Propaganda Botnets on Social Media
Social media bots are prolific in Mexican twitter. Researchers in Mexico have been studying twitter bots for several years. If you’re not familiar with bots, head over to Resource for Understanding Political Bots by Sam Woolley for an introduction to automated propaganda.
While activity by propaganda bots is somewhat invisible, using network visualization software we can see what it looks like and track patterns in its usage.
The following network graphs were created by Alberto Escorcia from LoQueSigue in Mexico City using Gephi, an open source network visualization program.
The chaotic looking, multicolor formation in the middle are humans tweeting hashtag #YaMeCansé. It’s a visual representation of a conversation on Twitter; a map of the network created by everyone tweeting and connecting accounts.
The blue-green & brown formations in the upper left are not organic structures. Mexican researchers call those formations “tumores” (tumors). The tumors are bots attacking the hashtag #YaMeCansé.
Above is another network graph of hashtag #YaMeCansé. The (green) tumor representing the bots is in the upper left corner. This graph also shows the “mutation” of #YaMeCansé into #YaMeCansé2 — an innovation by Mexican twitter users to circumvent the bot attacks. Bots spammed #YaMeCansé so much the hashtag became useless, so users altered the hashtag by adding a number and started a fresh trend. #YaMeCansé2 is shown in the upper right branching off the original conversation. Bots targeted #YaMeCansé2 too and so it was changed again to #YaMeCansé3. #YaMeCansé morphed through over 30 iterations and trended for almost a month straight in 2014. Each time it was attacked and “overthrown” by bots.
Altering the hashtags worked for awhile and users were able to avoid the bots, but bot tactics in Mexico have evolved since then and it’s no longer effective.
Finally, this network graph from LoQueSigue is from #EPNNotWelcome, a hashtag that was used to protest Mexican president Enrique Peña Nieto’s (EPN) visit to Washington D.C. in January 2015. The multicolor, chaotic formation with various hashtags is thousands of people tweeting against the Mexican president.
The obvious green formation is a gigantic tumor that represents thousands of bots that tweeted spam messages and flooded #EPNNotWelcome on the day of the visit. This was the first bot attack recorded in 2015.
These are a few examples of the research that’s been done in Mexico to demonstrate that propaganda botnets exist.
So what exactly are these bots doing? Here are a few of the activities we’ve seen bots do in Mexican networks:
- disrupting networks
- suppressing and censoring information
- spreading smear campaigns & misinformation
- attacking important nodes in order to cut them off from the rest of the network
The above network graphs are massive in size (mapping tens of thousands of tweets). Below is a much smaller network graph of #TecnocensuraMX in July 2016. The graph was made by researcher and blogger, Rossana Reguillo.
Each twitter account is a node in the network and retweets/mentions/replies are edges connecting the nodes. There are no tumors. People in several countries had an open conversation about tecnocensura (“tech-censorship”) and it was unimpeded by bots.
This network has a high degree of modularity; connections between nodes are dense and several community structures (denoted by different colors) overlap. It’s a strong network. There’s a clear difference between this highly connected network and the botnets which stand out from a network and don’t connect or interact with other accounts.
Rossana and Alberto have both been targeted by bot and troll campaigns attacking them on social media. They received thousands of death threats. Alberto has been harassed for several years. Someone broke into his apartment and stole computer equipment, he was hacked, his website was taken offline, his family and friends have been threatened. Rumors were spread online about him that cost him clients. And of course the omnipresent death threats pour in on a regular basis, especially when he publishes anything denouncing bot activity or when his research appears in the news.
A massive attack was carried out against Rossana apparently for her support of Ayotzinapa protests. It lasted over two months. She received death threats containing misogynistic language, hate speech and pictures of dismembered bodies and burned corpses. She was also targeted with phishing links attempting to steal her passwords.
Below is a visualization of the attack against Rossana. This network graph was created by Rossana herself and Jesús Robles Maloof. Rossana is the green target in the middle. Data mining revealed many if the accounts participating in the attack were bots and trolls. Maybe you’d think the knowledge that these threats are not coming from “real people” should be some level of comfort, but imagine getting hundreds of notifications showing pictures of dismembered bodies for a few hours. Multiply that by several months and you’ll begin to understand the level of online harassment Mexican netizens endure.
Rossana gave a talk at Hacker Garage in Guadalajara on December 5, 2016 and she explained why she was targeted. It’s not because she’s famous, but because she’s an important intermediary node in her network. She talks to journalists, academics, activists, lots of young people. The purpose of the attacks against her and similar campaigns is to destroy the intermediary nodes and cut them off from their networks. Whether it’s a temporary disruption causing a disconnect (until the attacks stop) or the target deleting their accounts and/or permanently leaving the internet due to intimidation and fear, the tactics succeed in their intended effects.
