How to monitor oppressive regimes on Twitter using TweetDeck

This entry was updated in April 2023 to cover the new TweetDeck layout and settings

(Click here to watch and listen to the video version of this blog entry)

Twitter and TweetDeck as monitoring tools

Twitter is a huge social media platform where millions of users share content daily. Although many see it as a place to share opinions, get news, or connect to other professionals, it is also a valuable tool for millions living under oppressive regimes. Twitter gives eye witnesses and victims all over the world a platform to share evidence of crimes committed against the innocent. This can often be done in real time, and within the safety of anonymity.

TweetDeck, a platform owned by Twitter, can be used as a dashboard to monitor specific types of content. It is an amazing tool for investigators to keep track of what is happening in certain areas of the globe and collect evidence of possible human rights violations.
I have chosen to use the Islamic Republic of Iran for this tutorial because it fits various criteria that will be useful for us: there is an ongoing conflict between the population and the regime, it has a history of human rights abuse, and they speak a language I cannot read (I like a bit of a challenge).

A quick note before we start. When investigating and collecting data on possible human rights violations you can expect to find content that may be distressing. I will not share any graphic content in this tutorial but if you put into practice what I will explain below, there is some chance you be exposed to distressing imagery. Make sure you are comfortable with it before jumping from the theory to the practice.

TweetDeck Dashboard

The TweetDeck dashboard is comprised of various columns, each completely independent from each other. Columns can be spread throughout different decks which are in turn also independent from each other. Below you can see a sample of my working dashboard (censored, sorry). On the left, you have the decks, you can see my first one with a solid purple box. You can assign different icons to each to make them easier to tell apart. The grey background around the first icon indicates we are currently looking at that specific deck. You can also see three different columns, each highlighted with a different colour. At the top of each there’s a solid box with the name of the column. There is no maximum number of columns you can have although after a few dozen it might start lagging a bit.

Setting up TweetDeck

Now that we know how a TweetDeck dashboard looks like, let’s learn how to set it up to start monitoring content. First you will need to go to TweetDeck.com where you will be asked to login to Twitter (unless you are already logged in). Once your account is synced, you will be presented with an empty dashboard, as seen in the image below. On the left menu you will see your first deck. By default it will be called “Personal” and the icon will be a star.

Above the list of decks you can see an icon that says “Add column”. This will be used to start populating our dashboard. For monitoring purposes there are only three types of column that you need to know about: “Lists”, “Search”, and “Profiles”. Everything else can be ignored.

Lists vs Searches vs Profiles

Whilst Lists and Profiles will focus on the users, the Search column will focus on the content of the tweet. This means that on Lists and Profiles you will only see content from the specific users you selected, whereas on the Search columns you will get results from any users as long as the content matches what you’re looking for.

Lists: Useful to monitor content shared by a list of users. Best for following accounts that focus on a very specific topic such as local news agencies, local journalists, government officials, NGOs, local community groups, organised activism, etc.

Searches: Useful to track down content related to a specific topic, regardless of which account shared it. They can be very broad if you are just monitoring certain topics within certain regions of the globe (e.g. “torture” in “Tehran”), or very targeted if you are investigating a specific incident (e.g. the killing of Mahsa Amini while in custody of the Iranian morality police in September 2022).

Profiles: Useful to keep track of what a specific user is sharing online. It can be combined with keywords or hashtags so that you only get results when the user mentions a specific topic. For example, monitoring the Iranian government Twitter account for when they use the word “women” in their communications.

How to create Twitter Lists and what to include

Now that we know the difference between Lists, Searches, and Profiles, let’s create our first list. You can do it on either TweetDeck or on your Twitter account. Since this is an entry about TweetDeck let’s learn how to do it on this platform. First we need to add a new column by selecting the “Add column” on the left menu (1). On our new window we will choose “Lists” (2), followed by a “Create a new List” (3), as seen below.

You will get a “Create a new List” window where you can select an image, the name of the list, a description, and privacy settings. You can choose whatever you want but the most important piece of information is to mark it as private. This will ensure that no one knows who you have added or removed from your lists. The account owners will never be informed of your actions and you remain absolutely anonymous. If you were to have your list set to public, the accounts you add would receive a notification. This would enable them to quickly block your account and you would lose access to their content. We don’t want that. Sneaky is good.

