Inside a BJP influence operation targeting West Bengali politics

Political campaigning in India is on the rise as the West Bengali elections near, and so are the mass information campaigns to promote agendas, discredit opposition, and skew narratives.

All of this activity has the overarching goal to win the hearts and minds of voters and discredit the opposition through social media manipulation.

This case looks at one recent campaign that was waged on social media platforms which saw a hashtag boosted to one of the highest in India for that day. It looks at exactly how that campaign was run, its tactics, techniques and the digital breadcrumbs left behind by this campaign, and others like it, that identify who is behind them.

What this research will show:

1. Framework: how this campaign was run
2. The nature of the promoters
3. Measuring operation traction
4. Visualising the operation
5. Past TTPs and IOCs
6. Operation relation to platform policies

Brief summary

This report is based on an information operation campaign to amplify the hashtag #AmitShahInBengal on Twitter on Thursday 18 February 2021. The hashtag was one of the most popular tags within a 24 hour period.

I was able to access the organising framework of the operation and identify how it was structured in a Google Drive with a public Google Document containing suggested tweets in Bengali, English and Hindi.

These tweets were to discredit the TMC government and boost the profile of former BJP president and Modi government member Amit Shah during his visit to Bengal ahead of the West Bengal elections.

Those suggested texts were copied from the document, along with the tag, and were tweeted by users supportive of the BJP, or BJP-labelled and affiliated accounts. I captured more than 5000 accounts through the hashtag while the operation was in effect and found the primary accounts amplified in the network were amitshah, bjp4india, bjp4bengal and kailashonline.

These techniques have been used in the past to amplify similar content and the same actors. It indicates that this operation is not unique and appears to be a standard operating procedure for pro-BJP content. Open source evidence also indicates the parties responsible for these campaigns have been BJP affiliated and from Indian Government social media teams.

Background and context

There are two parties at heads with each other in this area of interest. The Bharatiya Janata Party (BJP), a major political party in India, led by Jagat Prakash Nadda, with current Prime Minister Narendra Modi in a senior role. And the All India Trinamool Congress (TMC), an Indian national party currently led by Mamata Banerjee.

Each organisation and its many civilian supporters has been active on the streets, and online, to get their voice heard. Both sides have been active in using social media to run campaigns and win voter support. This has resulted in mass social media activity from both sides, especially in the lead-up to crucial election areas such as the state of West Bengal with more than 90 million people residing in it.

1. Framework: how this campaign was run

A brief summary on exactly how this campaign operated:

1. A link to a Google Drive and Google Document is shared on WhatsApp and Twitter with the mention of a specific hashtag and a time to post
2. The Google Document has suggested tweet texts in Hindi, English and Bengali all with the same hashtag included
3. Those texts are tweeted out by pro-BJP networks all at the same time indicated in the original call to action
4. The hashtag is made to trend in India and consume the online narrative of that specific issue

When the campaign is viewed through the news feed on Twitter by an average user, the content looks authentic with a legitimate Twitter trend. It was one of the trending hashtags in India on 18 February with more than 400,000 tweets.

However this is the product when the exact same text is searched for in the Twitter search bar. You can see it has been replicated over numerous accounts.

So how is this campaign being managed on the back end? First, it starts in two ways, both of which promote a shareable Google Drive link. The sharing is either by tweeting out the Google Drive link, or through a forwarded WhatsApp message.

The Google Drive link is a drive organising the content for the campaign. That content, similar to the techniques of past information operations, consists of a folder with media (infographic style images) and a Google Document. The title of the drive is usually referring to the name of the hashtag in the campaign.

The Image Card folder holds the media content the networks are encouraged to share, and the document contains suggested tweets with the included hashtag. As with other pro-BJP operations, these are broken down into three languages: Bengali, English and Hindi.

2. The nature of the promoters

The nature of the accounts spreading the content of the campaign are largely human-operated BJP supporter accounts. We can see an example of these accounts by using the text in the campaign document as a search mechanism. Take, for example, a text making a claim that a competing party used "a chant" to "cheat" the people of Bengal. Keep in mind that this text is part of a political marketing campaign to hijack a hashtag on Twitter and force a political narrative.

Running this text through Twitter provides numerous accounts using the exact same text in a copypasta tactic.

In looking at those accounts in a little more detail, first we can see there are obvious BJP-affiliated or local area representative accounts using the copy and paste text. Then second, there are other accounts that appear to be normal users, however only engage in content that is pro-BJP and pro-Modi.