In the digital propaganda business, botnets can be bought, sold, rented and shared. Sometimes they cross borders. An interesting case study by @BotsPoliticosNo titled “Elecciones Mayo 2015. Quienes hacen trampa en Twitter” (Elections May 2015. Who is playing tricks on Twitter) discusses a network of accounts that was created in April 2014 to support Venezuelan anti-government protests La Salida, then it went silent for 8 months and then resumed tweeting against PODEMOS from Spain.
In summary, this is a network created in April 2014 in support of street protests that took place during those months in Venezuela. Then it stopped for eight months and restarted, this time in Spanish politics, shortly after the creation of the MEVA (Movimiento Español Venezolano Antipodemos). In this second period its activity centered on criticism of PODEMOS and promotion of Ciudadanos, while the possible account of the network’s administrator began to be followed by 18 official accounts of that party.
@BotsPoliticosNo tracks political propaganda generated by bots on twitter and has a large body of research in Spanish language on their blog. They use Python, Gephi and Twitter’s API to track political propaganda spread by fake profiles and in several cases, Twitter has shut down the networks thanks to their research.
“This conduct is morally unacceptable,” they wrote on their blog. “It’s scamming the people and we must not permit it.”
The team of anonymous researchers stated their purpose is to denounce the networks of false profiles that they find. Their goal is not to harm particular political parties or people but to find the traps that are laid in effort to get users to change their votes.
They have published case studies of botnets involved in politics of Spain, Venezuela, Bolivia and Argentina. Most of their work focuses on Spanish politics and they say they hope their research has stinted the explosion of networks of fake profiles in Spain, or at least contained the activity so it doesn’t expand faster.
Propaganda bots in Mexico are known spread misinformation. Activists and journalists are frequent targets of smear campaigns spread by bots. One of the main questions I hear often but have not found many solid answers: How effective are propaganda bots at changing public opinion?
According to Colombian hacker, Andrés Sepúlveda they are very effective. In a March 2016 article from Bloomberg titled How to Hack an Election, Sepúlveda said that voters trusted what they thought were spontaneous expressions of real people on social media more than they did experts on television and in newspapers.
He wrote a software program, now called Social Media Predator, to manage and direct a virtual army of fake Twitter accounts. The software let him quickly change names, profile pictures, and biographies to fit any need. Eventually, he discovered, he could manipulate the public debate as easily as moving pieces on a chessboard.
According to a November 2016 in The Atlantic about twitter bots in the US election, the Federal Elections Commission has “shown no evidence of even recognizing that bots exist.”
Who is running all these propaganda bots? According to a November 2016 peer-reviewed journal by Alessandro Bessi and Emilio Ferrera about bots used in the US elections, it’s impossible to determine the bot operators.
Unfortunately, most of the times, it has proven impossible to determine who’s behind these types of operations (Kollanyi, et al., 2016; Ferrara, et al., 2016). Governments, organizations, and other entities with sufficient resources, can obtain the technological capabilities to deploy thousands of social bots and use them to their advantage, either to support or to attack particular political figures or candidates.
Since I first ran into bots in Mexican twitter in 2014, I’ve been collecting articles and papers about bots & trolls from around the world. One of my reasons for writing this series of blogs is to put all the information I’ve gathered in one place for reference purposes. I had so much content I divided it into 3 lists: Academic journals and papers, bot & troll news from Mexico and bot & troll news from around the world.
I have another (short) list of bot “nicknames.” I have found is that in each country where people notice bot activity on social media, they give the bots a name in the language of each country. Using those nicknames we can usually look them up on twitter. In Mexico at least, users are so familiar with peñabots that they tweet screenshots of suspicious looking activity.
Here are the bot nicknames I’ve come across so far:
- Mexico — peñabots
- Honduras — JOH-bots or JOHbots
- Peru — fujitrolls (unknown if these are automated bots or just trolls)
- Turkey — AK trolls, AK-trolls, previously “imamın ordusu” (army of the imam — afaik not related to the book by the same name) also “the army of 6,000”
- Egypt — online committees, e-committees, legan electronya (Franco-Arabic), or لجان الكترونية
- China — 50 cent army
- Russia — nashibots
Given that the usage of bots is so widespread, my guess there are many more. If you have any articles or papers that may be related to propaganda botnets (any language), please DM them to me (@3r1nG) and I’ll add them to my lists.
Countries where digital propaganda has been documented: Mexico, Honduras, Dominican Republic, Venezuela, Argentina, Peru, Spain, Turkey, Egypt, Syria, Bahrain, Saudi Arabia, Azerbaijan, Russia, Tibet, China, UK, USA, Australia, South Korea.
