Introduction to Social Media Investigation: A Hands-on Approach, 1st Edition (2015)

Chapter 9. Twitter

Abstract

Twitter is a “microblogging” Web site. Recall that blogs emerged in the late 1990s and resembled online diaries. People could write anything they wanted and post it for people to read or comment on. While blogs could take any form, the posts were often essay length. Microblogging allows users to make posts, but they tend to be very short. Twitter limits posts to 140 characters. This creates an environment that is fundamentally different from blogging, since it is easy for someone to read hundreds of posts in a short amount of time. This chapter presents an overview of the different types of information people share on the site and how to find those people.

Keywords

Social media

Social networks

Twitter

Microblogging

Case Study Paragon: Anthony Weiner

Perhaps, the most famous case of someone's Twitter activities revealing far too much is that of Congressman Anthony Weiner (D-NY). On May 27, 2011, Weiner, a member of the US Congress representing New York, sent a public tweet directed at a 12-year-old woman who followed him on Twitter. The tweet contained a link to a picture that was a close-up of an erect penis concealed by a pair of boxer briefs.¹

Because the post was publicly accessible for a time—until it was deleted—many people saw and archived it. Weiner was not explicitly being investigated by most of these people; politicians' accounts are regularly followed by people who are interested in all their activities, including those who are interested in any content that could be potentially damaging.

However, it turns out Weiner's Twitter activity was also being explicitly investigated by a group of conservatives.² For months before the tweet described above was posted, a group calling themselves the #bornfreecrew monitored Weiner's posts. They sent public messages to the women who followed him, warning them to “stay away” from him. The New York Times reports that there is even evidence that this group or others created fake Twitter accounts to try to entice Weiner into making inappropriate statements.³

It was one of these #bornfreecrew members, Dan Wolfe, who retweeted Weiner's inappropriate photo to his followers and eventually shared it with conservative publisher Andrew Breitbart. Breitbart then published the picture on his website.

As the news broke, Weiner responded by claiming that he had not posted the picture and that, instead, his account had been “hacked”.⁴ On June 6, 10 days after the original photo was tweeted, Breitbart published another photo of Weiner, this time shirtless, that was obtained from a woman who said Weiner had emailed to her.⁵

Weiner called a press conference the same day and confessed to posting the original tweet, sending other pictures to women, and conducting “inappropriate” conversations on Twitter, Facebook, and other platforms. Ten days later, on June 16, Weiner announced he would resign from Congress.

When you are being monitored on Twitter, a single post can have dramatic consequences.

Twitter Overview

Twitter is a “microblogging” website. Recall that blogs emerged in the late 1990s and resembled online diaries. People could write anything they wanted and post it for people to read or comment on. While blogs could take any form, the posts were often essay length. Microblogging allows users to make posts, but they tend to be very short. Twitter limits posts to 140 characters. This creates an environment that is fundamentally different from blogging, since it is easy for someone to read hundreds of posts in a short amount of time.

Twitter is the largest microblogging website. It launched in 2006, and studies estimate there are close to one billion Twitter accounts. Twitter reports approximately 250 million active users (where “active” is defined as someone who accesses the site at least once a month).

Basic Twitter Activities

On Twitter, all activities center around two things: posting and reading.

Posting (“Tweeting”)

On Twitter, posts are called tweets, and the act of posting is called tweeting. Figure 9.1 shows a tweet by our example user, Malcom. Roughly half of the 250 million active users will have tweeted in the last month, while the rest spend their time reading posts others have made.

FIGURE 9.1 A tweet posted by Malcom.

Tweets are public by default. Anyone can read someone else's tweets by going to their Twitter account page. Figure 9.2 shows Malcom's Twitter profile with all of his tweets.

FIGURE 9.2 Malcom's Twitter profile with all of his tweets.

@mentions

Users can have public conversations on Twitter. This is done by using something called “@mentions” (pronounced “at mentions”). A user types an at sign, immediately followed by someone's username (sometimes called a “handle”). For example, if someone wanted to send a tweet directed at Malcom, then he or she would begin the tweet with “@malcomCsmith.”

Like all tweets, these are publicly visible. However, the user who is mentioned will have the tweet highlighted in a section of their profile. Some users receive a notification that they have been @mentioned.

Direct Messages

There is also an option to have private conversations, using a feature called direct messages. However, we won't focus on them here, since they're hidden and inaccessible to an investigation.

Hashtags

Finally, an online convention seen more and more across the web—but which began on Twitter—is the hashtag.

