I was watching the feed in real time and got to witness the worst of the attack, which occurred, around 12:40 EST on October 7th, 2009, and lasted for at least an hour.
I wanted to break down the event, so that we might be able to understand the psychology of the spammer and the reactions of those people who were rightfully contributing to the stream and those that were watching it.
8am: The conference kicked off, the health of the twitter stream looked positive. There was interesting content being published and the frequency of the tweets that had the #ims09 tag was about 100 every 10 minutes.
10:30am: the #ims09 feed was picking up in terms of frequency of tweets. The #IMS09 conference was gathering of the some of the biggest voices in Social Media today @Garyvee @Chrisbrogran @Missusp @JasonFalls @mvolpe and collectively these people have more than 1,000,000 followers – so when they mention something valuable in their twitter stream others repeat, often times using the exact alphanumeric characters which would include the #ims09. The #ims09 feed was generating about 300 mentions every 10 minutes.
To illustrate the viral nature of the tweets, and their multiplying factor I examined a tweet that @chrisborgan published yesterday morning:
This one tweet was retweeted (rebroadcast) 101 times – see the data below, the retweet statistic is next to the word Conversations. The data is provided by bit.ly
11:42am – The amount of tweets that contained the #ims09 symbol increased in frequency (this was right before everyone was to break a for lunch) and the #ims09 was included in the top trending topics on Twitter. This signaled Spammers that there was a significant amount of people who were paying attention to the stream. Spam started to trickle into the stream, in the form of an unsolicited offer appended with the #ims09 tag.
12:13pm – The #ims09 stream was flooded with spam. Take a look at the snapshot below of what my twitter stream looked like (Warning: There is offensive material in this stream that I tried to blur…)
This snapshot was taken when the attack was in full force. I noticed that there was only about half dozen accounts that were involved in the attack, but the effect was brutal. For more than an hour, the feed became useless. More than 50% of the tweets in the stream were spam. I quit watching after about an hour.
Reaction: There were some immediate impacts of the spam attack, first and most importantly, most legitimate accounts abandoned the stream, not those at the event, but those who were not at the event and were watching and retweeting. This had a chilling effect on the volume and frequency of tweets with #ims09 tag. This slowdown in frequency removed the stream from the top trending topics and made it less of a target for continued spam attacks. Secondly, some of those still participating in the stream got frustrated asking Twitter for help, and in some cases angry…one tweeter blamed the event organizers for the attack.
8:15am – (The day after) Update: All the accounts that participating in the spam attack have been suspended.