A Brazilian account that mixes bot-like and human-like features illustrates the difficulty in determining whether an account is automated

A Brazilian Twitter account outed as a bot by a popular magazine pushed back on the publication with clear indications that a human was, in part, behind its operation.

After Veja, one of the most prominent news magazines in Brazil, published an article claiming that the Twitter account @Mariang69423516 was a bot, the account published an image that allegedly pictured its owner, Mariangela, as proof of her identity. While the story of whether the account was a bot is important to determine the authenticity of its content, the motivation for undertaking an inauthentic operation — if that is in fact what this was — is even more important; in other words, how the account undertook its operations is less important than why.

With that in mind, figuring out whether an account is authentic is a good first step in determining whether it is a part of a larger influence operation. This is the story of one account and its attempts to prove itself genuine.

Mariangela, bot or not

Mariangela Pereira is a short-haired blonde woman in her 60s. With glasses perched on her nose, she stares directly at the camera, holding up a calendar with the image of a saint and a highlighted date: April 6, 2019. The text in the post accompanying the image reads, “This is me, today is April 6. I am not a bot.”

In the text accompanying the image in the tweet rebutting the Veja article, Mariangela wrote: “According to Veja magazine, I am a bot. To prove that this account is mine, today is April 6. Let’s go Moro. We are with you. I am not a bot. I am just a Brazilian like the other 57 million that supported our captain,” the last title in reference to Brazil’s President Jair Bolsonaro, a retired army captain. The post also mentioned Justice Minister Sérgio Moro, who also posted a picture with a calendar when he opened his Twitter account.

Bolsonaro replied to Mariangela, a vocal supporter of the right-wing politician, by saying “A big hug, Mrs. Mariangela. Brazil above everything…” The magazine nonetheless maintained its position that the account was a bot.

So, what was the truth about this account? Mariangela’s account is most likely not fully automated, not fully run by a human, but rather what is sometimes known as a cyborg. A cyborg can be defined as any account that falls in between exclusively human-controlled and entirely automated. This spectrum includes both automated accounts with some amount of human assistance and human accounts with occasional automation assistance.

Mariangela’s account can be classified as a cyborg because it combined features of automated accounts with features of human-run accounts.

When Veja’s article was published, Mariangela’s Twitter handle had a sign of anonymity, the handle @mariang69423516. The alphanumerical handle suggested that the account name could have been generated automatically by a bot creator. The name could have also been a careless creation by an operator indifferent to its handle.

A few days after the article was published, the account handle changed from @mariang69423516 to @MariangelaP17. Many Bolsonaro supporters use “17” on the end of their Twitter handles as a reference to his ballot box number. Even though the handle changed, though, the unique ID of the account remained the same, indicating that @mariang69423516 and @MariangelaP17 were the same user.

Anonymity was not the only suspicious feature of the account; it also had a high volume and frequency of activity. On the day after the article was published, the alleged owner of the account, Mariangela Pereira, gave a written interview to the right-wing website O Antagonista. The interviewee claimed that the account took shape while the person was allegedly recovering from heart surgery in 2018. According to the interview, while suffering from insomnia, the person started tweeting a lot during the night.

The restless activity of @MariangelaP17

Still, sleepless nights alone cannot explain the account’s high level of activity. On average, @mariang69423516 posted 106 tweets per day between August 9, 2018, when the account was created, and July 17, 2019. Some days, it posted more than 600 times. The DFRLab considers posting more than 72 times a day on average as suspicious, and more than 144 a day as highly suspicious. While posting frequency is a useful indicator for considering whether an account might be automated, it should never be used as the sole indicator, given that there are many authentic Twitter users who exceed those averages.

Perhaps most revealing, though, is the fact that the account posted more than one tweet per second on multiple occasions, which is very difficult for a person to do without help from automation software. On one day, the account posted 11 times in one second (and the posts were not part of a thread). Twitter listed the source of the account’s tweets as “Twitter for iPhone” rather than as from automated software, but the account may have used an automation technique that Twitter could not detect.

The first instance of rapid posting detected by the DFRLab happened on October 25, 2018, three days before the second round of presidential elections in Brazil. @MariangelaP17 retweeted the hashtag #NordesteÉ17 (“Northeast is 17”), a hashtag meant to encourage voters in the poorest region of Brazil — and also the only one that was massively voting against Bolsonaro — to support him.

In another instance on May 16, the account retweeted posts featuring the hashtag #IdiotasUteis (“Useful idiots”), quoting an expression President Bolsonaro used to describe protesters in Brazil. One of the posts retweeted was against Bolsonaro, which might indicate that the account was amplifying all mentions of the hashtag without distinguishing on the basis of meaning.

The account posted many tweets within a single second later the same day, all of which mentioned the account @RaquelBlak. All but one were retweets, with the outlier being a reply. To do this manually from an iPhone, the person would have had to click on the retweet icon for one post, click again on “retweet without comment,” repeat the same steps six times, and also write her reply in a post (or even copy and paste the text from a pre-written post), all in a single second.

The final instance of rapid-succession posting, on June 18, saw @MariangelaP17 amplifying replies to journalist Shannon Sims after the latter started a Twitter poll asking people how they felt about Minister of Justice Sergio Moro. All messages retweeted by the account that day supported Moro.

