BANNER: Supporters of Guatemalan anti-graft presidential candidate Bernardo Arevalo, celebrate following his victory in the presidential run-off election, in Guatemala City, Guatemala August 20, 2023. (Source: Reuters/Pilar Olivares)

In August 2023, Guatemala held its presidential run-off, ending an election season plagued by politically motivated criminal investigations that impacted campaigns and undermined trust in electoral institutions. Facebook pages posing as Guatemalan media and nongovernmental organizations amplified content that originated on Telegram and X (aka Twitter) to attack presidential candidate Bernardo Arevalo and other members of the leading political party, Movimiento Semilla (“Seed Movement”). The DFRLab found evidence of connections between media outlets, websites, and other social media accounts managed by people linked to operations targeting previous elections, political parties, and journalists.

Arevalo, who led a campaign advocating against corruption, won the election on August 20, 2023, garnering around 60 percent of the vote. Arevalo defeated conservative candidate Sandra Torres, who garnered 39 percent of the votes on her third attempt at winning the presidency. At the time of writing, Torres, ex-wife of late President Álvaro Colom, has refused to acknowledge her defeat. She has also endorsed statements from her political party, Unidad Nacional de la Esperanza (“National Unity of Hope”), that labeled the electoral process as “illegal” and supported judicial investigations into Arevalo and Movimiento Semilla.

Before and during the electoral campaign, legal summonses and search warrants issued by judges and prosecutors were used as political tools to fuel narratives on digital platforms and undermine trust in electoral authorities, including Guatemala’s highest electoral body, the Tribunal Superior Electoral (TSE).

Electoral observation missions from the Organization of American States and the European Union shared concerns about these actions, which could affect the presidential power transition process to Arevalo leading up to his inauguration on January 14, 2024. For instance, the European Union’s preliminary report on the second round indicated that information operations amplified narratives to erode trust in the electoral process, and  disclosed privileged information from judicial cases in a coordinated manner to artificially influence political discourse, largely against the president-elect’s campaign. In an EU statement released on August 29, Josep Borrell, High Representative of the European Union for Foreign Affairs and Security Policy, stated, “The EU is deeply concerned over persistent attempts to undermine the election results through selective and arbitrary legal and procedural actions.”

In August 2023, the DFRLab examined over 1,500 distinct X profiles that retweeted Guatemala’s Public Ministry account more than 3,300 times over the summer in an attempt to get Movimiento Semilla suspended from the platform. Among the most influential accounts, the DFRLab identified a far-right network that included the account @__VaderGT, which reappeared in our latest investigation.

We identified twelve messages against TSE workers and Movimiento Semilla party members that originated from @__VaderGT and its Telegram channel between June 25 and July 25, 2023. Facebook pages, which mostly described themselves as media outlets, amplified these messages while showing signs of potential coordination and intentionally deceptive behavior. The analyzed timeframe coincided with the first round of voting on June 25 and the resumption of the campaign on July 12.

Additionally, historical analysis of domain registrations for two websites associated with two of the Facebook pages revealed connections with Guatemalan politicians.

Some of the accounts describing themselves as media on Facebook and websites analyzed in this investigation have been active for over eight years. In 2019, the UN International Commission against Impunity in Guatemala reported that political campaigns created fake media outlets and inauthentic networks as a means of influencing online discourse in their favor. The findings included in our current investigation revealed previously unknown connections between Telegram channels and a network of social media accounts, websites, individuals, and companies.

The DarkSide Telegram channel and its X account, @__VaderGT, were central to the amplification of political content targeting Arevalo and the electoral authorities, with a coordinated network of Facebook pages sharing posts from the two accounts. Both accounts appeared to be managed by the same person or organization and used references to the Star Wars saga and the character of Darth Vader in particular, posting images and phrases like “yes, master!” alongside references to the “dark side.”

On X, the accounts @LordVaderGT and @__VaderGT both used the username ¡Yes, Master! and associated with far-right networks that have previously targeted Guatemalan politicians and journalists. The operator behind the accounts appears to have spun up @__VaderGT in June 2021 after the platform suspended the original account @LordVaderGT in March 2021. On April 30, 2021, not long after @LordVaderGT’s suspension, the DarkSide Telegram channel first appeared, using the handle @LordVaderGT.

Besides the similarity in the usernames and handles, posts during the first month of the second round of elections showed that most of the messages from @__VaderGT and its Telegram channel appeared on the same day, often within the same minute. Both accounts posted eight messages about legal proceedings against the Movimiento Semilla and four against public employees, claiming electoral fraud. At least seventeen Facebook pages, which described themselves as media outlets, advertising agencies, or political movements, subsequently amplified these messages in a seemingly coordinated manner.

