#ElectionWatch: Bots and Boosters in Mexico

Assessing the amplification of New Alliance Party hashtags

Background, timeline of traffic on the hashtag #VotoUtilEsNuevaAlianza, from a Sysomos scan. Foreground left, Facebook post from the official Nueva Alianza page. Foreground right, tweet by amplifier @JGuillermoRang1, reproducing the text. Posts archived on June 19, 2018. (Source: Facebook / NuevaAlianzaMx / Twitter / @JGuillermoRang1)

Mexican political party the New Alliance (Nueva Alianza, or PANAL) has been benefiting from significant online amplification by a cluster of activists and probable Twitter bots, in the countdown to the country’s July 1 election.

As part of our ongoing monitoring of Mexican political dynamics, @DFRLab analyzed a number of hashtags supporting PANAL. We found a mixture of bots and highly-active human accounts which, together, gave a major boost to the campaign’s hashtags — enough to significantly distort the traffic.

#MeadeConNuevaAlianza

In the early morning of June 13 (late on June 12 local time), online monitoring service Trendsmap Mexico tweeted the news that a pro-PANAL hashtag, #MeadeConNuevaAlianza, was trending.

“#MeadeConNuevaAlianza is now a trend in Mexico.” Archived on June 19, 2018. (Source: Twitter / @TrendsMexico)

The hashtag started trending on June 12, as the third and final debate between Mexico’s four presidential candidates was taking place in the city of Merida in Mexico. It highlighted the coalition the ruling Institutional Revolutionary Party (PRI) had formed with PANAL and the Green Party back in December 2017 to support PRI presidential candidate Jose Antonio Meade.

According to a machine scan conducted with online tool Sysomos, the hashtag was used 59,400 times between June 12 and June 14. These mentions (tweets and retweets) were generated by a total of 13,600 users.

Traffic on #MeadeConNuevaAlianza, May 21 — June 29, 2018/ (Source: Sysomos)

This is a remarkably high figure. In scans of organic traffic which @DFRLab has conducted previously, the typical average rate of posting ranges from 1.1 to 2.2 posts per user. The traffic on #MeadeConNuevaAlianza was almost double that, suggesting artificial amplification.

Analysis of the reach of #MeadeConNueaveAlianza. (Source: Sysomos)

Equally strikingly, 96 percent of all Twitter mentions of the hashtag were retweets, indicating that a small number of accounts produced original content, while the vast majority of users amplified it by retweeting it. Such a high level of activity is typical of automated amplification, or deliberate signal boosting by small user groups.

Breakdown of tweets and retweets on #MeadeConNuevaAlianza. (Source: Sysomos)

To illustrate, the fifty users which used the hashtag most generated 14,856 mentions in less than 48 hours, with the most active single user, @avrm8, generating 623 mentions. This translates to roughly one post every five minutes for 48 hours without a break.

Hyperactivity was the defining feature of this Twitter flow. Of the users involved, 485 accounts posted the hashtag more than 20 times in the scanned period, and 765 accounts used #MeadeConNuevaAlianza more than 10 times.

Moreover, thirteen out of the twenty most active users were serial retweeters: upward of 98 percent of their Twitter activity consisted of retweets, rather than authored posts.

Balance of tweets and retweets among the twenty most active accounts. (Source: Sysomos)

An analysis of the three accounts which exclusively posted retweets, using the Twitonomy online tool, showed that they were heavily focused on promoting the @NuevaAlianza Twitter account, along with some of its influencers, including PANAL campaigners and supporters, such as @ConyDir, @AngelinoCaamalM, @swordsolan.

Twitonomy scan which shows users’ activity patterns and lists accounts they retweeted the most. (Source: Twitonomy.com)

It is unclear if these users are fully or partially automated, or run by hyperactive account holders. What is clear is that their behavior pattern is far more reminiscent of bots than humans.

Pushing to Trend

This was the most high-impact hashtag we found promoting PANAL in recent days, but by no means the only one. On June 16, according to trend tracker @influen_cer, the hashtag #VotoUtilEsNuevaAlianza (“useful vote is for the New Alliance”) reached number 44 in the trend lists — just ahead of the hashtag #ARGISL, referring to the Argentina-Iceland match at the soccer World Cup, and just behind #Messi.

Trending hashtags in Mexico, according to @influen_cer. The screenshot was taken from a computer set to UTC; it reflects the state of play at midnight from June 16–17, Mexican time. Archived on June 19, 2018. (Source: Twitter / @influen_cer)

The hashtag featured in a number of pro-PANAL posts, whose essence was “This July 1, my #UsefulVoteIsForTheNewAlliance because…”, followed by various campaign promises from the party.

This hashtag was launched in the morning of June 16, Mexican time, surged explosively during the afternoon, and fell back almost to nothing by the morning. In total, it generated almost 30,000 mentions, according to a Sysomos scan.

As with the Meade example, those mentions came from a strikingly small user group — 5,442 users. On average, each user therefore posted the hashtag 5.4 times. This was even higher than the average for the Meade hashtag.

