BANNER: Source: Twitter. Accounts posting the same wording and image ahead of the Armenian election.

Armenians go to the polls on April 2 for the first election under a new law which marks the transition towards a parliamentary system of rule.

The days before the election saw a spike in manipulative behavior on Twitter, including fakes, bots, and the targeted blocking of key accounts.

First, at the end of March, tens of Twitter users tweeting in Russian started sharing a fake USAID email implying that the US is meddling in Armenia’s elections.

The email was debunked by the US Embassy in Yerevan, which pointed out grammatical and spelling mistakes in the text, and the implausibility of a genuine USAID email coming from a gmail account:

A new version of the email, with the mistakes corrected and the gmail address cropped out was then shared on Pastebin on March 29. Nonetheless, on the eve of the election a significant number of accounts began posting the earlier, more obviously fake, email again on Twitter.

Its promotion was led by accounts tweeting in Russian, which all posted a screenshot of the fake email:

Although the text accompanying the image varied, at least 43 accounts that shared the image used “НПО готовятся сорвать выборы в Армении,” which translates to “NGOs prepare to disrupt elections in Armenia.”

These accounts had a number of features which gave them the appearance of a network of automated “bot” accounts, rather than genuine users. One, had an avatar image copied from a stock online photo of actress Barbara Mori, as a reverse image search revealed:

All the accounts in question had similar patterns of activity. They were created over a year ago (many in spring 2015), numbered only a few tweets (often under 200), had almost no followers, and followed only a handful of accounts:

The account @Poljakov5Sergei is particularly striking. Having tweeted 89 times, it records no followers and no follows since May 2015.

While lethargic, these accounts have all recently tweeted on another political issue, namely the March 26 anti-corruption protests in Russia, using the hashtag #ДимонОтветит (“Dimon will answer,” a reference to Prime Minister Dmitry Medvedev, as the DFRLAb explains here). In this case, the tweets were limited to the hashtag and memes whose relation to the protests was unclear, giving the impression that their purpose was to flood the hashtag with irrelevant content:

Low activity and a low follower / follow count are not, in themselves, particularly suspicious qualities. However, the fact that so many of the accounts which tweeted the same phrase all had these qualities, and also tweeted random images on the ДимонОтветит hashtag, gives the impression that this is a small botnet at work.

This was not the only appearance of manipulative behavior on Twitter: a number of Twitter accounts were suspended on the eve of the election, triggering claims that they had been falsely targeted.

Four accounts known to have been blocked were:

@reportearm — a journalist and producer

@civilnettv — a prominent media organisation

@hetq_trace — a network of investigative journalists

@stepangrig — director of the Analytical Center on Globalization and Regional Cooperation

The accounts were unblocked approximately two hours later, after Armenian civil society activists started tweeting @support asking to unblock them.

While the reason for the suspensions is not clear, suspensions in other areas have reportedly been triggered by bot-led attacks which send multiple complaints about the accounts’ activities.

Finally, two hacking attempts were reported by prominent academic and commentator Babken DerGrigorian.

DerGrigorian, who has been outspoken about the upcoming elections on social media, reported on Twitter that attempts had been made to hack his email and Facebook accounts.

With a landmark vote imminent, Armenia’s online space is particularly vulnerable to manipulation and disinformation. The attempts identified so far have been small scale and of limited reach, but they illustrate the various ways in which online actors can attempt to manipulate the digital space.