Social Media Automation & Infowars by Venezuelan Opposition

A critical look at some of the methods used by the right-wing Venezuelan opposition against the Maduro government and supporters of Chavismo.

There is a long history of foreign interference in Latin America and Venezuela specifically. In recent years, the US government has imposed crushing sanctions on the already struggling Venezuelan economy. An information war is also playing out on Venezuelan social media, though the actors involved are unknown. For 1.5 years I have tracked a hashtag associated with a group of right-wing political hackers who support the Venezuelan opposition. I’ve found blatant use of automation, coordinated inauthentic behavior and cyborgs in Venezuelan networks; accounts that tweet hundreds to thousands of times per day in order to push out a massive volume of media on Twitter.

One of these cyborgs tweeted at me in 2017 after I published an initial study about opposition hashtag, #TeamHDP. The cyborg told me they were using IFTTT to boost their tweets because of censorship. I believe the person who was running this account was likely an activist who genuinely believed they were trying to circumvent state censorship, but the Venezuelan opposition is far from censored on Twitter. To the contrary, their trends generate billions of impressions every day.

I’ve never seen anything with such a tremendous reach as this Venezuelan opposition hashtag, which is why I’ve continued monitoring it since I first found it in June 2017.

Background

In March 2016 Bloomberg published the investigation How to Hack an Election, which is how we learned that Andres Sepulveda, Colombian right-wing political hacker, had rallied Anonymous in Venezuela against Chavez in 2012.

I had seen some Venezuelan Anonymous accounts on Twitter and noticed they were using hashtag #TeamVene10, so I downloaded some tweets that corresponded with that hashtag in June 2017. That was how I stumbled across #TeamHDP.

At the time I was mostly experimenting, so I downloaded some #TeamHDP tweets too, and realized soon after that the hashtag was unusual.

I later discovered that #TeamHDP was used by an anonymous group of right-wing political hackers that have attacked the Venezuelan government, leaked documents online and targeted supporters of President Maduro, known as Chavistas with doxing campaigns on Twitter.

When I graphed the hashtag in 2017, #TeamHDP consisted of three main actors:

1. an anonymous penguin (handle: HDPY0)

1. a Justin Bieber parody account (handle: YoSoyJustin)

1. a US website based in Miami (handle: DolarToday) that, according to wikipedia, “is more known for being an exchange rate reference to the Venezuelan bolivar” and “monitoring the Venezuelan economy.”

I did an analysis of their networks in June 2017 which you can read here:

The network is currently down to 2 actors: DolarToday (3.4 million followers) and another iteration of the anonymous penguin, ThePinguinHDP (17.5K followers). Justin Bieber has disappeared and I’m not sure what happened to him but I’m going to backtrack to 2017 briefly to explain something I found then that wasn’t included in my initial analysis.

---

The Venezuelan Justin Bieber

The accounts that were tweeting under hashtag #TeamHDP were also using a second hashtag #LaListaJustin (Justin’s list). This hashtag was a network used to dox government officials and Chavistas. In May 2017, they hacked a government portal of national ID cards and leaked a cache of personally identifiable information on Twitter.

I found out about the hashtag dox list after I published my blog and I easily found some of the tweets with personal data. I reported them (PII was still on Twitter in June 2017, a month after it had been hacked). They were doxing supporters of the Venezuelan government including military members and police, and also doxing their wives and families.

Then Twitter suspended the Venezuelan Justin Bieber, YoSoyJustin. I received a notification back from my reports that the account had violated Twitter rules. But shortly after he was suspended, sometime overnight between June 26 and June 27, 2017, he came back on a new profile (YoSoyJustin_ ). I monitored this new account and watched it rapidly gain tens of thousands of followers within a matter of days. I documented the progression on Facebook and took screenshots:

“@YoSoyJustin was one of three trollish accounts I found in #TeamHDP and since he was doxing people, I reported the tweets with private info and his account was suspended sometime overnight between June 26 & 27.

Here’s the progression in chronological order of his “new” account after he came back on a new profile.

