Thread by @BenDoBrown

A copypasta campaign in India is targeting politically-sensitive tags #TMCHataoBanglaBachao & #KrishokSurokhaAbhijan on Twitter. I captured data over the past week for analysis.

Report: benjaminstrick.com/twitter-analys… CC @TwitterSafety

Here's some findings in this #OSINT thread 🧵👇

It's clear there is coordinated activity here. Scores of pro-BJP/Pro-Modi accounts operate in a network to spam packets of text (copypasta method)

Example: the tag #TMCHataoBanglaBachao with the text “Bengal has been suffering from last 10 years. The TMC regime has built..."

And another related campaign, using the tag #KrishokSurokhaAbhijan with the text: "নতুন কৃষি আইনের দ্বারা কৃষিজ পণ্য বিক্রি করা হবে আরও সহজ। বিজেপি সরকার আনছে কৃষক সুরক্ষা অভিযান।"

Using Hoaxy, we can visualise the networks of those text strings. The accounts are ranked in probability of automation from 0-to-5.
0 being most human-like
5 being the most bot-like (red)
This should be compared with other points (incl copypasta) before conclusions are made.

Drilling down into the detail of each account, using @luca's @accountanalysis platform, shows some of the accounts have some pretty decent posting times.

One account managed to make more than 300 retweets between 6-7pm on a Saturday 😬

NOTE: Some of the 'easy' checks for Twitter automation flag accounts that may be human operated. Yes, there are clear signs of coordination in this network, but the accounts may be human operated. Here's more on that (screenshot is from the article) occrp.org/en/investigati…

An important finding (and always a red flag), is that going through the data I captured over the past week, there appears to be dates where accounts were created in 'batches' in Dec 2020 and Jan 2021 (the 10 days of Jan).

I've highlighted them in the CSV data below.

Bulk creation dates should always be taken into consideration with the entire picture of what's going on.

But in looking at the account creation dates in the whole network, the batched dates are clear. It's when that obvious trend emerges that further interest is warranted.

Finally, let's view those accounts in comparison to the whole network of accounts captured under tags #TMCHataoBanglaBachao & #KrishokSurokhaAbhijan.

On the left is the normal vis.

On the right is the same vis with the Dec/Jan accounts seen bigger & in red.

Made with @Gephi.

It appears the 'recommended' text in Bengali, English and Hindi have been posted by 'BJP-affiliated' Facebook accounts then replicated on Twitter.

This is an example of one of the Bengali talking copypasta text packets which have been echoed by the network.

Here is one of the recommended "English Tweets" that has been seen posted in public BJP Facebook groups.

Again, echoed by the copypasta network on Twitter.

Here is an example of the Hindi Tweets which are echoed from the list of Tweet text packets and copied onto Twitter by the network.

It will be important to monitor the buildup for the #Bengal Elections for widespread propaganda campaigns like this.

A Twitter user has sent through a link to a Google Doc which coordinates the copy and paste of pro-Modi text and hashtag to manipulate the #YuvaShaktiWithModi tag.

Tweet:

https://twitter.com/EnergyMamata/status/1348852025644126211?s=20

Google Doc: docs.google.com/document/d/1c7…

Here is an example of the effort currently underway by the network to amplify these 'talking points' of text/spam.

This is a Hindi text packet of pro-modi tweets also targeting the #YuvaShaktiWithModi tag. It's a copy and paste technique by this network from a specific Google Doc. This is a very well coordinated spam tactic. @TwitterSafety @TwitterIndia 👀

The Google Doc being shared to run this coordinated copypasta campaign has author details in it.

The email address is listed on the Linkedin of a "social media team lead" for the Indian Government.