On September 10, far-right Twitter users in Germany launched an attack on DerSpiegel magazine after it wrote an article about their activities.
The attack was driven by a small group of aggressive and coordinated accounts, then greatly boosted by automated “bots”. Their chosen hashtags trended on German Twitter, showing how effectively far-right groups are at pushing online messages in the countdown to Germany’s general election on September 24.
However, the far-right campaign failed to gain widerspread traction, with traffic limited to a relatively small group of users.
“Not my Spiegel”
The attack came in reaction to a DerSpiegel article on September 9. Headlined “March of the Trolls” (“Aufmarsch der Trolle”), this described how far-right supporters of the anti-migrant Alternative für Deutschland (AfD) party were coordinating Twitter campaigns, inspired by the international, and especially American, far right.
At 13:41 UTC on September 10, a Twitter account called @darksideofkek responded by tweeting the two hashtags #NichtMeinSpiegel (“Not my Spiegel”) and #LügenSpiegel (“Lying Spiegel”).
This is a classic far-right account. Its username references “Kek”, the totem of the far-right movement in the United States and one of the key terms to characterize its “Great Meme War” during the 2016 election in the United States. Its avatar image is Pepe the Frog, another far-right totem.
The account is not particularly active, having posted 635 times since it was created in early June, at the somewhat unusual time of 02:17 UTC (4:17 a.m. German time). The account’s following is also small, at 582 users as of September 12.
The hashtags it launched initially spread slowly, consistent with a user with a small following. However, at 17:00 UTC, traffic on both #NichtMeinSpiegel and #LügenSpiegel jumped from under 600 tweets an hour to over 7,000 tweets an hour. By September 12, according to a machine scan, the two hashtags were tweeted an almost identical number of times: 21,420 for #NichtMeinSpiegel, 21,990 for #LügenSpiegel.
@darksideofkek was the most-mentioned user on both hashtags:
According to @darksideofkek’s own claim, the hashtag #NichtMeinSpiegel was trending by the evening of September 10:
An article posted on the election-watching website wahlzone.mdr.de noted the two hashtags were ranked third and fourth in political trends the same evening.
The following morning, #NichtMeinSpiegel and #Lügenspiegel were ranked first and second in German political topics.
By September 12, they had slipped well down the rankings, but #NichtMeinSpiegel still ranked in the top 100, according to trendingdeutschland.com.
Thus the hashtags at least achieved their creators’ initial goal, by making it into the trending lists, and thus, potentially, being noticed by many more users.
Bring on the bots
However, the reason for this success was not public interest, but a sudden and massive injection of hyperactive, and probably automated, accounts. In other words, “political bots”.
For example, the most active account to tweet both #NichtMeinSpiegel and #LügenSpiegel was called @Teutemantuts. In the space of just over 36 hours, this account posted 870 times on #LügenSpiegel and 828 times on #NichtMeinSpiegel, including 712 posts which mentioned both. Every single post was a retweet.
Created on the evening of September 4, this account posted 1,855 tweets by midday on September 12, at an average of almost 250 posts per day. As of September 12, all its most recent posts were retweets.
By all indications, @Teutemantuts is a bot set up to amplify pro-AfD messaging with sheer volume of posts.
The same applies to @Ichsagemeine. This account, which gives no personal information and whose avatar image is a pair of rings, posted 392 tweets on #NichtMeinSpiegel between Sunday noon and Monday evening, 332 of them retweets.
It was even more active on #LügenSpiegel, posting 500 times over the same period. This time, 372 were simple retweets; the remainder were apparently retweets with the same hashtags added time and again.
Another significant amplifier was @Konservator_78, which was created on August 2 and provides no verifiable personal information.
This account has more human characteristics, posting a higher proportion of replies and apparently authored posts; nevertheless, it posted both hashtags 74 times, together with the hashtag #Reconquista (“reconquest”), a reference to the Christian reconquest of Spain from the Moors.
Another member of the group even adopted “Reconquista” as its handle, @ReconquistaGer.
Some of the most active accounts were literally faceless. For example, @SOPAM49 gives no avatar image or biographical information — a common feature of bots (for further indicators, see our list of twelve ways to spot a bot here.)
Starting on September 10, this account made 193 posts on #Lügenspiegel, and 196 on #NichtMeinSpiegel, all retweets.
The accounts @MalWieder_da and @MalWieder_real, both created in September, share these characteristics, as they both show high levels of activity and offer no avatar image or biographical information.
@MalWieder_Real posted 123 times on #LügenSpiegel, a mixture of retweets and long strings of hashtags attached to pro-AfD, anti-Spiegel, and anti-Merkel memes.
@MalWieder_da posted 88 times, in much the same style.
The posts of @TorstenDonners show a similar density of messaging and tweeted 297 times using #LügenSpiegel. Its content consisted of annotated retweets, with the exact same wording and punctuation.
Most of these accounts appear automated; all made a deliberate effort to amplify the hashtags, far beyond the activity of normal Twitter users.
Indeed, according to a machine scan, the top 10 users on each hashtag posted over 4,000 tweets between them, accounting for almost one-fifth of traffic.
The top 50 users posted over 10,000 tweets, or roughly 50 percent of all the traffic — a sure indication that the hashtags were not driven into the trending lists by grassroots interest, but by a deliberate and relatively small group. In typcial grassroots traffic, the figure lies around 10 percent.
