#ElectionWatch: Inauthentic Activity in India

Pages used false identities to exacerbate polarization on both sides before elections

@DFRLab
@DFRLab
Apr 1 · 8 min read

On April 1, Facebook took down over 700 assets that were posting partisan content on Indian politics ahead of the country’s national elections, ruling that they had engaged in “coordinated inauthentic behavior”. A number of large pages on Facebook and Instagram supported the ruling Bharatiya Janata Party (BJP); several dozen smaller Facebook pages were linked to the main opposition party, the Indian National Congress (INC).

Social media are already a major battleground in India’s pre-election fervor. The BJP has long been accused of running deceptive social-media accounts and disinformation campaigns from inside its so-called “IT cells.” The INC is reported to have followed suit, although the latter operation is allegedly suffering from internal disputes.

In a blog post, Facebook explained three “separate and unrelated” actions, which included:

We removed 687 Facebook Pages and accounts — the majority of which had already been detected and disabled by our automated systems — that engaged in coordinated inauthentic behavior in India and were linked to individuals associated with an IT Cell of the Indian National Congress (INC).

We removed 15 Facebook Pages, Groups and accounts that engaged in coordinated inauthentic behavior in India and were linked to individuals associated with an Indian IT firm, Silver Touch.

We removed 321 Facebook Pages and accounts in India that have broken our rules against spam. Unlike the first three actions, this last activity does not represent a single or coordinated operation — instead, these are multiple sets of Pages and accounts that behaved similarly and violated our policies.

The pro-BJP assets carried vitriolic posts against opposition leaders and managed to garner high engagement, while the INC-linked assets pushed satirical posts but garnered moderate engagement.

The fact that partisans on both sides resorted to such tactics is a troubling feature. It suggests that such inauthentic behavior may increasingly be considered a necessary part of political campaigning, with the expectation that the other side will also be conducting such activity. That, in turn, suggests that the platforms, and voters, will continue to face more challenges from more directions, as they try to distinguish between genuine and inauthentic content.

Simultaneously, Facebook took down a set of Indian pages that posted spam, and a set of pages linked to Pakistan that engaged in coordinated inauthentic behavior (CIB). The DFRLab analyzed the Indian and Pakistan pages engaged in CIB, but not the spam pages.

The India Eye

The takedown included two pro-BJP pages called “The India Eye,” which Facebook removed from its own platform and Instagram. These were significant assets: by the time of the takedown, the Facebook page had over 2 million followers. According to The Wire, “The India Eye” was connected to an Indian IT company called Silver Touch Technologies Ltd, which also created Prime Minister Narendra Modi’s official app.

The page was strongly nationalist, a vocal supporter of Prime Minister Narendra Modi, and a critic of Congress leader Rahul Gandhi.

Last year, AltNews, an open-source fact-checking outlet, reported that a related website called theindiaeye.com was hosted on Silver Touch servers. Silver Touch managers denied having anything to do with the website or the Facebook page, but Facebook’s statement attributed the page to “individuals associated with” Silver Touch.

The page was created in 2016. It went through several name changes in the first two weeks of its existence, suggesting that the operation was experimenting with branding.

Even after several regional media outlets reported that the page was spreading false information related to Indian politics, the engagements on posts kept increasing, with a significant uptick from June 2018 onward.

On occasion, the page held events, including quiz nights aimed at celebrating the BJP’s hold on power. These events started with little success, but gained more engagement over time, up into the low thousands.

Overall, the notoriety of this page, as well as its high follower count, suggest that it was a significant asset. It engaged its users with partisan and polarizing content, posing as an independent outlet, while serving the interests of the governing party.

Its removal a few weeks prior to the election eliminates an important player from the pre-election landscape, but it highlights the willingness of the BJP’s supporters to engage in large-scale inauthentic behavior to push their message across.

The India Eye Facebook page had a counterpart on Instagram. After Indian media began writing about the Facebook page, the page redirected its activity toward Instagram, opting for more visual content with fewer words, and even fewer sources.