Many legitime social media actors use automation when posting. Various media organizations, for instance, schedule their posts to go live at a certain time of the day, when more readers are likely to be reached. This is different, though, from amplifying content from specific users or hashtags, which appeared to be what @MariangelaP17 was doing. Twitter forbids “platform manipulation” or “inauthentic engagements, that attempt to make accounts or content appear more popular or active than they are.”

@MariangelaP17 often acted to amplify content from other users. Of all of the account’s posts, 76 percent were retweets. This may indicate automation, as bots usually aim to amplify a particular message, user, or hashtag.

Human-like behavior

While @mariang69423516 exhibited some bot-like features, it also displayed human-like characteristics.

Despite its alphanumerical handle, the profile picture of the account was not generic or stolen, as it often is for completely automated accounts. A reverse image search performed of the account’s profile picture did not return any other results, indicating that the photo is probably unique to the account.

Even though the account primarily amplified other users by retweeting or quote tweeting them, it also authored some original posts often accompanied by images, including the post with a person purporting to be Mariangela holding the calendar. Another post included a picture of the same woman allegedly attending a pro-Bolsonaro protest with her mother.

In another indicator of human activity, the account posted less throughout the night than it did during the day, just as a normal human would.

Boosting pro-Bolsonaro hashtags

@MariangelaP17’s activity on Twitter had one main beneficiary: the Brazilian government. Almost all of the account’s activity boosted hashtags in support of President Bolsonaro and his allies.

@MariangelaP17 played an instrumental role in making these hashtags trend in the country. On June 17, 2019, her profile was among the main amplifiers of the hashtag #ReformaDeUmTrilhao (“One Trillion Reform”). This hashtag intended to generate support for the government’s proposed pension reforms, which faced resistance from the opposition. Brazil’s lower house of Congress approved the reforms on July 10, and the Senate approved it on October 22.

On that day, @MariangelaP17 posted 640 times, using the hashtag 374 times, tweeting the hashtag the seventh most of all accounts on Twitter. In all, the hashtag was mentioned 157,000 times, with 11 percent of the tweets coming from the 100 most active accounts, including @MariangelaP17’s.

@MariangelaP17 was also hyperactive on May 18, 2019, when the account posted 643 times. She used the hashtag #BolsonaroNossoPresidente (“Bolsonaro Our President”) 129 times and was, again, among the top 100 users of the hashtag. In total, the tag was mentioned more than 255,000 times on that day. The 100 most active accounts, among them @MariangelaP17’s, were responsible for 8 percent of the total mentions.

After conducting its research, on July 30, the DFRLab reached out to the office of Twitter in Brazil about the account. The account had been suspended by the platform for violation of Twitter rules, though not necessarily its automation rules.

Days later, the account was live again. The DFRLab contacted the account via Twitter asking for a contact number in order to interview its operator, but the owner of the account replied via Twitter, often taking a private message and replying publicly. There is no question that a human being, and not a machine, replied to the questions. The person, however, was not able to explain how it was able to post multiple times in one second.

@MariangelaP17 told the DFRLab that it tweeted only from an iPhone and that it did not use any automation software (such as the ones that are sometimes used with good intentions by media outlets). After the DFRLab sent a screenshot of the tweets posted at the same second, all tweets posted before July 22 vanished from the account’s timeline. @MariangelaP17 claimed it was not involved in the disappearance of the tweets and said it was the author of the post. Finally, the operator said Twitter suspended the account due to the platform’s spam policy.

@MariangelaP17 claimed that the timestamps of the tweets were an error, and that is why it appears that it had tweeted in the same second. The DFRLab retrieved timestamps using both analytics tool Sysomos and Twitter’s API. In both cases, the DFRLab found several examples of tweets posted in the same second and no similar patterns in the timestamps for its own researchers’ accounts, indicating that it was very likely not a system-induced error.

After the account reemerged from its suspension, it started to promote racist rhetoric against Brazil’s indigenous population. In particular, on August 12, it retweeted a post that, in response to a video, referred to indigenous protesters as an “invasion” and claimed that a building at which the activists had staged a protest was being “invaded.”

Since the conclusion of the DFRLab analysis, the account has remained active and kept the same type of activity. It posted the racist tweet above, pro-Bolsonaro memes, and hashtags that supported the government.

Conclusion

The case study of Mariangela Pereira’s account provides a roadmap for identifying possible cyborg accounts. The characteristic tell of a cyborg is the dual presence of signs of automation and signs of human activity.

While Veja magazine identified @MariangelaP17 as a bot, the account was more likely a cyborg. On one hand, it possessed features characteristic of automated accounts, particularly its hyperactivity. But the account also engaged in behaviors that suggested a human operator was involved: it shared what seemed a unique picture of the person it claimed was behind the account and reduced its activity at night, when most humans would sleep. More importantly, it clearly reacted to the DFRLab’s direct inquiries with original replies posted publicly.

Knowing whether an account is automated or not aids researchers in understanding online influence operations. But as this case study has shown, automation does not necessarily appear always in isolation — sometimes it can be paired with genuine human activity. Without access to the operator, it is extremely difficult to determine with 100 percent certainty whether an account is human-run, automated, or a mix of the two.

Nevertheless, it is possible to determine if accounts are trying to manipulate Twitter by analyzing the impact of their activity. An analysis of @MariangelaP17’s posts — independent of the assessment of automation — indicated that this account went to greater lengths to engage an audience and influence the conversation than a typical Twitter user would; its behavior could potentially constitute a violation of the platform’s rules.

Follow along for more in-depth analysis from our #DigitalSherlocks.