Nigerian government-aligned Twitter network targets #EndSARS protests

Influencer and sockpuppet Twitter networks amplifying

Nigerian government-aligned Twitter network targets #EndSARS protests

Share this story

Influencer and sockpuppet Twitter networks amplifying pro-government content mount campaign targeting activists

(Source:@jean_leroux/DFRLab via Photoshop and Gephi)

Two networks of Nigerian Twitter accounts are amplifying pro-government content and appear to be staging an online suppression campaign to delegitimize the nationwide #EndSARS protests against police brutality.

From at least late October, 2020, these two networks –comprising a cluster of recently created grassroot sockpuppet accounts, and the second a group of high-follower paid influencers — posted and amplified content and hashtags supporting Nigerian President Muhammadu Buhari and his incumbent political party, the All Progressives Congress (APC). The accounts also shared and amplified content meant to suppress #EndSARS protesters, delegitimize prominent eyewitnesses and vilify local organisations pushing for accountability on the part of government.

The accounts did this by circulating meme-like graphics in a loosely coordinated manner. Over the span of a few minutes to several hours, these images — using the same fonts, colors and graphical elements — would be posted and amplified by both of these networks. The accounts frequently interacted with and amplified each other’s posts through retweets and quote tweets. The accounts coordinated their activity using a distinct set of hashtags, particularly #OneNigeria, #LeadWithLove, #EndViolence, and more recently, #EndViolenceInNigeria.

Considering the scale and persistence of the #EndSARS movement on social media, such a campaign stands to benefit President Buhari and his government. Although there is no direct evidence linking President Buhari’s government to these accounts, the content being shared is strongly biased in favor of President Buhari, his government and the Nigerian armed forces.


The current cycle of #EndSARS activism was sparked on October 4, 2020, when video footage taken near the Wetland Hotel and posted on Twitter claimed the Nigerian Special Anti-Robbery Squad (SARS) shot and killed a young Nigerian man before speeding off in his car. The scale and resilience of the #EndSARS campaign on social media is noteworthy — the hashtag made 302 billion impressions between October 1 and November 18, 2020.

An analysis using Meltwater Explore indicating the volume of tweets using #EndSARS. Between October 1 and November 18, 2020, the hashtag has been used 185 million times by 31.5 million users. A large portion of this traffic was retweets. (Source: Meltwater Explore)

The claims surrounding the Waterfront Hotel video was false, though: it was later revealed the man had jumped from his moving car after being arrested by Delta Safe, a different law enforcement unit from the area. But despite the questionable narrative surrounding the Wetland Hotel video, the incident served as a catalyst: numerous Nigerians shared other videos of police brutality perpetrated by SARS officers against civilians under the same hashtag.

Within a week, nationwide protests were organized to call on the Nigerian government to disband the unit altogether. Within another week, international celebrities and Twitter’s Jack Dorsey rallied behind calls to #EndSARS.

An inflection point was October 20, 2020, at the Lekki toll gate in the south of Lagos. Video footage and social media posts suggested Nigerian soldiers had opened fire at protesters at the toll gate: a DFRLab investigation confirmed that Nigerian soldiers, firing their weapons, could be placed at the scene along with injured civilians. The Nigerian military labelled these initial reports as “fake news.”

While the governor of Lagos has since instituted a commission of inquiry into the incident, fears remain of a possible cover-up. The Nigerian army initially denied deploying any soldiers to the scene at all, but in a series of cascading retractions it later admitted to the deployment, but not opening fire, then subsequently admitting that soldiers fired their rifles, but claimed no live ammunition was used. The Nigerian minister of Justice Abubakar Malami has also suggested that hoodlums dressed in Nigerian military uniforms could be behind the shooting.

It is amid these fears of a cover-up and the rewriting of the narrative by state forces that these suspicious networks of accounts have now surfaced.

Repeat performers

During October and early November 2020, several Twitter accounts began sharing similarly stylized content using a combination of recurring hashtags: #OneNigeria, #LetLoveLead, and #EndViolence. Later, #EndViolenceInNigeria would also be used.

An analysis using Meltwater Explore of tweet volumes mentioning the hashtags #OneNigeria, #LetLoveLead, #EndViolence and #EndViolenceInNigeria. The initial spike on October 1 and October 2 related to the celebration of Nigeria’s 60th year of independence. (Source: Meltwater Explore)

Although some of these hashtags were used organically for real-world events at the time — such as #OneNigeria during celebrations of Nigeria’s 60th year of independence on October 1 and 2 — some of the accounts persistently engaging with these hashtags appeared suspicious. A recurring set of Twitter accounts used the hashtags to post, retweet and quote-tweet meme-like graphics.

