Information Operations Exploit APIs to Manipulate Social Media

• APIs enable programmatic platform access, and authorized apps can act on users’ behalf; their role in manipulation remains underexamined despite known risks of app misuse.The paper notes prior research on automation apps, spoofed apps, and API-managed inauthentic accounts.Source: §1 · p. 1
• The research asks what forms of manipulation appear in third-party app usage and whether app usage improves coordination detection.Source: §1 · p. 1
• Three complementary computational case studies identify potentially coordinated app or account groups, followed by qualitative analysis of behavioral patterns.For detection, the study adds app usage as a coordination indicator to an unsupervised method.Source: §1 · p. 1
• The study identifies shared API-as-a-service infrastructure, unauthorized engagement by gaming apps, spoofed app names, and centrally controlled amplification through apps sharing accounts.The same pool of accounts can post through multiple apps to boost content at scale.Source: §1 · p. 2
• App usage patterns also reveal coordination through synchronized social media tools, custom fake-news infrastructure, and RSS-based propaganda automation.Source: §1 · p. 2
• Adding app usage as a coordination indicator modestly but consistently improves detection, while Twitter/X’s removal of critical app metadata makes this analysis impossible.Source: §1 · p. 2

2 Data

• Two datasets serve distinct aims: characterizing third-party app usage across campaigns and evaluating coordination detection with labeled information-operation and control accounts.Source: §2 · p. 2

2.1 App usage dataset (RQ1)

• Across 43 information operations (IOs) taken down between 2018 and 2021, the study identifies 3,877 distinct apps and retains activity from 496 apps after filters targeting campaign-specific tools.The filters remove accounts with fewer than 10 total tweets, require each app to have at least 100 total tweets and 5 distinct users, and cap app users at 500. The thresholds are heuristic; sensitivity is assessed by varying one parameter at a time and measuring overlap with the reference configuration.Source: §2.1 · p. 2

2.2 Labeled dataset (RQ2)

• The detection dataset comprises 26 labeled datasets of information-operation and control accounts, filtered using coordination indicators including shared hashtags, URLs, retweeted users, and co-retweets.Accounts with fewer than 10 tweets were discarded, and retained tweets included indicators used by at least two users 10 or more times in total.Source: §2.2 · pp. 2–3

3.1 Information operations

• Prior studies describe information operations spreading disinformation, infiltrating political communities, simulating grassroots support, and amplifying content through bots or coordinated engagement.Other documented tactics include reply attacks, political imagery, and fake or spoofed legitimate applications [25].Source: §3.1 · p. 3

3.2 Privacy and security risks

• Research on third-party app risks includes unauthorized data sharing, collection affecting users’ friends without consent, and data misuse for targeted political advertising.Source: §3.2 · p. 3
• Studies of app privacy report misconfigured access controls, flawed consent dialogs, and proposed frameworks for more informed permission decisions.Source: §3.2 · p. 3

4.1 Case 1: App network based on name similarity

• Name-similarity filtering yielded 203 apps in 41 groups; clusters included likely rented API services, gaming-app abuse, and spoofed app names.The reference configuration captured most of the same suspicious clusters across varied filter settings; the API-service interpretation remains unconfirmed because the apps are inaccessible.Source: §4.1 · pp. 3–4
• Name-similar apps also exposed religious camouflage and campaigns pairing follower growth with domestic political or cultural content.The follower-growth clusters had very low retweet ratios, consistent with original-content production rather than amplification.Source: §4.1 · p. 5

4.2 Case 2: App network based on account overlap

• The account-overlap network retained edges above 0.86, producing 106 apps across 20 components, with core clusters stable across parameter settings.The authors define overlap using shared users relative to the smaller app user set, with a denominator constant that prevents single-user apps from dominating.Source: §4.2 · p. 5
• Account-overlap groups commonly amplified content; one five-app cluster showed hourly retweet activity peaking together at zero lag (r≈0.75).The component’s apps operated through 12 accounts, with an average overlap of nine accounts; the pattern suggests one entity controlled multiple amplifying accounts.Source: §4.2 · pp. 5–6, Figure 2 · p. 6
• Account-overlap clusters included religious posting, attacks on opposition parties, and one group for which researchers identified no prominent manipulation tactic.The Turkish and Russian sub-clusters were connected only through shared users of Hootsuite.Source: §4.2 · pp. 5–6

4.3 Case 3: Account network based on app usage

• The app-usage case builds a bipartite account–app graph, projects TF-IDF-weighted usage into account similarity, then filters edges at the 99.9th percentile.The resulting network contained 1,747 nodes, 55,039 edges, and 91 components; the selected threshold retained accounts with identical app-usage patterns.Source: §4.3 · pp. 6–7
• App-usage clusters linked synchronized management tools, bot platforms, and custom or RSS posting infrastructure to varied campaign activity.Findings included propaganda and fake-news dissemination, cross-campaign tool use, and clusters mixing original content production with amplification.Source: §4.3 · p. 7

5.1 Indicators

• The comparison uses an unsupervised network method, contrasting five established indicators with a setup that adds app usage.The five indicators are shared hashtags, shared URLs, retweeted users, retweeted posts, and posting synchronicity; synchronicity is binned into 30-minute intervals.Source: §5.1 · p. 7, §5 · p. 7

5.2 Maximum indicator support

• Maximum indicator support counts significant indicators shared on account pairs, then assigns each account its highest-supported relationship.Permutation-based p-values calibrate edges across indicator networks, with Benjamini–Hochberg correction at p<0.05.Source: §5.2 · p. 8
• Permutation calibration matters for app usage because popular apps can create high incidental similarity; the method filters edges rather than treating every nonzero link equally.The node-pruning method’s union of all nonzero links produces dense networks in this dataset.Source: §5.2 · p. 8

5.3 Results

• Median AUC-ROC rises from 0.56 to 0.64 with the app indicator, significantly and consistently across campaigns except Cuba.The difference is significant by Wilcoxon signed-rank test (p<0.0001).Source: Figure 3 · p. 8, §5.3 · pp. 8–9
• IO accounts have significantly higher maximum indicator support than controls in 16 of 26 campaigns when all indicators are considered.The authors suggest IO accounts tend to leave traces across more behavioral dimensions.Source: §5.3 · p. 8

6 Discussion

• Apps can lower the human costs of managing accounts, distribute activity across apps to circumvent rate limits, and reduce detection risk.App tokens may remain active after account suspension, allowing activity to persist or reemerge through alternate accounts.Source: §6 · p. 9
• The case studies connect app patterns to reused API services, unauthorized gaming-app engagement, spoofed names, centrally controlled amplification, and coordinated app-use tactics.The authors report that app usage as an indicator consistently improves detection, though moderately.Source: §6 · p. 9
• Coordination traces embedded in campaign technology can support scalable detection and attribution because the same apps recur across distinct campaigns.The authors argue app-level metadata transparency can improve governance, enforcement, and developer accountability.Source: §6 · p. 9
• The analysis covers historical Twitter datasets and pre-2023 app metadata; evolving tactics and newer applications may not be captured.Fixed thresholds may yield slightly different outcomes, and Case 3 omits content similarity because its data spans long periods and diverse topics.Source: §6 · p. 9

A Appendix

• Table 6 reports network statistics across the case studies.Source: Table 6 · p. 10

A.1 Case study 1

• Beyond the 95th-percentile similarity threshold, the app-name network decomposes into distinct clusters as the threshold rises.Figure 4 tracks connected-component count and largest-component size against the similarity percentile threshold.Source: Figure 4 · p. 10
• Detected app clusters are stable across changes to tweets-per-app, tweets-per-user, and maximum users-per-app, but more sensitive to minimum users-per-app.Jaccard similarity is at least 0.89 for the stable parameters and 0.68–0.77 for minimum users-per-app.Source: Table 7 · p. 10

A.2 Case study 2

• Beyond the 96th-percentile similarity threshold, the app network decomposes into distinct clusters.The figure plots connected components and largest-component size against the similarity threshold; app similarity is based on account overlap.Source: Figure 5 · p. 11
• 0.79–0.91 Jaccard similarity across tpa settings indicates moderate stability of the top-1% app pairs; upamin and upamax are more sensitive.Their Jaccard ranges are 0.66–0.91 and 0.70–0.76, respectively.Source: Table 8 · p. 11

A.3 Case study 3

• Beyond the 99th-percentile similarity threshold, the user network decomposes into distinct clusters.The figure plots connected components and largest-component size against the similarity threshold; user similarity is based on app usage.Source: Figure 6 · p. 11
• Jaccard similarity is at least 0.91 across tpa, tpu, and upamin settings, while upamax yields 0.63–0.75 for the top-0.1% users.The table identifies upamax as the most sensitive parameter and says highly popular apps most strongly influence which users appear in the top 0.1%.Source: Table 9 · p. 11

A.5 Node-pruning method results

• Figure 7 presents results based on the node-pruning method by Luceri et al. [18].The supplied figure caption does not state result values or comparisons.Source: Figure 7 · p. 12

A.5 App usage as coordination indicator

• Figure 9 compares per-campaign AUC-ROC without versus with the app indicator; a rightward slope denotes improved detection.Each line joins the two AUC-ROC values for one campaign, using maximum indicator support across 26 campaigns.Source: Figure 9 · p. 12
• For 26 campaigns, normalized Mann-Whitney U above 0.5 means IO accounts tend to score higher; black dots mark corrected significance at p<0.05.The test is one-sided, with the alternative that IO accounts' maximum indicator support scores exceed controls'.Source: §A.5 · p. 12, Figure 8 · p. 12