To provide a visualisation of the sort of content those accounts were posting, I used accountanalysis to view the metrics of the past 1000 tweets with a specific look at the hashtags being used. The indication of content shows these accounts are heavily engaged in primarily retweeting, and second, tweeting, pro-BJP content.

Having collected many of the accounts that were amplifying the hashtag, we can also take a look at some indicators, such as the names of the accounts. A large number of the accounts start with the letters "bjp", relating to the political party, and a number began their Twitter bios the same way.

3. Measuring operation traction

Measuring the effectiveness or impact of an information operation is difficult and may be better assessed by platforms with access to the full range of data. However, two ways to assess the reach of this specific campaign is to look at the status of the hashtag over the day in the country, and then the number of interactions different text packets have received.

First, did this hashtag reach a trending status? Yes it did. It was the sixth top hashtag in India at one point, with a total of 402,600 total tweets.

There is no doubt there is substantial authentic activity based on the tag, however what the suggested text packets do is throw a widely reflected and shared narrative into the context of the tag to dominate the conversation.

The main area of use of that tag was in West Bengal. Next, to look at the number of retweets and traction gained on some of the copypasta text, I used a Twitter code to search the exact text filtered with a minimum number of retweets and likes:

What we can see in these tweets is that there appears to be a high retweet to like ratio. Some users of the copypasta text have more than 300 retweets, yet less than 20 likes. This may indicate off-platform retweet campaigns to amplify the content of specific users.

The fact that accounts with public standing, as well as some verified accounts, were involved in the copypasta campaign, indicates the wide effect of the message of the campaign.

4. Visualising the operation

Using the Twitter API, I collected a sample of the network as the campaign grew. This data allows me to visualise the hashtag activity and identify central points of the network. This is the visualisation of that network of 5711 accounts as a whole.

By using this visualisation we can identify key nodes in the network. The lines between those nodes are mentions, retweets and tagged tweets. Below I have displayed the node name and size dependent on the incoming traffic from the network. The larger the name and the node, the more central the account is.

The modularity functionality of Gephi allows for the clearer visualisation of relationships within the network. That is why you can see four main colours, which represent the networks amplifying, supporting or tagging the four accounts named above.

5. Past TTPs and IOCs

For those reading this type of analysis for the first time: TTP means tactics, techniques and procedures. IOC means indicators of compromise.

It should be noted that this is not the first pro-BJP campaign that has been waged on social media, and that these TTPs have been seen before in pro-Modi and pro-BJP campaigns. Specifically, three campaigns have used the same Google Document-to-tweet tactic in India, where attribution can be made through forensic open source evidence.

First is a pro-BJP copypasta network I documented in January 2021. You can find the full report here. In that case, there was a large network attacking the opposing political party, again in the setting of West Bengal politics. The network overlapped with another campaign to target the hashtag #YuvaShaktiWithModi. The same technique of using a Google Document with suggested tweet text was used, however the author of the Google Document had failed to secure their email address which was on display in the code of the page. This in turn led to the LinkedIn account of a social media team leader employed by the Indian Government. Note, I have maintained the privacy of the person responsible for the creation of the Google Document for their wellbeing and safety.

A second case from 2018 saw the amplification of the hashtag #MamataKilledStudents. The name Mamata refers to the leader of the TMC. The containing Google Drive indicates the owner of the drive and the author of the document, which was a BJP West Bengal Google account.

The third campaign, very similar to the second in terms of the indicator, is a campaign to promote the tag #ModiWithFarmers. The indicator in that campaign was, again, the author details behind the social media campaign. In this case the author appeared as "BJP IT & SM Office", which stands for BJP Information Technology and Social Media Office. This was easily viewable in the Google Drive, much like the other two cases.

6. Operation relation to platform policies

This report is written in detail, for a reason. It is to provide sufficient, publicly available evidence to indicate a potential breach of the rules of Twitter, and identify parties responsible in this case.

The specific policy this campaign would fall under is the platform manipulation and spam policy. Under that, there is a subsection on the misuse of Twitter product features. It says you cannot misuse Twitter product features to disrupt others’ experience, and this includes repeatedly posting identical or nearly identical tweets, or repeatedly sending identical direct messages.

What has been documented in this report relates to the copy and paste technique of an influence operation campaign to interfere in the build-up to an election, and to manipulate a trending hashtag, both of which are policies for the social media platform.