Influence operation promoted Brazilian President Jair Bolsonaro and attacked his rivals

Facebook announced on July 8, 2020, that it removed a network of accounts, pages, and one group closely connected to Brazilian President Jair Bolsonaro and the party that propelled him into office, the right-wing Social Liberal Party (PSL).

The company stated the network is linked to employees of the offices of Bolsonaro and his sons Eduardo and Flávio Bolsonaro — who serve in Brazil’s Lower House and the Senate, respectively — as well as two PSL state lawmakers, Alana Passos and Anderson Moraes. The DFRLab could not confirm the links to Flávio Bolsonaro, but found that one member of the network is connected to a third son, Carlos Bolsonaro, and another is employed by Coronel Nishikawa, also a state legislator from PSL. The assets removed had a combined audience of more than 2 million accounts.

Over the course of his 2018 election campaign, Jair Bolsonaro’s political rivals — including former allies and members of his government — faced targeted online attacks and harassment. These attacks did not abate when Bolsonaro was sworn into office; if anything, they were granted institutional legitimacy. According to former Bolsonaro insiders, a group of Bolsonaro allies dubbed the “Hatred Cabinet” is currently involved in the coordination of harassment and disinformation campaigns targeting politicians, public officials, and journalists critical of Bolsonaro, with rumored institutional backing. Information manipulation, including disinformation, is a central part of this strategy.

Brazil’s Supreme Court has investigated the financing of disinformation and harassment campaigns against the court and its ministers. On May 27, 2020, the Federal Police conducted raids to execute 29 search warrants against businessmen and influencers as part of the Supreme Court inquiry. The Supreme Court decision mentioned a Twitter account (@bolsoneas) that happens to be owned by one of the people responsible for pages and accounts subsequently removed by Facebook. As members of his inner circle face a number of open investigations into suspected wrongdoing, Bolsonaro has waged a political battle against the Supreme Court and Congress. Online attacks against these institutions and their members have translated offline, as supporters of the president engage in aggressive street protests calling for their closure.

According to Facebook, the set of 88 assets — 14 Facebook pages, 35 personal accounts, 38 Instagram pages, and one group — were engaged in coordinated inauthentic behavior by running a network that worked to deceive domestic audiences systematically by concealing the operators’ identities. In its official announcement, Facebook stated:

This network consisted of several clusters of connected activity that relied on a combination of duplicate and fake accounts — some of which had been detected and disabled by our automated systems — to evade enforcement, create fictitious personas posing as reporters, post content, and manage Pages masquerading as news outlets. They posted about local news and events including domestic politics and elections, political memes, criticism of the political opposition, media organizations and journalists, and most recently they posted about the coronavirus pandemic. Some of the content posted by this network had already been taken down for Community Standards violations including hate speech.

We found this activity as part of our investigation into suspected coordinated inauthentic behavior in Brazil reported on by press and referenced in recent congressional testimony in Brazil. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to individuals associated with the Social Liberal Party and some of the employees of the offices of Anderson Moraes, Alana Passos, Eduardo Bolsonaro, Flavio Bolsonaro and Jair Bolsonaro.

The DFRLab had access to a subset of 80 assets before they were removed from the platform as a result of its partnership with Facebook monitoring election interference. Among the assets were duplicate and fake accounts that promoted Bolsonaro and his allies in various Facebook groups, as well as pages with hundreds of thousand followers that published pro-Bolsonaro memes and other content disparaging his critics. While the pages did not openly state that they were connected to Bolsonaro and his allies, several were linked to staffers of pro-Bolsonaro politicians. Notably, the staffers’ involvement in the operation may indicate a potential misuse of public funds, as many of the posts were published during working hours.

Part of the network was created prior to the 2018 election and acted to promote Bolsonaro and attack his opponents during the campaign, sometimes employing hyperpartisan media outlets. This behavior is consistent with accounts of how the alleged Hatred Cabinet operates. More recently, some of the accounts attacked the Congress and the Supreme Court and were, much like Bolsonaro, pushing the idea that COVID-19 was not a serious threat, suggesting that Brazil should not adopt social distancing measures. As of July 7, 2020, Brazil has recorded more than 66,800 deaths and 1.67 million cases of COVID‑19, including Jair Bolsonaro himself.

The players

The DFRLab was able to recreate the network of assets by observing common ownership, followers, and like patterns among them.

The assets in the network belonged to several clusters, which the DFRLab divided by the cities in which the staffers operating them were based: Brasilia, Rio de Janeiro, and São Bernardo do Campo. The largest subset of the network appeared to be connected to the Rio de Janeiro operation, linked to Rio congressmembers Alana Passos and Anderson Moraes. President Bolsonaro used to live in Rio and was a congressmember representing the state for almost 30 years.

These subsets each employed unique strategies that distinguished them from one another. While the Rio and São Bernardo sets made prominent use of duplicate and fake accounts, the DFRLab identified few fake profiles in the Brasília cluster. Additionally, the Rio and the São Bernardo clusters operated hyperpartisan external media outlets, which was not the case of the Brasília cluster.

