This post was originally published on this site
Sometime in the past few years, the official Twitter account for the U.S. Geological Survey’s National Atlas program began doingdid something unusual: It started posting politically charged messages. In Russian.
“It’s time for the West to cancel sanctions and stop demonizing Russia,” the account wrote on Feb. 26, 2017, using Cyrillic script. “In USA Trump’s popularity is growing amid declining Democrat’s ratings,” it tweeted a month later.
The messages may have surprised cartographic enthusiasts, because as of last month, the handle still appeared on the government’s list of official accounts, called the Digital Registry. The U.S. had in fact deleted the National Atlas handle years earlier—and it was later picked up by another user.
The federal government’s troubles combating Russian trolls spreading fake news isn’t its only problem on social media. It is also struggling to keep track of which accounts are its own, The Wall Street Journal found. The National Atlas’s handle was one of 10 such Twitter accounts listed in April as controlled by the U.S. government, when in fact they were no longer under federal control. Four were tweeting in languages other than English.
“In hindsight, it seems like the government agency should have kept the Twitter account even if they weren’t going to use it,” said Keith Jenkins, a researcher at Cornell University who used the National Atlas service before it was deleted.
The U.S. launched the registry in part “to confirm the official status” of government social media accounts, according to the service’s website. The registry’s purpose: “To help prevent exploitation from unofficial sources, phishing scams, or malicious entities.”
But the Journal’s findings raise questions about that premise, experts said.
“How can we trust the list at all if some of it is wrong?” said Libby Hemphill, a professor at the University of Michigan who researches social media.
A spokesman for the U.S. General Services Administration, which maintains the registry, said it was up to individual agencies to ensure information is accurate.
Shortly after the Journal asked about the rogue handles, a warning popped up on the service’s website: Accounts whose registry entries hadn’t been recently updated had been “archived,” and wouldn’t be visible to the public.
“This was done to help ensure that users can trust that accounts listed in the U.S. Digital Registry as official are still active,” the notice said.
For its part, tThe U.S. Geological Survey, which operated the National Atlas account, said the Twitter account was archived on July 22, 2015, several months after the closure of the official program, and the handle scrubbed from the organization’s website. But the agency had “neglected to remove it from the registry.”
“While we do go through and periodically do checks of accounts in that system, this one wasn’t caught, unfortunately,” an agency spokeswoman said.
The account name appropriations appear to happen when a government account changes its screen name or gets deleted, and a new account assumes the old name.
The Journal also reviewed government accounts on Facebook, Instagram and YouTube, but the problem with commandeered handles didn’t appear as acute. Facebook allows users to change their page name only once and Instagram and YouTube have rules about reuse of old screen names. On Twitter, users can recycle old screen names—or change their identity at will.
A Twitter spokeswoman told the Journal to address questions to the digital registry, . “That is a .gov website that Twitter does not control or have access to,” she said, adding that the company tries to work with the government on account security and the best ways to archive or transfer accounts.
The expropriated screen names identified by the Journal included two linked to agencies of the Department of Homeland Security, which is tasked with helps protect the country from malicious cyber actors.
TSABlogTeam, which as of November 2014 had about 40,000 followers, was listed as part of DHS’s Transportation Security Administration, and previously tweeted tips for safe travel.
Now, it appears to be a promotional account operated by an individual someone using the name Wiley B. McCall. Its most recent tweet, on Jun. 4, 2016, said: “Comply with The 3 P’s Of Advertising and marketing.” The account didn’t respond to a Twitter message.
Since the screen name was taken over, hundreds of people have interacted with it as if it were still connected to the TSA, including one tweet from DHS’s own Twitter handle, the Journal found. A TSA spokesman said the account is no longer activeagency was. “We’re working to update the national registry.”
Another ex-DHS account reviewed by the Journal once belonged to the administrator of the Federal Emergency Management Agency.
The account, CraigAtFEMA, which in March 2016 had about 54,500 followers, changed its name after Craig Fugate’s tenure as FEMA administrator came to an end in January 2017.
But that update wasn’t made on the registry listing, and a new account, also called CraigAtFEMA, soon sprouted. The account says its name is “maja franjic,” boasts images of a mustached man in a fedora and a Toronto skyline. Its single tweet, on Jan. 21, 2017, says: “Just setting up my Twitter. #myfirstTweet.” It didn’t respond to a message from a Journal reporter.
A FEMA spokesman said the agency would correct the error.
When asked about the accounts, aA DHS spokeswoman said the agency was “currently working with GSA to ensure they have the most updated information on their website.” The spokeswoman said DHS kept a separate, “updated” list on its website—which also turned out to have errors, including three Twitter accounts that didn’t exist and one that was suspended.
The possibility for abuse is high, experts say.
“It’s shocking something malicious hasn’t happened using this exploit,” said Justin Littman, a researcher at George Washington University who has written about the appropriation of government accounts by rogue operators.
In fact, it is possible that eErstwhile official accounts could have been purloined. The Journal found three of the U.S. government accounts still listed on the registry last month were suspended by Twitter—a move that typically happens after the platform determines an account has violated its terms of service.