Overall, the #NichtMeinSpiegel hashtag, which generated 21,420 tweets, only involved 2,258 users, while Lügenspiegel, with slightly more tweets, had even fewer users (2,122). This translated to an average, in each case, of over 9 tweets per user. For comparison, studies of hashtags known to be organically driven typically have an average of 1.5–2 tweets per user.
This indicates the two hashtags attacking Der Spiegel were driven by a small group of aggressive users, backed by bots, in order to make their hashtag trend rather than a genuine grassroots campaign.
Traitors’ Duel
The reason for the group’s attack on Der Spiegel may be that the outlet referenced a hashtag, #Verräterduell (“Traitors’ duel”), which the same group launched on September 3, to mark the one TV debate between Merkel and her main challenger, Social Democrats’ (SDP) Martin Schulz.
Der Spiegel also noted that the users coordinated on the 4chan platform; @DFRLab investigated this channel, and found advice — in English — on how to spread memes, together with material for users to share.
The #Verräterduell traffic shows strong signs of artificial amplification and coordination, consistent with Der Spiegel’s report. A separate scan of Twitter traffic on this hashtag shows usage peaked almost vertically, then fell steeply away — a classic sign of bot activity.
The average number of tweets per user was very high — 10.8, across a sample of 10,105 tweets. The 50 most active accounts produced 41 percent of all tweets. All these factors indicate bot amplification.
Some of the individual users were also the same. The traffic was launched by @Konservator98 with a call to “bomb the traitors’ duel”.
The two most-influential voices were @ReconquistaGer and @Darksideofkek, each mentioned over 1,000 times.
@Teutemantuts, @SOPAM49, @MalWieder_da and @MalWieder_Real all provided amplification, albeit on a smaller scale (7–27 posts each).
The traffic was enough to make the hashtag trend among political topics on both September 3 and September 4.
On this occasion, the heaviest amplification came from a different set of accounts. However, this initial hashtag, which triggered Spiegel’s interest, clearly comes from the same s community.
Another day, another hashtag
Other hashtag drives originated with this group as well. On September 8, a few days after the TV debate, the same cluster of accounts began pushing the hashtag #NichtMeineKanzlerin (“not my Chancellor”). This saw more activity: over 52,000 tweets between September 8 and September 12.
Again, however, the activity was not organic, but bot-driven. All the tweets were generated by just 3,753 users, a phenomenal average of 13.9 tweets per user — almost ten times the rate to be expected of a genuine grassroots movement. The top 50 accounts contributed 21,924 tweets, or 42 percent of all the traffic.
The traffic was spread out over four days, but it showed the classic sudden spikes of bot amplification:
Once more, @Darksideofkek was one of the top voices, alongside @Konservator_78 and @ReconquistaGer.
@TorstenDonners was another early mover, once more posting strings of hashtags attached to various anti-Merkel and pro-AfD memes.
The top amplifiers included the same accounts again: @Teutemantuts (1,448 tweets), @Ichsagemeine (1,033), @TorstenDonners (750), @SOPAM49 (737) and @MalWieder_real (695).
This diagram shows the crossover between the three hashtag campaigns, with stars marking the accounts which were top-10 tweeters for each:
This is clearly the same group, using the same methods for the same purpose: to make their hashtag trend or create a facade that a lot of real people are engaging on their content. However, the rapid fall-off in traffic after the spike of bot activity shows that they did not manage to attract significant new users.
“Merkel must go”
One final hashtag drive merits attention. On Saturday, September 9, the group began amplifying the hashtag #MerkelMussWeg (“Merkel must go”). On this occasion, the intent appears to have been to amplify and publicize a small pro-AfD demonstration (a reported 200 people) in Berlin.
As @DFRLab has described, this is a long-running hashtag of the far right in Germany; its use in conjunction with a demonstration on the streets is an interesting case of electronic campaigning in parallel to physical campaigning.
Yet again, @darksideofkek was the most amplified user; yet again, @ichsagemeine, @TorstenDonners, @SOPAM49 and @MalWieder_real ranked among the top tweeters.
The traffic was marked by a high average number of tweets per user (5.8, in this case); and, yet again, the 50 most active users contributed an implausibly high proportion of the total traffic — just over 60 percent.
Again, it appears to have contributed to trending topics.
However, the final similarity is the most important for the student of online effects: as before, the traffic dropped back close to zero once the bots had disengaged, as this timeline shows:
Conclusion
The attacks on Der Spiegel came from an aggressive, well-prepared, and small group of far-right activists, who have honed their Twitter cooperation through a number of campaigns.
The campaigns were marked by the plentiful use of memes, the same few leading voices, many of the same hyperactive supporters, and a cast of bots. These are techniques we have already observed on the far right in the United States and France. In fact, the tactics behind this attack resembles the “Great Meme War” launched by the alt-right in the run-up of the Presidential elections in the U.S.
In the short term, the campaigns succeeded in trending hashtags and, therefore, bringing them to the attention of new users. However, there is no indication that they then attracted new users to keep sharing the message.
On each occasion, the campaigns relied on a very high number of tweets from a very low number of accounts to achieve their effect, and the later campaigns, especially the ones targeting Der Spiegel, did not seem to have significantly greater success than the earlier ones.
Thus these campaigns were a tactical victory, but do not seem to have translated into strategic gains.
Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).
Donara Barojan is a Digital Forensic Research Associate at @DFRLab.
Follow along for more in-depth analysis from our #DigitalSherlocks.