Once you have decided on a name, description, and marked it as private(!) you click “Next” to be taken to the following window. You can then use the search bar to find the Twitter accounts you want to monitor and click “Add” to add them to your list. If you want to remove an account you can perform the same steps but select “Remove” instead.
Always make sure you have the real accounts and not an impersonator or you will be getting misleading content.

As previously mentioned, lists are good to monitor content shared by official accounts. You can, for example, compare official statements versus evidence we have gathered of the events.
Take Iran for example. Imagine there is a protest and users online are claiming the government used violence to disperse the population. An official government account releases a statement denying any use of violence. We may then find photos or videos showing government bodies (police, military, etc), from that day, in the reported location of the protest, threatening and hitting civilians. We can then put all of these pieces of evidence together when writing an OSINT incident report. It is a bit like “I’m not saying you are lying, but we have proof that you are lying.”

How to create a Twitter search string and what to include

Unlike lists, the “search” option focuses on the content, not the user behind the tweet. Ultimately it will not matter if the piece of evidence is being shared by an account with thousands of followers, or by a brand new user with one tweet. If the keywords match our criteria, we will find it. And if we can find it we can archive, verify, and analyse the evidence.

When monitoring for content on Twitter I find it easier to stick to the “where AND what” rule. This means that whatever string of keywords we choose to combine must have the specific location (where), and what content we want to monitor (what).

Let’s start with a practical example on how to monitor for content related to protests in the Islamic Republic of Iran.
First we need to define the where and the what as such:

Where – Tehran, Mashhad, and Isfahan – the three most populated cities in Iran.
What – protest.

Our search term will end up being something like “Tehran AND protest”, “Mashhad AND protest”, and “Isfahan AND protest”.

Note: The “AND” is a boolean operator and must be capitalised.

But Iran doesn’t really have English as an official language does it? So let’s change all of this to Farsi, the country’s official language.

Tehran AND protest — becomes — اعتراض AND تهران
Mashhad AND protest — becomes — اعتراض AND مشهد
Isfahan AND protest — becomes — اعتراض AND اصفهان

We do not want to have a column per search or we will end up with far too many columns. So let’s put it all together on a longer string. For that we will introduce two new features: the parenthesis and the OR operator. The parenthesis will divide each section like a mathematical equation, and the OR will tell the search engine that you want to search for various options. A bit like giving someone a shopping list that says “white OR brown bread”. It means that you want to receive at least one of the options. You will be happy with either. Same applies here.
You can tell Twitter’s search engine something like: (Tehran AND protest) OR (Mashhad AND protest) OR (Isfahan AND protest). This string will search for any of these options and give you the results that contain at least one of the criteria.

Note: The “OR” is also a boolean operator and must be written in all caps.

You can even improve the string a bit more to make it use less characters, as seen below.

Our boolean search with the three Iranian cities and the word “protest” can go from this:
(Tehran AND protest) OR (Mashhad AND protest) OR (Isfahan AND protest)
(اعتراض AND تهران) OR (اعتراض AND مشهد) OR (اعتراض AND اصفهان)

To this:
(Tehran OR Mashhad OR Isfahan) AND protest
(مشهد OR مشهد OR تهران) AND اعتراض

Can you see how you will get the same results but the string is shorter and more concise? There is no need to repeat the word “protest” three times when we can just tell the search engine to circle through the cities one by one and see if it can find the name of the city plus the word “protest” on each tweet using a much smaller string.

But we do not want to just monitor three cities do we? We want the entire country!

Defining locations to monitor

To obtain information about Iran as a whole we can focus on provinces. The Islamic Republic of Iran contains 31 provinces so I gathered the list to create a string that can cover the entire country. But suddenly there is a small issue. Some of the provinces’ names contain more than one word such as South Khorasan or Sistan and Baluchestan. If we put (South Khorasan AND protest) on a Tweetdeck search it will give us results that match either South AND protest, Khorasan AND protest, or South Khorasan AND protest. It will not interpret South Khorasan as one string, but as two different keywords. We can solve that by adding the quotation marks to force it to recognise “South Khorasan” as one entity.