Two of the most amplified messages on Facebook mentioned a legal process initiated against the Movimiento Semilla in May 2021 for alleged signature forgery, and a criminal investigation against Ramiro Muñoz Jordán, the director of the TSE’s Registry of Citizens. According to Guatemalan media outlet Plaza Publica, the Public Ministry and Judge Fredy Orellana initiated the investigation into Muñoz as a strategy to intervene in electoral processes and pressure TSE officials during the presidential runoff. Both messages appeared on July 14, the same day that the presidential campaign resumed following the first round of voting.

Three different pages amplified the message against the Movimiento Semilla within a three-minute time period, including using the same images from the original posts. Some used different hashtags that slightly changed the text. The first posts appeared on the pages AAP Revista and Noticias Mixco, which describe themselves as a marketing agency and a media outlet, respectively. The last page to amplify the content was that of the nongovernmental organization Chapines Unidos por Guate, which has previously amplified content related to far-right groups while targeting Movimiento Semilla. As of September 2, 2023, the three posts had accumulated a total of 1,194 comments, reactions, and shares.

Another two posts from the Vader Telegram and X accounts attacking TSE Registry of Citizens Director Muñoz originated simultaneously at 8:05 p.m. local time; between 9:54 p.m. and 10:03 p.m., eight Facebook pages portraying themselves as media outlets amplified them.

As of August 1, 2023, @__VaderGT and the DarkSide Telegram channel had garnered approximately 13,500 followers and 2,200 subscribers respectively. On Facebook, pages reached audiences ranging from 7,100 to 392,600 followers, accumulating more than 948,800 followers in total. Additional amplification may have taken place on Facebook as well, as searches conducted via CrowdTangle and Google do not include private posts from accounts or groups.

Beyond amplifying LordVader’s messages from X and Telegram, the Facebook pages showed additional signs of coordination. This included the use of similar contact information, describing themselves as media outlets or marketing agencies, receiving reviews from the same users, and links to websites registered on the same day by the same administrator.

Ten pages shared similar information in their Transparency or About sections. For example, the pages Prensa Popular GT and Diario Nacional GT, both created in January 2020, used the same contact number and listed Guatemala as the country of origin for three managers each.

Suspicious Facebook accounts also posted recommendations to support various pages. For instance, in May 2020, the same account posted four statements of support to the pages NotiRadio Peten, Prensa Popular GT, Conguate gt, and Radio Popular Petén. Since May 7, 2020, the account has displayed a profile picture of a Paraguayan pilot who died in Bolivia in 2017.The account posted publicly until May 10, 2020, at which point it either made its content private or stopped posting.

Some pages included links to websites posing as media outlets in their contact information, some of which were no longer active or had not updated their posts in months. The pages Noticias de Peten and NotiRadio Peten each displayed a link to the respective websites noticiasdepeten.com and notiradiopeten.com, both of which were registered within five hours of each other on May 6, 2020, by Istmo Entertainment, SA.

According to a July 2023 investigation by the Guatemalan outlets Agencia Ocote and El Clip, Istmo Entertainment is linked to disinformation campaigns involving former presidential candidate Manuel Baldizón Méndez and individuals associated with companies owned by him. Baldizón was arrested in the United States on federal money laundering in 2018; he plead guilty the following year. According to Agencia Ocote and El Clip, Istmo Entertainment also has connections with Poll Anria, a Panamanian political advisor who worked on political campaigns in Guatemala in 2015 and 2019, supporting political parties close to Baldizón and the presidential campaign of the current President of Guatemala, Alejandro Giammattei.

Information operations that have affected elections in Guatemala for more than a decade continue with similar strategies and with actors that have been able to evade the actions of social networks and authorities. The evidence exposed in this research demonstrated that actors aiming to influence Guatemala’s public conversation still have the capacity to act in a coordinated manner on multiple platforms. Although the electoral process in Guatemala officially concluded with Arévalo’s election, the transition of power process remains ahead, including strong legal pressure on Arévalo and the TSE from members of parliament, the prosecutor’s office, and others, all of which could destabilize the results of a democratic election.

Daniel Suárez Pérez, “Suspicious media targeted Guatemala’s elected president,” Digital Forensic Research Lab (DFRLab), October 23, 2023, https://dfrlab.org/2023/10/23/suspicious-media-targeted-guatemalas-elected-president.