A DFRLab analysis of social media trends before and after Brazil’s October 2022 presidential runoff found that claims of electoral fraud targeting the Superior Electoral Court, as well as narratives about military intervention, led to a spike in polarizing content on social media, including nationalist extremism and demands for a military coup.

An analysis of one of the main hashtags pushed by pro-Bolsonaro supporters on Twitter, #BrazilWasStolen, showed signs of inauthentic behavior, including a high concentration of tweets in a small group of users and highly active, newly created accounts. #BrazilWasStolen was also amplified well beyond Twitter, Facebook and Instagram; this cross-platform activity included content on alternative platforms, such as Telegram, TikTok, Rumble, Odysee, as well as a presence on Twitch and Spotify.

Brazilian voters elected leftist Lula da Silva on October 30, 2022 with 50.9 percent of the vote, compared to 49.1 percent received by the incumbent president, Jair Bolsonaro. After the election, pro-Bolsonaro supporters took to the streets to demonstrate and protest against the presidential results across different cities in Brazil, claiming electoral fraud and asking for military intervention to stop Lula’s transition to office. Two days after the election, Bolsonaro acknowledged his administration would cooperate with the presidential transition, but avoided any mention of defeat.

According to a search query using the social media monitoring tool Meltwater Explore, between June 1 and November 9, 2022, there were around 530,000 Twitter posts in Portuguese containing the keywords eleições (elections) and fraude (fraud). These claims of electoral fraud spiked on October 30, 2022, after the election runoff. Nearly 100,000 of these posts included at least one of the following keywords: TSE (Tribunal Superior Eleitoral, the Supreme Electoral Court), forças armadas (armed forces), militares (military), golpe (coup), and crime eleitoral (electoral crime).

Although Twitter mentions of these terms significantly increased in early November, there was also a prior spike in mid-July, after Bolsonaro targeted the TSE and ballot box security during a meeting with ambassadors. Bolsonaro also suggested that the armed forces should have a more active role during the electoral process. These claims generated further distrust in the electoral system, leading to social media narratives focusing on a potential coup ahead of the elections. Brazilian media outlets like Folha de S. Paulo also highlighted concerns around such narratives.

On October 30, 2022, after Lula defeated Bolsonaro in the runoff election, pro-Bolsonaro supporters took to the streets across the country. As previously noted, many protesters demanded military intervention amidst claims of electoral fraud. On Telegram and Twitter, accounts published content encouraging protesters to continue demonstrating. Crowds of Bolsonaro supporters gathered outside military outposts across the country to press for their intervention.

On social media, especially on Twitter, a video circulated showing protesters singing Brazil’s National Anthem in the city of São Miguel do Oeste, in Santa Catarina state. Some Twitter users noted the video appeared to show protesters doing a Nazi salute. At the time of writing, the video had garnered more than 12 million views.

After this video received a high volume of social media engagement, the Israel embassy in Brazil tweeted their concerns about the events in São Miguel do Oeste and asked authorities to investigate the matter.

The Santa Catarina public prosecutor’s office claimed the protesters’ gesture occurred after being asked to extend their hand on the shoulder of the person in front of them and was not an intentional Nazi salute. This did not settle the matter, though, as many individuals in the video engaged in the gesture without appearing to reach out to people’s shoulders in front of them.

At the time of writing, social media accounts continue amplifying electoral fraud narratives, promoting new protests, and demanding a military intervention, despite Bolsonaro’s announcement that he accepted the election results and the armed forces stating that they did not find any evidence of electoral fraud.

The DFRLab analyzed hashtags associated with electoral fraud narratives. Some of these hashtags contained keywords related to the armed forces and military intervention, while others included terms relative to the protests and electoral fraud narratives. Most of these posts were driven by conservative Twitter accounts linked to Brazil’s far right, as well as by newly created anonymous accounts that primarily amplified the hashtags.