One of the most engaged posts presented a polarizing narrative of one of Prime Minister Narendra’s recent speeches on corruption. The post suggested that, during the speech, Indian media outlets focused their cameras on the INC, as if confirming the allegations of corruption plaguing the party. The post provided no corroborating evidence for the claim, and used a collage graphic of three distinct images rather than video footage.

The page used popular hashtags, such as #like4like and #follow4follow on Instagram, to push its messages across political filter hashtags and to attract a wider following. This is a common tactic of hyper-partisan and spam accounts.

Despite this, compared with the Facebook page, the Instagram page had far fewer followers, perhaps in part because it did not live up to its promise to follow users who followed it. The page followed only 12 accounts, including government offices and senior BJP politicians.

In general, the Instagram account posted the same memes as the Facebook page, but tended to have more impact, despite its lower overall following.

Overall, and despite its smaller following, the Instagram page appeared to significantly increase the impact of individual posts, although some crossover between the Facebook and Instagram user bases cannot be ruled out.

Congress Gujarat IT Cell Pages

Facebook also removed hundreds of pages run by “individuals associated with an IT Cell of the Indian National Congress (INC).” Facebook did not name the cell, but the evidence suggests that it was most likely the cell based in Gujarat.

According to Facebook’s blog post, “the individuals behind this activity used fake accounts, the majority of which had already been disabled by our automated systems, and joined various Groups to disseminate their content and increase engagement on their own Pages”

Most of these pages used the same page image as that of the Gujarat Congress IT Cell’s “Cyber Army,” and some made their loyalty explicit.

Many of the pages taken down were dedicated to different local towns in Gujarat, suggesting that their strategy incorporated granular geographic targeting for the Gujarat assembly elections.

Among the Congress IT Cell pages that targeted BJP, some of the most popular posts were:

Lampooning the Opposition Via Caricatures

The INC pages employed distinct post templates for satirical content. One of the pages, “मामा मामू बना गया” posted against the former Chief Minister of Madhya Pradesh, Shiv Raj Singh Chouhan, and Prime Minister Narendra Modi. Congress IT Cell usage of satirical caricatures managed to garner a few engagements. Despite the creative strategy, the pages had less engagement compared to The India Eye’s page.

Another page, called Jo Feku, had significant engagement — over 15,000 likes and followers — and employed a similar pattern of posting content related to the BJP. The Jo Feku page took similar satirical digs at Modi and the incumbent government for their performance over their term.

Breakdown of Pages

The page creation dates of several of these pages suggest that they were created before the December 2017 Gujarat assembly elections.

The pages garnered a significant engagement with more than 200,000 likes.

Many of these pages were dedicated to states. While most were related to the Gujarat elections, some focused primarily on Mumbai and Chhattisgarh.

Overall, the Gujarat INC Cell was more transparent in its affiliation — its pages explicitly called users to join the IT Cell. The content was more satirical in nature, with mostly cartoons and memes ridiculing the incumbent government. The operation was granular in its geographical targeting, focusing on assembly elections in Gujarat, Madhya Pradesh, and Chhattisgarh.

Conclusion

Facebook’s takedowns illustrate the intensity of India’s online battle ahead of the election. The India Eye, with its millions-strong following, was run from a company with links to the BJP; the regional network was linked to the Congress party and its IT cells. Each example showed partisan users running covert assets to push their political messages.

There were differences in approach. The India Eye was one very large entity on Facebook and Instagram, posting polemic and hyper-partisan content. The pro-Congress pages were smaller individually, and more focused on regional and sub-regional locations but made up for their lower individual followings with a much higher number of pages. They were more satirical in tone.

Both operations, however, relied on inauthentic behavior and the use of covert assets to push their message across. This is the most troubling development in the case. It suggests that the use of covert assets has become an accepted part of campaigning, at least in Indian politics, and that parties which aspire to governance will likely look to inauthentic amplification as a necessary tool in the broader campaigning toolkit. If so, that would be a poor outcome for the health of democratic debate.


Kanishk Karan is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (DFRLab).

Ben Nimmo is Senior Fellow for information Defense at the Atlantic Council’s Digital Forensic Research Lab (DFRLab).

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.