Twitter Suspended A DC Think Tank For Violating Its Rules Against Fake Accounts

Twitter has suspended three accounts connected to a Washington cybersecurity think tank that has connections to senior government and intelligence officials, and that has a history of using shady social media practices.

The main Twitter account for the Institute for Critical Infrastructure Technology was suspended last week, as was the personal account of its executive director and cofounder, Parham Eftekhari. The account of ICIT cofounder and former senior fellow, James Scott, was also suspended.

"These accounts were suspended as they were in violation of Twitter Rules," a Twitter spokesperson told BuzzFeed News.

Twitter's action comes nearly a year since BuzzFeed News first revealed that ICIT was using fake social media accounts to amplify its work and to promote Scott. The investigation also revealed that Scott has questionable cybersecurity credentials and a long history of dubious business practices, including selling fake social media amplification services.

Scott, whose real name is James Scott Brown, left the institute after the story was published and has not been involved since, according to Eftekhari.

BuzzFeed News has learned that the specific violations identified by Twitter are related to its policies regarding fake accounts and related behavior, such as spamming or attempting to manipulate conversations on the platform.

Eftekhari told BuzzFeed News in an email that he does not know why the accounts were suspended.

"No we don’t know why this happened but have contacted their customer service to see what’s going on and are waiting for a response," he said in an email. "Nothing’s changed on our end with regard to ICIT/my accounts' Twitter activity so this is perplexing to us as well."

As a result of BuzzFeed News' reporting, Twitter previously suspended roughly 40 fake Twitter accounts that were retweeting and liking content from ICIT, Eftekhari, and Scott, as well as tweeting flattering memes about Scott. But at the time it didn't take action against the main ICIT account, or the personal accounts of Eftekhari and Scott.

Eftekhari said in a May statement that "ICIT is hiring an independent law firm to do a review of the claims in the article against James Scott." But when asked about the results of that review this past December, Eftekhari said ICIT did not actually retain a law firm. He said his own "internal investigation" was sufficient.

"ICIT’s internal investigation confirmed that the social media processes managed by James [Scott] were lacking in terms of policy, tracking, and oversight," he said. "The institute planned to hire a law firm for an external investigation, however before we got to this stage James [Scott] informed us that he would pursue other opportunities and did not seek to return to ICIT."

That explanation contradicts Eftekhari's original statement to BuzzFeed News, which noted that Scott had already left the organization and ICIT would still be hiring a law firm to conduct a review.

Eftekhari also said at the time that he had taken over management of ICIT's social media presence. "All ICIT sanctioned social media is now run from the United States, by ICIT staff, from ICIT branded accounts, using new policies and guidelines," he wrote.

Twitter's action against ICIT and Eftekhari comes after these new policies were put in place. He denied the accounts in question had violated Twitter's rules against fake accounts.

"There is no 'fake account' activity of any kind that the institute is actively engaging in. I oversee only two accounts, @parhamtech and @icitorg, and tweets come either from me or my lead researcher who is here in the US," Eftekhari said in an email sent after this story was first published.

Though the institute initially lost sponsors and canceled events in the wake of the story last year, it is once again attracting some of Washington's top government, intelligence, and industry officials involved in cybersecurity.

In November, it held its annual black tie fundraiser for members of the intelligence and cybersecurity establishment in DC. Retired Adm. Michael Rogers, the former director of the National Security Agency and US Cyber Command, accepted the 2018 ICIT Pioneer Award and spoke at the event.

Others honored at the event included Essye B. Miller, the current principal deputy of the Department of Defense's chief information officer, and Karen Evans, the current assistant secretary for the Office of Cybersecurity, Energy Security, and Emergency Response in the Department of Energy. Photos from the event show other current military cybersecurity officers in attendance.

While Eftekhari and ICIT appear to have maintained connections to the Washington cybersecurity elite, Scott is now on his own and trying to sell a hacker-inspired line of clothing based on his now-suspended Twitter handle, @artofthehak.

He sells Art of the Hak clothing, cellphone cases, and other merchandise in an online store. He also operates artofthehak.com, where he continues to write about cybersecurity and information warfare.

The suspension of his account last week comes after he lost tens of thousands of followers last summer when Twitter purged locked accounts from showing up as followers.

Scott did not reply to multiple emails requesting comment.