The new account @YoSoyJustin_ was actually opened in May 2014 (during La Salida protests) and has been lying dormant until this week when it was activated, began tweeting and has gained over 21K followers in 1 week.” — me from June 2017.

This account tweeted the following instructions in a thread of 12 accounts including the now suspended YoSoyJustin:

“We should wait for the new account that will be opened to do the same operation to it.”

I’m still not clear what the “operation” involved but over the next few days I watched the second Venezuelan Justin Bieber gain tens of thousands of followers.

The tweet included in the next screenshot says “I’m back again ASSHOLES”

A few days later, Venezuelan Justin Bieber #2 jumped from 11.9K followers to 21.5K followers.

I mentioned above that the second Venezuelan Justin Bieber’s account had been dormant since 2014. I saved screenshots I took from socialbearing.com in June 2017. The second account has also been suspended.

There were also 2 more fake Justin Bieber accounts but I don’t know if these were made by the same person or someone else trolling the troll.

The anonymous penguin is still online using a new iteration of the original HDPY0 handle.

Candy Crush Level 1#TeamHDP pic.twitter.com/EAQo07dIE3

— YO Er HDP (@ThePinguinHDP) January 29, 2019

I have continued to monitor this hashtag over the past 1.5 years. I’m not sure how many versions of Justin Biebers have been opened and suspended, but there was at least one more (yosoyjustincito). It seems like all fake Venezuelan Justin Bieber accounts are now suspended but the rest of the network is still online.

• • • –

Persistent automation

The extent of automation that was being used in this hashtag network in June 2017 was obvious. They used several well-known apps like Botize, IFTTT as well as 2 apps associated with DolarToday, “SWAT Comunicacional” and the self-named “DolarToday.” These apps used OAuth so people could log in and authorize Dolar Today to broadcast tweets to their timelines.

I also found several accounts tweeting at high volumes which I documented in my first analysis of this hashtag.

Since that first analysis of #TeamHDP, I’ve collected 8 additional datasets, 9 total. I’ve captured a total of 299,391 tweets and of that total, 52,383 of those tweets were sent by automated apps. The total of automated tweets ranged between 9% to 24% since I’ve been tracking it.

#23E

I didn’t realize they were going to try and overthrow the government again last week, so I didn’t start collecting tweets for related hashtags until Jan 24. Here’s the user-to-hashtag network for 18,116 #23E tweets from January 24 to January 28. The #TeamHDP hashtag was a noticeable presence in #23E which was one of the main hashtags for the protest.

The user-to-user network for this same dataset shows DolarToday was a central influencer of the #23E hashtag during the timeframe that I captured tweets.

Here are the top users for the hashtag #23E during the time I collected tweets for this hashtag. Note that this hashtag made over 1 billion impressions in 4 days.

I found a variety of automation apps in #23E: IFTTT, Buffer, TweetDeck, GroupTweet, dlvr.it, Hootsuite, several of what appear to be news outlets are tweeting using 6 different versions of something called “Tuiteo Top EP”: Tuiteo TOP EP (1), Tuiteo TOP EP (2), Tuiteo TOP EP (3), Tuiteo TOP EP (4), Tuiteo TOP EP (5), and Tuiteo TOP EP (6).

I found 2 apps attributed to Blackberry although I suspect only one is legit: Twitter for BlackBerry® and Twitter for BlackBerry.

Dolar Today tweeted using its 2 usual apps: SWAT Comunicacional & DolarToday.

DolarToday also got massive retweets from an account called notiven which says in its bio that it aggregates news. notiven uses an app called “notiven” and averages 2243 tweets per day. DolarToday is also tweeting at a high volume, averaging 349 tweets per day.

The average tweets per day cited on socialbearing.com is calculated by taking the total number of tweets divided by the number of days since the account has been online. Although DolarToday’s average is 349 tweets per day, the account sometimes stops tweeting and then resumes tweeting at a volume which escalates to over 1000 tweets per day at times, like this week.

Notiven operates on a similar schedule.