As discussed earlier in the book, a tag is a label applied to something in order to make finding it easier. On Twitter, tags are prepended with a “#” character (hence the name “hashtag”).

Some hashtags are obvious in meaning. For example, people often use a hashtag to indicate a sports team they are discussing, like #redsox or #chicagocubs. Other hashtags evolve by convention. The #ff hashtag stands for “follow Friday,” indicating a tweet where people list other users that they think are worth following.

Hashtags are also links. Thus, if a hashtag doesn't make sense to you by itself, you can click on it to see other tweets with the same hashtag. The context of the other tweets may reveal the hashtag's meaning.

Reading

If a user likes a tweet someone has posted, they can choose to show it by one of two actions: favoriting and retweeting.

Favoriting Tweets

Under Malcom's tweet in Figure 9.1, there is a small Favorite link beside a star icon. Sometimes, only the star icon is shown (see Figure 9.2). Clicking this will mark the tweet as a favorite.

User can go back and revisit their favorites. The tweet's original poster is notified when the tweet is favorited.

Retweeting Tweets

A user can also retweet, which reposts the original tweet onto the user's profile. In each of the figures mentioned above, the “retweet” option with a double arrow icon is shown to the right of the Favorite link. When a tweet is retweeted this way, it appears as though it came from the original poster.

Alternatively, some people retweet manually. This was commonly done in the early days of Twitter. A manual retweet is simply the copy-pasted text of another tweet, preceded by “RT” (meaning “ReTweet”) or “MT” (meaning “Modified Tweet,” if the user changed the original text). Manual retweets are still used when someone is adding a comment to the original. In Figure 9.3, Malcom has retweeted a post from NASA with commentary.

FIGURE 9.3 Malcom has retweeted a post by NASA. Malcom's text (“AWESOME!”) appears at the beginning of the tweet. Then, the “RT” characters indicate the subsequent text is a retweet. The “@nasa” indicates that NASA's account posted the text, and finally, the original text from NASA's tweet appears.

Following Users

If a user finds that someone often has interesting tweets, they can follow that person. By doing so, the followed user's tweets are aggregated and displayed in reverse chronological order on the home page when a user logs in (see Figure 9.4).

FIGURE 9.4 Malcom's home screen with tweets from the accounts he is following (and an ad from Amazon listed as “Promoted”).

There's an important difference between following and the “Add Friend” feature common among other social networks: following is a one-way relationship.

On sites like Facebook, friendships are mutual. If you add someone as a friend, they must approve the friendship, and it establishes a two-way relationship.

On Twitter, there is no requirement that a relationship goes both ways. For example, in Figure 9.4, we can see that Malcom follows the official accounts for the NFL team Baltimore Ravens, the Discovery Channel show MythBusters, and Netflix's show House of Cards. By following them, Malcom is able to see their updates, but those accounts do not need to follow Malcom back (and probably won't).

To follow someone, simply find someone's Twitter profile (more on this later), and click the Follow button (see Figure 9.5). The user will receive a notification that they have a new follower.

FIGURE 9.5 The profile summary for NASA. Notice the “Follow” button in the lower right. Clicking this instantly makes the user follow the tweets posted to NASA's account.

Twitter Demographics

Twitter skews slightly toward women, who make up 53% of users. Twitter users tend to be under 30 and it is much less popular among older Americans. Urban dwellers are also more active on Twitter.

One standout point about Twitter users comes in race. Twitter is much more popular among African-American users. Among all African-Americans online, 22% use Twitter compared with 16% of Caucasian internet users.⁶ Among younger people, the rate is even higher with 40% of African-Americans under 30 using Twitter.

Finding People

By Search

There are two major methods for finding people on Twitter. First is through search. At the top of every Twitter page is a search box. You can see an example of this in Figure 9.4 at the far upper right. You can enter a person's name in that box, and you will get a set of results that are different than what you would find on many other services.

The Twitter search returns a mix of tweets and people that match the search term. Figure 9.6 shows example results if we searched for “Malcom Smith.” You can see the three top users who match the search term at the top of the screen, followed by a list of tweets that match.

FIGURE 9.6 The results page on Twitter after searching for “Malcom Smith.” Notice both people and tweets are listed.

You can narrow this using the sections on the left. Note the check mark next to “Everything” at the top of the column on the left. If you click on “People,” you will see a list of people who have names, usernames, or personal descriptions that match your search term; the results will not include tweets. This is shown in Figure 9.7.

