Suspicious accounts boosted pro-government hashtags in Colombia

A group of accounts that exhibited bot-like behavior amplified three pro-government hashtags in Colombia between May and July 2019.

Colombia, like many countries in the Latin American region, is facing political polarization. In response to — and likely contributing to — this growing partisan split, Colombia’s ruling party sought to amplify hashtag campaigns on social media, all in an effort to improve the public’s perception of the party.

Using DFRLab’s bot identification framework and open-source tools such as Botometer, it becomes possible to better understand how those hashtag campaigns attempted to trend on Twitter using bot-like accounts.

Strategies to Shape the Conversation

#AriasEstamosContigo (“Arias, we are with you”), the most recent campaign of the three observed, boosted support for former minister of agriculture and rural development, Andres Felipe Arias, who is accused of embezzling state subsidies in favor of third parties.

On Twitter, Arias’s case turned into a battle between those who considered his sentence unfair and unreasonable and those who thought Arias should go to prison for corruption.

On July 12, 2019, the United States extradited Andrés Felipe Arias to Colombia, where he arrived to face a 17-year prison sentence and a fine of $9 million. According to TrendoGate, a web application that monitors hashtags and trending topics in different countries, the phrase “Andrés Felipe Arias” trended on Twitter at 8:27 a.m. local time that same morning. In addition to Twitter, many national and international media outlets covered the former minister’s extradition that morning.

Based on Twitter API data that day, 93,115 tweets mentioned Arias’s name. Between 5:00 p.m. and 10:00 p.m. local time, the topic reached its highest volume of mentions. An average of 72.8 tweets per minute mentioning Arias played out over the course of the day.

At 9:50 a.m. local time, the hashtag #AriasEstamosContigo began trending. Users tweeting the hashtag primarily expressed support for the former minister, arguing that the accusations against him were false and unfair.

The first tweet mentioning #AriasEstamosContigo went live at 8:26 a.m., just a few minutes after Arias arrived in Colombia. From 8:26 a.m. to 9:50 a.m., 1,130 tweets used the hashtag. According to Twitter data, 87.9 percent of them were retweets posted by 407 accounts, including members of the Democratic Center Party. In total, the hashtag was mentioned 25,753 times on July 12.

Additionally, 27 verified accounts belonging to officials in the Democratic Center Party posted 89 tweets containing the hashtag, while 126 accounts that described themselves as members of the ruling party posted 443 tweets, and 872 users who described themselves as uribistas — a term referring to supporters of former President Álvaro Uribe Vélez — published 4,468 tweets.

The activity of the last group mainly consisted of amplifying posts by other users. Specifically, 91.6 percent of the posts by uribistas were retweets, with each account averaging 4.6 retweets.

Amplifying Posts by Other Users

In the first hour of the #AriasEstamosContigo hashtag, 370 out of 407 accounts retweeted posts by other users without publishing a tweet on their own. The DFRLab found that among those 370 users, 95 had been involved in two previous Twitter campaigns employed by the ruling party and published a much higher volume of tweets per hashtag.

The first of these two campaigns took place on May 1, 2019. The hashtag #SíALasObjeciones (“YesToTheObjections”) aimed to support the president’s objections to a statutory law that defined the powers of the Special Jurisdiction for Peace (JEP). The JEP is a judicial mechanism of Colombia’s transitional justice system, which is mandated by the Final Peace Agreement between the Government of Colombia and the Revolutionary Armed Forces-Popular Army (more commonly known by its Spanish acronym, “FARC”) and which is modeled after other reconciliation agreements such as South Africa’s post-apartheid Truth and Reconciliation Committee and the Northern Irish Good Friday Agreement.

The second hashtag, #ApoyoAMilitaresYFuerzaPublica (“Support to soldiers and public forces”), began trending after the publication of a New York Times article titled “Colombia Army’s New Kill Orders Send Chills Down Ranks” on May 18, 2019. According to the article, “[T]he head of Colombia’s army…has ordered his troops to double the number of criminals and militants they kill, capture or force to surrender in battle –and possibly accept higher civilian casualties in the process.”

