Bots for hire push partisan election messages on all sides

In the countdown to Mexico’s presidential election, a network of automated Twitter accounts has been pushing partisan messages which appear to have been paid for by local political groups.

The bots appear purely mercenary, promoting hashtags which attack all sides. They are linked to Carlos Merlo, self-described as Mexico’s “king of fake news,” whose largely outsourced operations @DFRLab previously exposed.

Their hashtag campaigns underscore the mercenary nature of the business of fake amplification in Mexico, and suggest that political groups from across the spectrum have taken to using such dark arts to gain an edge in the polls.

Win with Victory Lab?

On June 28, BuzzFeed published an interview with Merlo in which the 29-year-old proudly made a hashtag trend for them. The hashtag was #GanaConVictoryLab (“win with Victory Lab”), the motto of the fake-news business which he runs.

According to BuzzFeed, the hashtag hit the fourth most trending spot in Mexico in just two hours. Their article reproduced a few of the posts.

Merlo’s technique was to pre-write tweets in an Excel file, and send them to an unspecified piece of software, which ran the bot accounts. This is a way of getting a large number of accounts to post apparently authored content, in a way, which is less easy for Twitter’s detection algorithms to spot.

@DFRLab analyzed traffic on the hashtag using the Sysomos online tool. This confirmed an abrupt spike in traffic on June 16.

The fact that over 4,000 tweets came from just 213 accounts confirms that this traffic flow was massively manipulated; an average of two tweets per user, not 20, would be characteristic for organic traffic.

The scan also confirmed a number of the accounts which BuzzFeed had identified in its article. Each one posted many times — dozens or scores — on the same hashtag, using a different text each time.

The same wording appeared across multiple accounts, showing how Merlo’s Excel file had been operationalized.

Some accounts posted the same memes, but with different wordings.

These are all characteristics of heavily manipulated and bot-driven traffic. They can be taken as indicative of Victory Lab’s methods.

Some of the variety of language in posts was too great for automation, and suggests that some of Merlo’s employees were manually posting. However, what is clear is that these accounts can be firmly identified as being controlled by Merlo and Victory Lab.

Some of the accounts which posted on #GanaConVictoryLab were suspended by Twitter soon afterwards. Others, however, remained active until June 29. The hashtags which they posted therefore expose some of the hashtags which Victory Lab boosted ahead of the election.

#TodosConCuitlahuac

Some hashtags were positive. One, #TodosConCuitlahuac, reproduced the campaign slogan of Cuitláhuac García, a candidate for the governorship of Veracruz province from the MORENA party, which is headed by presidential front-runner Andrés Manuel López Obrador.

Traffic on this hashtag was very low — just 233 mentions — but followed the same pattern of a spike in a few hours, with traffic driven by a handful of hyperactive users (in this case, averaging exactly 25 tweets each).

The accounts involved showed the same pattern of authored tweets as Merlo’s own example. The fact that the same account, @NiCkltA48, posted both hashtags reinforces the connection. Another of the main drivers of the campaign, screen name “Queen” (handle @LicMala), was also a main driver of the #GanaConVictoryLab campaign.

This therefore appears to be another Victory Lab operation, benefiting García, albeit on a very small scale.

#NoMeRajo

Another campaign hashtag the same accounts promoted was #NoMeRajo, the slogan of Alejandra Del Moral, a Senate candidate in the state of Mexico for the ruling PRI party, which is lagging in nationwide polling.

According to a machine scan of posts using the hashtag on June 26, traffic was heavier in volume, and came from proportionately more accounts. It also continued to gain limited traffic during the day.

Some of this traffic was organic, and driven by Del Moral’s own posts. However, at least one apparent Victory Lab accounts amplified the signal. @ricarditoooop, which posted the Victory Lab hashtag 117 times, posted #NoMeRajo 32 times.

This is insufficient on its own to prove a Victory Lab campaign; however, we consider it noteworthy enough to include here.

#ConEsosZapatos

While some hashtags were positive, far more were negative. On these, the fingerprints of the sort of campaign waged by Victory Lab were clearer.

One of the accounts which posted heavily on #GanaConVictoryLab, @PayasoNegroo, also posted heavily on the hashtag #ConEsosZapatos (“with those shoes”). As in the known Victory Lab effort, it posted a range of memes and apparently authored texts, at very high speed.

The hashtag was part of an attack López Obrador, which originated in a claim that he wore extravagantly expensive shoes.

As before, the traffic was marked by a very sudden spike, and an unnaturally high rate of posting — an average of 12.7 tweets per account, far above the average for organic traffic.

@PayasoNegroo was not the only Victory Lab amplifier to post on this. Another, @_la_fresilla, posted over 200 times on #GanaConVictoryLab, and over 200 times on #ConEsosZapatos. The combined action of the two accounts is too great for coincidence.

The attack on López Obrador appears, again, to be Victory Lab’s work.

Falling Anaya

Not all the attacks were on López Obrador. One phrase — “Anaya se cae” (“Anaya is falling”) — attacked conservative contender Ricardo Anaya, of the National Action Party (PAN). It referred to his fall in the polls ahead of voting day.

The phrase appeared on Twitter on June 1, and was heavily pushed by the same accounts which later pushed #GanaConVictoryLab.

@PayasoNegroo was, again, a ringleader, posting the phrase dozens of times in rapid succession; another bot, now suspended, called @FresiBB_ (screen name “BB”), which also posted massively on #GanaConVictoryLab, was even more active.

Posts by “BB” on #GanaConVictoryLab (above) and “Anaya se cae” (below).

This followed the familiar pattern of a rapid spike in traffic driven by a relatively small number of highly active accounts — this time, averaging 6.8 posts per account.

Curiously, the same phrase returned at a somewhat higher volume on June 13, with an even higher average rate of posts per user (10.5), and a similarly abrupt spike in activity.

Yet again, some of the most active posters were involved in the #GanaConVictoryLab push. For example, @TuPrinchess and @WhizKantinFlash posted heavily on “Anaya se cae,” having earlier been drivers of #GanaConVictoryLab.

Both attacks on Anaya therefore seem to have originated with Victory Lab.

Conclusion

This is only a snapshot of the many hashtags pushed by Merlo’s team during the course of the election; however, they illustrate the apolitical nature of his operation.

Hashtags amplified by the Victory Lab team attacked both López Obrador and Anaya, as well as other politicians; smaller operations appear to have promoted local politicians from various parties.

These operations were small, involving a few hundred accounts at most. They were carefully prepared, using a large stock of memes and authored texts to avoid Twitter’s detection. As the BuzzFeed article showed, they were enough to make their hashtags trend in Mexico.

These operations showcase the challenges Twitter faces from users attempting to game the “trending” algorithm. They also appear to show the ready market that Victory Lab has found among Mexican politicians, and their supporters, who are eager for online promotion to create the illusion that real voters are engaging on chosen messages.

#ElectionWatch in Latin America is a collaboration between @DFRLab and the Adrienne Arsht Latin America Center at the Atlantic Council.

Follow along for more in-depth analysis from our #DigitalSherlocks.