BANNER: Presidents Tayyip Erdogan of Turkey and Ilham Aliyev of Azerbaijan attend a military parade to mark the victory on Nagorno-Karabakh conflict, in Baku, Azerbaijan, December 10, 2020. (Source: Turkish Presidential Press Office/Handout via REUTERS)

Like most modern conflicts, the Nagorno-Karabakh conflict included an informational dimension that played out online. For both Azerbaijanis and Armenians, Twitter was the primary domain through which both sides attempted to present their perspective to the international community.

Much of this activity was authentic, coordinated among individuals in public and private Facebook groups, which often referred to themselves as “social media armies.” But researchers studying the early activity at the Australian Strategic Policy Institute (ASPI) also noted that some of it bore hallmarks of platform manipulation, included copy-pasted spam messages aimed at journalists and news outlets and the repurposing of old marketing bot accounts.

Early analyses showed that activity to pro-Armenian hashtags was greater than activity to pro-Azerbaijani hashtags, coinciding with an online activism campaign in Armenia to encourage Armenians on Facebook to join Twitter, as well as wartime-imposed social media restrictions in Azerbaijan. But an analysis of activity to 12 of the most popular hashtags on each side throughout the course of the entire war showed that pro-Azerbaijani hashtags displayed sharp spikes in activity on October 5, October 11, and October 16, 2020.

After analyzing 24 prominent hashtags used in the conflict, the DFRLab chose two of them that were prominent in the third spike, from October 15–19, for further analysis: #ArmenianAggression and #ArmenianTerrorism. While much of the activity appeared to be from authentic users, there were several distinct communities of disinformation amplifiers, including a particularly active community of accounts tweeting support for Azerbaijan primarily in Turkish that previously tweeted exclusively about K-Pop.

This analysis is a reflection of the complexities of online social interaction amid armed conflict. Throughout the war, users employed simplistic narratives about social media “bot armies” allegedly commandeered by the other side, often with accusations that these online armies were government-run. The reality, however, was significantly more complicated: social media users, many of them youth, mobilized accounts previously devoted to pop culture to tweet pro-Azerbaijan wartime propaganda. The majority of these accounts appeared to be based not in Azerbaijan, but in Turkey, which has lent both rhetorical and material support to Azerbaijan in the war over Karabakh.

On the pro-Azerbaijan side, the DFRLab selected the following English-language hashtags for analysis:

 #ArmenianAggression
#DontBelieveArmenia
#KarabakhisAzerbaijan
#ArmenianTerrorism
#StopArmenianAggression
#StopArmenianTerrorism
#ArmeniaKillsCivilans
#StopArmenianOccupation
#ArmenianTerrorism
#ArmenianWarCrimes
#LongLiveAzerbaijanArmy
#WeStandWithAliyev

The traffic to these hashtags was compared to the following 12 pro-Armenian hashtags over the same period:

#StopAzerbaijaniAggression
#StopAliyev
#ArtsakhStrong
#KarabakhIsArmenia
#ArmeniaStrong
#StopTurkey
#ArtsakhisArmenia
#AzeriWarCrimes
#AzerbaijaniAggression
#TurkeyIsATerroristState
#TurkeyIsATerrorState
#StopErdogan

From September 11 to December 7, 2020, pro-Azerbaijan hashtags amassed over twice as many mentions as the pro-Armenian hashtags: 8.5 million vs 4.13 million, respectively. The pro-Azerbaijan traffic also showed prominent spikes in activity on three occasions in October that did not appear consistent with authentic traffic flows. One of the spikes coincided with the first short-lived humanitarian ceasefire agreed to on October 10; another coincided with the announcement of a second attempt at a ceasefire, made on October 16 and expected to go into effect on October 18.

These hashtags contain a variety of different anti-Armenian information, sometimes including multiple narratives in a single post. The themes of these posts usually cover the first Nagorno Karabakh conflict, alleged Armenian war crimes, destruction of Nagorno Karabakh and the surrounding areas by the Armenian soldiers, and stories of Azeri victims of these conflicts.

