A hashtag used to magnify awareness of Taliban operations peaked during the Afghan presidential election, due in part to the amplification of 60-plus Taliban-associated Twitter accounts. The hashtag was likely employed to intimidate voters and communicate Taliban influence over the electoral process.

Taliban-inflicted violence on election targets could have contributed to record-low voter turnout in the Afghan presidential elections on September 28, 2019. Amid questions of electoral legitimacy and ballot-stuffing, preliminary tallies suggest fewer than 2.7 million Afghans voted, and the results remain undecided.

The amplified hashtag, #AlFath, refers to the Al Fath Jihadi Operations, a spring offensive inaugurated by the Taliban on April 12, 2019. Unlike a previous Taliban offensive, which targeted “American invaders” and foreign troops, ongoing Operation Al Fath focuses on Afghan governmental, military, and security forces who the Taliban claim are “being used by invaders for their own objectives.”

A DFRLab analysis found that at least 67 Taliban-associated accounts pushed the #AlFath hashtag leading up to the election. Of those 67 accounts, 50 were created in August or September 2019, indicating that those 50 may have been created with the express purpose of amplifying the hashtag. Mentions of the hashtag spiked on September 28.

#AlFath, which translates to “victory” in Arabic, is an English transliteration of #الفتح, the Arabic version of the hashtag. Although both versions of the hashtag were pushed by Taliban-associated accounts — sometimes in the same tweets — the DFRLab analysis focused on #AlFath, not #الفتح. #AlFath tweets were predominantly in English, while #الفتح tweets pushed Pashto content.

The Taliban has several official accounts featured on the homepage of its websites. Two of these accounts, @Zabehulah_M33 and @QyAhmadi_1, used #AlFath in tweets.

@Zabehulah_M33 appears to be the largest account on Taliban Twitter; it has roughly 81,400 followers and is retweeted at higher rates by other Taliban-associated accounts. According to TweetBeaver, which allows users to download a Twitter account’s 3,200 most recent tweets, @Zabehulah_M33 posted 36 election day #AlFath tweets, which were in turn retweeted a total of 380 times and liked 1,568 times.

These official accounts’ tweets of the hashtag followed an identical format, in which the hashtag introduced Taliban actions such as electoral disruptions, attacks, and murders. Certain locations in Afghanistan were emphasized via hashtags, while other places were not. The tweets may have also served as a way for the Taliban to convey updates quickly on the state of the insurgency.

Taliban-associated accounts, including both those that outrightly state their Taliban affiliation in their profile as well as accounts that predominantly post pro-Taliban content, amplified the #AlFath campaign in several ways.

Between September 26 and 29, at least 26 accounts, nine of them created in August and September, all directly used #AlFath. Another 41 accounts associated with the Taliban, all created in August or September, tweeted or retweeted #AlFath.

On election day — September 28 — alone, @Zabehulah_M33 was the point of origin for 16 #AlFath notices, which were reposted by various Taliban-associated accounts. Reposting content, in comparison to retweeting, is the identical reuse of language from another tweet, posted as if it is an original tweet. Reposting content over retweeting it allows an account to pretend to be producing its own tweets, while not actually disseminating original content.

The reposts of @Zabehulah_M33’s content happened at a quick pace, suggesting a degree of coordination among the accounts. At 2:09 p.m. local time, @Zabehulah_M33 tweeted an #AlFath update about a blast at a polling site in Kabul and other attacks that “halted” the “electoral process.” In addition to #AlFath, the tweet also used hashtags to identify Khost and Kabul. In minutes, two other accounts — both created in August 2019 within a day of each other, with 237 common followers — reposted the same content.

@aorpWH7DuiAuxI1, an account that reposted @Zabehulah_M33’s update within one minute, exhibits some bot-like behaviors. Signs of bot activity include anonymity, amplification, common content, stolen/shared photos, and alphanumeric account handles. The account had an alphanumeric handle and a display name that, according to Google Translate, means “Afghan fighter.” It mainly amplified Taliban content through retweets and reposts. This account was not hyperactive, however, as is typical of bot-like accounts.

Several minutes after tweeting about events in Khost and Kabul, @Zabehulah_M33 used #AlFath again. This update was a bulletpoint list of some of the attacks that had occurred in Afghanistan so far that day, including the number of gunmen killed and the areas where the Taliban had achieved success. Paktika, Takhar, Baghlan, and Kunduz, all hashtagged in the tweets, are all contested areas that are neither controlled by the Afghan government nor by the Taliban. Within 40 minutes, another official Taliban account and five Taliban-associated accounts tweeted the same content under the hashtag.

In the hours after, five more accounts copy and pasted the content in tweets without the hashtag #AlFath. In total, this particular #AlFath tweet was spread on 12 accounts, seven of which were created in August and September.

In addition to reposting #AlFath tweets, some of the 67 Taliban-associated accounts displayed similar bot-like activity. Five accounts that tweeted #AlFath between September 26 and September 29 used other suspiciously similar hashtags, often accompanied by an unrelated black-and-white image. All of the accounts still currently tweet hashtags with stock photos attached. These accounts’ common content, anonymity, and stock photo imagery suggest possible bot activity.

