Page 82 - CDM Cyber Warnings February 2014

It started as an experiment, the creation of the Twitter many times harsh and attacking which best served
account (mirror) that mirrored the adversary. It would be credential building. Even harsher responses to their
an experiment in information warfare, cyber psyops, responses laced with extremist religious rhetoric mixed
intelligence gathering and cyber counterintelligence with verse ensure the persona met the intended audience.
methods. The avatar of the mirror was the same as that of
the adversary. The location the same. The tag line the same. About one year into the experiment with followers now
The handle just one letter off. The look and feel matched equaling the adversaries, the mirrors message started a
that of the adversary. Analysis of adversary twitter activity slight change in messaging. The messaging began with a
included time of day for tweeting, number of tweets per change in the numbers being mentioned; the religious
hour, per day, and of course, the tone, tenor and overall overtones more pronounced and intense. The references
content of the tweets. The initial matching were just that. to verse slowly made their way to each and every tweet.
Word for word verbatim tweets of the adversaries tweets This part of the slow metamorphosis lasted about three
at the same time of day. Adversary went dark. Mirror went months when the next series of changes began. In parallel,
dark. Over a few weeks, original tweets of the same type the mirror gain new and different followers as well as a
but different from the adversary started making their way request for an interview by a major, international news
to the twittersphere. organization. The interview occurred via email over a
period of two weeks with carefully crafted responses to well
These tweets were equally atrocious in content and full of thought out questions. The new followers gained placed
propaganda and outright lies. They had to be equal to the the mirrors numbers over adversaries by nearly 1.5k. Surely
task. In fact, they need to be just a bit more over the top to an event that would upset the adversary and cause more
gain interest and gather followers. The reasons it seemed scrutiny of the mirror.
that many followed the adversary were many.
The adversary changed course by creating a second and a
● Religious fervor and alignment third twitter handle to push out propaganda. With each
● Members of the group new handle came a new mirror. With each new tweet came

● Interested news organizations a �mirrored response.�
● Adversaries of the adversary
● Sock puppets looking to infiltrate The main mirror morphed yet again claiming an injustice
● Adversaries looking to gain intelligence advantage was perpetrated against family by the adversaries. In
addition, the adversary had granted an interview with the
● Funding sources looking to ensure the content was on
same aforementioned international news organization that
message
exposed several interesting facts that could and would be
● Fighters in the field looking for moral support and Web
used to further experiment although changing the script.
2.0 courage
With followers creating a buzz about the injustice, new
● Just plain curious
followers joined the mirror in questioning the motives of
the adversary and calling for change. The mirrors
Whatever the reason, the tweets had to appeal to each
messaging started calling for the physical removal of the
organization to build street credentials. This is not a short
adversary. The messaging became more local in flavor and
term game. The effort required patience and planning. The
intent. The messaging no longer mirrored the adversary
effort required a screenplay type script.
but starting to juxtaposition the adversary using a higher
moral and religious authority and tone. The followers grew
As time progressed, the �mirror� as the twitter handle will
to over 2.5k more than the adversaries and included leaders
be known as going forward, gain followers from each of
of countries.
the types mentioned above. Responses in re-tweets were

CYBER DEFENSE MAGAZINE - ANNUAL EDITION 82