09-19, 16:15–17:00 (Europe/Tallinn), Stage 2
In April 2023, Sarah Bils was revealed to be one of the main people behind the DonbassDevushka social media "personality,” posting pro-Russian propaganda to a variety of social media accounts since 2014. One of the main accounts, the PeImeniPusha Twitter account has been active since 2015, with a huge uptick in activity concurrent with the Russian invasion of Ukraine. Ms. Bils has claimed that there was a team of at least a dozen people responsible for the Donbass Devushka personality.
With a group of people all writing under the same “personality” can we detect patterns that might reveal shifts in authorship of tweets? I used a number of open and closed source tools, along with original methodology and tools, to analyze text and metadata collected from the PeImeniPusha Twitter account and several other sources. Primary areas of research and analysis include identification of potential authorship clusters, analysis of trends in content posted, and network analysis of people affiliated with the Donbass Devushka personality. This session will build significantly upon research first presented to a standing room only crowd at the DEF CON 31 Misinformation Village, and will present additional research and analysis for the first time.
Shea has over 25 years of experience in security consulting, malware campaign investigations, compliance, and technology. He also co-founded a venture-backed knowledge management startup. Shea has presented both domestically and internationally on a wide range of topics including disinformation, OPSEC, application security, and compliance. Shea’s areas of research include elicitation, disinformation, open-source intelligence, and crisis management.