On Wednesday, Matt Taibbi released the most recent installment of his “Twitter Files” in which he names the Atlantic Council’s Digital Forensic Research Lab. We wish to correct some of the points he makes, which are wrong, misinterpret events, or do not incorporate our responses made in good faith. Taibbi reports that DFRLab contacted Twitter’s Trust and Safety Team to examine a dataset of 40,000 Twitter accounts in 2021. As Taibbi reported, Twitter found almost all of the accounts to be authentic users. The dataset was part of an investigation into alleged coordinated disinformation and online harassment in India, conducted in parallel with the Indian outlet The Wire . One of their reporters at the time collected the dataset and shared it with our team; he attributed the tweets to the BJP, but his analysis failed to meet our research standards. The DFRLab therefore decided not to publish that investigation, terminating our collaboration with The Wire in October 2021. When an investigation necessitates it, the DFRLab shares our findings with social media platforms to help ensure our research is accurate. This was the case with the alleged BJP dataset; we shared it with Twitter solely as part of our due diligence. As neither our internal research staff nor Twitter could find a connection between this particular dataset and the BJP, we decided to not move forward with the research. We stand by that decision. The Wire eventually published its own investigation in early 2022 but later retracted it after losing confidence in their report’s accuracy. As an independent research organization, the DFRLab thoroughly vets all research prior to publishing, particularly when it involves data received from outside sources. That vetting process often involves sharing initial findings
Conclusions & Recommended Actions & Technical Summary
- Forensic Focus: Audit chain of custody, system timestamps, and artifact logs for related activity.
- Source Provenance: Technical briefing synthesised from DFRLab (Digital Forensic Research Lab) advisories.
- Examiner Action: Update investigation IOCs and cross-reference artifact signatures.
- Forensischer Schwerpunkt: Systemprotokolle prüfen, Artefakte analysieren und die Beweiskette sichern.
- Quellenherkunft: Verifizierte technische Analyse basierend auf Berichten von DFRLab (Digital Forensic Research Lab).
- Maßnahme: Relevante Indikatoren (IOCs) aktualisieren und betroffene Systeme prüfen.