BANNER: A man walks by a campaign poster featuring Nicaraguan President Daniel Ortega (right) and his wife, Vice President Rosario Murillo (left), in Managua, Nicaragua, September 25, 2021. (Source: REUTERS/Maynor Valenzuela)

On November 1, 2021, Facebook removed a network of more than 1,400 assets engaged in coordinated inauthentic behavior targeting domestic audiences in Nicaragua. According to Facebook, these assets — including 896 Facebook accounts, 132 pages, 24 groups, and 362 Instagram accounts — were operated by the government of Nicaragua and the Sandinista National Liberation Front political party, also known as FSLN.

Approximately 560,000 Facebook accounts followed one or more of the pages in the network, while around 72,000 accounts participated at least one group; additionally, about 125,000 users followed at least one of its Instagram accounts. In total, approximately 757,000 accounts followed one or more of the de-platformed assets. The network ran a cross-platform operation that stretched well beyond Facebook and Instagram, including inauthentic assets on Twitter, Telegram, YouTube, TikTok, Blogger, and possibly other platforms, including Pinterest.

According to Facebook’s report on the network:

The accounts were removed days before Nicaragua’s November 7, 2021 general election. President Daniel Ortega is running for a fourth term in what the United States and other international actors have called a sham election. The former leader of the revolution that overthrew the US-backed Somoza dictatorship in 1979, Ortega has governed the country in an increasingly authoritarian fashion, especially following nationwide protests that begin in 2018. Ahead of the 2021 election, Ortega and his wife, Vice President Rosario Murillo, launched an unprecedented crackdown, arresting and persecuting the main opposition contenders, as well as businesspeople and journalists.

The social media influence operation exposed by Facebook confirms claims previously made by Nicaragua’s independent press, which had accused the regime of running a troll operation. According to these reports, the operation was initiated by Vice President Murillo after the 2018 protests, with around 100 people working for the operation, run from Nicaraguan Post Office headquarters. Facebook corroborated the claim that many of the posts were made by “shift workers,” with a decrease in activity during lunch time and outside their apparent work hours. The multi-platform social media operation is part of a larger strategy to control communications in the country, alongside the government acquiring media outlets and cracking down on others.

The Nicaraguan influence operation spread across at least six platforms, including Facebook, Instagram, Twitter, Telegram, YouTube, and TikTok. At least one page also appeared to have a Pinterest account. The operation also utilized websites and blogs. It is an illustrative case of how malign actors try to leverage multiple platforms to reach different audiences. At the time of publication, Facebook, YouTube/Google, and Twitter had removed many of the accounts participating in the operation, while other accounts remained available Telegram and TikTok.

According to Facebook, the company de-platformed 132 pages, of which the DFRLab reviewed 116 of them, as part of its ongoing research partnership with the platform. Most of these pages were created between 2018 and 2020.

The content across the network varied widely. While some pages posed as media outlets, news sites, and personal blogs, another subset of assets presented themselves as political organizations, politicians, or community-based groups.

The network primarily posted photos, followed by links and videos. A small number of these posts also contained links to YouTube videos. At the time of publication, some of this content had been removed by YouTube as part of its own ongoing investigation into coordinated influence operations linked to the Nicaraguan government.

The network shared links to websites with domains that matched the name of the removed pages, such as barricada.com.ni, redvolucion.net, jscomunicadores.com, and molotovdigital2.blogspot.com, among others.

The websites dossierinformativonic.blogspot.com and molotovdigital2.blogspot.com, both built on Google’s Blogger platform, were blocked for violating Blogger’s terms of service.

In terms of audiences, the most followed pages were Redvolución (a play on words from “network” and “revolution”), Nicaragua Linda (“Pretty Nicaragua”), and Barricada (“Barricade”).

The 116 Facebook pages reviewed by the DFRLab published approximately 1,600 posts per month between January 2015 and October 2021. Barricada, Redvolución, Adelante Siempre (“Always Ahead”), and Molotov Digital received the highest number of interactions during this period, collectively amassing more than 12 million interactions, including likes, comments, shares, and reactions. Overall, they averaged roughly 256,000 interactions per month.

Non-political posts, including topics such as sports and tourism, were among the most engaged with assets on the platform. However, the network mainly pushed content promoting President Ortega’s activities and his 2021 campaign for reelection.

The pages also fueled negative sentiment towards the United States — a common tactic used by similar regimes such as Venezuela.

Using Telegram’s API, the DFRLab identified and analyzed 48 channels linked to the network. These channels amassed nearly 10,000 subscribers and were created between 2018 and 2021. These channels shared content from other sources as well, such as Russia’s RT, Venezuela’s regime-backed broadcaster TelesurTV, HispanTV, among other Telegram channels linked to Venezuela and the FSLN party.