FIGURE 9.7 The “People” section of the Twitter search results page, showing a list of users who match the search term.

As with Facebook, people can be found using their name or their email address. Searching for an email address is often an effective way to find people who have chosen not to use their real name on Twitter. Even with a fake name, if you know the email addresses a target uses, you may be able to find them.

By Follow Lists

Another way to find people is to look for them in the “Following” and “Follower” lists of their known associates. This is essentially doing a search of the target's social network, even though the network is not explicitly a friend network on Twitter like it is on sites like Facebook.

For example, if we want to find our target Malcom Conroy-Smith and can't find him using search, we may search the lists of his associates. Say we know he associates with the person who runs the account for Hopper Dog, a golden retriever.⁷ If we go directly to Hopper Dog's profile page, we can see several relevant links toward the top of the page. Figure 9.8 shows the number of “Following” (people Hopper Dog is following) and “Followers” toward the top of the page.

FIGURE 9.8 The top of Hopper Dog's profile shows the number of people she is following and the number of her followers. Clicking on one of those numbers will link to a list of those people.

Clicking on the number of Following or Followers will take us to a list of those people. For example, if we click on “Following,” we see all the people who are following Hopper Dog (see Figure 9.9). We can then browse through this list to see if Malcom Conroy-Smith appears there.

FIGURE 9.9 A list of people following Hopper Dog.

Obtaining Data

You can get to a target's page by going to http://twitter.com/«SCREEN-NAME» (where “«SCREEN-NAME»” is replaced with the screen name the person uses on Twitter). Our example target uses @MalcomCsmith as his Twitter screen name, so his profile would be athttp://twitter.com/MalcomCsmith.

User Profiles

A target's profile contains some basic information about them. (Note that Twitter doesn't have “full” profile pages, like Facebook.) At the top of a person's page, you'll see their name, a short description of themselves, and—if they've chosen to share it—their location.

The location on a user's profile is manually entered; it's not detected from their tweets. So, it could be specific (like a city name), generic (like “Earth”), or even something made up (e.g., “The Hanging Gardens of Babylon 5”).

Figure 9.10 shows Malcom's profile.

FIGURE 9.10 Malcom's biographical information from his Twitter profile.

Tweets

Much more information can be found in the tweets themselves. On a user's profile is a list of their tweets in reverse chronological order. Figure 9.2 above shows a list of Malcom's most recent tweets. The content of the tweets themselves often reveals a lot of information. However, you can find metadata about the tweets that are also very helpful.

Tweet's Time

Each tweet has an associated date and time it was posted. At the top of each tweet, you will see the user's real name, followed by their screen name, followed by a date or time.

The specific date and time is not always shown on the user's main page. For example, in Figure 9.2, we can see his top tweet has a date of “Apr 16” but no time. The two tweets below that are also dated “Apr 16” followed by one on “Mar 11.”

Clicking on the date (e.g., “Apr 16”) takes you to a page for that specific tweet. This page has more extensive data—not only the date and time but also other data. Figure 9.11 shows the detail for Malcom's first tweet from Figure 9.2.

FIGURE 9.11 The details of one of Malcom's tweets. Note the additional date and time information at the bottom of the page. Under the image is a more specific date and time.

Tweet's Location

On a specific tweet's page, its location may also be available. Not all tweets will have location information, since users can choose not to share it.

However, when location information is there, it is extremely specific. In Figure 9.11, Malcom's tweet is listed as being in “Washington, DC.” This is under the text of the tweet but above the photo next to the pin icon. The name of the city is itself a link. Clicking the link takes you to a detailed Google Map, with a pin marking the exact GPS coordinates of the tweet (Figure 9.12).

FIGURE 9.12 The map that we are taken to when clicking on the location of Malcom's tweet shown in Figure 9.11. Note that the precise GPS coordinates are given in the location box, and the pin shows the precise location along with the coordinates.

Follow Lists

Finally, friends and followers are available through a person's profile. These social connections are different than what we find in many social networks, since they do not reflect any relationship between the two users. Followers are simply interested in someone's tweets.

This isn't to say that social relationships don't exist on Twitter but rather that they can't be assumed from the presence of a follow relationship.

In this case, looking at the tweets people exchange (especially through @mentions) can reveal the nature of their relationship.

Privacy Levels and Access

Privacy is very straightforward on Twitter. Users either can make all of their tweets totally public or can restrict access to their accounts. This is called a “protected” account. In this case, only a user's followers can read the user's tweets, and those followers need to be approved by the user. Estimates put the percentage of protected accounts under 12%, so the vast majority of people have totally public accounts.

