BANNER: (Source: @luizabandeira/DFRLab via Fernando Frazão/Agência Brasil, photo; Twitter)

In an attempt to criticize a protest campaign, real Twitter users amplified a bot-fueled hashtag targeting American journalist Glenn Greenwald that called for his removal from Brazil.

On June 10, 2019, Greenwald came under attack on Twitter from Brazilian accounts on the platform after the Brazilian edition of The Intercept, a news publication he co-founded, published a politically explosive report he had co-written.

The campaign against Greenwald, who has been living in Brazil for the past 14 years, called for his deportation from the country using a series of hashtags. This is yet another example of an online campaign targeting a journalist for their work, but the supportive traffic was largely driven by bots and inadvertently amplified by real users rejecting its premise.

The DFRLab examined one of the most popular hashtags targeting Greenwald: #DeportaGreenwald (“Deport Greenwald”). This hashtag reached the trending topics section on Twitter and subsequently received considerable media coverage. Both authentic tweets and automated activity ultimately contributed to the hashtag’s popularity.

This case thus demonstrates how well-intentioned actors can amplify an otherwise automation-driven campaign by criticizing it online.

On June 9, Greenwald and his colleagues published a story to The Intercept Brasil revealing conspiratorial conduct behind the prosecution of former President of Brazil Luiz Inácio Lula da Silva, commonly referred to as “Lula.”

Based on a trove of leaked messages it had acquired, The Intercept Brasil claimed that judge Sergio Moro — who had sentenced Lula to prison — had illegally collaborated with prosecutors on the corruption case against the former president, who was leading in the polls for the 2018 presidential election prior to his arrest. Moro, who currently serves as Minister of Justice in President Jair Bolsonaro’s government, subsequently denied having conspired against Lula.

The current hot nature of Brazilian politics led to an equally heated reception of Greenwald’s story, which in part took the form of hashtag campaigns. One particular hashtag, #DeportaGreenwald, received significant engagement on Twitter; among the accounts that most frequently used the hashtag, several displayed signs of automated behavior.

The account @Vnia60277936, for instance, used the hashtag 294 times in 4.5 hours. According to an analysis conducted using Sysomos, which measures engagement on Twitter, this account was the second most active in using the hashtag.

@Vnia60277936 exhibited many features associated with bot accounts. It was very active, posting an average of 577 tweets per day. The DFRLab views more than 144 tweets per day as highly suspicious. On some days, the account posted even more frequently; on June 2, it tweeted around 1,700 times, a number highly unlikely to have come from a human account.

The account @Vnia60277936 also has an alphanumerical handle, possibly generated by an algorithm. It also used a generic profile picture. Anonymity is a common feature of bot accounts, as many are created in batches too large to allow for much customization.

Finally, @Vnia60277936 acted mainly to amplify posts by other users — a prominent function of bot accounts. All of the account’s tweets containing the hashtag #DeportaGreenwald were either retweets or quote tweets. In general, nearly 99 percent of posts by @Vnia60277936 were retweets or quote tweets.

Two popular machine learning tools that measure automation probability — Botometer and PegaBot (Bot Catcher) — also identified a moderate-to-high likelihood that the @Vnia60277936 account employed automation. While both of these tools are useful as indicators, they should not be considered definitive in determining whether an account is a bot.

Botometer gave the account a score of 3.5 out of 5 in terms of automation probability, and PegaBot, a Brazilian website, concluded with 100 percent certainty that the account was automated. The range in automation probability estimated by the two tools can be attributed to the differing methodologies of their respective algorithms.

Finally, the account frequently tweeted two posts that were not part of a thread within a single second of each other. The Diretoria de Análises de Políticas Públicas (DAPP, or Department of Public Policy Analysis) of the Getulio Vargas Foundation, a partner of the DFRLab, considers this rate strong evidence for the use of automation, as it is almost impossible for humans to tweet in such a short interval of time without using automation software.

The other main users of the hashtag followed similar patterns that indicated automation, as can be seen in the image below.

That several of the most active profiles engaging in the #DeportaGreewald campaign featured automation indicators does not mean, necessarily, that most accounts using the hashtag were automated.

According to a machine scan conducted with the social-listening tool Sysomos, 23 percent of the accounts that used the hashtag had an authority score of 3 or less (out of 10). On average, 21 percent of Twitter users have an authority score below 3. Authority scores are based on an account’s activity and influence and can serve as a proxy for bot probability, thus indicating that the accounts participating in the #DeportaGreenwald campaign were likely not automated.

Despite automated accounts playing a role in boosting the hashtag #DeportaGreenwald, some of the most retweeted posts using the hashtag came from real users criticizing the campaign against him.

Writer Marcelo Rubens Paiva, for example, published the most retweeted post using the hashtag. In his tweet, Paiva expressed concern for Greenwald’s safety; the tweet garnered more than 2,000 retweets. The third-most popular post was also critical of the hashtag campaign, saying that the “digital militias” calling for Greeewald’s deportation were the same ones that complained about the lack of freedom of expression in Venezuela.

In the case of #DeportaGreenwald, genuine social media users inadvertently boosted a hashtag campaign possessing several strong indicators of inauthentic activity. This case serves as a reminder: well-intentioned actors, in publicly denouncing an online campaign, often draw further attention to the initial content. And in doing so, they end up amplifying a message they otherwise do not support.

Follow along for more in-depth analysis from our #DigitalSherlocks.