Traffic on #VotoUtilEsNuevaAlianza, showing the number of mentions and users. (Source: Sysomos)

As before, a very high proportion of these accounts posted retweets. Of the 29,418 total mentions, 28,341 were simple retweets, with no added comment — a proportion of 96.3 percent. This would be exceptionally unusual for organic traffic, and strongly suggests significant bot amplification.

Traffic on #VotoUtilEsNuevaAlianza, showing the number and proportion of tweets, replies and retweets. (Source: Sysomos)

In the vast majority of cases, the accounts which shared this hashtag did so by tweeting the exact wording of posts which PANAL had made on its official Facebook page, sometimes with the addition of a few account tags.

Left, Facebook post from the official PANAL page. Right, tweet by amplifier @JGuillermoRang1. Posts archived on June 19, 2018. (Source: Facebook / NuevaAlianzaMx / Twitter / @JGuillermoRang1).
Left, Facebook post from the official PANAL page. Right, tweet by amplifier @noe_rodriguez230. Posts archived on June 19, 2018. (Source: Facebook / NuevaAlianzaMx / Twitter / @noe_rodriguez230)

Again, some of these users were hyperactive. User @MtraLGarfias, for example, posted the hashtag 613 times in 48 hours, a botlike rate of posting. A visual scan of the account confirmed that its posting seemed to consist entirely of PANAL promotional material, primarily as retweets, but also as apparently authored posts.

The same applied to @rosssy_3, which posted 539 times on the hashtag. The great majority of these were retweets of posts supporting PANAL; some were apparently authored posts which, again, closely resembled PANAL Facebook posts, with the addition of unrelated hashtags (including #WorldCup).

Above, Facebook post from the official PANAL page. Below, tweet by amplifier @rosssy_3. Posts archived on June 19, 2018. (Source: Facebook / NuevaAlianzaMx / Twitter / @rosssy_3)

The presence of such apparently authored tweets raises the question of whether these accounts are bots, semi-automated cyborgs, or human users drawing their content from a prepared stock of texts and memes. The likelihood is that the traffic was generated by a combination of all three.

What is clear is how much a relatively small number of accounts drove the flow. According to our machine scan, the fifty accounts which tweeted the hashtag most often posted it a total of 12,396 times, accounting for 42 per cent of all traffic.

Whatever the combination of human, bot and cyborg accounts in the mix, it is clear that the large-scale, trending traffic was not the result of organic interest, but a deliberate campaign conducted by a limited number of hyperactive accounts.

Different Tags, Same Names

As a final test to verify the scale of the user community which drove this traffic, we scanned two more phrases which were subsets of the larger scan. These were “Si votamos por lxs candidatos de @NuevaAlianza” (If we vote for the @NuevaAlianza’s candidates) and “Este 1⃣ julio ☝🏼mi #VotoUtilEsNuevaAlianza,” (This July 1 my #UsefulVoteIsNuevaAlianza) with the emojis.

The former search returned 2,601 mentions from 574 users. The latter returned 1,174 mentions from 260 accounts. In each case, this translates into an average of close to 4.5 posts per user — double what we would expect of organic traffic.

We then listed all the accounts which tweeted on either phrase in two columns of an Excel file, and isolated those which featured in both columns. We found that 146 different accounts had posted both phrases — more than half the users who posted on “Este 1⃣ julio ☝🏼mi #VotoUtilEsNuevaAlianza.”

The first twenty accounts to have posted on both phrases, from machine scan. The order is alphabetical by username: this image does not attempt to distinguish users by the frequency of their posting, or to define whether they are human-run or automated.

We then searched for all posts by these 146 accounts in the larger scan on the hashtag #VotoUtilEsNuevaAlianza, to gauge their impact on traffic as a whole.

In total, these 146 driver accounts posted 14,798 tweets (including retweets) on the hashtag during the scan for June 12 to 14 — or 50.3 percent of all the traffic on the hashtag. Of those accounts, half were also major amplifiers of #MeadeConNuevaAlianza.

This confirms how much of PANAL’s online support was driven by a relatively tiny handful of users (“tiny” compared with Mexico’s population of 127 million) which posted with hyperactive speed.

Conclusion

These analyses show that traffic on hashtags which promote the Nueva Alianza is very significantly driven by a relatively small group of hyperactive users, many of whom seem to post content straight from the Nueva Alianza Facebook page.

Organizing themselves around chosen hashtags, this group posted a combination of apparently authored posts and retweets, and a sufficient variety of content, to make its hashtags trend in Mexico — a country of 127 million people.

The behavior patterns of these accounts strongly suggest that they were either automated, or run by full-time human activists who drew their content from a prepared stock of Nueva Alianza promotional material. The likelihood is that the hashtags were driven by a combination of both.

As Mexico heads towards the July 1 elections, and attention increasingly focuses on the influence and impact of online manipulation, the ability of this small group to make its hashtags trend is a reminder of how effective such online manipulation can be.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Donara Barojan is a Digital Forensic Research Associate at @DFRLab.

#ElectionWatch in Latin America is a collaboration between @DFRLab and the Adrienne Arsht Latin America Center at the Atlantic Council.

Follow along for more in-depth analysis from our #DigitalSherlocks.