If we put all of the knowledge above together we can create our first search column targeting protests in any Iranian province.
This is what it would look like in English:

(Alborz OR Ardabil OR Bushehr OR “Chaharmahal and Bakhtiari” OR “East Azerbaijan” OR Isfahan OR Fars OR Gilan OR Golestan OR Hamadan OR Hormozgan OR Ilam OR Kerman OR Kermanshah OR Khuzestan OR “Kohgiluyeh and Boyer-Ahmad” OR Kurdistan OR Lorestan OR Markazi OR Mazandaran OR “North Khorasan” OR Qazvin OR Qom OR “Razavi Khorasan” OR Semnan OR “Sistan and Baluchestan” OR “South Khorasan” OR Tehran OR “West Azerbaijan” OR Yazd OR Zanjan) AND protest

You can see above how we have several province names in quotes to keep the keywords unchangeable, we have the parenthesis keeping them all together in one set, we have the OR operator so that the search engine can circle through the list, and we have the AND operator to force it to find the word “protest” within the tweet.
And this is what it would look like in Farsi:

(البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND اعتراض

We can then keep on adding terms to make it as inclusive as possible. We already have all the provinces but only one term to match with them: protest. Let’s think of other ways we could see it referred to. I often look for similar tweets to see what keywords they are using and add it to my search. In this case we can have a list of related keywords such as: protest (اعتراض), protests (اعتراضات ), demonstration (تظاهرات), uprising (قیام), march (راهپیمایی), and revolution (انقلاب).
Let’s add the new keywords into our search string. This is how it will end up looking like:

How to create a TweetDeck search column and what settings to use

Now that we have our string let’s create our first search column. There are various ways to do it. You can simply click the magnifier symbol on the left menu, or you can choose “Add column” and then select either “Search” from the list of options, or put your string directly onto the “Search Twitter” bar.

I have chosen to click the “Add column” and then “Search” from the list for this tutorial so we can see all available options.
At the top we will drop the search string we created to monitor for protests in all provinces of Iran, as seen below.

But there is a problem. I still can’t read Farsi and it would take me forever to translate all the tweets one by one. Fortunately I am not interested in any text, I want to see visual content. So let’s adjust our column settings to improve our results so we only see tweets that contain images and videos. For that we will click on “Media” and then turn on the “Only show Tweets with media” option. You can select what type of media you want to see but let’s leave it on “Images and videos”.

Suddenly our column is filled with videos and photos of protests from various provinces of Iran, updated in real time. Now we can start monitoring for any incidents related to protests.

Having just one column is not enough and as you start adding more you will soon realise you need to have some sort of organisation, starting with the column name. By default the columns will be named whatever you put on the search string. This is not very useful for people that do not speak the target language. Luckily for us the new TweetDeck version allows the user to change the column name to something easier to understand.
At the top right of our new column we can see the gear symbol highlighted in red below. Once we click on it we will be presented with more options. Almost at the bottom of the list we will see the “Rename column” option, also highlighted in red. If we turn it on we will be able to choose a name for the search column. You can see below on the right how I renamed it to “Protests in Provinces” (purple). This will be very useful once we end up with dozens of columns spread throughout various decks.

Populating TweetDeck

Once we know how to create a good search string, we can apply it to any other topics following the same formulae: where AND what.
So what else would we want to monitor in a country with a history of being authoritarian and oppressive towards the population? I would start with the protests and arrests, and throw in some torture and executions. As we know that the protests started with women, we also need to add a column for it. Finally, let’s just keep an eye on any negative mentions of the regime to monitor for population discontentment or possible future uprisings.
In practical terms we would end up with these topics and these keyword variations:

