X’s new location disclosure coverage: What does it imply for security? | Cybersecurity News | USAEMALL.com

X, the social media platform formerly known as Twitter and owned by Elon Musk, has launched a new “transparency feature” which provides a greater level of information about accounts, including the locations of the users behind them.

X says the move will provide greater transparency and address concerns about “bots” that spread misinformation by enabling users to identify where they are based.

But it has raised concerns about safety and privacy for users worldwide.

Here is a closer look at what is happening.

What is happening at X?

Nikita Bier, head of product at the social media platform, announced the new feature, which will be rolled out globally, in a post on the platform on November 22.

“In a couple hours, we’ll be rolling out About This Account globally, allowing you to see the country or region where an account is based. This will be accessible by tapping the signup date on profiles,” Bier wrote.

X account profiles include a clickable “About This Account” page, which is accessible from the user menu. Until now, this page has displayed only the creation date of the account publicly.

Now, it also shows details such as the country the account holder is based in, the date the account was created, the number of times the username has been changed – and when – and the country of origin at the time of creation. It also indicates whether the app has been installed on an Android device or via the iOS App Store and in which country.

If the account is verified, it also displays the date it was verified. For some verified profiles, company affiliation also shows, such as X for Musk or the United States State Department for US Secretary of State Marco Rubio.

X said this is necessary to ensure content posted on the platform is “authentic” and transparent.

“This is an important first step to securing the integrity of the global town square. We plan to provide many more ways for users to verify the authenticity of the content they see on X,” Bier said.

Can users opt out of this?

On the whole, no. On Tuesday, the platform did not appear to provide an option to hide this information from other users. For private accounts, which users must request permission from the account holder to follow, the new information is only accessible to users who have been approved to follow them.

Bier added that for users who are located in countries with restrictions on free speech, “we’ve included privacy toggles to only show your region”. He did not specify which countries he was referring to or why this feature was being offered to users there.

Could this compromise users’ safety?

Mark Owen Jones, an associate professor of media analytics at Northwestern University in Qatar, told Al Jazeera that the new feature could enable people or agencies to cross-check the location of an anonymous account with data from other accounts, potentially allowing bad actors to identify or narrow down the location of someone requiring privacy because of security concerns.

It could also provoke attacks on people who are wrongly accused of falsifying their locations, he added.

“For example, saying that a journalist has been lying about their location in Poland, could lead to attacks on that person online, maybe in person, accusations of fraud that might have knock-on consequences on their personal and professional life,” Jones said.

“In that case, it risks causing damage to a person in terms of, you know, their wellbeing and their reputation and other forms of harassment.”

Who could be badly affected by this?

Palestinians in Gaza are one group who could be particularly vulnerable to these sorts of claims, Jones said, because it is very difficult to verify who is telling the truth and who is not.

Since the feature was rolled out, some X users have claimed that accounts purporting to be of Palestinians in Gaza are in fact based in other countries. For instance, an account called @yasminemuhamsd, which was created last month, appears to belong to a Palestinian mother in Gaza, but the account is based in India, according to the About This Account page.

Another verified page, @sam_uel_best appears to be of a woman named Sarah Ali, whose bio reads “a Gazan woman, still resilient”. The account reposts links to different fundraisers, not just for Gaza, but also for local causes in the US. Most of these links are inactive. The About This Account page says that this account is based in Nigeria.

The Israeli Foreign Ministry has responded to these claims in X post, stating: “New X feature ripped mask off countless fake ‘Gazan’ accounts. Some chap posting from Pakistan, another in London. Another manipulative abuser somewhere else. All claiming to be suffering in Gaza while in the comfort of some coffee shop far away.”

However, many people use VPN [virtual private network] services, which mask their IP addresses and hide their locations when they are browsing the internet. This can also spoof the location online and show it to be different from the actual location of the user.

Jones said that the feature is, therefore, of limited value because it only provides location information without confirming its accuracy.

“Of course, we know there are people scamming and pretending to be Palestinians to get money,” Jones said. However, he said, the creation of these sorts of accounts is just as likely to be a ploy to discredit genuine X users in Gaza.

“What if you created a bunch of accounts that were fake and obviously scammy and then made it look like they’re in Gaza and then they use that to say that Palestinians are scamming. You could easily engineer that situation, and I’m sure there’s some people doing that. If your job is to basically make Palestinians look bad and you don’t have any scruples, that’s exactly what you’d do.”

Jones said that pro-Israeli accounts have long been undermining the credibility of Palestinian content on social media via conspiracy theories, such as one about what they term “Paliwood”.

Using terms like “Paliwood” or “Gazawood”, pro-Israeli users claim that videos of atrocities in Gaza have been staged and are fake.

Jones said that if pro-Israeli accounts can claim that Palestinian influencers and journalists are also lying about their location, “it’s another piece of ‘evidence’ saying that they are just misleading the public”.

“This is the most dangerous aspect [of] these reputational attacks on Palestinians which will fuel into legitimising further the Israeli occupation and genocide.”

Will this feature really help to root out actual ‘bots’?

It’s debatable.

Since the feature was introduced on November 22, several Donald Trump supporters’ accounts, such as those called @MAGANationX and @MAGAStormX, have been shown to be based in Eastern Europe, according to their About This Account pages.

Similar pages appear to be based in Thailand and Bangladesh, reigniting concerns among users about the suspected high number of “bots” in foreign countries that are spreading political and election-related misinformation about the US on the platform.

However, because of the widespread use of VPNs, which mask users’ true locations, people cannot confirm the information they see, Jones said. As a result, X is effectively passing the responsibility for detecting fraud, spam bots or state-backed information operations on to users.

“All it is doing is providing location information without actually giving people the ability to determine if that location data is accurate. What’s the point of rolling out a feature when you also roll out a qualifier saying, well, the accuracy of this information cannot be trusted?

“It should be on the companies to stop people [from] abusing the platform and having accounts rather than crowdsourcing the policing of accounts. Again, it’s just companies being lazy, not doing due diligence on their side and then passing that responsibility onto the consumer.”

Can ‘About this Account’ pages be doctored?

Images and screen grabs of them can.

Some X users have already started sharing doctored images and videos purporting to show the “About This Account” pages of other users. One post on X, for example, accused the US Department of Homeland Security (DHS) account of being based in Israel.

Bier stepped in to refute this, saying “the DHS has only shown IPs from the United States since account creation”.

When Al Jazeera checked on Tuesday, the location for the department’s account showed as the US.

On November 23, the department posted on its X account: “I can’t believe we have to say this, but this account has only ever been run and operated from the United States. Screenshots are easy to forge, videos are easy to manipulate. Thank you for your attention to this matter.”

 Could information on the ‘About This Account’ page be wrong?

The feature is very new on X and Bier acknowledged that his team is ironing out a few “rough edges” which would be resolved by Tuesday this week.

“If any data is incorrect, it will be updated periodically based on best-available information. This happens on a delayed and randomised schedule to preserve privacy,” he added, without giving further details.