Skip to content

Media Forensics Hub

Creative Inquiry

Every semester, the Hub runs the Media Forensics Open-Source Investigation CI. In this CI, we will introduce cutting-edge open-source media-forensic techniques. Students will use those techniques with increasing levels of expertise to analyze media artifacts from conversations that are prominent on social media that we jointly identify as interesting and important. As a team, students will publicly report on their findings, to be disseminated to the CU Hub community and media partners to deepen how the public interprets these media artifacts. Examples of past reports are available below.

To apply to join the CI, please contact us at

  • My Heart Returns to Kashmir
    My Heart Returns to Kashmir Cover

    Release Date: April, 2024

    This report examines ongoing social media influence operations on both Facebook and X for which there is good reason to believe may be a recurrence of the campaign identified and suspended by Twitter in early 2022, a campaign likely linked to the Indian Army’s Chinar Corp. In addition to examining this pro-Indian activity, this report will also describe ongoing activity from a pro-Pakistani influence operation taking place on X. Together, these campaigns give insight into the propaganda war occurring between these two nuclear armed and contentious neighbors.


    Read the CI Report Here

  • Crypto Bestiary
    Bestiary Cover

    Release Date: October, 2023

    Cryptocurrencies have fueled the growth of online fraud in various forms. They are poorly understood by many users, have value that shifts quickly and unexpectedly, and are easy to move in a digital world without borders. Cryptocurrency is seemingly purpose built as a tool for hucksters and scammers. The world of cryptocurrency can be scary for the uninitiated.


    Read the CI Report Here

  • The 5-Year Spam: Tracking a Persistent Chinese Influence Operation
    5 Year Spam

    Release Date: February, 2023

    This report analyzes the behavior of a single, coordinated inauthentic information operator working within China and in the interests of the Chinese government. This operator has been called by different names by different analysts, including “Spamouflage Dragon“ (by the network analysis firm Graphika) and “Dragonbridge” (by the Google owned cybersecurity firm Mandiant) and has been operating continuously since, at least, April 2017. In this report we will refer to this actor as Dragonbridge. Section II of this report gives an update on several campaign this actor has engaged in recent months. Section III presents a synthetic overview of some of Dragonbridge’s past and ongoing tactics and targets. Section IV draws some more general lessons about how this actor operates.

    Read the CI Report Here

  • Spicy Memes from Spicy Panda
    Spicy Panda

    Release Date: November, 2022

    This report described a network of over 3000 inauthenticlooking Twitter accounts which worked to amplify a Twitter account called Spicy Panda (@SpicyPandaAcc). Spicy Panda itself had over 45 thousand followers and worked to attack the West and support pro-Chinese state perspectives. This network seemed to have links with iChongquing, a state linked multimedia platform based in Chongqing, a city in Sichuan, and famous in the West for its spicy food.

    Read the CI Report Here

  • Oh, The Places You'll Guo
    Oh The Place You'll Guo

    Release Date: June, 2022

    This report describes an influence operation targeting narratives around Chinese scientist Li-Meng Yan, dealing mostly with her relationships with exiled Chinese investor Guo Wengui and American political operative Steve Bannon. This operation is ongoing, has lasted over a year and consists, at its core, of over 250 political cartoons in at least three languages that have been spread on social media, web forums, and political blogs.

    Read the CI Report Here

  • The Xinjiang Nylon Influence Operation
    Nylon Influence

    Release Date: November, 2021

    This report documents the presence of and tactics employed by a complex and multifaceted inauthentic social media campaign conducted over Fall of 2021 around narratives of interest to the People’s Republic of China (PRC), especially those that relate to the treatment of the Uigher minority in Xinjiang province. In it, we document two large classes of social-media accounts, which differ in their origins and the role they play in this campaign, but which all have significant markers of inauthenticity. We begin by laying out narratives where this campaign was discovered, document the sorts of accounts participating in this campaign, and then turn to core tactics.

    Read the CI Report Here

  • Russian Misinformation Network
    Russian Misinformation

    Release Date: April, 2021

    In this report, we identify a number of accounts that we conclude with a high degree of certainty are from an inauthentic network, and based on communication patterns and message content, conclude that they are operating in support of the Russian government to promote a pro-Putin narrative within the Russian Federation. In this network, we observe interconnectedness between accounts, similarities in narratives, and inauthenticity of the account identities.

    Read the CI Report Here

  • Nigerian Trump Parade
    Nigerian Trump Parade

    Release Date: November, 2020

    On November 3, 2020 at 9:38 AM, President Donald Trump retweeted a video from Abraham O. Adeyemi showing a parade of Nigerians for Trump. President Trump retweeted it with the message, “A parade for me in Nigeria, a great honor!” The individuals taking part were holding Trump 2020 signs, waving American flags, and singing. Although many commenters assumed a parade for Trump was unlikely and probably fake, the parade turned out to be authentic. However, there appears to be an inauthentic connection between the church who organized the parade and two other organizations, Plain Truth Now and Civil Rights International. There have also been accusations of violence, robbery, murder, and injustice perpetrated by the church and its leader.

    Read the CI Report Here

  • Master Shojae's Army
    Master Shojae's Army

    Release Date: October, 2020

    The account @ZIENAAB_313 sent out a tweet with an accompanying photograph of a liquor store in flames behind a grimmly ironic silhouette waving an American flag. This stark image, although reported to be Arizona, captured an altogether different scene. A quick analysis of the photo and an image reference search reveals that the photo was from the George Floyd riots in Minnesota. The pairing of this quote and photo raises many questions regarding the authenticity of the account producing it, as well as its motives. The tweet was also being amplified and liked by accounts extremely similar in form and rhetoric. This leads to an even broader question: what is this account trying to accomplish and is it part of a larger network with a common agenda and operator? In this report, we examined the written, visual, and conversational content posted by @ZEINAAB_313 and other related accounts, and draw a number of conclusions. First, the aforementioned tweet contains a picture that is not what it was stated to be; second, the account is not who they purport to be; third, the existence of a network associated with the @ZEINAAB_313 profile; and fourth, the possibility of an underlying agenda within this network. 

    Read the CI Report Here

Media Forensics Hub
Media Forensics Hub | Watt Family Innovation Center, Clemson, SC