The similarities between these images were striking; across multiple topics and subjects, the slides used a similar font, typographical style and artistic assets. This suggested that the content was created centrally for distribution by these accounts.

Examples of similarly stylized content shared by one of the more prominent accounts in the network. Over multiple days, the account posted images using the same typeface, quote-style format and repeated graphical assets. (Source: @mickiebrownkie / archive, top left; @mickiebrownkie / archive, top center; @mickiebrownkiev / archive, top right; @mickiebrownkie / archive, bottom left; @mickiebrownkie / archive, bottom center; @mickiebrownkie / archive, bottom right)

These users’ timelines revealed that they were tweeting the same images in a loosely coordinated way. Although there were slight variations in the accompanying text, the central message remained the same. The accounts also shared the same series of images within a timespan of a few minutes to several hours, again suggesting a very relaxed level of coordination. The accounts also frequently retweeted and quote-tweeted each other’s posts. This behavior could be observed over multiple days.

Screengrabs of examples from these influencer/digital marketing accounts distributing the same images on November 5 (top), November 10, (center) and November 13 (bottom). (Source: @johnfanimokun/archive, left; @mickiebrownkie/archive, center left; @lollylarry1/archive, center right; @cbngov_akin1/archive, right)

In addition, these high-follower accounts were seemingly supported by a group of low-follower sockpuppet accounts. Several of these were recurringly found to have retweeted and quote-tweeted tweets using the hashtags or related images.

Screengrabs from the @abubaka62933112 Twitter account showing the large number of retweets of related content and hashtags. (Source: @abubaka62933112archive)

Content without moderation

Specific examples of campaign “tracks” shared by this network included celebrating the Nigerian army’s victory over Boko Haram rebels; spotlighting infrastructure spending by the incumbent government; and a series of questions delegitimizing Obianuju Catherine Udeh, a popular Nigerian musician and eyewitness to the Lekki toll gate shootings. Shortly after an NGO with links to the Nigerian military provided Amnesty International Nigeria with an ultimatum to leave Nigeria or risk being lynched, this network circulated graphics that labeled Amnesty International “a threat to Nigerian national security.”

The content of these images could be classified into positive, negative and suppressive content. The positive content celebrated the achievements of the incumbent government, the Nigerian armed forces, or President Buhari himself. These were contrasted with negative content that cast doubt on the events of the Lekki shooting, criticized prominent witnesses and targeted the media and NGO’s such as Amnesty International Nigeria, who has been vocal in calling for accountability of the shootings.

Several of the images shared by these accounts took aim at supporters of the protests (left), showed support with the Nigerian armed forces (center) or supported the federal Nigerian government and President Buhari (right). (Source: @iam_ademuyiwa / archive, top left; @mickiebrownkie / archive, bottom left; @iam_demuyiwa / archive, top center; @iam_ademuyiwa / archive, top right; @iam_ademuyiwa / archive, bottom right)

A third category of content seemed aimed at dissuading social media users from participating in the protests. These urged the so-called Soro Soke generation (Yoruba for “Speak louder!”) participating in the protests to reconsider, as they can expect to be outmaneuvered politically by the children of the leaders they are protesting against. This echoed similar narratives delegitimizing the protests, insinuating the protests are an excuse for hooliganism and urging protesters to heed calls for a unified Nigeria.


To explore the nature of this network of accounts, the DFRLab extracted tweets using the hashtags #OneNigeria, #LetLoveLead and #EndViolence for the period from October 30, 2020 until November 12, 2020. The resulting data was visualized as a social network graph using Gephi to identify the most prolific tweeters and the accounts that amplified them. This revealed two distinct networks.

A social network graph of the accounts using #EndViolence, #OneNigerian or #LetLoveLead between October 30 and November 12, 2020. The analysis revealed two distinct networks — a sockpuppet retweet network indicated in green, and a number of pro-government influencers indicated in purple. (Source: @jean_leroux/DFRLab via Gephi)

The first of these networks, indicated in green above, bore hallmarks of a sockpuppet or astroturfing network. These accounts tried to create the impression of grassroots or organic support for tweets using either the hashtags or the related graphics. The accounts retweeted and quote-tweeted each other frequently, creating the dense network seen in the network graph.

The active accounts within this sockpuppet network had relatively small followings, and in some cases their followers consisted mainly of other accounts within the same network. Many of the newer created accounts also used the stock profile picture.