In all, current and former staffers of five government officials were identified by the DFRLab as connected to the operation, including staff of President Jair Bolsonaro; two of his sons, Eduardo and Carlos Bolsonaro; Alana Passos and Anderson Moraes, members of the Rio de Janeiro state legislative house; and Coronel Nishikawa, a São Paulo state legislator. Facebook also mentioned employees of Flávio Bolsonaro, but this finding could not be corroborated by the DFRLab as the assets connected to him were no longer on the platform and therefore not part of the set that it analyzed. Meanwhile, Facebook did not mention Carlos Bolsonaro in their official statement, but the DFRLab found that one of the staffers involved in the operation used to work for him. Coronel Nishikawa was also not mentioned by Facebook.

None of these officials had their personal accounts removed, and Facebook did not find on-platform evidence connecting them directly to the inauthentic accounts. The operators of the scheme, however, include members of their current and former staff, some of whom had their accounts removed by Facebook.

The only operator who is directly employed by Bolsonaro was Tercio Arnaud Tomaz, an advisor in the president’s office. Arnaud is better known as the manager of the popular Facebook page “Bolsonaro Oppressor 2.0,” a pro-Bolsonaro Facebook page that had some 1 million followers but is currently offline. In 2019, media outlets revealed that, despite being listed as a staffer of Carlos Bolsonaro in Rio’s City Council, Arnaud was instead working with the digital communications team for Bolsonaro’s presidential campaign.

Arnaud currently works in an office meters away from Bolsonaro’s presidential office, according to media reports, and has a monthly salary of R$13,600 (around $2,400 USD). According to former Bolsonaro allies, the so-called Hatred Cabinet is allegedly run by Arnaud, alongside two other staffers: José Matheus Salles Gomes and Mateus Matos Diniz.

A staffer to Eduardo Bolsonaro, Paulo Eduardo Lopes, better known as Paulo Chuchu, appears as one of the main network operators. Paulo Chuchu is the leader of Alliance for Brazil in the city of São Bernardo do Campo, in the greater São Paulo area. Chuchu is employed by Eduardo Bolsonaro and receives a salary of R$7,800 ($1,400 USD) per month. On his official Facebook page, which was not removed as part of this takedown, Chuchu states he has worked for the Bolsonaro family for five years.

Two accounts that bore the name of Eduardo Guimarães — another Eduardo Bolsonaro staffer — were also removed. As neither of these accounts included images of Guimarães or other identifying information, however, the DFRLab was not able to confirm the accounts were connected to him. According to a document discussed during the congressional inquiry, Guimarães used to run a well-known, now-defunct Instagram page called “Bolsofeios,” which posted content similar to that of the pages in this network.

Two operators of the network are connected to Rio State legislators Alana Passos and Anderson Moraes. Meanwhile, Leonardo Rodrigues de Barros Neto, also known as Leonardo Bolsoneas, created the “Bolsoneas” pages on Facebook and Instagram. Bolsoneas is a portmanteau of Bolsonaro and the first name of Enéas Ferreira Carneiro, a former conservative politician in Brazil who is now deceased.

Until April 2020, Leonardo worked for Congressperson Passos, who belongs to Bolsonaro’s former party, PSL. While a staffer for Passos, he received a salary of roughly R$5,000 (about $960 USD) per month.

Meanwhile, Vanessa Navarro, Leonardo’s girlfriend, works for Anderson Moraes at Alerj, the Rio State Assembly. She receives a monthly salary of about R$2,000 (around $380 USD). Bolsonaro appears to have personal connections with the couple, as he sent videos praising Leonardo for the Bolsoneas page and one congratulating Vanessa for her birthday, which the page later posted. The Bolsoneas Twitter page appears in the “fake news” investigation of the Supreme Court. Leonardo was not among the people targeted by police raids on May 27, but the court nonetheless demanded that Twitter give them details about the page’s registration. Twitter suspended the Bolsoneas account on July 7.

Finally, one operator of the scheme was connected to São Paulo state lawmaker Coronel Nishikawa, also of the PSL party, who has his main constituency in the São Bernardo do Campo region. One of his employees, Jonathan William Benetti, used fake accounts to boost content supportive of Bolsonaro and Nishikawa. Two of Benetti’s accounts included Bolsonaro posters, one of which is an image that depicts the president with Nishikawa.

Leonardo Bolsoneas and Vanessa Navarro used a similar fake account strategy, and appear to be connected to 13 accounts that all use variations of their names. These accounts were used to post pro-Bolsonaro content across different groups and pages.

Some of the fake accounts in the network were used to post positive messages about Bolsonaro and his allies in various Facebook groups, including groups not dedicated to politics. Additionally, an inauthentic account was an administrator of one group and one page that worked to promote Bolsonaro; all three assets were removed by Facebook.

Memes and targeted attacks

Many pages in the set were dedicated to publishing memes and pro-Bolsonaro content while attacking political rivals.

One of these pages was the Instagram page @bolsonaronewsss. The page is anonymous, but registration information found in the page’s source code confirms that it belongs to Tercio Arnaud. @bolsonaronewsss had some 492,000 followers and more than 11,000 posts.

