Bot or not? Mystery over anonymous user retweeted by Trump

The Twitter user goes by Gigi, though sometimes Sophia, Emma or Leona. The occupation is listed at various times as teacher, historian, documentary writer and model. There's been speculation about whether this person is really a woman—or even human. But bot or not, the account has gotten the attention of the president and his Twitter followers.

Just before midnight Friday, Trump retweeted a tweet from the user, then going by Surfermom77, that included the alleged name of the anonymous whistleblower whose complaint ultimately led to Trump's impeachment by the House. Critics worry the move could invite retaliation against the individual.

The account highlights how the internet has given everyday Americans—and those posing as them—a direct line of communication to the president, even if people don't always know who they are.

While anonymity on Twitter allows people in oppressive communities to speak online freely, it can also allow people to harass others or spread bogus claims without accountability. When those tweets get to the president, they can quickly be retweeted to millions.

Twitter's rules permit bots and anonymous users as long as they refrain from online manipulation, racist imagery, violent threats or impersonation.

"It's certainly something we know bad actors exploit as well," said Cindy Otis, a disinformation expert and former CIA analyst. "The platforms that allow that policy need to be more diligent in making sure it's not being exploited."

For months Trump supporters and some conservative news outlets have published what they claim to be details about the whistleblower, including the person's name and career history. Trump's retweet marks the first time he has directly sent the alleged name into the Twitter feed of his 68 million followers.

The actual whistleblower's identity has not been released or verified. The Associated Press typically does not reveal the identity of whistleblowers.

Social media analysts immediately raised questions about Surfermom77, noting that the account bore the hallmarks of a social media bot, an automated program that sometimes spread information online while appearing like a human.

Surfermom77 tweets more than most human users—72 times a day on average for more than six years. Another clue? Profile photos were taken from stock photography galleries.

Following Trump's retweet, the name on the profile changed from Sophia to Emma, then Leona and then to Gigi. The account's handle changed, too, from Surfermom77 to LovelyGigi33. Whoever's behind the account posted a new profile picture, replacing a stock photo of a woman in business attire with a photo of stilettos.

The user is a self-described Trump supporter and a California resident, according to the Twitter profile.

Attempts to reach the account user were unsuccessful Monday. The account's direct messaging function was deactivated, and the profile had no email or phone contact. Phone calls to numbers matching the account's original name and listed hometown weren't returned. Twitter declined to speak publicly about the company's efforts to verify the user's identity, citing privacy and security concerns.

While Facebook has a policy banning posts that name the alleged whistleblower, Twitter does not. On Monday the account was briefly suspended by Twitter, only to be reinstated hours later. Twitter said the suspension was a mistake. On Saturday, the company had said the account hadn't broken any of its policies.

"Twitter is extremely hesitant to suspend accounts even when they display very suspicious behavior," said Nir Hauser, chief technology officer at VineSight, a technology firm that tracks online misinformation. "Apparently it's a really high bar of suspicious activity."

Proving an account is a bot or being used to manipulate other users can be difficult for online watchdogs. Otis said the rate with which Surfermom77 changed the account name and profile pictures suggest the account is run by a real person.

Facebook has a stricter policy, intended to avoid such scenarios, that requires users to provide a full name in order to create an account.

The whistleblower filed a complaint in August about one of Trump's telephone conversations with Ukraine President Volodymyr Zelenskiy and other dealings with the Eastern European nation. The complaint prompted House Democrats to launch a probe that ended with Trump's impeachment earlier this month.

Trump insists he did nothing wrong in his dealings with Ukraine and has asserted that the whistleblower made up the complaint, despite its corroboration by other officials.