How to monitor oppressive regimes on Twitter using TweetDeck

Introduction

Open source data is all around us and there are endless ways to take advantage of it. Whilst there are many people working in OSINT who track down individuals, organisations, and/or locations, I do a wider version of that. My job involves monitoring, analysing and investigating conflict between countries, organised groups and/or civilians. For that I use a few techniques to gather evidence of war crimes, human rights violations, and the general “this country is being a bit naughty towards their population” data. I am sharing some of my techniques because the world needs more of us making sure oppressive regimes do not get away with it. So let’s learn how to monitor and collect evidence on Twitter using Tweetdeck.

As there is a wealth of knowledge to be learned on this topic I wanted to keep it simple so that you can learn the basis and then expand that knowledge however you want (please don’t do anything illegal). Therefore this blog entry will only focus on how to monitor a specific country and on a small number of topics. For that we will be using a free Twitter web-based dashboard, Tweedeck.
I have chosen to pick the Islamic Republic of Iran for this blog entry because it fits various criteria that will be useful for us: it is an oppressive regime, there is an ongoing conflict between the population and the regime, and it has a language I cannot read (I like a bit of a challenge).

A quick note before we start. When investigating and collecting data on oppressive regimes you can expect to find content that may be distressing. I will not share any graphic content in this blog but if you put into practice what I will explain below, there is some chance you will see graphic content. Make sure you are comfortable with it before jumping from the theory to the practice.


Twitter and TweetDeck as a monitoring tool

Twitter is a huge social media platform where millions of users share content daily. Although many see it as a place to connect with others and share opinions, memes, or news, it is also a valuable tool for millions living under oppressive regimes. Twitter gives victims all over the world a platform to share evidence of the crimes committed against them. This can often be done in real time, and within the safety of anonymity. Eye witnesses can share footage, photos, and/or audio files in the hopes of it breaking out from the control of their oppressive regime.

TweetDeck, a platform owned by Twitter, can be used as a dashboard to track down, in real time, any content, claim, and evidence shared by people anywhere in the world. This data is then collected, verified, and analysed by people like me, open source investigators trying to bring accountability to authoritarian regimes, and justice for its victims.
Below you can see a (censored, sorry) sample of my working TweetDeck. I have between 17 to 32 columns at all times tracking down, in real time, everything that is happening within a certain country. The chances of seeing a dead body at any given day is 99%.


Setting up your TweetDeck

Let’s start from the beginning. If you go to TweetDeck.com, you will first need to login with your Twitter account so they both connect. Afterwards this is what you will see; a dashboard with a column for “Home”, one for “Notifications”, a column for “Messages” and the last with the “Trending” hashtags. As I am using a sock puppet account everything is blank.

Let’s just start by removing all of the columns. I want a blank slate as none of it is of any use for us now.
First we select the icon at the top right, highlighted in orange. This will bring up some options and at the bottom of the new window we have a “Remove” option, highlighted in dark blue. If we do it for all of the columns we will end up with a completely blank dashboard.

Then it is time to start rebuilding it all over again. You can click the “+” button (highlighted in green below) on the left bar and select what type of column you want to add. There are only two types that are of any use to us: lists and searches.


Lists vs Searches

The difference between lists and searches is that on lists you are tracking down users and on searches you are tracking down content. You may have noticed on my working TweekDeck screenshot above that I have only one (visible) column with a list, highlighted in pink below, and a huge number of “search” columns, highlighted in yellow. This is because targeting content is much more useful when the goal is to gather evidence. However I am also very interested in what certain accounts have to say about certain topics so lists come in handy as well.

Often in oppressive regimes people send their photos/footage/audio to trustworthy journalists or news agencies so that they share the evidence with their wider audience. The population benefits from the source protection, one of the main pillars of journalism ethics, and the news agencies benefit from the access to this exclusive content. For that reason one of my lists is composed of various journalists and news agencies that I know will share content that is often against their regime. In case you are wondering why they are allowed to spread content against their authoritarian nation, they are not. Many are imprisoned, tortured, and killed. Their courage in the face of their situation is commendable. It is because of many like them that we get to see the reality of how many countries treat their population.


How to create a Twitter list and what to include

In order to create the list you just need to follow the obvious steps. Click “+” and “add column”. Afterwards select the “List” option and “+ Create List”. Now comes the most important piece of information when creating lists. Mark it as private. This will ensure that no one knows who you have added or removed from your lists. These accounts will never be informed of your actions and you remain absolutely anonymous. If you were to have your list set to public, the accounts you add would receive a notification. This would enable them to quickly block your account and you would lose access to their content. We don’t want that. Sneaky is good.

In addition to having a list with journalists and news agency accounts, I also find it very useful to have lists with “official government accounts”. Often when something big happens these will release “official statements” so having a column that gathers them all is very handy. They are useful in a situation where there is a claim against the government’s action (or inaction).
Take Iran for example. Imagine there’s a protest and users online are claiming the government used violence to disperse the population. An official government account releases a statement denying any use of violence. One of our “search” columns then provides us with photos from a variety of angles with government bodies (police, military, etc), threatening and hitting civilians. We can then put all of these pieces of evidence together when writing an OSINT incident report. It is a bit like “I’m not saying you are lying, but we have proof that you are lying..”


