A large archive of tweets from Venezuela reveals that the Maduro government is relying heavily on automation to amplify pro-regime propaganda — including an app specifically developed to help users automate their retweets. This marks the first verifiable instance of a government using a Twitter app to amplify its domestic propaganda.

On January 31, Twitter released a massive dataset on Venezuela, as part of its crackdown on a “state-backed influence campaign” aimed at the country’s domestic audience. The dataset included more than 8 million tweets from about 1,200 accounts that mostly laundered pro-Maduro propaganda.

In a blog post, Twitter’s Head of Site Integrity, Yoel Roth, said:

This archive helps to explain how these state-backed influence campaigns work and how they execute disinformation operations domestically. Consisting of roughly 1,200 accounts, the archive likely constitutes the largest domestic state-backed influence campaign that Twitter has taken down.

As authentic grassroots political and social movements developed in response to the domestic political unrest in Venezuela, a state-backed influence operation emerged online. This operation hijacked the public discourse, relying in part on automation to amplify its reach and build a wider audience.

In its announcement of the takedown, Twitter referred to it as a “state-backed influence campaign targeting domestic audiences” and noted that the operation primarily used government-linked propaganda hashtags such as #LegionFANB, which expressed support for the National Bolivarian Armed Forces of Venezuela, and #Tropa, a hashtag commonly used by regime supporters on Twitter to identify themselves. Out of the top 10 hashtag combinations used, two in particular — #RT #Noticias and #Noticias #RT — often accompanied stories from Russia Today, including content from Actualidad RT, the Spanish version of RT, and Sputnik News, both of which are Kremlin broadcasters. Moscow is one of the Maduro regime’s chief allies in Venezuela.

@DFRLab plotted account creation dates with the timeline of several Venezuelan protests and found that account creation dates coincided with the dates of major protests in the country. In the first quarter of 2014, for example, a series of protests took place to draw attention to the Venezuela’s high levels of urban violence, rampant economic inflation, and chronic shortages of basic goods. The protests inflamed tensions between government forces and anti-incumbent demonstrators. @DFRLab identified at least 32 accounts created around these protests.

On March 14, 2016, tens of thousands of pro-Maduro demonstrators gathered in the streets to protest U.S. sanctions, opposed by anti-Maduro activists. @DFRLab determined that at least 91 accounts were created that same day.

Similarly, on January 20, 2017, there was a noticeable increase in account creation activity after protests broke out when multiple opposition leaders were arrested following the collapse of a planned dialogue with the Maduro government.

The dataset of tweets reveals the extent to which the accounts relied on automation techniques to amplify and schedule messages. The most used applications — dlvr.it and IFTTT — are US-based companies that automate and schedule messages for a variety of social-media platforms. According to Bloomberg, Russian troll accounts used both services to amplify their messages during the 2016 U.S. presidential election.

Meanwhile, @DFRLab’s analysis found at least 4,000 tweets from the dataset that used the application RTNicolasMaduro, an app directly linked to Nicolas Maduro and the United Socialist Party of Venezuela (PSUV) that can be used to retweet Maduro. The dataset included basic retweets from Maduro’s official Twitter account.

It is unclear what permissions the app developers required as part of the authentication procedure. Access to users’ profile information, however, poses serious data privacy risks, as granting authentication permission to RTNicolasMaduro may share users’ sensitive information with the app’s developers.

Although similar automation has been used before — according to The Intercept, supporters of Brazilian President Jair Bolsonaro have created Facebook tools to automatically share posts from Bolsonaro’s official Facebook page — this disclosure still stands as unique. It marks the first verifiable instance of an incumbent government party developing a Twitter app for the express purpose of retweeting the party leader’s tweets.

Some accounts in the archive had sizeable audiences and close ties with the regime. The most popular one was @ForoCandanga, an account with more than half a million followers created in 2011. It belongs to an organization of the same name, which was created to organize regime supporters on social media and spread pro-government propaganda. Its founders often lead workshops on “offensive communications operations” sponsored by official institutions. In 2014, Maduro’s account, in turn, tweeted @ForoCandanga a congratulatory message for the organization’s third anniversary in which he encouraged them to “keep giving the battle for the truth of revolution and without rest.” A scan using Sysomos, a social-media listening tool able to retrieve tweets from deleted or suspended accounts, revealed that the account published its last tweet on December 7, 2018.

Another account with a high follower count was @MippciVen, the now-defunct profile of the Venezuelan Ministry of Communication and Information. According to a Ministry press release, this handle was suspended in 2017 amid a crackdown on Twitter accounts associated with the Venezuelan regime. The account’s final follower count, according to the takedown data, was 316,000. The Ministry currently tweets under the handle @Mippcivzla and has 56,000 followers.

Twitter also suspended the account @CorazondelPSUV, which translates to “PSUV’s heart.” News coverage at the time of the suspension indicated that the profile was created in 2015 to support PSUV candidates for National Assembly elections. A Sysomos scan revealed that the account had amplified government messages since its creation, mostly by retweeting high-profile officials. The account’s last tweet appeared on November 8, 2018. It had 70,900 followers at the time of its suspension.

@DFRLab found 13 accounts from the Russian 2019 Twitter archive that were tweeting pro-Maduro regime content in their effort to influence the Venezuelan political landscape. The accounts had shared and posted pro-Maduro regime content, most of it from Russian outlets like Actualidad RT.

The URL most amplified by the Russian accounts was a Youtube video titled “LAS TUMBAS de LORENT SALEH” (“The Graveyards of Lorent Saleh”). The video features a compilation of protests and displays the names of those injured or killed during the 2014 protests, presumably by Maduro’s sympathizers. The Venezuelan government accused Saleh, an opposition activist, of orchestrating violent acts during the demonstrations. The description of the video translates to “The dead [bodies] of the terrorist who supports the Venezuelan opposition.”

Notably, one of the most shared URLs led to a malicious link that redirects users to download a fake version of Adobe Flash Player, presumably in an attempt to spread malware.

The archive of data Twitter released on January 31 revealed the largest to-date takedown of Venezuelan accounts that amplified state-backed propaganda domestically.

In this case, a state-run influence campaign exploited ongoing social and political grassroots movements within the context of domestic unrest in Venezuela. This campaign demonstrates that state-backed influence operations increasingly rely on automation to hijack public discourse, to amplify their reach, and to build a wider audience.

Follow along for more in-depth analysis from our #DigitalSherlocks.