets in, there is a series of tweets that all look to have been made at around the same time, 1-hour previous to the check.

It is a strange mix of tweets. With a common theme.

A CNN piece on division in the Democratic party. Is it a mirror of the Tea Party days?

Next a tweet from the Washington Examiner on Ilhan Omar.

Then a post about Bernie Sanders accusing Biden of misinformation.

Then a post about a fall-out between groups over an article about Pete Buttigieg.

The common theme here is division. Polarization.

It feels appropriate to put this account in the "likely troll" category. A primary goal of trolls are there to divide. Lib-trolls want to divide us.

Enough of the warning signs are there for @today_resis. If we were 100% sure this was a false account, then it is easy enough to report it as a suspicious or as an account that is impersonating someone else.

This is such a new account. A baby troll. Rather than report this right away, it's best to watch for a few days. @today_resist may teach us something about the dynamics about what trolls are using to divide us. For today, this lib-troll is on the watch list and hopefully it will teach us something.