[Paper Review] Behind the Mask: A Computational Study of Anonymous' Presence on Twitter

Keenan Jones, Jason R. C. Nurse+1 more|arXiv (Cornell University)|Jun 15, 2020

Misinformation and Its Impacts6 citations

TL;DR

This computational study analyzes over 20,000 Twitter accounts self-identifying as Anonymous from 2008–2019 using machine learning, social network analysis (SNA), and topic modeling. It reveals a non-leaderless structure with a small core of highly influential accounts, declining network activity post-2013, and consistent thematic content across key influencers, challenging Anonymous’ claimed decentralization and supporting qualitative findings with large-scale empirical evidence.

ABSTRACT

The hacktivist group Anonymous is unusual in its public-facing nature. Unlike other cybercriminal groups, which rely on secrecy and privacy for protection, Anonymous is prevalent on the social media site, Twitter. In this paper we re-examine some key findings reported in previous small-scale qualitative studies of the group using a large-scale computational analysis of Anonymous' presence on Twitter. We specifically refer to reports which reject the group's claims of leaderlessness, and indicate a fracturing of the group after the arrests of prominent members in 2011-2013. In our research, we present the first attempts to use machine learning to identify and analyse the presence of a network of over 20,000 Anonymous accounts spanning from 2008-2019 on the Twitter platform. In turn, this research utilises social network analysis (SNA) and centrality measures to examine the distribution of influence within this large network, identifying the presence of a small number of highly influential accounts. Moreover, we present the first study of tweets from some of the identified key influencer accounts and, through the use of topic modelling, demonstrate a similarity in overarching subjects of discussion between these prominent accounts. These findings provide robust, quantitative evidence to support the claims of smaller-scale, qualitative studies of the Anonymous collective.

Motivation & Objective

• To investigate the structural and behavioral characteristics of Anonymous on Twitter using large-scale computational methods.
• To test the validity of qualitative claims that Anonymous is not truly leaderless and has fragmented after key arrests (2011–2013).
• To identify and analyze a network of self-identified Anonymous Twitter accounts using machine learning and social network analysis.
• To examine the evolution of content and influence across time, particularly in relation to major historical events like the arrests of prominent members.
• To compare the thematic content of key influencer accounts using topic modeling to assess ideological consistency across the network.

Proposed method

• Employed a two-stage snowball sampling method to identify and expand a network of self-identified Anonymous Twitter accounts.
• Applied machine learning classifiers to detect accounts affiliated with Anonymous based on profile content, usernames, and tweet patterns.
• Conducted social network analysis (SNA) on the identified network to map relationships and measure influence using centrality metrics (e.g., degree, betweenness, eigenvector centrality).
• Used topic modeling (LDA) to analyze and compare the thematic content of tweets from six key influencer accounts.
• Tracked temporal changes in network size, account inactivity, and new account creation from 2008 to 2019 to assess network evolution.
• Validated findings against qualitative studies and public reports to contextualize computational results within existing sociological understandings of Anonymous.

Experimental results

Research questions

• RQ1 Does the Anonymous network on Twitter exhibit a non-leaderless structure, as suggested by qualitative studies, despite the group’s claims of decentralization?
• RQ2 How has the influence distribution within the Anonymous Twitter network changed over time, particularly following the 2011–2013 arrests of key members?
• RQ3 To what extent do key influencer accounts on the Anonymous network share similar thematic content in their tweets?
• RQ4 What is the relationship between network activity (e.g., new account creation, inactivity) and the historical timeline of Anonymous’s high-profile operations and arrests?
• RQ5 How do the computational findings compare to qualitative accounts of Anonymous’s structure and cohesion?

Key findings

• The study identified a network of over 20,000 self-identified Anonymous Twitter accounts active between 2008 and 2019, demonstrating the scale of the group’s online presence.
• A small number of highly central accounts—measured by degree, betweenness, and eigenvector centrality—dominate the network, indicating a non-flat, hierarchical influence structure.
• The number of new Anonymous accounts created annually declined significantly after 2013, coinciding with the arrests of prominent members, suggesting network fragmentation.
• A notable proportion of accounts (over 30%) showed signs of inactivity, indicating a decline in sustained engagement post-2013.
• Topic modeling revealed strong thematic similarity across the six key influencer accounts, with dominant topics centered on political activism, information sharing, and critique of institutions.
• The lack of prominent mentions of 'Ops' (operations) in the tweets of key influencers suggests a decline in active campaign participation, supporting claims of reduced cohesion and activity.