Identifying a pro-BJP copypasta influence operation in India

A pro-BJP and pro-Modi network of Twitter accounts are attempting to influence the narrative of politically sensitive topics in India with newly created accounts posting the same text and amplifying specific hashtags.

The content amplified is supportive of the Bharatiya Janata Party (BJP), led by India Prime Minister Narendra Modi. The influence operation attempts to artificially distort the narrative on issues such as the farmers’ debate and discredit opposing parties.

This is not the first time pro-BJP content has been identified as attempting to influence social media narratives on political issues. In the past the BJP, through its IT Cell, has been alleged to have exploited online communication methods to influence voters, as well as coordinate influence and automate Twitter activity for hashtag manipulation.

Overview of the network

The two main issues that appear to have surged in online activity over December and January targeted by the campaign are the All India Trinamool Congress with the #TMCHataoBanglaBachao tag, and the subject of Indian farmers and the BJP with the #KrishokSurokhaAbhijan tag.

I captured activity on Twitter using those two hashtags over an intermittent period between 2 and 10 January, and visualised the network through Gephi. The visualisation is made up of accounts as nodes and their retweets and mentions as edges. This was the basis for further analysis.

Accounts captured in the network published content under both hashtags. Much of the content used the exact same text, published through scores of accounts, many of which were newly created. This same text publishing is known as the copypasta technique.

I first noticed the copypasta campaign on the #TMCHataoBanglaBachao tag on 2 January. Subsequently many of the accounts I was monitoring moved on to amplify content under the #KrishokSurokhaAbhijan tag, indicating that the coordination of accounts has either the same, or a mutual goal.

The #TMCHataoBanglaBachao network

The activity under this tag focussed on the amplification of a single message: "Bengal has been suffering from last 10 years. The TMC regime has built its foundation on Cut Money".

Some of the posts also included infographics. It should be noted that there were other pro-BJP copypasta campaigns using the same hashtag running different text packets. This initial investigation commenced with the "Bengal has been suffering" text, so I have chosen to run an assessment on the network of that text use.

Assessing accounts in the network

Using Hoaxy, a visualisation can be created of the repeated text seen in the copypasta campaign. This allows for the display of links between the accounts to identify trends and commonality.

Hoaxy uses a bot score system to assess the likely level of automation of an account where 5 may indicate a large amount of automation, and 0 for little to none.

While the score is a good indicator, other factors should be taken into account, such as a deeper and more granular inspection of the accounts, in conjunction with identification of activity such as the copypasta evidence seen in the screenshots.

It may be the case that a network of accounts can be operated by human users in a troll farm, and that the use of those accounts may exhibit automated tendencies. However these should not be classified as bots, but rather human-use accounts operating in a coordinated manner to target specific talking points and agendas.

In the identification of the red accounts for further analysis, many of them had moved on from the #TMCHataoBanglaBachao amplification to amplify the #KrishokSurokhaAbhijan content.

Analysis of individual accounts

Looking at the user-level data shows how some of these accounts operate on a granular level. To identify this detailed information, I have used accountanalysis and chose three accounts from the visualisation that were indicated in the red category as highly likely to be automated. I have blacked out the identification data of the specific users, for the purpose of protecting potential hijacked accounts or stolen profile images.

What we can see in the above data is the high posting tendency at specific times. For example, in one of the accounts in a single hour on a Saturday there were 218 tweets. In the context of tweets, this also includes retweets, and in line with the high retweet to tweet ratio of the accounts it is likely that the majority of those were retweets.

In assessing that data, it may be the case that these accounts are not automated, but rather are shelf accounts for human use, and are specifically made to amplify certain content. After enough amplification has been made by the account, the human user may log out and access another account in the next hour to repeat the process.

In the three account samples, as well as many of the others I looked at, there was cross-content with the other analysed hashtag as well as #ModiWithFarmers, #MaynaguriBJP, #BengalWithBJP and #AmitShahInBengal.

The #KrishokSurokhaAbhijan network

The copypasta activity under this tag focussed on a message in Bengali which, using Google Translate, says: "The new agricultural law will make it easier to sell agricultural products. The BJP government is bringing farmers protection campaign." A very helpful source, that wishes to remain anonymous, has confirmed that translation as correct.

Again using Hoaxy, I created a visualisation of the repeated text. The network of amplified content appears to be larger than the effort focussed on the #TMCHataoBanglaBachao tag, which may suggest specific interests and priorities of the influence operation.

In looking at the creation dates of many of these accounts, as well as those in the first campaign, there appears to be a batch of accounts made in December 2020 and January 2021. While other accounts have intermittent creation dates, the indication of these larger than normal creation dates is more indicative of the inauthentic use of these accounts.

When viewing the granular data of the accounts posting under this tag, similar posting patterns can be identified. One of the accounts, for example, on a Saturday evening between 6pm and 7pm made 303 tweets including retweets. That same account was created on 19 December 2020 and in the dataset of 1000 tweets of that account analysed it had only ever retweeted, and never posted original content.

Creation dates across both networks

One approach to analysing the size of that network in the wider range of Twitter activity is to analyse the entire network of activity of the two hashtags, and then visualise the accounts that were created in December 2020 and January 2021.

Using Twitter’s API, I captured activity over an intermittent period spanning eight days. I captured 1669 accounts to analyse.

To do this, I went through the spreadsheet individually flagging the accounts that were created between 1 December 2020 and 10 January 2021. There were a total of 408 accounts created between that window. In comparison to the other creation dates, this is indicative of accounts being made for a purpose, such as use in a coordinated network.

In looking at the number of accounts assessed, it is important to keep in mind I do not have access to all of the data available on the platform, and the data I do have access to appears to be incomplete to make a whole figure assessment on just how many accounts exist in this influence operation, as well as to make a precise and evidential attribution of the network.

Update: listed tweet content on Facebook pages

There are a number of Facebook accounts, some of which identify as BJP employees, sharing a list of tweet texts in Hindi, English and Bengali. I have anonymised the specific user data so as to not reveal the identity of the person, either for repercussion against their actions, or in case the account has been hijacked or is using a stolen image.

Running a search for these texts on Twitter shows that each of these text packets have been echoed by large networks in the same copypasta method assessed in this report.

Update: a Google Document identifies its author

A Google Document with suggested tweets for the same copypasta network has emerged and is an open document for the public to view. The hashtag being promoted in that document is #YuvaShaktiWithModi, with pro-Modi messaging. The content is a list of tweets in English, Hindi and Bengali, and were spammed on Twitter by the network that also featured above in this analysis.

By looking at the specific data of the Google Document, an author can be identified. I have kept the privacy of the author as they may be required to conduct this role for their job. The email address is listed as a contact address on the bio of a LinkedIn account. The owner of that LinkedIn account is a social media team leader at MyGov India.

Summary

There is clear evidence, both through network visuals, screenshots of activity from the platform, and metrics, that there is coordinated activity on Twitter’s platform of pro-BJP accounts amplifying content in an attempt to influence the narrative on politically sensitive issues in India.