Amid the disagreement on whether former Bolivian President Evo Morales’ recent ouster was a coup or the will of the Bolivian people, a group of 1,435 Twitter accounts pushed anti-Morales and coup-denying messaging. Some investigators alleged that these accounts were part of a large-scale bot operation.

The controversy about whether a coup had occurred has critical implications for Bolivia’s political future: as of November 21, at least 32 people have died — some, according to witnesses, at the hands of police and security forces — in ongoing protests about Morales and the new government. The debate has inflamed preexisting ethnic and religious divides: many Indigenous people are protesting in support of Morales, while the interim president has taken steps to negate some of the gains made by Indigenous Bolivians under Morales.

Although accusations of bot activity proliferated, the DFRLab found evidence of traffic manipulation. From November 10–12, a DFRLab analysis identified a total of four copypastas — blocks of copy-and-pasted text — that pushed the same narrative: Morales was illegitimate and his ouster was not a coup. The accounts also used around 50 newly created hashtags, which they spammed along with identical imagery in an effort to manipulate traffic.

The evidence for a large-scale coordinated botnet involved in pushing these copypastas, however, was less apparent. Some of the accounts displayed several of the indicators of bot-like activity but lacked others. Other accounts furnished evidence of human activity when singled out for being automated. The most widely publicized reposted message, spread across social media, became a meme suggesting that there was American intervention to initiate a coup in Bolivia. To complicate matters further, the Kremlin-linked media company Redfish began pushing the narrative that a large-scale bot network was manipulating online traffic regarding recent events in Bolivia, potentially weaponizing the discussion of social media manipulation.

The accounts posting the copypastas deployed a textbook narrative manipulation technique: flooding, which involves pushing a high volume of information — in this case in the form of tweeting at scale and hashtag amplification. This technique is often used to create the false perception that a particular campaign or viewpoint has more popular support than it genuinely has. While Twitter is used by 22 percent of Americans, it is less popular in Bolivia and Latin America, in general. According to the 2018 Latinobarómetro, only 9 percent of Bolivians use Twitter, compared to 12 percent of Latin America as a whole. It is therefore possible, as in much of the rest of the world, that the Bolivians using Twitter are not representative of broad-scale public sentiment in Bolivia.

Twitter users identified one of the reposted messages and its artificial amplification the same day as Morales’ resignation. Many identified possible bot accounts with varying degrees of accuracy. Other reposted messages perpetuating the narrative escaped notice.

Popular copypasta: “Friends from everywhere…”

The most widely shared reposted message denied that a coup had occurred in Bolivia, casted Morales’ government as illegitimate, and described the recent events as a popular uprising to preserve democracy. The text read, in English:

Examples of the reposted content:

Between November 10 and the morning of November 12, a social media scan by social media listening tool Sysomos indicated that there were 1,606 tweets or retweets of an almost identical message that included the phrase, “friends from everywhere, in bolivia there was no coup.” Of these, 401 were tweets and 1,206 were retweets, and 1,263 unique Twitter accounts helped amplify the phrase.

Out of the entire Sysomos dataset, 110 accounts (8.7 percent) were created in November 2019, and, of those, 10 were created the day of Morales’ resignation (November 10) and 77 accounts on November 11.

At the time of the Sysomos scan on November 12, 43 unique accounts had zero followers and/or were following zero other accounts. As of November 13, only 36 of the 43 remained online. A majority of this smaller subset of 36 accounts — 86 percent, or 31 accounts — were created the day following Morales’ resignation.

The copypasta message was not just confined to the text of tweets. Many users posted the same “friends from everywhere” message in images. Some of the images seemed designed to look unique, as if they were coming from disparate sources, even though they contained identical text.

In other cases, identical images were disseminated by numerous unique accounts.

Amplification of copy-and-pasted content within a short period of time, which all of the accounts engaged in here, is an indicator of inauthentic activity. One of the accounts in the Sysomos set, @Erika12397452, demonstrated bot-like behavior. The account tweeted and/or retweeted the phrase 42 times, was anonymous, had an alphanumeric handle, had no followers, and was following no accounts.

The “friends from everywhere” copypasta, however, also benefited from amplification by bonafide users. The top amplifier in this dataset was @Todd_Bonzales, a seemingly real user who retweeted the phrases for his own “Fascist copypasta shame thread.”

Skeptical Twitter users quickly identified the “friends from everywhere” message as copypasta.

After being widely shared on Twitter, the “friends from everywhere” started to iterate into users’ jokes. Accounts added their own variations of it, riffing off of current memes, and the narrative became part of a broader Twitter joke about the heavy-handed involvement of the United States in a perceived Bolivian coup.

The joke spread beyond Twitter as well, showing up on both Facebook and Reddit. While the intended effect of the copypasta was likely to sway users into thinking there had not been a coup, it seems that the opposite effect occurred. Clear evidence that anti-Morales, coup-denying narratives were amplified on Twitter, in part by bot accounts, appears to have convinced some users that there was indeed a coup in Bolivia.

