#FireMcMaster, explained

How alt-right media and a handful of Twitter bots tried to get the United States National Security Advisor fired

(Source: Twitter)

On August 3, a handful of Twitter accounts launched a media campaign under the hashtag #FireMcMaster. The hashtag appeared in response to United States National Security Advisor H.R. McMaster’s recent personnel decisions at the National Security Council (NSC) and his recently leaked letter to former President Barack Obama’s National Security Advisor Susan Rice.

The ensuing social media campaign to #FireMcMaster spread virally and, ultimately, forced President Trump to affirm support for his closest advisor on matters relating to national security and foreign policy, for now. Mobilization across alt-right social media platforms is commonplace, and this case shows another correlation between their mobilization and high-performing bot networks.

What caused the “fire”

In the past week, McMaster fired Rich Higgins, the NSC’s Senior Director for Strategic Planning, because of a memo Higgins wrote alleging a conspiracy or political warfare against Trump, including from “globalists, bankers, the ‘deep state,’ and Islamists.” McMaster also fired two other senior officials brought to the NSC by General Michael Flynn, who preceded McMaster in the National Security Advisor position.

McMaster also extended the top secret clearances to all of his predecessors as National Security Advisor, including Susan Rice, who alt-right in the media has accused of politically-motivated requests to unmask portions of sensitive intelligence sources, during the 2016 United States presidential elections. The practice of extending security clearances for former National Security Advisors and unmasking certain aspects of intelligence are commonplace and routine for any United States National Security Advisor.

Both actions led to a coordinated campaign, spearheaded by known alt-right figures, to fire McMaster. The anti-McMaster campaign was initiated by large, alt-right media platforms — primarily Infowars and Breitbart, as well as alt-right Twitter activists including Paul Joseph Watson and Jack Posobiec, both of whom are associated with Prison Planet, another website operated by Alex Jones.

The right media, the right time

Between August 2 and August 6, Infowars and Breitbart published 14 negative stories about McMaster and his relationship to President Trump.

Infowars

Aug 4: ‘Everything the president wants to do, McMaster opposes’ former NSC official says

Aug 4: General McMaster panics as journalists expose him as greatest national security threat

Aug 3: McMaster purging key Trump Allies

Aug 3: Report: McMaster fired National Security Council official for penning memo on globalists

Breitbart

Aug 6: McMaster worked at think tank backed by Soros-funded group that helped Obama sell Iran nuclear deal

Aug 4: Trump meets with McMaster amid reports he cleared Susan Rice, purged loyalists

Aug 4: Brigitte Gabriel: ‘Politically correct’ H.R. McMaster ‘doesn’t see eye-to-eye’ with Trump on how to defeat Islamic State

Aug 4: Report: H.R. McMaster ‘increasingly volatile’ and ‘frequently blows his top’

Aug 3: Report: H.R. McMaster gave ‘explicit instruction’ not to mention Obama ‘holdovers’ in Trump admin

Aug 3: Allen Roth: H. R. McMaster ‘at odds’ with Trump on Iran nuclear deal

Aug 3: H.R. McMaster promised Susan Rice she could keep her security clearance in secret letter

Aug 3: NSC Purge: McMaster “deeply hostile to Israel and to Trump”

Aug 3: Report: H. R. McMaster believes Susan Rice did nothing wrong in unmasking requests

Aug 2: Report: H. R. McMaster fired National Security Council official for penning memo on globalists

These were quickly picked up by other alt-right media outlets. Below is an example of how one of those stories — “Report: McMaster fired National Security Council official for penning memo on globalists” — spread:

(Source: @DFRLab)

Other articles on Infowars and Breitbart had similar amplifying networks behind them.

Influencers behind #FireMcMaster

The Twitter campaign #FireMcMaster was led by a traditional group of alt-right activists, among whom were Prison Planet’s Paul Joseph Watson and Jack Posobiec:

https://twitter.com/JackPosobiec/status/893216542145613824

They, however, were not as effective as Lee Stranahan. Stranahan is the founder of Populist.TV and a co-host of the Sputnik news show Fault Lines. Sputnik is a Russian government media outlet that frequently recurs in @DFRLab reporting.

(Source: Twitter)

In a recent interview with The Atlantic, Stranahan said: “I’m on the Russian payroll now, when you work at Sputnik you’re being paid by the Russians.”