Protests — protest (اعتراض), protests (اعتراضات ), demonstration (تظاهرات), uprising (قیام), march (راهپیمایی), revolution (انقلاب)
Arrests — arrested (دستگیر), taken away (برده شده), prison (زندان), kidnapped (ربودند, ربوده)
Torture & Executions — torture (شکنجه), execution (اعدام), murdered (کشته), sentenced (محکوم), corpse/dead body (جسد)
Protesters/Women — woman (زن), women (زنان), girl (دختر), girls (دختران), protester (معترض), protesters (معترضان)
Regime — regime (رژیم), dictator (دیکتاتور), tyrant (ستمگر), repressive (سرکوبگر)

Now we need to combine our new keywords with the list of provinces.
This is the final result for each:

Protests: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (انقلاب OR راهپیمایی OR قیام OR تظاهرات OR اعتراضات OR اعتراض)
Arrests: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (دستگیر OR “برده شد” OR زندان OR ربوده OR ربودند)
Torture & Executions: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (محکوم OR کشته OR اعدام OR شکنجه OR جسد)
Protesters/Women: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (دختران OR دختر OR زنان OR زن OR معترض OR معترضان)
Regime: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (رژیم OR دیکتاتور OR ستمگر OR سرکوبگر)

We can populate our TweetDeck dashboard by simply copy pasting each of the strings above to separate columns, and selecting the “only show Tweets with media” option. The image below shows how my TweetDeck looked like once I was done. Within minutes we went from no data to a huge amount of content, all very targeted, organised in topics, and updated in real time.
The screenshot below shows how the first column, which was monitoring protests, contained a video of a group of masked people burning various government banners and billboards. The second column contained photos of various civilians, their names, ages, and how long they have been imprisoned by the regime for protesting. The third column showed the photo and grave of a 19 year old who was killed during a protest in the province of Kermanshah. Our fourth column contained a video of the moment of an explosion targeting an Islamic Revolutionary Guard Corps base in retaliation for the recent mass poisoning of school girls. Lastly, the fifth column contained a video allegedly filmed in Tehran in which people can be heard in the distance shouting “death to dictator”.

How to monitor specific users on TweetDeck

Sometimes it is useful to keep an eye on specific users, especially those with a lot of influence. There are various ways to monitor content from single accounts, depending on what is your goal.

We can create a column with just their username and track down all their content.
We can specify which keyword(s) we are looking for and only receive the results matching our criteria.
We can select to only see tweets that have a minimum level of engagement or either replies, retweets, or likes.

Let’s use the Iranian government Twitter account as an example (@PadDolat).

In order to add a new user column you have to follow the same steps you did before but this time select the “Profiles” option on the “Add column” list (1). Afterwards you need to type the name of the account you want to monitor (2). Once the new column is created you can click the magnifier icon to check out various options. You will be able to specify which keywords, hashtags, or search strings you want to monitor by adding them to the search bar, in front of the “from:username” (3).

If you want to monitor all content from a specific account you are all set with just adding the “from:username” on the column, however if you want to target your searches even more you can play a bit with the settings.

Below you can see two different options of targeted content from the PadDolat account.
On the left image below I have added a search string with various keywords that we previously used on one of our columns. It contains the terms “arrested” (دستگیر), “taken away” (برده شده), “prison” (زندان), and “kidnapped” (ربودند, ربوده). This means that this column will only show tweets published by the PadDolat account that contained at least one of our target keywords.
On the right image below you can see how we did not add any keywords but we want to see tweets that have a minimum level of engagement. For that we can specify the minimum amount of replies, retweets, and likes. This information will be automatically populated on the search bar as seen below. You can either edit it manually or just change the numbers on the appropriate areas under the “Level of engagement” section.

Conclusion

Twitter is a platform used by millions of people around the world to share evidence of crimes and/or publicly expose the inhumane activities of their government. The TweetDeck dashboard is a great tool to monitor content being shared on Twitter in real time. The possibilities are endless and it is up to you what topics you want to monitor and what keywords you want to track down. This tutorial explained how to create search strings to target a number of issues in specific areas of the globe, how to monitor lists or individual users, and how to change your settings to better target the content you are looking for.
I hope you found this tutorial informative. This is just the tip of the iceberg but it is a great way to start creating your own monitoring stations. We do not need to wait for the media to give us the news, we can get them ourselves directly from the source.
Stay safe out there.
Thank you for reading.

~Sofia.