Screengrabs from the Followers tabs for three of the recently created sockpuppet accounts, indicating that the mutual followers are all within the same network. The account creation dates are also indicated in the image above. (Source: @feyiofada / archive, left; @kelvinchinons15 / archive, center; @sirdeeh12 / archive, right)

One of the most prolific accounts in this network (@abubaka62933112) was created five days after the Lekki toll gate shooting, but has to date tweeted 846 times. Of these tweets, 95% were retweets or quote-tweets of accounts which form a part of this network.

Screengrabs from the @abubaka62933112 Twitter account showing the largest portion of retweets by the account were of accounts identified within this network. All of the top nine most retweeted accounts were identified within the full network. (Source: @abubaka62933112 / archive @jean_leroux/DFRLab via TruthNest)

Some of the accounts in this network were created recently, and even in short succession: for example, three of the accounts in this network — @abuduwyinmi, @FeyiOfada, and @FardaGobir- were created within the span of five minutes. There are indications that at least two of these accounts were created using the same mobile phone number.

Screengrabs from several accounts that engaged with related hashtags revealed that many of these accounts were recently created, some in short succession. These accounts used profile images and banners related to the imagery used as well. (Source: @abuduweyinmi / archive, top left; @feyiofada / archive, top center; @faridagobir / archive, top right; @kelvinchinons15 / archive, bottom left; @ene_uk / archive, bottom center; @sirdeeh12 / archive, bottom right)

The account creation dates for this part of the network varied, and not all of them were newly created. Some of the accounts were created as far back as 2014, but only recently returned from extended periods of inactivity to engage exclusively with the same hashtags and graphics.

Screengrabs from the accounts for @Mr_eemraan (left) and @princpogu (right) indicating the extended periods of inactivity. A timeline of their recent activity corroborates their sudden reappearance. (Source: @mr_eemraan/archive, left; @princepogu/archive, right; via Twitonomy)

There are also indications that multiple Twitter accounts are being created and used within the network; examples such as @faysal306/@306faysal, @1unitednaija/@1unitednaija1, and @aliyuAfar/@aliyuafaru were found within the network.

Screengrabs from several accounts that appear to be duplicated accounts acting as sockpuppets for the network. The accounts engaged with related content and hashtags (indicated in red) and retweeted other accounts in both networks. (Source: @faysal306/archive, top right; @306faysal/archive, bottom right; @1UnitedNaija1/archive, top center; @1unitednaija/archive, bottom center; @aliyuafaru/archive, top right; @AliyuAfar/archive, bottom right)


The second portion of the network consisted of a group of highly active influencer and digital marketer accounts with relatively high followings. Some of these accounts are overtly aligned with the incumbent government and President Buhari, while others were paid marketers.

Screengrabs of the profiles of several of the prominent accounts in the influencer/paid marketer network. These accounts were either open about their communication and paid marketing roles (yellow) or overtly supportive of the Nigerian government (red). (Source: @scarfizal/archive, top left; @mickiebrownkie/archive, top center; @lollylarry1/archive, top right; @johnfanimokun/archive, bottom left; @cbngov_akin1/archive, bottom center; @iam_ademuyiwa/archive, bottom right.)

These accounts were very prominent in the network of tweets, likely as a result of their substantial followings. Whereas the sockpuppet accounts had mostly single digit follower numbers, these accounts had substantially more: the most prominent accounts had at least 20,000 followers, with the largest clearing just north of 81,000 followers. This is evidenced in the large number of engagements their accounts were responsible for within the network, visible as the size of their respective nodes.

A network analysis revealed the second group consisted of high-follower paid influencer and digital marketing accounts amplifying the hashtags and graphics related to the broader campaign. The size of each account indicates the account’s degree, or level of interaction with the hashtags in the network. (Source: @jean_leroux/DFRLab via Gephi)

As already demonstrated, these accounts posted the same content related to the campaign in a loosely coordinated manner. Their activity does not appear to be either fake or automated, but instead present as real social media influencers that are participating in this campaign.


This network appears to be an attempted counter of the #EndSARS movement’s popularity online, combining a mixture of social media influencers and sockpuppet accounts to amplify content beneficial to the Nigerian armed forces, President Buhari and the Nigerian government. At the same time, these accounts cast doubt at the legitimacy of the protests and the demands underpinning them.

This behavior is deceptive, and creates the impression of support for this content where there is little authentic support for it. There are also indications that the network is expanding: new sockpuppet accounts have already joined the accounts indicated here since our research began.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab and is based in Cape Town.

The DFRLab team in Cape Town works in partnership with Code for Africa.

Follow along for more in-depth analysis from our #DigitalSherlocks.