An account called PK2noticiosos is also tweeting using the DolarToday app, SWAT Comunicacional. Although this account doesn’t tweet at a high volume, its activity looks very unusual using Luca Hammer’s Account Analysis tool:

Here’s a look at the repetitive automation coming from the DolarToday account and various other accounts that auto-tweet its content. The spammy repeater tweet translates to: “PERVERTED DRUG ADDICT! Hugo Chávez tried to sexually abuse Eva Golinger while smoking marijuana”

IFTTT

I found a network of accounts using IFTTT in 2017 and IFTTT is still being used by the Venezuelan opposition to tweet in 2019. Here’s a few of the accounts using IFTTT.

Zuliano73 averages 245 tweets per day but tweets on a very unusual schedule. It appears to push out hundreds of tweets around 3am.

leonysradio is also using IFTTT. This account was dormant for months but is now pushing out a lot of tweets around 3am.

ReportenVivo is another unusual account. Its bio says “Live reports and news from Venezuela but it tweets only around 3am using IFTTT.

Brandon Solorzano is supposedly a systems engineer, but his account tweets at the same time as the rest, 3am using IFTTT.

noticiasmiami says it’s “the best news from Miami and Venezuela for Latinos in USA” and it spits out hundreds of tweets at 3am like these other accounts, but also tweets using TweetDeck and Twitter Web Client at other times of the day. noticiasmiami is averaging 450 tweets per day.

There are more accounts participating in this 3am Twitter blitz. I don’t know who is operating these accounts but I can confidently call this a pattern of inauthentic, coordinated behavior on Twitter.

#TeamHDP network visualizations

Here is the user-to-hashtag network for 14,242 #TeamHDP tweets from January 24 to January 29. The hashtag is linked to a variety of daily protest hashtags: 15E, #21E, #23E, #23Ene, #24E, #25E, etc.

The red area in the upper left perimeter is a cluster of anti-Maduro trends as well as location specific hashtags.

The main accounts in the user-to-user network for #TeamHDP mainly consists of DolarToday and a new iteration of the anonymous penguin, in the lower perimeter, tagging several Venezuelan politicians. The Venezuelan Justin Bieber is absent.

Again I want to reiterate, the hashtag #TeamHDP is associated with a group of Venezuelan anti-government hackers, so it seems unusual that a financial website from Miami is the main account promoting a hashtag associated with hackers.

High volume accounts

Many of the account that are retweeting DolarToday are tweeting hundreds to thousands of tweets per day. I filtered this network by edge weight 10 to see how many accounts retweeted DolarToday 10 times or more.

There are many high volume accounts retweeting DolarToday. The obviously massive edge is notiven. Notiven is tweeting over 2000 times per day on average which is why it’s so thick. The rest of the edges highlighted above are accounts tweeting hundreds of times per day.

I found several accounts in this batch of retweeters that have been dormant for months or years but appear to have recently woken up and began emitting high volumes of tweets.

Several accounts that tweeted very high volumes, went silent on Thursday and Friday of last week (January 24 & 25) and began tweeting again at high volumes on Saturday January 26.

I also found four accounts, including the main DolarToday account, that registered 3200 tweets in a 7 day timespan. Twitter limits the amount of tweets you can extract per user to 3200 tweets, so it’s possible those 4 accounts were actually tweeting more than 3200 and I hit a rate limit.

These four accounts — info_Ve, Notiven, DolarToday & LpezRodriguez — together tweeted at least 12,800 tweets in a 7 day period.

I calculated average tweets per day using tweet totals from Account Analysis for 26 accounts that retweeted DolarToday 15 times or more and they are all high volume accounts. Only 1 was created this month, the rest were accounts created between 2009 and 2018, with the exception of notiven which was opened June 2, 2007 (the oldest account I found in this batch). 15 of these 26 accounts were created in 2012 or older.

• • • –

#TeamHDP trend over time

I have downloaded this hashtag at random times since I first found it in June 2017. Each infographic below shows the top sources used to tweet hashtag #TeamHDP from June 2017 up to and including this month January 2019. For at least 1.5 years this hashtag has had a significant and consistent amount of automation.