The DFRLab isolated two hashtags that appeared to contain the majority of mentions in the October 16 spike: #ArmenianAggression and #ArmenianTerrorism. For both hashtags, the traffic flow spiked quickly, amassing hundreds of thousands of mentions within 24 hours and dying down to nearly zero just as quickly. Data from social media monitoring tool Meltwater showed that both hashtags had more than 75 percent of messages as retweets and quote tweets, with fewer than 20 percent of tweets consisting of original content.

According to Meltwater, the top locations associated with these tweets were Turkey and Azerbaijan, followed by the United States.

For deeper analysis, DFRLab scraped the Twitter API data to have a closer look at the networks involved in the spread of these hashtags. DFRLab used Gephi for the visualization, with edges as the connections and nodes as the accounts involved in the spread of the hashtags. 

 Visual analysis revealed that there were three distinct communities involved in the amplification, with a large cluster of overlapping communities marked as the main effort.

The main effort was the most populous and most intermingled. This community contained the most natural traffic, which was mostly based in Western countries, particularly the United States. The DFRLab filtered some of the most active accounts — specifically the top 0.27 percent most active — for a deeper analysis.

Upon closer investigation, there was little indication these accounts were inauthentic. Reverse image search did not conclude that most of the accounts were using fake or stolen images, nonetheless they were created very recently. A majority of them were created in the period between July and August, 2020, and they had already posted up to a few thousand tweets apiece. Furthermore, these accounts were posting information mostly related to the Nagorno-Karabakh conflict, suggesting that most of them were created for the express purpose of posting about the war.

Outside of the main cluster of accounts, which included several intermingled communities of both newly created and longstanding accounts, there were three active communities tweeting to the two hashtags. The largest of these three was primarily all in the Turkish language, but also posted in English. The vast majority of these accounts appeared to be dedicated to K-pop music, judging from their previous posts and profile pictures of various K-pop singers. These accounts seemed to amplify the anti-Armenian hashtags by directly referring to a few specific accounts, a common amplification strategy. Most of these accounts were not posting any disinformation related to the conflict.

ASPI’s report mentioned that Turkish K-pop fan accounts had previously been mobilized to spread pro-Turkish narratives during Turkey’s Operation Peace Spring military offensive in Syria in 2019, indicating that this repurposing of pop culture accounts may be a concerted strategy.

Very similarly to the first community, the second community also consisted mostly of Turkish accounts that primarily posted in English. The most active accounts from this community were also hyper-active, some having tens of thousands of tweets. A large portion of the most active accounts seemed to post information primarily regarding Turkish movies, singers, and other Turkish pop culture. Despite no clear evidence of stolen identity, none of these accounts had a large number of followers and seemed to be created for information amplification. These accounts also mostly amplified the anti-Armenian hashtags by directly referring to a few specific accounts, but some of them wrote original posts as well.

The third community also consisted of Turkish pop culture accounts that primarily tweeted in Turkish, but occasionally in English. Similarly, these accounts seemed to use original profile pictures. These accounts also mostly amplified the anti-Armenian hashtags by directly referring to a few specific accounts, or retweeting, directly answering to some of the other anti-Armenian posts.

The mobilization of these Turkish pop culture accounts is not necessarily indicative of a government-linked information campaign; these communities may be authentic users coordinating elsewhere online, as has been the case for similar efforts on both the Azerbaijani and Armenian sides throughout the war. Nonetheless, the identification of the Turkish K-pop community is particularly interesting, given K-pop fandoms are well known for their ability to command online attention and mobilize their resources and ability to game Twitter’s algorithms toward specific causes, many of which have little to do with K-pop.

Lukas Andriukaitis is an Associate Director with the Digital Forensic Research Lab;

Follow along for more in-depth analysis from our #DigitalSherlocks.