17,000 bots target Malaysian opposition party ahead of the General Elections on May 9

Ahead of the Malaysian general elections on May 9, Twitter bots launched two hashtag campaigns promoting #SayNOtoPH and #KalahkanPakatan (translation from Malay: Defeat Pakatan). Pakatan Harapan (PH) is an opposition coalition of center left parties in Malaysia and currently the second largest bloc in the Parliament of Malaysia.

According to a machine scan, the bot campaign against the opposition party PH started on April 12 and at the time this article was written, was still ongoing.

The two hashtags — #SayNOtoPH and #KalahkanPakatan — were used 44,100 times by 17,600 Twitter users, the majority of which were bots. The campaign reached more than 300,000 users and generated more than half a million impressions. It is hard to say how many of those impressions came from real users considering the bots behind the campaign had very few followers, most of which were other bots.

Of the 22,000 accounts who used the hashtag, 98.4 percent had a low authority score (based on account’s activity and account’s influence), which indicated a high prevalence of automated accounts.

Upon closer inspection of raw data, we found that 37,409 mentions of the hashtag were generated by accounts that have an authority score of zero (out of 10). This was the first indicator that the vast majority of accounts behind the hashtag campaigns were indeed automated accounts.

We also found that most accounts had alphanumerical handles, a tell-tale sign of a bot.

Even the accounts that had human-looking handles, turned out to be bots.

In their tweets, most accounts followed the exact same pattern by using two hashtags “#Kalahkanpakatan #sayNOtoPH” and then tagging between 13 and 16 other accounts, most of which were a mix of other bots and real accounts. It appears that bots tried to reach real users by tagging real peoples’ handles into their tweets.

Repetitive pattern of speech and tweet structure is another important sign that indicates bot activity.

Apart from that, all tweets posted by these accounts included the same images and short videos promoting Barisan Nasional, a coalition of Chinese, Malay, and Indian parties that is currently the largest bloc in the Malaysian Parliament.

One of the most shared videos was a nine second clip featuring two images, the Malaysian flag with Malaysia Decides written on it and an image of what appears to be a campaign rally.

@DFRLab discovered that the photo used in the video was taken at the Barisan Nasional’s Youth Manifesto launch event that took place on April 10, 2018.

Another frequently used image accompanying the tweets posted by bots was a photo from Barisan Nasional’s Motorcycle convoy that took place on November 10, 2017.

It is important to note that the bots did not share any content promoting other political parties.

Russian handles

Among the top 10 most active accounts using the two hashtags, all were bots and nine had Russian-sounding Cyrillic screen names. Interestingly, all of the most active bots listed below were created between October 12 and October 14, 2017, indicating a high likelihood that these accounts were created by the same bot herder. Additionally, neither one of the top ten most active bots tweeted about anything else, but the Malaysian election.

One of the most prolific tweeters was an account under @a6M4xtwnF0QFP9y (archived here) using the name of Elena Kupina (Елена Купина).

The account tweeted several audiovisuals, among which was a video, with a still that said, “Keep calm and vote Barisan Nasional.”

Apart from the video, the account also shared an image promoting Barisan Nasional’s manifesto. The bot tweeted the image 28 times, which is significant considering it only posted 31 tweets since its creation in October 2017.

Another active bot @3MktrKU7KBq6BzI with a Cyrillic name Sveta Aleksandrova (Света Александрова) shared the same image 16 times.

The prevalence of bots with Cyrillic screen names does not suggest that Russian social media users are meddling in the Malaysian elections, but does indicate that whoever is behind the campaign purchased bots created by Russian-speaking bot herders.

Separately, it is noteworthy that the imagery shared by the bots was visually similar to the official content pushed out by the Barisan Nasional party’s Twitter page.

https://twitter.com/barisanasional/status/982629936895700992https://twitter.com/barisanasional/status/976393026250555392

All three images used the same font, pictures and graphics and at the bottom of the image, all provided links to Barisan Nasional’s social media pages.

This suggests that the image shared by bots was either produced by the same people who created content for Barisan Nasional’s social media pages, or the bot herders copied the images from BN’s social media pages.

Conclusion

Although it is impossible to confidently attribute the bot campaign to any specific entity using open source data, the campaign did highly favor the Barisan Nasional coalition. Considering that some of the imagery used by bots was visually similar to that produced by the official campaign, it is likely that the Barisan Nasional party or its supporters were behind the campaign.

It should be noted that the campaign is unlikely to have had any real impact. Although the bots managed to post more than 40,000 tweets, the lack of real user participation contained the spread of the two hashtags within the bot networks themselves.

The campaign is still on-going and despite the glaring indicators that most of the accounts behind the campaign are bots, Twitter has done little to systematically remove these robotic accounts from their platform.

Follow along for more in-depth analysis from our #DigitalSherlocks.