For example, the hashtag #BrazilWasStolen trended on Twitter around 6pm BST on November 4, garnering nearly 750,000 mentions that day. At some moments, the hashtag appeared on more than fifty Twitter posts per second, a possible sign of platform manipulation. By November 9, #BrazilWasStolen had gathered more than 1.5 million mentions.

There were also indications of coordination around the intervals of each Twitter post. After analyzing the hashtag’s amplification by the 1,000 most active accounts, the DFRLab found that most of the tweets by these accounts were published within three to five seconds of each other, which could indicate a coordinated attempt to push #BrazilWasStolen into the trending topics.

The activity of this hashtag showed a high volume of newly created accounts. Around 10 percent of all accounts that engaged with the #BrazilWasStolen hashtag were created following the election runoff. Although this could be explained by new Twitter users joining the conversation around Brazil’s presidential election, these accounts also showed signs of coordination based on creation dates. Most notably, around 25 percent of these new accounts were created within five seconds of each other, while 88 percent were created within one minute. These newly created accounts were responsible for nearly 5 percent of all tweets containing the hashtag on November 4, when #BrazilWasStolen trended on Twitter.

An analysis of traffic proportion by 10 percent of the most-active accounts using the hashtag, showed that this set of accounts was responsible for nearly 60 percent of the hashtag’s total traffic. Some of the most-active accounts amplified the hashtag more than 300 times in one day, mostly through retweets. To explore the activity of this hashtag during November 4, the DFRLab measured the traffic proportion by the most-active 10 percent of the accounts between 6pm and 12am BST. In all cases, these accounts were responsible for more than 45 percent of the traffic flow.

The hashtag #BrazilWasStolen was also amplified beyond Twitter, including Instagram, Telegram, TikTok, Odysee, and Rumble, as well as on its own website, which was registered the same day the hashtag trended on Twitter.

The narrative gained steam after far-right Argentinian media outlet La Derecha Diario (“The Right Journal”) streamed a live video on YouTube titled #BrasilWasStolen. The live stream was presented by Argentinian Fernando Cerimedo, a self-described digital marketing specialist on Twitter and associate to Congressman Eduardo Bolsonaro, son of Jair Bolsonaro. During the video, Cerimedo amplified claims of electoral fraud during Brazil’s presidential election, particularly regarding ballot box security. The video garnered more than 50,000 engagements on Facebook and Twitter. At the time of writing, La Derecha Diario had set the video to private, but the DFRLab was able to confirm that the live stream started at 4:47pm BST on November 4, approximately one hour before the narrative trended on Twitter largely through inauthentic means.

Despite the video going private on YouTube, social media accounts shared copies of it on TikTok, Telegram and Twitter, as well as on video hosting services such as Odysee, Rumble, BitChute, and CloutHub. The audio of the video was also published on Spotify as a single podcast episode. By November 9, the hashtag #BrazilWasStolen had reached more than 1 million views on TikTok.

Social media accounts, including users on Instagram, Telegram, and Twitch, have also transformed the #BrazilWasStolen hashtag into usernames. One such account was removed by Twitch for unspecified violations, but a replacement account has garnered more than 2,000 followers.

On Telegram, channels using BrazilWasStolen either in their name or title amassed more than 4,000 subscribers. These channels, many of which were created after the presidential runoff share content from other channels amplifying electoral fraud narratives. Some of the newly created Telegram channels have included other keywords used by pro-Bolsonaro protesters, including “Brazilianspring,” “help Brazil,” and “intervenção pelo Brasil” (“intervention in Brazil”).

Although the BrazilWasStolen operation used Twitter to drive an election-related disinformation campaign in the aftermath of the Brazilian presidential elections, this narrative has expanded across multiple social media platforms, especially online video hosting platforms that described themselves as offering freedom of expression.

Esteban Ponce de León, “Election fraud narratives surge on Brazilian Twitter following Bolsonaro defeat,” Digital Forensic Research Lab (DFRLab), November 16, 2022, https://medium.com/dfrlab/election-fraud-narratives-surge-on-brazilian-twitter-following-bolsonaro-defeat-e1876a45a137.