SANS ISC: The More Often Something is Repeated, the More True It Becomes: Dealing with Social Media - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

When we think about "Cyberwar," we often think about power stations blowing up and satellites deorbiting. So far, we have not seen much of this regarding the war in Ukraine. But as Russian troops close in on Kyiv, a "Cyberwar" plays out on social media and has a substantial impact. It can be argued that public opinion and aid for the government in Kyiv are shaped by social media posts of brave Ukrainians resisting insurmountable odds.

The title of this post, "The More Often Something is Repeated, the More True it Becomes," is even more evident in social media than in the past. The mantra of simplifying and repeat has been used in advertising and propaganda for ages. A "mantra" is one implementation of this principle. It is essential to recognize bias and take it into account when assessing a particular news source.

Let's look at the opening paragraph of this post to see what indicators of bias it includes:

• I inclosed the term "Cyberwar" in quotes. Using quotes indicates that I am not exactly comfortable with the word and probably am on the side of considering the word hyperbolic.
• I am using the term "war" to describe what is happening. A writer more aligned with the Russian site would probably have called it "situation" or "conflict."
• I use the Ukrainian spelling "Kyiv" (not Kiev or Kiew, which a Russian-biased writer would use). 
• Similarly, I am careful to talk about Ukraine, not "the Ukraine."

Every post you see and every article or report has a bias. The above indicators are simplistic, and you will have to read between the lines to understand an author's bias. Consider omitted details. It is often more telling if you look at what is not said.

A few techniques I have observed in social media posts this week:

• Use of old imagery: This is probably the most common technique. A post stating a fact includes an old image supporting the said fact.
• Misinterpreting an image: Images are always powerful "proof." But most of us cannot tell one burning tank from another.
• Relativating events: Posts may attempt to misdirect by comparing what is happening to other conflicts/wars.
• The use of humor to make a certain person or a point of view seem ridiculous. Typically, the joke is obviously overstating a fact. But even an outrageous "lie" can still affect people in believing that part of it is true. Humor is often used that way.

Here are a few tricks to deal with this:

• More information doesn't mean you get better info. Limit your use of social media (this is also important for mental health). Social media is probably one of the least reliable ways to obtain information. It appears to be immediate and current, but in most cases, it has been reposted multiple times, altered, and the original source is no longer verifiable.
• Stick to original sources and recognize their bias.
• Confirmation bias is dangerous and almost impossible to escape: You are much more likely to believe someone who agrees with you.
• Do not amplify questionable news.
• A quick image search can often provide the source (e.g., image.google.com)
• Comments may note issues with the statement.
• Consult biased sources. A source with a known bias can make it easier to spot related stories. Reading a biased source can also discover what a particular group omits about the topic.
• Does the story "make sense," and does it fit the overall context, or is it an outlier not connected to other facts.

Even without any malicious intent, the news is often misrepresented—for example, translation errors. You may have heard the recent news about a "40 miles column of tanks". Some sources indicated that the "40 miles" didn't refer to the convoy's size but the distance from Kyiv. Another issue, even for native English speakers, is the word "casualties." Many understand it as the number of people killed. But it more commonly includes injured individuals as well. Misinterpretation can often lead to vastly different conclusions.

It is always best to start by establishing some ground truth. For example, becoming familiar with the geographic location, things like weather, and local customs and culture. Best to consult pre-event sources to learn about this. This will also better enable you to judge commentary. 

[The image above shows a crashed Star Wars "Tie Fighter." This image is often used to make fun of reports of destroyed tanks. The best I can tell, it comes from this clip: https://www.youtube.com/watch?v=Y0U9KwHa0jQ. But I think it may have been part of a commercial aired in Germany at some time. As far as the saying goes, "the more often something is repeated, the more true it becomes": There are several different sources that the phrase is attributed to. Not going to attempt to resolve this. But I did not come up with it.]

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|