Inauthentic activity by spam accounts boosted pro-Jokowi hashtags just days before Indonesia general elections

Spam accounts manipulated Twitter campaigns and hashtags in favor of the incumbent President of Indonesia, Joko Widodo, posting them repeatedly in a bid to make them trend.

The episode shows how social-media platforms, major battlegrounds for political campaigns around the world, are being targeted for manipulation ahead of the Indonesian elections. With the elections scheduled for April 17, 2019, inauthentic activity may become increasingly active in amplifying hashtags.

According to DFRLab’s analysis, the hashtag #JokowiLagi (“Jokowi Again,” translated from Indonesian) received about 25 percent of tweets from automated applications from March 10 to April 10. “Jokowi” refers to Joko Widodo, using a common Indonesian naming convention wherein a person’s name is shortened through combination. Along with these automated tweets, there was a significant amount of duplicate content posted by the accounts.

Indonesia is the world’s fifth largest country in terms of Twitter users. According to a report by Reuters, political parties in Indonesia hire “buzzers,” or local social-media consultants, that help to spread paid but organic content on the platform.

Twitter has been active in purging bot-like accounts as part of its effort against platform misuse and misinformation. In its rules and policies document for automation, Twitter states:

Trending topics: You may not automatically post about trending topics on Twitter or use automation to attempt to influence or manipulate trending topics.

Multiple posts/accounts: You may not post duplicative or substantially similar Tweets on one account or over multiple accounts you operate.

According to DFRLab’s analysis, some accounts may have violated automation policy by duplicate posting of substantially similar tweets with same content. These accounts repeatedly shared the same hashtags, suggesting that they belonged to the same network.

As part of its election monitoring effort, the DFRLab analyzed the Indonesian Twitter environment and found spam-like accounts that amplified pro-Jokowi messages.

Spam Activity in Indonesia

From March 10 to April 10, 2019, about 25 percent of tweets were posted using automating applications. The analysis shows apps like IFTTT, TweetCaster, and Twittbot.net were used by some accounts. These apps allow users to automate their posts, including retweeting particular hashtags.

Other than the accounts using automated applications, others reproduced identical content without signs of automation, amplifying other accounts’ posts by including the same repeated hashtags over multiple posts.

Additionally, as the accounts frequently posted the same hashtags in the same order, they also did so in a narrow timeframe.

The #JokowiLagi hashtag was used in tandem with other hashtags to garner more attention. This is a common technique employed by hyperpartisan accounts engaging in spam activity. Furthermore, a hashtag search showed that a network of these accounts posted the same hashtags with identical tweets within a very close timeframe. This behavior suggests that the accounts were either operated by a single person through some form of automation or, alternatively, a closed network.

The other hashtags that were used alongside #JokowiLagi also favored Jokowi: #01IndonesiaMaju, #JokowiOrangyaBaik, #SlapPutikanGBK, #KarenaKamuCuma01 and #JabarJuaraHiji.

#JokowiLagi is a popular hashtag and is also used by the National Awakening Party (NAP) to support the Jokowi-Amin ticket for the elections. NAP is an Islamic political party that is allied with the Indonesian Democratic Party of Struggle.

After examining #JokowiLagi, the DFRLab investigated #01IndonesiaMaju (roughly translated as “#01 Indonesia Onward”), which had amplifiers who tagged Jokowi throughout the posts. The accounts using this hashtag exhibited a similar pattern of quoting to those that amplified #JokowiLagi. According to Twitter, accounts that “post duplicative or substantially similar tweets” may constitute spam activity.

The accounts posted tweets with similar content and hashtags within a short timeframe.

Conclusion

The DFRLab identified many accounts using spam-like activity to amplify hashtags in support of Indonesia’s incumbent President Joko Widodo ahead of the country’s elections.

There was, however, insufficient open-source evidence to determine who deployed the accounts amplifying the hashtag #JokowiLagi. Since political parties in Indonesia increasingly rely on the use of buzzer teams that employ spamming and bot-like tactics to turn the political tide in their favor, it is possible that this operation may have been conducted by a buzzer team favoring the Jokowi campaign. At the time of writing, Twitter had already disabled some of the accounts.

This network of accounts was noteworthy for the extent to which it dominated select hashtags and the relative ease with which it bypassed Twitter’s spam filters. It also serves as a potential reminder of the risks posed by hashtag hijacking in online electoral discourse.

Register for the DFRLab’s upcoming 360/OS summit, to be held in London on June 20–21. Join us for two days of interactive sessions and join a growing network of #DigitalSherlocks fighting for facts worldwide!