Thread by @BenDoBrown

An influence operation was waged online yesterday to amplify pro-BJP text in the #AmitShahInBengal tag, attack opposition, and win over Indian voters. Full report: benjaminstrick.com/inside-an-infl…

This forensic thread details 🧵👇
- HOW it was done
- HOW it spread
- WHO runs them

1. HOW WAS THIS OPERATION CARRIED OUT?

Yesterday morning I came across these tweets, and was sent these WhatsApp messages from contacts in India.

What are they? They're links to a Google Drive, containing suggested tweets and graphics to use. Let's have a closer peek.

Here is the Google Drive with a Google Document containing text packets of suggested tweets, and a folder with images for the network to pump out through Twitter.

For a little context of this material, there are two main parties I refer to that are at heads with each other in the leadup to the #WestBengalElections2021. They are:
- The Bharatiya Janata Party (BJP), major Modi-led political party.
- The All India Trinamool Congress (TMC).

Here are the suggested tweets. They're in Bangla, English and Hindi. Many of them promote @AmitShah for his West Bengal tour as well as the BJP, some also discredit the opposing TMC party.

One text even claimed the opposition used a 'chant' to 'cheat' the people - Ironic.

It's not the first time we've seen this technique used for pro-BJP/Modi Govt content in India. Using a Google Doc appears to be a standard procedure to influence social media narratives.

Here's an example of one from last month also targeting Bengal 👇

https://twitter.com/BenDoBrown/status/1348648410946146305?s=20

2. HOW WAS IT SPREAD ONLINE?

This influence operation runs smoothly. Accounts take the text from the document, and tweet it out into their communities under a targeted hashtag.

Let's follow some of that text as it leaves the doc, and look at the accounts posting these packets.

The accounts posting the text are fairly obvious in their allegiances. For example, here's a selection of five accounts.

Three are BJP-affiliated groups. Two analysed using accountanalysis.app. show the past 1000 tweets of those accounts have majority pro-BJP/Modi content.

I also collected 5000+ accounts using the #AmitShahInBengal hashtag at the time the information operation was in effect.

There were a lot with twitter handles starting with the letters "bjp"

Here are also accounts in the #AmitShahInBengal network with "BJP" in their profile description.

3. DID THIS NETWORK HAVE ANY IMPACT?

Well first, let's take a look at the status of the #AmitShahInBengal tag.

In a 24 hour period it reached No.6 of most used tags in India.

That's effective. But that could also be due to normal user activity as well.

What about looking at the traction gained from the text taken from the Google Document that the influence operation was being ran from?

To show this, I've taken screenshots of Google Doc, and screenshots of the relevant copy&paste text used on Twitter.

We can see two things here.

1. There are verified accounts and accounts with good standing that have been part of this copy paste network.

2. There is an odd ratio of retweets to likes with some of these accounts getting 300+ retweets, yet less than 50 likes.

Some might ask why is this bad?

This was a trending topic in India yesterday. People were talking about it. However it's likely that many were unaware there was a coordinated attempt to push a specific agenda and discredit others in that dialogue.

That's inauthentic.

A goal of the campaign was to boost BJP profiles. So let's look at who is at the center of the network. We can visualise the entire network in @Gephi using data from Twitter's API to identify the accounts amplified.

Zooming in a little closer, we can see the main actors with their green, purple, pink and blue amplifier networks.

Those accounts in the center of the #AmitShahInBengal network are @AmitShah @BJP4India @BJP4Bengal and @KailashOnline.
By no means am I attributing the cause of the network to those accounts in the visualisation above. They are merely the central nodes in the network's activity.

4. WHO IS BEHIND NETWORKS LIKE THIS?

This is not the first pro-BJP operation to be waged on social media, but it does indicate common TTPs (Tactics, Techniques and Procedures) and there are digital crumbs left behind to identify those parties.

Let's look at some of the cases

CASE 1: In almost the exact same example of pro-BJP content in Bengal, again spread from a Google Doc, last month I identified a network targeting the #YuvaShaktiWithModi tag.

AUTHOR of the doc: a social media team leader for the Government 👇

https://twitter.com/BenDoBrown/status/1348899122460430337?s=20

CASE 2: Case from 2018 that saw the amplification of the tag #MamataKilledStudents. A screenshot of the Google Drive and Google Document, with suggested tweets (just like the current case) can be seen below.

AUTHOR of the Drive: seen in the first image as "BJP West Bengal"

CASE 3: Again very similar to all of these is a campaign to promote the tag #ModiWithFarmers.

AUTHOR: In the image below of that Google Drive, we can see the owner is labelled as ‘BJP IT & SM Office’ – this stands for BJP Information Technology and Social Media Office.

We have three other independent cases where Docs>Tweets promoted BJP and discredit opposition parties like in the #AmitShahInBengal network:
#YuvaShaktiWithModi - authored by Indian Govt
#MamataKilledStudents - authored by BJP West Bengal
#ModiWithFarmers - BJP IT & SM Office

There are policies covering the issue of what I have documented on the repeated posting of identical tweets and using a hashtag to manipulate a conversation

Here's the policy: help.twitter.com/en/rules-and-p….

Here's my report: benjaminstrick.com/inside-an-infl…

The endless monitoring, analysis and investigation of these networks I have done here is in my free time, without funding and outside of my day job 😅

Whether it's in West Bengal, Uganda, US or UK, all of these networks should be investigated and documented.