Global Investigative Journalism Conference 2013 (GIJC13) GLOBAL: Great Investigations You Should Know About Tuesday, October 15 9:00am ----------------------------------------------------------------------------------- KCIJ(Korea Center for Investigative Journalism) exposed the National Intelligence Service(NIS), South Korea's spy agency illegally did political campaigning and manipulated public opinion during presidential election in 2012. KCIJ found out that the spy agency had formed secretive cyber psychological warfare unit, created at least 660 Twitter accounts. KCIJ identified those accounts posted or re-tweeted 280,000 tweets usually criticising the opposition candidates for helping the ruling party candidate.

1. REPORTING ON
MANIPULATION OF INTERNET PUBLIC OPINION
BY SOUTH KOREA’S SPY AGENCY
BEFORE 2012 PRESIDENTIAL ELECTION
KCIJ-NEWSTAPA.ORG

2. OUTLINE
Alleged online smear campaign
by the National Intelligence Service (NIS)
to influence the 2012 presidential election

3. OUTLINE
Some 600 Twitter accounts
used by spy agents detected
A network of 10 groups confirmed
Major Twitter account holders
confirmed as spy agents

4. OUTLINE
KCIJ reporting used as strong evidence by prosecutors,
prompting indictment of former NIS chief

5. Online smear campaign conducted
on online forum website “Today Humor”
by an NIS official surnamed Kim uncovered

6. NIS explanation :
normal anti-North Korean
psychological campaign

7. REASONABLE DOUBTS
 It couldn‟t be done alone if it really were a normal operation
 It must have been conducted on other websites as well

8.  Googled some 100 postings on the website “Today Humor”
 Found online postings with similar contents on Twitter,
written during the same period

9. Traced Twitter accounts that retweeted the online postings.
A total of 65 Twitter accounts uncovered


Criticizing North Korea, promoting government policies, denouncing opposition parties, etc
Twitter postings coincide with online postings on “Today Humor”

10. 



Online posting activities stopped simultaneously
on Dec 11, 2012, the day when an NIS official was caught
Confirmed core Twitter accounts
that mainly produced contents without retweeting : nudlenudle, taesan4
First reporting on Mar 15, 2013
Twitter account holders which remained active
before the first reporting deleted postings or withdrew

11. Revelation by an opposition lawmaker about orders
made by former NIS chief to meddle in politics
(Mar 18, 2013)
Confirmed online postings
made by suspected Twitter accounts
in line with the orders
Confirmed 600 suspicious Twitter accounts

12. Retrieved postings made by deleted Twitter accounts
Collected Tweets from weblog with the use of crawler
Succeeded in collecting 280,000 postings
from some 450 Twitter accounts
Obtained information about content producers,
retweeters as well as postings and dates.

13. NETWORK ANALYSIS



Analyzed relations among retweets
Completed making a network map with Twitter accounts with more than 10 retweets
Calculated with the help of “MODULARITY” on SNA analysis program

14. CONFIRMED
10
MAJOR
GROUPS
Composed of at least 10 core Twitter accounts (producers),
remaining supporting accounts (messengers), and Twitter bots

15. KEYWORD
ANALYSIS
Sorting Tweets according to
„Morphological Analysis‟
15%
of Twitter postings confirmed to
be related to presidential election

16. DISTRIBUTION MAP OF
PRESIDENTIAL ELECTION-RELATED TWEETS

17. Remaining problem :
Lack of compelling evidence that confirms
Twitter account holders as NIS officials
Difficulty :
Need to obtain information
about the identities of Twitter accounts holders
from Twitter headquarters in the U.S.

18. EMBARKED ON THE PROCESS OF
IDENTIFYING THE TWITTER ACCOUNT HOLDERS




Use of e-mail address when registering a Twitter account
Possibility of using e-mail accounts from local portal sites
Entered some 660 IDs into the account registration section of major portal sites
Found same 160 IDs

19. SEARCHED E-MAIL ADDRESS
THAT HAVE THE SAME IDS
THROUGH PEOPLE SEARCH WEBSITES




Confirmed real names of account holders with unique IDs
Major account “nudlenudle” included
Confirmed the identity of a 43-year-old man surnamed Lee
His bio introduced him as a Korean Air captain, but Korean Air confirmed it as a lie

20. Confirmed through multiple sources
that Lee is a member of a warfare psychological team of the NIS
Reported that the major Twitter account
belongs to the NIS official, Lee, on May 17, 2013

21. INFLUENCE AND CONSEQUENCES
OF THE REPORTING
The main opposition Democratic Party reported Lee
to the prosecutors’ office on charges of violating NIS and election laws

22. INFLUENCE AND CONSEQUENCES
OF THE REPORTING
Prosecutors started a probe into social network sites
- Searched big data companies
- Requested the U.S. for judicial cooperation

23. INFLUENCE AND CONSEQUENCES
OF THE REPORTING
Prosecutors indicted former NIS chief Won Se-hoon
for violating election laws on June 17, 2013
- Secured some 320 Tweets suspected of meddling in the presidential
election
- Tracing the identities related to some 400 accounts accused of having
been used by NIS officials (70 percent of such accounts coincide with the
Twitter accounts revealed by our reporting)
- Confirmed the creation of a separate team in Feb 2012 to strengthen
the SNS activities of the warfare psychological team of the NIS

24. THE SIGNIFICANCE
 Revealed the secret, organized online smear campaigns
by the NIS to meddle in the presidential election
 First reporting based on SNS data collection and analysis