A network graph showing the most shared Telegram channels. The yellow nodes represent Telegram channels linked to the Nicaragua network. The blue nodes represent external channels not directly associated with the analyzed network involved in the Facebook takedown. (Source: @estebanpdl/DFRLab via CrowdTangle)

The administrators of the Telegram channels also coordinated to amplify hashtags on Twitter. For example, on February 19, 2021, the Redvolución Telegram channel invited members to join a hashtag campaign by posting a call to action using the hashtags #SandinoLuzYVictorias (“Sandino, Light and Victories”) and #AquiEstaSnadino (“Here is Sandino”). Between February 20 and 22, these hashtags garnered nearly 50,000 mentions by roughly 6,000 Twitter accounts.

The troll network was also active on Twitter, where it pushed pro-Ortega and pro-Murillo propaganda. Most of these efforts focused on promoting Ortega’s campaign for reelection, particularly in recent weeks and months. The network also utilized hashtags, suggesting their Twitter activity focused on bringing pro-Ortega narratives to a broader audience.

According to local media reports, Twitter began suspending Sandinista accounts immediately prior to Facebook’s announcement. After Facebook published its own findings, Twitter suspended additional accounts corresponding to Facebook’s research.

The DFRLab used a sample of 50 Facebook pages removed in the takedown to manually look for their counterparts on Twitter, finding that nearly half of them (24 pages) featured a corresponding Twitter presence. Of those, 17 had already been suspended by Twitter, while seven remained active. This number may be an underestimation, as many of the pages removed by Facebook had relatively generic names, making it difficult to find their corresponding Twitter accounts.

Many of the so-called media outlets that acted as propaganda vehicles for Ortega and Murillo also had Twitter accounts. Pages such as RedVolucion, Barricada, Molotov Digital, and others posted a mix of campaign-related material, such as a countdown of days left until Ortega’s electoral victory and “articles” about the Ortega administration’s programs and achievements.

Twitter suspended the account of Erick Ríos, who Nicaraguan media identified as one of the heads of the operation. According to these reports, Ríos is close to Vice President Murillo and served as coordinator of the Sandinista Youth Communicators network, aiding in digital operations. Twitter also suspended the account of Julio Avilés Sánchez, son of the head of the Nicaraguan Army, General Julio César Avilés Castillo. In 2020, the general was sanctioned by the US Treasury Department for allowing paramilitary groups to target protesters in 2018.

The Nicaraguan troll farm was also present on TikTok, indicating that it was attempting to sway the platform’s younger demographic. While some trolls used their TikTok accounts simply to post clips from longer videos they published on Facebook, others used TikTok more natively, creating a more dynamic feed that aligned with the viral nature of the platform. Among the latter were RedVolución and Red de Jovenes Comunicadores.

RedVolucion’s TikTok account, which first posted in January 2020, gathered 12,900 followers and 90,000 likes. Among the videos posted by the account was a short clip of Ortega followed by a remixed reggaeton song, as a green-screened presenter pointed to a tweet while dubbing another TikTok user. Red de Jovenes Comunicadores, meanwhile, started posting in January 2021. The account’s posts also took advantage of TikTok’s editing features, publishing videos of people dancing and pointing to on-screen text about Ortega’s achievements, as well as memes remixed with campaign songs.

At least one of the pages identified by Facebook appeared to have a corresponding Pinterest account. A Pinterest page featuring the same logo used by the Facebook page Zafarrancho Nica promoted content about tourism in Nicaragua, similar to its topical activities on both Facebook and Instagram. Additional pins, however, also promoted Ortega’s regime. The DFRLab could not confirm whether the Pinterest account was related to the Facebook page, but the use of the same logo and the publication of the same type of content indicates a possible connection.

Along with maintaining a presence on Facebook, Instagram, and potentially Pinterest, Zafarrancho Nica also appeared on Twitter, YouTube, Telegram, and TikTok, making it an illustrative example of the operation’s multi-platform influence strategy.

An analysis of the 10 Facebook pages that posted the most videos between January 2015 and November 2021 showed their pages were more active and amassed more engagement than their corresponding YouTube accounts. The Facebook pages that posted videos, Live videos, and YouTube links garnered 4,773 views per video on average, while their respective YouTube channels averaged 3,068 views per video.

The YouTube channels followed the network’s strategy of amplifying pro-government messaging as well as non-political content, such as tourism. The most viewed videos of channels belonging to pro-government media such as SiempreMásAllá 21 included official announcements of televised school classes amid the pandemic and songs celebrating the 41st anniversary of the Sandinista Revolution.

The Revolucionnic YouTube channel, which remained online at the time of publishing, stated on its About page that it supports left-wing ideologies and “countering disinformation.” Videos on the page also linked back to RedVolucion’s Facebook page. Its content often praised Ortega’s government and included a propaganda video regarding the Sandinistas’ August 1978 assault on the National Palace.

YouTube channels linked to the network also promoted content that praised Ortega-aligned members of the Venezuelan and Cuban regimes. Among the 10 most-viewed videos on the Red de Jóvenes Comunicadores channel was a video that commemorated former Venezuelan President Hugo Chavez, and a documentary on the Cuban Five, a group of Cubans convicted of spying in Miami in 2001.