After the article was published, the first conversations on Twitter at 7:32 AM local time started using the hashtag #FalsosPositivos (“False Positives”) to highlight related events that involved the killing of civilians by members of Colombia’s army between 2006 and 2009.

These three hashtags shared two characteristics: (1) a context or moment in which the ruling party is facing a polemic situation affecting the conversations in social media; and (2) the hashtags work as a strategy to shape the conversation on social media using specific words and topics.

The 95 accounts involved in the three Twitter campaigns posted 1,171 tweets per hashtag on average. Of these tweets, 96.2 percent were retweets. At first glance, the behavior of these users through those campaigns suggested that these accounts mainly boosted posts by other users via retweets.

Botometer, a machine-learning algorithm trained to identify the likelihood a particular Twitter account is bot or human, identified some of these users as likely bots. While Botometer is useful for online behavior analysis, it should not be considered conclusive. To arrive at a more confident assessment of whether these accounts exhibited bot-like behavior, the DFRLab triangulated their Botometer scores with its own list of potential bot indicators that examines activity, anonymity, amplification and other factors.

Botometer provides two score outputs: a probability score based on Botometer’s API that yields a percentage likelihood that a given account is a bot, and a “bot score” that looks at many aspects of the account to calculate a score on a 5-point spectrum.

Using the Botometer API, 11 out of these 95 accounts scored above 50 percent of probability to be bot-like.

Botometer’s bot score, in contrast to its API-based probability calculation, scores a particular Twitter account between 0 and 5, with 0 being most human and 5 being most bot-like. On that scale, for example, the account @SanchezH2010 scored 4.1 out of 5. @SanchezH2010 had a probability of 50 percent of being completely automated according to a more conservative measure applied by the Botometer algorithm. In comparing these two scores, @SanchezH2010’s behavior could be determined to substantially bot-like but the account’s actual likelihood of being a bot is less certain.

In addition to these measures, @SanchezH2010 exhibited features viewed as indicators of bot-like behavior. The activity of this account, for instance, shows an average of 138.8 tweets per day. The DFRLab views 72 tweets per day as suspicious and over 144 per day as highly suspicious, putting @SanchezH2010 on the high end of suspicious. Like other indicators, a single factor such as activity is not enough to determine bot-like behavior, as there are numerous Twitter accounts that post many times per day but are not automated in any way.

Another indicator of bot-like behavior is how much of an account’s content appears to be amplification. In this particular case, 99.5 percent of its tweets were retweets. High percentages such as this are a common indicator of bots, especially those whose main role is to boost posts from other users.

A third indicator to identify potential bot-like behavior is anonymity. The account @SanchezH2010 uses a non-specific avatar and a stolen image for its background picture. According to Google reverse image search, this background picture, featuring former Colombian President Álvaro Uribe Vélez and former Vice Minister of Interior and Justice of Colombia Rafael Nieto Loaiza, was first published on October 16, 2017, in a local news media outlet.

Six of the 11 accounts — those with an over 50 percent likelihood of being a bot — had the highest Botometer scores after @SanchezH2010, and all six scored above 2.9 out of 5 in Botometer’s site. Although these scores are not conclusive to attribute bot-like behavior, all six also exhibited features of amplification and anonymity.

These six accounts acted mainly as amplifiers for other users’ posts. According to an analysis conducted using Twitonomy, an online tool that analyzes Twitter profiles and provides visual analytics on anyone’s tweets, 100 percent of posts made by these users were retweets.

In addition to amplification, the six accounts show anonymity features such as no avatars and no background pictures. Specifically, the accounts @GIRALDOPOLITICO and @ramiropinzon56 use a stolen picture of former President Uribe. These two accounts also showed high activity on Twitter with an average of 126.1 and 174.9 tweets per day, respectively.

Conclusion

Analysis of three hashtag amplification campaigns revealed a group of users who acted mainly to amplify the ruling Center Democratic Party’s content. The activity of some of these users displayed signs of automated activity.

Using open-source tools, such as Botometer and its 12 ways to spot a bot framework, the DFRLab showed how those strategies attempted to trend hashtags on Twitter using often bot-like accounts.

Follow along for more in-depth analysis from our #DigitalSherlocks.