The content was misleading in many cases, employing a mix of half-truths to arrive at false conclusions. The account claimed that the reaction to the COVID-19 pandemic was exaggerated, and that hydroxychloroquine, a drug heavily promoted by Bolsonaro as a coronavirus cure, could kill the virus. To support these claims, the accounts cited the World Health Organization’s initial statement that asymptomatic spread of COVID-19 was “very rare” without including its subsequent clarification that scientists have yet to determine the frequency of asymptomatic transmission. The page also highlighted the retraction of a major Lancet study that raised safety and efficacy concerns about the use of hydroxychloroquine to treat COVID-19, but it did not explain that there is still no conclusive scientific evidence that the drug is an effective or safe treatment for the virus.

A companion Facebook page, also called “Bolsonaro News,” shared the same content as the Instagram page.

The “Bolsonaro News” pages, particularly on Instagram, also used memes to attack former allies of Bolsonaro, a tactic of the alleged Hatred Cabinet revealed in the course of the congressional inquiry. This behavior persisted throughout the 2018 election campaign and continued after Bolsonaro assumed office.

Many of these posts were published during working hours, which might be an indication that Tercio Arnaud was posting on this website — which is not officially connected to the Presidency — during official office hours.

Some pages removed by Facebook also used memes and images to attack the Supreme Court. The “Bolsoneas” Facebook page, for instance, published an article quoting former Culture Secretary Regina Duarte as saying the Supreme Court should be closed; the page suggested that this statement was one of the reasons it supported Duarte. Furthermore, an Instagram page named “Direita Zona Norte RJ,” connected to the Rio de Janeiro cluster, used the hashtag #STFVergonhaNacional (“Supreme Court, national shame”), while Vanessa Navarro used the hashtag #STFEscritóriodoCrime (“STF Crime Office”). Both hashtags were among search terms the Supreme Court included in its investigation and mapping of coordinated online attacks against the institution.

Amplifying hyperpartisan websites

Two of the largest assets in the network, the “Bolsoneas” Instagram and Facebook pages created by Leonardo Rodrigues de Barros Neto, also levied attacks against Bolsonaro’s political rivals. But unlike the “Bolsonaro News” assets, the “Bolsonéas” accounts relied on headlines and hyperpartisan websites characterizing themselves as media outlets, in addition to posting memes.

The combined follower count of both pages was more than 1 million people. On Twitter, meanwhile, an account with the same name that posted the same content has over 200,000 followers. On May 27, 2020, the Supreme Court demanded that Twitter should release information about the owner of the account.

Most of the amplified websites page were familiar players in Brazil’s hyperpartisan media ecosystem, with the exception of one: Jogo Político, Portuguese for “Political Game.”

Jogo Político describes itself as an “independent digital outlet formed by authors that have access to the news behind the scenes.” WHOIS data, however, lists Leonardo Rodrigues as its owner, indicating that, in addition to the “Bolsonéas” pages, Leonardo is also behind the Instagram and Facebook Jogo Político pages that Facebook removed as a part of this takedown.

The Jogo Político website started publishing on April 23, 2020, but the Facebook page was created several days prior on April 17. As they were relatively new, these assets were not able to amass a significant number of followers before they were taken down, but the evidence demonstrates that this network expanded beyond Facebook.

Off-platform assets also appeared in the cluster of the network connected to Eduardo Bolsonaro. Paulo Chuchu owns a website called The Brazilian Post, which also had its Facebook and Instagram pages removed. The pages, as well as the website, promoted Alliance for Brazil in the city of São Bernardo do Campo, as well attacked the party’s rivals and the local press. On Facebook, “The Brazilian Post” was also responsible for creating a public group called “News from São Bernardo do Campo.” The group, however, did not publicly state that is was connected to the Bolsonaro family.

Jair Bolsonaro has often invoked the specter of “fake news” as a political cudgel, accusing his opponents of staging disinformation campaigns in an effort to undermine his administration. This rhetorical device is a favorite of modern strongmen because it serves a dual purpose, at once rallying the political base and silencing opponents and watchdogs working to expose government corruption.

Several members of Bolsonaro’s inner circle are currently under investigation by the Supreme Court for alleged wrongdoing, including the orchestration of political harassment campaigns against the court’s justices. These probes have only prompted Bolsonaro to escalate his political attacks on the court, a move that many Brazilians consider an affront to judicial independence.

Bolsonaro’s allies have previously been accused of running information operations, but this is the first time their staffers have been connected to inauthentic accounts. This network steered a significant and longstanding operation, stretching back to at least the 2018 presidential campaign and having amassed an audience of millions, that fused political spin and disinformation with targeted online harassment — a recipe apparently perfected by the alleged Hatred Cabinet and detailed in the ongoing congressional inquiry.

Luiza Bandeira is a Research Associate, Latin America, with the Digital Forensic Research Lab.

Esteban Ponce de León is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Zarine Kharazian is Assistant Editor with @DFRLab and is based in Washington, DC.

Jean le Roux is a Research Associate, Sub-Saharan Africa, with the Digital Forensic Research Lab.