How to create a Twitter search string and what to include

Unlike lists, the “search” option focuses on the content, not the user behind the tweet. Ultimately it will not matter if the piece of evidence is being shared by an account with thousands of followers, or by a brand new user with one tweet. If the keywords match our criteria, we will find it. And if we can find it we can archive, verify, and analyse the evidence.

As mentioned in the introduction, I monitor and investigate naughty nations. I mostly gather and analyse evidence on a variety of topics from protests, assassinations, torture, executions, terrorist attacks, etc. It is quite a wide range of dark subjects but let’s start with a “lighter” topic for now and ease into the darker ones in a bit. Let’s go with protests.

When searching for information on Twitter I find it easier to stick to the “where AND what” rule. So whatever string of keywords I choose to combine must have the specific location, and what I want to find in that location.

Practical example

  • Where – Let’s pick the three most populated cities in Iran: Tehran, Mashhad, and Isfahan.
  • What – Now we add what we want to monitor there: protests.
  • Our search term will end up being something like “Tehran AND protest”, “Mashhad AND protest”, and “Isfahan AND protest”.

Note: The “AND” is a boolean operator and must be written in all caps.

But Iran doesn’t really have English as an official language does it? So let’s change all of this to Farsi, the country’s official language.

  • Tehran AND protest — becomes — اعتراضات AND تهران
  • Mashhad AND protest — becomes — اعتراضات AND مشهد
  • Isfaham AND protest — becomes — اعتراضات AND اصفهان


We do not want to have a column per search or we will end up with far too many columns. So let’s put it all together on a longer string. For that we will introduce two new features: the parenthesis and the OR operator. The parenthesis will divide each section like a mathematical equation, and the OR will tell the search engine that you want to search for various options. A bit like giving someone a shopping list that says “white OR brown bread”. It means that you want to receive at least one of the options. You will be happy with either. Same applies here.
You can tell Twitter’s search engine something like: (Tehran AND protest) OR (Mashhad AND protest) OR (Isfaham AND protest). This string will search for any of these options and give you the results that contain at least one of the criteria.

Note: The “OR” is also a boolean operator and must be written in all caps.

You can even improve the string a bit more to make it use less characters, as seen below.

Our boolean search with the three Iranian cities and the word “protest” can go from this:
(Tehran AND protest) OR (Mashhad AND protest) OR (Isfaham AND protest)
(اعتراضات AND تهران) OR (اعتراضات AND مشهد) OR (اعتراضات AND اصفهان)

Into this:
(Tehran OR Mashhad OR Isfaham) AND protest
(مشهد OR مشهد OR تهران) AND اصفهان

Can you see how you will get the same results but the string is shorter and more concise? There is no need to repeat the word “protest” three times when we can just tell the search engine to circle through the cities one by one and see if it can find the name of the city plus the word “protest” on each tweet using a much smaller string.

But we do not want to just monitor three cities do we? We want the entire country!


Defining locations to monitor

To obtain information about Iran as a whole we can focus on provinces. Iran contains 31 provinces so I gathered the list from Wikipedia to create a string that can cover the entire country. But suddenly there is a small issue. Some of the provinces’ names contain more than one word such as South Khorasan or Sistan and Baluchestan. If we put (South Khorasan AND protest) on Tweetdeck search it will give us results that match either South AND protest, Khorasan AND protest, or South Khorasan AND protest. It will not interpret South Khorasan as one string, but as two different keywords. We can solve that by adding the quotation marks to force the search engine to recognise “South Khorasan” as one entity.

If we put all of the knowledge above together we can create our first search column targeting protests in any Iranian province.
This is what it would look like in English:

(Alborz OR Ardabil OR Bushehr OR “Chaharmahal and Bakhtiari” OR “East Azerbaijan” OR Isfahan OR Fars OR Gilan OR Golestan OR Hamadan OR Hormozgan OR Ilam OR Kerman OR Kermanshah OR Khuzestan OR “Kohgiluyeh and Boyer-Ahmad” OR Kurdistan OR Lorestan OR Markazi OR Mazandaran OR “North Khorasan” OR Qazvin OR Qom OR “Razavi Khorasan” OR Semnan OR “Sistan and Baluchestan” OR “South Khorasan” OR Tehran OR “West Azerbaijan” OR Yazd OR Zanjan) AND protest

You can see above how we have several province names in quotes to keep the keywords unchangeable, we have the parenthesis keeping them all together in one set, we have the OR operator so that the search engine can circle through the list and see if any matches, and we have the AND operator to force the results to find the word “protest” within the tweet.
And this is what it would look like in Farsi:

(البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND اعتراض

We can then keep on adding terms to make it as inclusive as possible. We already have all the provinces but our only one term to match with them: protest. Let’s think of other ways we could see it referred to. I often just look at similar tweets to see what keywords they are using and add it to my search. In this case we can have a list of related keywords such as: protest (اعتراض), protests (اعتراضات ), demonstration (تظاهرات), uprising (قیام), march (راهپیمایی), and revolution (انقلاب).
Let’s add the new keywords into our search string. This is how it will end up looking like:

(البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (انقلاب OR راهپیمایی OR قیام OR تظاهرات OR اعتراضات OR اعتراض)


How to create a TweetDeck search column and what settings to use

So let’s (finally!) test it on TweetDeck by starting a new “search” column and what we wrote above. You simply click the magnifier symbol on the left and copy paste the string to the search bar. This is what we’ll get:


But there is a problem. I still can’t read Farsi and it would take me forever to translate all the tweets one by one. Fortunately I am not interested in any text, I want to see visual content. So let’s adjust this a bit by clicking the symbol highlighted as yellow below followed by the down arrow symbol, highlighted in red. Afterwards you’ll see the options in the middle picture below. By default the search column will show “all Tweets”. We can change this option to show “Tweets with any media”. This will ensure that all the results will have photos or videos.
Suddenly our column (right image) is showing a video of a protest! The result below was from a protest today, December 17, 2022 (time of writing), in Tehran. Allegedly the protesters are shouting “Death to the dictator”. If you keep scrolling you will keep finding more and more videos and photos of protests from any of the 31 provinces in Iran. It’s a gold mine.


Populating TweetDeck

Once we know how to create a good search string, we can apply it to any other topics following the same formulae: where AND what.
So what else would we want to monitor in a country with a history of being authoritarian and oppressive towards the population? I would start with the protests and arrests. Definitely throw in some torture and executions to monitor claims and collect evidence of human rights violations. As we know that the protests started with women we will also need to add a column on it. And then to end let’s just keep an eye on any mention of the regime from a negative point of view.
In practical terms we would end up with these topics and these keyword variations:

  • Protests — protest (اعتراض), protests (اعتراضات ), demonstration (تظاهرات), uprising (قیام), march (راهپیمایی), revolution (انقلاب)
  • Arrests — arrested (دستگیر), taken away (برده شده), prison (زندان), kidnapped (ربودند, ربوده)
  • Torture & Executions — torture (شکنجه), execution (اعدام), murdered (کشته), sentenced (محکوم), corpse/dead body (جسد)
  • Protesters/Women — woman (زن), women (زنان), girl (دختر), girls (دختران), protester (معترض), protesters (معترضان)
  • Regime — regime (رژیم), dictator (دیکتاتور), tyrant (ستمگر), repressive (سرکوبگر)

Now we need to combine our new keywords with the list of provinces.
This is the final result for each:

  • Protests: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (انقلاب OR راهپیمایی OR قیام OR تظاهرات OR اعتراضات OR اعتراض)
  • Arrests: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (دستگیر OR “برده شد” OR زندان OR ربوده OR ربودند)
  • Torture & Executions: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (محکوم OR کشته OR اعدام OR شکنجه OR جسد)
  • Protesters/Women: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (دختران OR دختر OR زنان OR زن OR معترض OR معترضان)
  • Regime: (البرز OR اردبیل OR بوشهر OR “چهارمحال و بختیاری” OR “آذربایجان شرقی” OR اصفهان OR فارس OR گیلان OR گلستان OR همدان OR هرمزگان OR ایلام OR کرمان OR کرمانشاه OR خوزستان OR “کهگیلویه و بویراحمد” OR کردستان OR استان OR مرکزی OR مازندران OR “خراسان شمالی” OR قزوین OR قم OR “خراسان رضوی” OR سمنان OR “سیستان و بلوچستان” OR “خراسان جنوبی” OR تهران OR “آذربایجان غربی” OR یزد OR زنجان) AND (رژیم OR دیکتاتور OR ستمگر OR سرکوبگر)

Let’s now populate our TweetDeck dashboard by creating one column per topic by simply copy pasting each of the strings above and select to show “Tweets with any media”. I also decided to create a final column with just the names of all the provinces just in case something pops up that I have not covered yet. This is how my TweetDeck looks once I am done. You can see various videos of protests, three in Tehran and one in the Kermanshah province. There’s also coverage of a prison riot in Kara, Alborz province, and a wreath with a photo of a young man allegedly kidnapped, tortured and killed by the government in Bandar Azali, in the Gilan province.


Conclusion

And this is how you start monitoring an oppressive regime for possible human rights violations. Twitter is an amazing platform used by many to publicly expose the inhumane activities of their government. The TweetDeck dashboard is, in my opinion, the best way to keep an eye on what millions of courageous people are sharing with the rest of the world. We just need to pay attention.
The possibilities are endless and it is up to you what topics you want to monitor and what keywords you want to track down.
As mentioned above, my working TweetDeck has a base of 17 columns but often that number goes much higher depending on what I am investigating. On average I would say I have around 22-25 columns in which I monitor what is happening in certain regions of the globe.
I hope this tutorial was informative. This is just the tip of the iceberg but it is a great way to start creating your own monitoring stations. We do not need to wait for the media to give us the news, we can get them ourselves directly from the source.
Stay safe out there.
Thank you for reading.

~Sofia.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Website Powered by WordPress.com.

Up ↑

%d bloggers like this: