REPORTING ON MANIPULATION OF INTERNET PUBLIC OPINION BY SOUTH KOREAS SPY AGENCY BEFORE 2012 PRESIDENTIAL ELECTION KCIJ-NEWSTAPA.ORG

OUTLINE Alleged online smear campaign by the National Intelligence Service (NIS) to influence the 2012 presidential election

OUTLINE Some 600 Twitter accounts used by spy agents detected A network of 10 groups confirmed Major Twitter account holders confirmed as spy agents

OUTLINE KCIJ reporting used as strong evidence by prosecutors, prompting indictment of former NIS chief

Online smear campaign conducted on online forum website Today Humor by an NIS official surnamed Kim uncovered

NIS explanation : normal anti-North Korean psychological campaign

REASONABLE DOUBTS It couldnt be done alone if it really were a normal operation It must have been conducted on other websites as well

Googled some 100 postings on the website Today Humor Found online postings with similar contents on Twitter, written during the same period

Traced Twitter accounts that retweeted the online postings. A total of 65 Twitter accounts uncovered Criticizing North Korea, promoting government policies, denouncing opposition parties, etc Twitter postings coincide with online postings on Today Humor

Online posting activities stopped simultaneously on Dec 11, 2012, the day when an NIS official was caught Confirmed core Twitter accounts that mainly produced contents without retweeting : nudlenudle, taesan4 First reporting on Mar 15, 2013 Twitter account holders which remained active before the first reporting deleted postings or withdrew

Revelation by an opposition lawmaker about orders made by former NIS chief to meddle in politics (Mar 18, 2013) Confirmed online postings made by suspected Twitter accounts in line with the orders Confirmed 600 suspicious Twitter accounts

Retrieved postings made by deleted Twitter accounts Collected Tweets from weblog with the use of crawler Succeeded in collecting 280,000 postings from some 450 Twitter accounts Obtained information about content producers, retweeters as well as postings and dates.

NETWORK ANALYSIS Analyzed relations among retweets Completed making a network map with Twitter accounts with more than 10 retweets Calculated with the help of MODULARITY on SNA analysis program

CONFIRMED 10 MAJOR GROUPS Composed of at least 10 core Twitter accounts (producers), remaining supporting accounts (messengers), and Twitter bots

KEYWORD ANALYSIS Sorting Tweets according to Morphological Analysis 15% of Twitter postings confirmed to be related to presidential election

DISTRIBUTION MAP OF PRESIDENTIAL ELECTION-RELATED TWEETS

Remaining problem : Lack of compelling evidence that confirms Twitter account holders as NIS officials Difficulty : Need to obtain information about the identities of Twitter accounts holders from Twitter headquarters in the U.S.

EMBARKED ON THE PROCESS OF IDENTIFYING THE TWITTER ACCOUNT HOLDERS Use of e-mail address when registering a Twitter account Possibility of using e-mail accounts from local portal sites Entered some 660 IDs into the account registration section of major portal sites Found same 160 IDs

SEARCHED E-MAIL ADDRESS THAT HAVE THE SAME IDS THROUGH PEOPLE SEARCH WEBSITES Confirmed real names of account holders with unique IDs Major account nudlenudle included Confirmed the identity of a 43-year-old man surnamed Lee His bio introduced him as a Korean Air captain, but Korean Air confirmed it as a lie

Confirmed through multiple sources that Lee is a member of a warfare psychological team of the NIS Reported that the major Twitter account belongs to the NIS official, Lee, on May 17, 2013

INFLUENCE AND CONSEQUENCES OF THE REPORTING The main opposition Democratic Party reported Lee to the prosecutors office on charges of violating NIS and election laws

INFLUENCE AND CONSEQUENCES OF THE REPORTING Prosecutors started a probe into social network sites - Searched big data companies - Requested the U.S. for judicial cooperation

INFLUENCE AND CONSEQUENCES OF THE REPORTING Prosecutors indicted former NIS chief Won Se-hoon for violating election laws on June 17, 2013 - Secured some 320 Tweets suspected of meddling in the presidential election - Tracing the identities related to some 400 accounts accused of having been used by NIS officials (70 percent of such accounts coincide with the Twitter accounts revealed by our reporting) - Confirmed the creation of a separate team in Feb 2012 to strengthen the SNS activities of the warfare psychological team of the NIS

THE SIGNIFICANCE Revealed the secret, organized online smear campaigns by the NIS to meddle in the presidential election First reporting based on SNS data collection and analysis