Thread by @BenDoBrown

Who is behind a pro-govt bot network pushing propaganda out of Indonesia on #WestPapua? @elisthoma5 & I ran an #OSINT investigation to find those responsible.

Follow this thread to explore a dark & murky world of disinformation networks

BBC: bbc.com/news/world-asi…
(Image: BBC)

How did we start this investigation? You might have seen this illustration on Twitter already. It’s a network visualisation I made in @Gephi after capturing five days of activity on Twitter that used the #WestPapua & #FreeWestPapua hashtags.

https://twitter.com/BenDoBrown/status/1168897466810454016?s=20

With the visualisation, we were able to identify a number of @Twitter bots, & dive into the accounts they were interacting with. While many were #bots using K-pop star images, many linked to sites & other platforms. You can see my 'how to' on @bellingcat bellingcat.com/news/2019/09/0…

The most interesting finding out of this, is that the #disinformation campaign was not just on @Twitter, it was also on Facebook and Instagram, & running ads targeting Netherlands, Germany, UK & US. You can check that out here on my Medium post: medium.com/@benjamindbrow…

Since publishing, @Twitter suspended many of the accounts & @fbnewsroom announced removal of more than 100+ accounts from its platform due to "inauthentic behavior". FB also found the campaigns spent about USD$300,000 on ads. newsroom.fb.com/news/2019/10/r…

Why is this important? How much harm can these fake automated #botnetworks on @Twitter and #sockpuppets have on platforms like @Facebook and @instagram?

#Disinformation networks are dangerous. Conflict has surged in #WestPapua. Internet has been blocked at times & foreign journalist access restricted. Social media is source of info about ongoing unrest & is now battleground for control of the narrative.

https://twitter.com/netblocks/status/1167010980355825666?s=20

Because of the danger these propaganda networks pose, and the ease at which platforms can be used to spread disinformation en-masse, we sought to identify the organisations and individuals behind posts like these 👇

The propaganda networks we identified were run under two separate campaigns, one ran by marketing co InsightID (identified by FB), the other by an individual with ties to the Indonesian Government.
InsightID’s accounts looked like this (archive link: web.archive.org/web/2019081506…)👇

The WestPapuaID account linked to a website which also had standalone Facebook, Instagram and YouTube accounts. (archive of website: web.archive.org/web/2019090214…)

The WestPapuaID account was one of the sites running @Facebook ads targeting Europe. It was removed by Facebook after the investigation. You can find more details on the propaganda campaign’s ad strategy and how I found that out here: medium.com/@benjamindbrow…

For the website, westpapuaindonesia(.)com, it had some interesting details on its whois record (details used to register the site). In open source, these are the clues we're looking for.

Some of those details were fake, but we could identify the phone number belonged to a co-founder of Insight ID by saving the number in WhatsApp, and using the Whatsapp image in a reverse search to identify social media accounts related to that number.

Now that we could confirm the company, a LinkedIn search for employees of the company gave away a number of other roles of employees working there, such as Facebook Ads analysts, social media specialists…

We were also able to confirm the sites were part of the same network as they all used the same Google Analytics tracking code. We were able to find this information in the source code of all of the websites. Examples are from westpapuan(.)org and infowestpapua(.)com

Analysing InsightID’s contact points on the website lead us to email address (abdul @ insight .org). We were able to locate 14 other domains, all about the #WestPapua issue.
domainbigdata.com/insightid.org/…

We’ve identified the individuals behind the #botnetwork on @Twitter & the large misleading network of websites & accounts on @Facebook, @instagram & @YouTube. Thankfully, Facebook removed many in its announcement, & Twitter has been aggressive on removing bot accounts.

But our investigation also ID'd another effort to spread fake news ran by individual working for a think tank with links to the Govt. We ID'd them in this BBC feature. H/T to @rebeccahenschke & @cyapila for their amazing on ground reporting with this ✌️
bbc.com/news/world-asi…

The campaign did not appear to have links to InsightID, but overlaps. We ID'd wawawajournal(.)com, tellthetruthnz(.)com & nokeninsight(.)com, each with Facebook, Twitter and YouTube accounts, operated by one person.

The WawawaJournal’s accounts target English-language tags related to news in West Papua. They link back to ‘news’ stories on WJ’s site. Some of the stories are slanted to reflect a pro-Indonesian narrative, others simply false. It also attacks media outlets.

Wawawajournal Facebook account was previously named TellthetruthNZ. That same Facebook page uploaded a cover photo of Noken Insight. Looking at the whois record shows the domain owner of tellthetruthnz.

The owner of the accounts admitted ownership and told the BBC "The international media are only getting information from a few people, that's not fair, there must be a counterweight." LINK: bbc.com/news/world-asi… (UN Statement below faked)

So what have we found? In this investigation @elisethoma5 & I analysed a network of assets used by two separate #InfoOps aimed at influencing international perceptions of the situation in #WestPapua in favour of the Indonesian government, and found the people behind them.

We used #OSINT & #DigitalForensics to identify actors responsible for these campaigns. Our attribution of the first campaign to InsightID was confirmed by Facebook. The second campaign has also been confirmed by the individual responsible.
Link: newsroom.fb.com/news/2019/10/r…

This effort was entirely collaborative with amazing @ASPI_ICPC researcher @elisethoma5 (she's a freelancer too for those that want these skills) & some epic writing & reporting by @cyapila & @rebeccahenschke ✌️. Check out the @BBCIndonesia epic thread 👇

https://twitter.com/BBCIndonesia/status/1181864506680631296?s=20

If you are a following up on this investigation, @elisethoma5 and I have produced a complete 48-page report with all of our findings, & in spirit of sharing with the #OSINT community, how we did it. It’s available on @bellingcat at bottom of this post✌️
bellingcat.com/news/rest-of-w…