Stranahan was heavily involved in the #FireMcMaster campaign. Between August 3 and August 7, Stranahan used #FireMcMaster 25 times. During the same time, he only used #FaultLines (the name of his show) 12 times.

Apart from that, Stranahan posted a video on Periscope in which he called on alt-right Twitter users to retweet #FireMcMaster. He also urged Trump supporters to get on the phone, call the White House, and ask President Donald Trump to fire McMaster.

On top of that, he published three videos on his YouTube channel urging his subscribers to call the White House and ask for McMaster to be fired:

https://www.youtube.com/watch?v=wei-3_S3JJ0https://www.youtube.com/watch?v=9tLuE__38Nshttps://www.youtube.com/watch?v=IUpJ-JuXpTY

#FireMcMaster on Twitter

#FireMcMaster on Twitter appears to have been the most well-organized campaign in the history of the alt-right. A total of 136,292 tweets using the hashtag #FireMcMaster were posted between August 3 and August 6, with two thirds posted between August 3 and August 4.

(Source: @DFRLab via Twitter)

@DFRLab analyzed a sample of 6,064 tweets posted during the period of August 3 and August 6. We found that 1,278 tweets using #FireMcMaster were generated by a mere 86 accounts, with the most active account managing to post 69 tweets using the hashtag. Our random sample indicates that less than 8 percent of all accounts sharing #FireMcMaster was responsible for 20 percent of all traffic on the hashtag.

This is a sample of public Twitter accounts. The list is a quantitative measurement of users who engaged on #FireMcMaster, and does not label leanings of each account.

The most active users

The following are some of the most active Twitter accounts to converse using the hashtag #FireMcMaster.

Twitter user @MarieMa49685063 posted 34 tweets using #FireMcMaster. Overall, in just four days, the account posted more than 3,000 tweets, 90 percent of which were retweets. It’s highly likely that this account is a bot.

(Source: twitonomy.com)

Similarly, @Hrenee80 posted 34 tweets using the hashtag, and posted 3,195 tweets in total last week (the week of August 1), of which 90 percent were retweets. Such volume indicates the account is likely a bot.

(Source via twitonomy.com)

@RescueTracker81 mentioned the hashtag 69 times, but this account is less likely to be a bot. It posts an average of 156 tweets a day, of which 74 percent are retweets.

(Source via twitonomy.com)

@GeneralDefense appears to be a bot. It was created a few weeks ago, and it posts 226 tweets a day on average.

(Source via twitonomy.com)

More importantly, #FireMcMaster makes up 68 percent of all hashtag usage by the @GeneralDefense account. In total, the account has posted 98 tweets with the hashtag.

(Source: twitonomy.com)

@tamaraleighllc is another account that appears to be at least partially automated. It tweets 332 tweets a day, 98 percent of which are retweets.

(Source via twitonomy.com)

Spread on Facebook

The spread of the call for McMaster’s dismissal, and the spread of accompanying media articles, did not stop with Twitter, but also proliferated heavily on Facebook. Data from Buzzsummo suggests that anti-McMaster articles from Circa, Breitbart, Liberty Writers News, The Daily Caller, and Young Conservatives (@TheYoungCons) garnered 126,000 engagements on Facebook alone.

(Source: buzzsummo.com)

Due to Facebook’s limited API (application program interface), it’s hard to tell how organic the engagement was, but if the Twitter campaign is any indication, the articles were likely spread by fake or automated accounts.

Spread it on Reddit

Redditors on /r/TheDonald, an alt-right forum of Reddit dedicated to discussions of President Trump, also actively engaged in spreading the hashtag and the articles associated with it.

Redditors were sharing the hashtag #FireMcMaster and encouraging others to spread it more widely:

(Source via reddit.com)

Links to tweets using the hashtag were also shared on the subreddit to prompt others to retweet and like them:

(Source via reddit.com)

Conclusion

This, by far, is one of the most organized and widespread alt-right campaigns to date, spanning across Twitter, Facebook, Reddit, and other social media. This shows the alt-right’s capacity to organize and amplify on several platforms simultaneously, and it signals the community’s growing digital capabilities.

The success of the campaign forced Trump’s administration to respond. Only two days after the start of the campaign, the White House issued a statement saying President Trump supports H. R. McMaster. The case shows how effective a group of well-organized bots, trolls, and cyborgs can, in extremis, force the White House’s hand in internal policy matters or at least shape public posture.


Donara Barojan is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.