There is no mechanism for limiting access to some tweets and not others. Thus, if you find someone's page and it is not marked as protected, you know you are seeing all of the target's tweets.

As mentioned above, direct messages between users are not public. These are similar to email messages sent within Twitter. They are restricted to 140 characters, but access to these direct messages is always limited to the two people participating in the conversation.

Example

When users have location information turned on in their Twitter accounts, it can reveal a lot about their lives. Consider our example target Malcom. He has location tagging turned on for almost all of his tweets. We could collect the GPS location of each tweet manually and then plot these on Google Maps or some other mapping tool.

In fact, interest in this kind of analysis is so common that there is a tool to do it called GeoSocial Footprint: http://geosocialfootprint.com.

At that website, you can put in a target's Twitter screen name and it will pull location from the target's last 200 tweets and plot them on a map. As an example, if we put Malcom's screen name into this website, it produces the following map (Figure 9.13).

FIGURE 9.13 A heat map from geosocialfootprint.com of Malcom's tweets.

Each pin marks a location from which Malcom has tweeted. Clicking on the pins pulls up the tweet associated with that location. Thus, not only can we see where Malcom goes, but also we can find out what he is doing in those locations. We can see many tweets centered around his place of work in the center of the screen and in the place he lives (toward the left on the map).

Case Studies

Twitter is a very popular social media site, and it is particularly useful for investigation since almost all tweets are totally public. Thus, it is an easy platform to find out a lot about targets if they have accounts.

Family Law

Rackham Karlsson, a Boston-area attorney, shared a story with me of a family law case he worked. An unmarried couple with two children had separated and were fighting for custody and child support arrangements. The father claimed he had very little income. The mother knew he had worked as a nightclub promoter, but the father insisted he was not making any money from that job.

Using the father's known email addresses, attorneys were able to find a Twitter account for him under a different name, which he was actively using as part of job as a promoter. This allowed the opposing side to offer evidence both of his deception and of his income that was used to calculate child support.

Hiring and Firing

I spoke with many people who were in charge of hiring and firing who reported using Twitter. To my surprise, the majority of their responses were positive; many people emailed me reports of looking up applicants online and being so impressed with their online presence that they made them a job offer. However, as you might expect, some of the more interesting stories were negative.

Mitch Donaberger is the social media manager for Saladworks, a nationwide chain of salad-oriented restaurants with over 100 locations. As part of his job, he monitors employees and the company's reputation online.

One example he gave of how he used Twitter was in investigating a person who posted this photo (Figure 9.14).

FIGURE 9.14 A photo posted by a former Saladworks employee of plastic bags worn over flip-flops in the kitchen.

The employee tweeted that she had worn flip-flops into an active kitchen—a violation of company policy and health safety laws. To comply, she put bags over the flip-flops and, as we can see, took a photo and posted it. Though she did not reveal her name or location on Twitter, Mr. Donaberger was able to cross-reference it against her other social media accounts and identify her name and general location and ultimately the store she worked in. Within a day, she was fired for damaging the brand through her post.

Crime

Bad guys use Twitter, too—sometimes to investigate their targets. A dramatic case of this occurred in the United Kingdom.⁸

James Charters, known publicly as DJ Ironik, is a rapper and musician based in the United Kingdom. He has had notable musical success, including his song “Tiny Dancer,” which featured Elton John and reached number three on the charts.

On November 6, 2010, he was returning home after a performance at the Element Nightclub in Southend-on-Sea in the United Kingdom. As he approached his home, two hooded men attacked him in an apparent robbery. Ironik tried to throw his diamond necklace toward the men and flee, but the attackers managed to stab him in the leg. The wound was severe enough that he spent the weekend in the hospital receiving treatment.

The attackers apparently knew of his location by monitoring his Twitter account. After Ironik had boasted on TV about the value of his jewelry, the muggers monitored his Twitter account to track his location. On the night before the attack, Ironik had tweeted about his performance at the Element Nightclub. The attackers used this to learn when he would be returning home and to wait there to ambush him.

Fortunately, Ironik fully recovered from his attack.

Conclusions

Twitter is a social media platform where people often post frequent updates. Photos and location information are quite common relative to what you might see on other sites. Also, the privacy issues are relatively simple since a person's tweets are either totally public or completely restricted to approved followers.

While profile information on Twitter is limited, people who post tend to do so frequently, sharing a lot of information about their daily activities.