These infographics also show the impressions for each dataset, which are consistently in the billions. I have never seen a hashtag reach that many impressions, I assume it’s attributable to the massive volume of tweets coming from this network.

Fake news

Old photos from other countries have been documented circulating in previous Venezuelan protests. A video from 2016 received massive diffusion in last weeks #23E protests, including from Katie Hopkins and other verified accounts.

DFRLab research

The Atlantic Council’s, DFRLab (Digital Forensic Research Lab) whose mission according to their website, is to “identify, expose, and explain disinformation where and when it occurs” — wrote a blog saying they “did not find clear evidence of automated amplification of hashtags trending around the protests.” They mention there was a disproportionate number of retweets in a variety of hashtags associated with #23E protests which can be an indicator of automated accounts, but they said more research would be needed to identify any “bot-like behavior on the amplification of the regime-pushed hashtag” (emphasis is mine).

I was shocked at the contrast between the way DFRLab portrayed Venezuelan social media versus what I’ve been monitoring for 1.5 years. I can at least confirm that the “disproportionate number of retweets” DFRLab noticed was caused by automated amplification although the opposition was doing the amplifying, which they apparently ignored.

Conclusion

I recently commented that there is a social media fog hanging over Venezuela and now you know why I said that. I believe this deluge of automated opposition is a big part of it. Prominent US politicians also contribute to this infowar. Senator Marco Rubio has been openly tweeting for regime change in Venezuela for many years and this past week many US politicians — both Democrats and Republicans — have publicly supported overthrowing the Venezuelan government.

People on Twitter claiming to be Venezuelan have told me that there is censorship in Venezuela and that they only have access to state media. I believe that within Venezuela, censorship is probably happening and state media likely does dominate the airwaves there. However outside of Venezuela, here in the US, I don’t think we are hearing any other opinions from Venezuela over the roar of the opposition swarm on social media.

I listened to this excellent podcast this morning for some critical analysis of Maduro and his administration. Eva Golinger explains that even the left in Venezuela wants a change and there are many legitimate reasons to criticize President Maduro besides the generic “because socialism” that we usually hear in the US.

I can read news in English and Spanish which usually helps me differentiate between what’s actually happening in Latin America versus what the US media is translating and reporting. But even without a language barrier, I still have a hard time parsing what is really happening on the ground in Venezuela. I hate that I have to question everything I see on Twitter and in US media regarding Venezuela, but I’ve seen too much to blindly trust what I’m reading online.

What I can say for certain is that Venezuelan opposition social media networks are engaging in inauthentic coordinated activity on Twitter. If we are to understand and combat social media manipulation, we need to recognize it and criticize it no matter who is doing it.

• • • –

Gephi graphs in this blog were created using OpenOrd combined with Force Atlas 2 layout algorithms.

Tweets per day (TPD) cited above are via Social Bearing as of January 2018 and those metrics can fluctuate over time. TPD is calculated by the total number of tweets an account has tweeted divided by the number of days the account has been online. This metric can change if an account stops tweeting for a period of time or deletes tweets en masse.

Account Analysis: For some accounts I used Luca Hammer’s Account Analysis tool to determine the tweet volume during the timeframes of the three hashtags I captured and calculated the average for the week since some accounts had been dormant for months or years which skewed Social Bearing’s metrics.

Impressions cited above are via Tweet Archivist who defines the metric as “the total number of times that the tweets of an archive have been delivered to Twitter streams. Of course, not everyone who receives a tweet will read it. As such, impressions are the largest possible audience for the given archive. Paid advertising works similarly; even though an ad was displayed on a website, there is no guarantee that a person actually saw it. Also, note that impressions does not deduplicate users, so if the same person sees a given hashtag twice, it counts as two impressions. Note that, because replies are only delivered to common followers’ timelines, they are calculated as a single impression.”

Source URL: Use Journal by Erin Gallagher