While broad attention has been paid to the “friends from everywhere” copypasta, several other messages were reposted that furthered the same narratives, denying the coup and casting Morales as illegitimate. One such message stated:

Specific examples included slight variations in the latter half of the message.

A Sysomos scan of tweeted messages that included the phrase “I denounce to the world that the government” from November 10–12 brought up 184 results. Of these, the majority were retweets, not tweets. There were 132 unique accounts, and the most common creation date was November 11, 2019.

Six accounts in this dataset did not have any followers. These accounts all have several bot-like or botnet indicators: all of them were created on November 11; all had no identifying profile imagery (either stock photos or none at all); all solely tweeted and retweeted about the coup, Morales, and Bolivia, sharing extremely similar tweets and the same hashtags; and all only liked tweets on these topics. Three of the accounts had usernames that were followed by random strings of numbers. It is thus likely that all of these accounts are bots, and it is possible that they were part of a botnet.

One of these accounts, @Pamela85758345, had also tweeted the “friends from everywhere” copypasta.

As of November 21, there have been only six tweets with the phrase after November 12, possibly suggesting that the message is no longer relevant or useful to propagate. The majority of tweets with the phrase were tweeted November 11.

On a much smaller magnitude, a similar copypasta also proliferated in Spanish. One message focused on Morales’s illegitimacy as a leader by referencing specific articles of the Bolivian Constitution. This message was reposted in independent tweets 46 times and retweeted 32 times between November 10–12, according to a Sysomos scan that pulled out tweets that included the phrase “Evo incumplió El Art. 168 de la CPE” (“Evo violated Article 168 of the Constitution”).

Another Spanish copypasta, including the phrase “Todo lo que sale de su boca es mentira” (“Everything that leaves his mouth is a lie”), a reference to Morales’s supposed lying, was tweeted nine times and retweeted once, according to a Sysomos scan from November 10–12.

Many accounts slightly varied the wording in disseminating all of these copypasta messages.

These slight variations make it more challenging to search for repeated posts quickly, since avoiding detection can be achieved by inserting a single word or character in an otherwise identical message. If these slight variations had been accounted for in the Sysomos scans, the number of reposted messages for all four of these copypastas is higher. In total, 1,435 accounts tweeted out one or more of these four reposted messages.

Many Twitter users were quick to identify the accounts that spread these reposted messages as bots. Journalists such as Ben Norton identified coup-denying accounts as bots based on account creation dates and alphanumerical handles.

While these elements are indicators of bot-like activity, they are seldom conclusive on their own. Nuance is critical in identifying possible bot activity, and the burden of evidence is high in order to make a confident assessment. Even accounts with many bot indicators can still involve a human-run element. In a recent case in Brazil, a Twitter account that was publicly accused of being a bot turned out to have allegedly been run by a grandmother; it is likely that her account was actually a cyborg: a partially human-run, partially automated account.

Similar to the Brazilian “granny bot” case, after a Twitter sleuth accused an account of being an account tweeting about Bolivia of being a bot, the so-called “obvious bot” posted a video of the operator in an attempt to prove that there was a real person behind the account.

Whether or not the accounts were bots, it is clear that suspicious activity was present in other ways. Traffic manipulation can occur with real or bot accounts, and the same four messages that denied a coup had occurred and condemned Morales were spread by over 1,400 accounts.

The meta-narrative that all of the accounts that are pushing the anti-Morales, no-coup narrative must be bots could unwittingly mean users are falling into another propaganda trap. As researcher Josh Russell correctly pointed out, one of the Twitter accounts sharing the suspicious amplification of the “friends from everywhere” copypasta is a Russian-funded media outlet.

RT, another Kremlin-owned media organization, also reported on the “bots,” based solely off of one Twitter user’s assessment.

The DFRLab identified four copypasta messages on Twitter that amplified anti-Morales, coup-denying narratives through a total of at least 1,435 accounts, including some bot accounts. The entities behind the accounts are unknown. Although there was some overlap in the accounts involved in the copypastas, the DFRLab did not find other evidence to suggest that the messages were run from the same source.

After discovering the amplified anti-Morales, coup denial narrative, Twitter users identified bot accounts with varying degrees of success. While the intended effects of the copypastas was likely to convince users there had not been a coup, the fact that the message was suspiciously amplified seems to have convinced some users that there was indeed a coup in Bolivia, as evinced in the memes users made.

This article is by no means exhaustive, and likely represents only the tip of the iceberg of Twitter manipulation that has occurred around events in Bolivia over the past few weeks. There is an opportunity for the public to build on these efforts to uncover suspicious activity through open-source research. In this case, the attempt to push a no-coup narrative backfired, was lampooned on social media, and possibly had the opposite of the intended effect by further convincing skeptical users that there had been coup.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.