Accounts used random text, including Wikipedia entries and song lyrics, to post anti-Guaidó hashtags on Twitter, in a likely attempt to avoid detection

A Twitter network used random text, including poems, song lyrics, and Wikipedia entries, to amplify hashtags against Venezuela’s Juan Guaidó on Twitter. The network’s actions suggested they engaged in inauthentic behavior to make the hashtags seem more popular and organic than they were, in an attempt to manipulate trending topics on Twitter.

Venezuela is undergoing a prolonged online battle — as a proxy for real-life support — between both the Maduro regime and the opposition. On social media, the regime has a history of using inauthentic tactics online for political gain, including Twitter’s traffic manipulation, the use of fake accounts, and state-backed campaigns on Twitter. Although there was no indication that these accounts were affiliated with the regime, their activity nonetheless indicated that pro-Maduro actors continue to use similar tactics to undermine Venezuela’s opposition coalition.

The DFRLab previously reported on this network, showing that the 112 accounts coordinated to amplify anti-Guaidó hashtags in the aftermath of the Venezuelan National Assembly vote for the presidency of the legislative body on January 5, 2020. (In January 2019, following the disputed national election in late 2018, the National Assembly confirmed Guaidó as “interim president,” allowing him to form an “interim government” that is now recognized by more than 50 countries.) The network amplified hashtags by retweeting, replying, and mentioning each other’s posts. The strategy of using random text unrelated to the hashtag had not been detected in the previous report, however.

The network

The posts that included random text also included the hashtags, thus pushing them to reach Twitter’s trending topics. They were all explicitly anti-Guaidó: the accounts used, for instance, the hashtags #NoQueremosaWaido (“We don’t want Waido,” a pejorative reference to “Guaidó”) and #WaidoEsFracaso (“Waido is a failure”).

Most of the hashtags appeared in response to stories about Guaidó published by media outlets and on social media. Coverage of his recent international tour, which included an appearance as a special guest in U.S. President Donald Trump’s State of the Union address on February 4, received particular attention. News of the interim government’s announcement that they would appoint a presidential commission to oversee the restructuring of the Maduro regime-backed broadcaster Telesur was also targeted by the hashtags.

The accounts may have included the random text as a means of thwarting Twitter’s automated detection tools for platform manipulation, which includes attempts to undermine public conversation through repeated action (e.g., using a hashtag repeatedly). It may also have done so to artificially amplify or suppress information through inauthentic engagements, making content appear more organic or popular than it actually was.

The DFRLab analyzed 22 hashtags posted by the network between January 4 and February 3, 2020. The hashtag used most often was #HastaNuncaWaido (“#SeeYouNeverWaido”), posted on January 5, 2020, the day of the election for the presidency of the National Assembly, followed by #YRctvWaido (“#AndRctvWaido” — RCTV refers to Radio Caracas Television, a Venezuelan media outlet) posted on January 12, after Guaidó announced his intention to restructure Telesur.

The 22 analyzed hashtags were used by 3,530 accounts in total. Most of these accounts tweeted only one of the 22 hashtags, while accounts associated with the network used on average half of them (11 out of 22). The accounts @maritzabarbi and @chepina2020 were the only two profiles to use 21 of the hashtags, which in part contributed to them being the most recurrent accounts among the network. (No account used all 22 of the hashtags.)

Random text included in anti-Guaidó hashtags

Among the text most frequently used alongside the hashtags were articles from different websites and fragments of poems. Some posts also included Wikipedia entries and song lyrics that were often unrelated to Guaidó and to the hashtags.

The accounts used this tactic to create original posts, which other accounts amplified consecutively. The relatively high volume of original tweets created the impression that the traffic was organic, when in fact it was being manipulated by a network.

The accounts @_Monicafer and @stev_nat, for instance, posted text lifted from Wikipedia entries accompanying the hashtags #NoMeImportaTelesur (“I do not care about Telesur”) and #RindeCuentasGuaido (“Be accountable, Guaido”). Both posts showed inconsistencies in the text, such as incomplete sentences and a single letter after a period.

@_Monicafer pulled text from the Wikipedia entry for pro-Maduro Venezuelan news outlet Telesur.

The account @stev_nat, separately, used the Spanish-language Wikipedia entry on the Eiffel Tower in a tweet that also used #RindeCuentasGuaido.

@stev_nat also included a snippet of unrelated poems alongside the hashtag #NoQueremosAWaido (“We do not want Waido”) on January 4, one day before the election for the presidency of the Venezuelan National Assembly. The examples included poems from Argentinian Julio Cortázar and Mexican Octavio Paz.

Other accounts, including @esneyder_2512 and @Cristprr, posted random text using song lyrics while mentioning the hashtags #PrefieroACapriles (“I prefer Capriles”) and #WaidoCriminalInternacional (“Waido International Criminal”).

Other sources of text included articles, bible psalms, and quotes. The accounts @venecophobic, @Kaiserincviper, and @RosschiII, among others, posted some of this content.

Patterns of the network

The accounts involved in the amplification of the hashtags posted at different volumes. A small subset of the accounts posted many tweets, while other accounts tweeted less.

A network analysis, a set of techniques that depicts relations among entities (in this case, Twitter accounts) and analyzes the structures that emerge from these relations, indicated that specific accounts acted to amplify the hashtags by retweeting, replying, and mentioning each other’s posts.

Most hashtag usage followed the same pattern: a small number of accounts posted and amplified hashtags mostly through high-volume retweeting of other accounts that used them.

For the hashtags that garnered the highest number of mentions and that had more accounts involved in amplifying it (#HastaNucaWaido, #YRctvWaido, and #WaidoCriminalInternacional), the most active profiles (by volume of posts) were @Pekytas1, @GladysVal_23, @AlejandraMalav, @nilfredo1978, and @Nebuverso.

Between January 4 and February 3, the period in which the accounts pushed the anti-Guaidó hashtags on Twitter, some accounts promoting these hashtags were either suspended by Twitter or deleted.

Additionally, some accounts have deleted their own tweets mentioning the hashtags or have changed their handles. Based on an account’s Twitter ID, a unique number attributed to each account that does not vary if an account changes its handle, the DFRLab determined that at least 25 accounts changed their handle in this period.

By changing their names, as well as through all of the other behavior outlined above, the accounts likely were attempting to evade Twitter’s enforcement mechanisms.

Follow along for more in-depth analysis from our #DigitalSherlocks.