Nine Twitter accounts designed for airtime on a Colombian TV program went dark following a DFRLab inquiry

Nine mysterious Twitter accounts featured regularly on a Colombian news program went dark after the DFRLab identified them as potentially inauthentic and inquired to the show’s broadcast network about them.

While the accounts exhibited a negligible amount of interaction on Twitter, they gained a significant audience by being featured on the show “Zoom a la noticia” (“Zoom to the News”), featured on Colombia’s NTN24 network. The accounts’ activity was thus not amplified on the online platform on which they originated but, rather, by a secondary platform: a TV broadcast channel. In this respect, the strategy employed by this inauthentic operation is unique among the cases the DFRLab has encountered.

Though there was circumstantial evidence linking this operation to the program’s production team, the DFRLab found no direct evidence to attribute the accounts to a particular actor. The director of the program told the DFRLab that NTN24 was not aware of the operation and that it had no evidence that it was connected to the show’s producers.

Following the DFRLab’s inquiry, the show ceased featuring the accounts on air, and, at the time of publishing, the accounts themselves had gone silent.

Indicators of Inauthentic Behavior

“Zoom a la noticia” is a weekday news and commentary program from NTN24, a Colombian network broadcast both in Colombia and on cable TV in many other countries in Latin America. NTN24 is particularly popular with those sympathetic to the Venezuelan opposition, many of whom continue to watch it on YouTube after it was banned from Venezuelan cable networks by Nicolás Maduro’s regime.

The DFRLab analyzed the social-media activity related to the show during a seven-day period, from March 4 to March 13, 2019. Among the 57 tweets featured on the show during the period of analysis, only one seemed to come from an authentic account, while all others came from inauthentic accounts. The show’s decision to feature inauthentic content was not for lack of authentic content: during the entire duration of the DFRLab’s analysis, the show only featured messages from the suspicious accounts, despite the fact that authentic Twitter users also tweeted about the show’s topic of the day in response to a prompt from the network’s Twitter account.

The number of comments from authentic accounts the show received each day, however, varied. On March 11, for instance, the DFRLab only found six posts from authentic accounts that commented on the show’s topic. On March 13, at least 37 tweets commented on that day’s topic, including mentions of @NTN24, #NTN24, @andrebernal26, and #ZoomVenezuela. Separately, not all of the tweets from the inauthentic accounts were ultimately featured on the program.

All of the detected accounts shared features that indicate inauthentic behavior. They had generic images as avatars, their handles consisted in most cases of a name in Spanish and a series of eight digits, and they were created in two batches. Four of the accounts appeared on October 4, 2018, between 9:58 p.m. and 10:20 p.m. local time, and the other six accounts were created October 16, 2018, between 1:39 p.m. and 1:53 p.m. local time.

At the time of analysis, the inauthentic accounts also had three or fewer followers and followed a small number of accounts, most of which belong to Colombian media outlets and public figures. Most of their tweets were replies to the accounts @NTN24Zoom and @andrebernal26, which belong to the show’s director and anchorwoman, respectively.

Despite these features, the analyzed accounts did not exhibit signs of automated activity, as they did not seem to be run by a computer program without human intervention. Their replies were not published by other users, they did not tweet in large volumes, and they did not post in multiple languages or discuss other topics.

The accounts also changed their screen names periodically, presumably in order to avoid detection among TV viewers. In doing so, they were featured on the program on multiple days under different display names, despite having the same handle and avatar. The regular display name changes were possibly intended to mislead viewers into believing that different accounts were featured on the show every day.

The inauthentic accounts were first featured on the show on October 5, 2018, less than a day after they first appeared on Twitter.

The accounts’ activities consisted almost exclusively of comments related to the show. Every day, the show’s official Twitter account publishes a post with a topic to be discussed during its broadcast and calls on followers to participate in the discussion via Twitter. It was in response to these posts that the inauthentic accounts would reply.

The accounts tweeted 741 times from October 5, 2018, to March 15, 2019. The only content the DFRLab could find that did not consist of retweets or replies to the show were 39 retweets from well-known Twitter profiles, such as @bbcmundo (the Spanish-speaking website of the BBC World Service) and the Colombian news outlets @ELTIEMPO, @ElEspectador, or @Pulzo. Presumably, these retweets intended to improve the accounts’ perceived authenticity. Not a single tweet was retweeted more than once by any of the accounts.

The accounts under analysis also posted at the same time, 2:00 p.m., each day, a further sign of coordinated behavior.

There is circumstantial evidence to suggest coordination between the NTN24’s production team and the inauthentic operation. The accounts engaged in the operation tweeted exclusively about the program, and the show consistently amplified their tweets from the accounts’ day of inception forward, despite them having little influence or engagement on Twitter. The DFRLab did not, however, find conclusive evidence of a direct link between NTN24 and the accounts.

After the DFRLab reached out to NTN24’s “Zoom a la noticia” on April 4, 2019, for comment, program director Andrea Bernal said the production team would increase efforts to better select the Twitter posts and accounts that are featured in the program. According to Bernal, NTN24 had no evidence that the production team was involved in the operation of the inauthentic accounts. Since the DFRLab contacted the program, “Zoom a la noticia” has stopped featuring inauthentic accounts in the show. On April 5, the program did not feature any tweets, as well as on April 8 and April 10, when the show featured interviews instead of its regular debate format. On April 9, it featured three posts from apparently authentic accounts, fewer than the usual number of tweets it used to feature per show. After the DFRLab discussed the issue with NTN24, all of the inauthentic accounts analyzed for this article stopped tweeting.

Conclusion

A small cluster of accounts that are commonly featured on a Latin American news and commentary program exhibited several key indicators of inauthentic behavior. These accounts tweeted exclusively about the program, were created recently, had generic images as avatars, and changed their display names frequently in a likely attempt to appear authentic to the TV show’s audience. These accounts did not exhibit signs of automation, however. In addition, the DFRLab could not find conclusive evidence as to who operates them.

Furthermore, the operation did not appear to further a political agenda; instead, the accounts endorsed divergent positions on the issue being debated on the program that day. Nonetheless, the strategy of deploying an inauthentic operation on an online platform, then subsequently amplifying that operation through a broadcast channel, could be weaponized in the future to further a particular political agenda. By using one medium to deploy an inauthentic operation and a second medium to amplify it, the orchestrator of this operation avoids drawing the attention of social-media platforms.

As social-media platforms mount tactical and strategic responses to the amplification of misinformation and disinformation, bad actors may increasingly turn to alternate channels to amplify inauthentic behavior originating online. This case demonstrates such an operation in action.

Register for the DFRLab’s upcoming 360/OS summit, to be held in London on June 20–21. Join us for two days of interactive sessions and join a growing network of #DigitalSherlocks fighting for facts worldwide!