Notably, 10 of the 13 Afghan areas the five accounts hashtagged in their #AlFath tweets are all contested (parts of Jowzjan, Faryab, Paktika, Ghazni, Kunduz , Kapisa, Logar, Farah, Takhar, and Baghlan). Kabul was also hashtagged 12 times total in #AlFath tweets by these accounts.

Another 12 accounts that tweeted or retweeted #AlFath all displayed alphanumeric usernames likely generated by automation software, such as “lxTz1Wh9WvXCZrn,” “SchsUFAvvzYlbBc,” and “IK6ajMDVLxxXwnq.” Three of these accounts were made in August, and nine were created in September. Nine of the 12 accounts included no identifying information and featured either a stock profile photo or none at all. All of them retweeted official Taliban spokesmen. Two of the profiles have been flagged by Twitter for suspicious account activity, and one has since been deleted.

These indicators do not necessarily mean these accounts were bots; they could be real people or they could be cyborgs, mixing automated and authentic activity. It is also difficult to ascertain via open-source evidence whether the efforts to amplify #AlFath were coordinated by a single entity or many separate ones. Regardless, the effect is the same: various Taliban-associated accounts boosted #AlFath during the presidential election.

Since the Taliban was so clearly associated with #AlFath, a counter-hashtag supportive of the Afghan government arose. According to Sysomos, 5.5 percent of tweets that used #AlFath also used #AlFathFailed.

The accounts that tweeted #AlFathFailed often also tweeted #AlFath, but their tweets were remarkably different in content to the other #AlFath tweets. In contrast to the Taliban-associated accounts’ remarks on the failures of the elections, #AlFathFailed tweets focused on the successes of the election and the Afghan National Security Forces.

It is possible that the use of #AlFath spiked on September 28 — the day of the election — because there were significantly more Al Fath attacks than in any day or month previously. The Taliban’s self-reported monthly attack statistics both confirm and refute this.

On the one hand, their September report explicitly refers to the presidential election, in which the “Mujahidin of the Islamic Emirate, escalated their attacks on the elections day by carrying out nearly 314 major and minor assaults against the enemy.” This could perhaps explain the rise in the use of #AlFath.

On the other hand, the Taliban’s reports also list significant Al Fath operations in a separate section. Their September report mentioned 17 Al Fath operations, in contradiction to their mention of 314; their August report mentioned 12; and their July report mentioned 14. The September number does not alone explain the disproportionate use of #AlFath during the election.

The timing of the amplification, which intensified on September 28, first suggested that the goal of the hashtag was to intimidate Afghans from voting in the elections and assert Taliban dominance over the electoral process.

Many of the #AlFath tweets directly referenced the elections using fearmongering tactics. Some #AlFath tweets included pictures of menacing Taliban soldiers, while other tweets were more instructional with handouts about staying home on election day. Taliban-associated accounts tweeted menacingly at Afghan officials: five minutes after @Zabehulah_M33 tweeted an #AlFath attacks notice, a Taliban-associated user tweeted it to Hamdullah Mohib, a national security advisor to the Afghan government and a former Afghan ambassador to the United States, who had tweeted about the success of the election.

The prominence of English-language content using the hashtag was also curious. Only 6 percent of Afghanistan speaks English, while 48 percent of Afghans speak Pashto. Thus, it is likely that #AlFath was not designed to reach an Afghan audience. Rather, it is possible that #AlFath served to communicate the Taliban’s grip over Afghanistan to an English-language audience. The reason for the English-language focus is unclear, though one possibility could have been to target an audience of U.S. servicemembers in the country.

Another possible explanation for the amplification of #AlFath is location. Apart from Kabul, most of the areas hashtagged in #AlFath tweets are contested, including parts of Khost, Jowzjan, Faryab, Paktika, Ghazni, Kunduz, Kapisa, Logar, Farah, Takhar, and Baghlan. Such location-specific hashtags seemed to reinforce the threat of Taliban control over places where its control is in fact weaker.

The rise of #AlFath on election day also has historical precedence. The Taliban’s 2018 spring insurgency, Al Khandaq, was also communicated through hashtag.

As the graph shows, use of the hashtag #AlKhandaq on Twitter peaked on October 19, 2018, the day before the Afghan parliamentary elections. The DFRLab could not confirm, however, whether the accounts that tweeted #AlKhandaq were associated with the Taliban.

It is unknown whether the amplification of #AlFath was a grassroots effort by the Taliban and its supporters or a Taliban campaign coordinated from the top. Regardless, the hashtag’s amplification served the Taliban’s broader goals of subverting the Afghan government’s legitimacy, asserting territorial control, and highlighting electoral violence in order to intimidate Afghans from voting. The Taliban’s increasing presence online could suggest a renewed battle for international legitimacy in the information environment.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.