From Telegram to Twitter: Top Puerto Rican Officials Plotted Possible Information Operation

Leaked chat logs suggest Puerto Rican officials may have played a role in encouraging troll accounts to boost pro-government hashtags, target opponents

@DFRLab
@DFRLab
Jul 29 · 10 min read
(Source: @luizabandeira/DFRLab via Ricardo Rosselló)

A cohort of troll accounts spread pro-government hashtags and targeted opposition figures on Twitter while participants in a private Telegram chat group, including Governor Ricardo Rosselló and several other Puerto Rican government officials, discussed similar campaigns, a DFRLab investigation has revealed.

After an anonymous source leaked the chat logs, protesters began demanding the governor’s resignation. On July 24, Rosselló announced that he will leave his post effective August 2, 2019.

The DFRLab cannot say with certainty that the chat participants directed the troll accounts; however, the timing and specificity with which the officials discussed the accounts’ actions within the chat suggest a degree of complicity. At worst, the chat logs show several Puerto Rican government officials organizing an information operation to boost pro-government messages and target opponents; at best, they show them actively endorsing such an operation.

After analyzing almost 900 pages of text messages, the DFRLab identified 12 cases in which the chat’s participants discussed specific actions on Twitter, either amplifying a message from the government or targeting opponents.

In most cases, the participants of the chat did not overtly mention the use of “trolls,” which are human-run social media accounts that display systematically abusive and aggressive behavior, often directed at other users. They instead referred to “our people” or “tweeters,” as well as, in one case, “unofficial accounts.”

Regardless of how the chat participants referred to these accounts, however, the DFRLab found that the accounts engaged in troll behavior. A group of the same 51 accounts — many of them trolls — were involved in at least six of the 12 planned campaigns. These accounts’ interactions with one another as well as other users suggested they belonged to a network that supported the government and targeted political opponents.

From Telegram to Twitter

The Telegram chat log was first published by the Centro de Periodismo Investigativo (Investigative Journalism Center) of Puerto Rico. The group said it received the documents from a source that requested to remain anonymous, but that it had verified the authenticity of the messages.

The chat had 12 participants in all; the leaked portion spanned a period from December 2018 to January 2019. The chat’s main objective appeared to be to monitor conversations in the media and on social media related to the Puerto Rican government.

The most damning evidence of coordination between the chat participants and a particular troll account appeared in the log on January, 13, 2019, after the president of the National Assembly in Venezuela, Juan Guaidó, was detained.

At 1:18 PM (Puerto Rico time; 12:18 EST) on that day, Ramón Rosario, the former Secretary of Public Affairs and Public Policy of the island, wrote: “Edwin [Miranda, founder of the marketing agency KOI], tell social networks to challenge Juan Dalmau and Yulín demanding that they repudiate Maduro, or they are accomplices.” At 1:25 PM, Edwin replied with “done.”

A mere three minutes later, at 1:28 PM (Puerto Rico time; 12:28 EST), the account @FuerzaDPueblo tweeted the following reply to the governor: “We challenge @CarmenYulinCruz and @juandalmauPR to express themselves against Maduro’s dictatorship or they are accomplices of these abuses, crimes, and oppression#democracy #Venezuela.”

On top, a screenshot of the chat in which Rosario asks Edwin to tell someone to challenge Yulín and Dalmau. On the bottom, a tweet by @FuerzaDPueblo using the same words and argument. (Source: Centro de Periodismo Investigativo and @FuerzaDPueblo)

The use of the same words — challenge, or “emplazar” in Spanish, and accomplices, or “cómplices” in Spanish — and the same argument — that Carmen Yulín Cruz, the mayor of San Juan, Puerto Rico, and Senator Juan Dalmau, would be accomplices of Maduro if they did not repudiate his actions — strongly suggested that the operator of the Twitter account in question was aware of Edwin Miranda’s directions.

Another case involved the account @FuerzaDPueblo, which was not officially connected to the government or to Rosselló’s New Progressive Party, but routinely amplified their messages. The account’s bio (also archived here) described it as “the official account of the People for a better Puerto Rico.” It currently has roughly 21,900 followers.

On December 8, 2018, Miranda wrote in the group chat that @FuerzaDPueblo “was back,” to which Rosselló responded with a celebratory “Bout time.” This interaction indicated that this account satisfied the officials’ objectives, even if they had not directed it to act.

Screenshot of the Telegram chat shows Rosselló celebrating the return of the Fuerza Del Pueblo account. (Source: Centro de Periodismo Investigativo)

On January 13, Yulín was mentioned 1128 times on Twitter, and Dalmau was mentioned 288 times. The accounts that mentioned them the most were trolls account that also involved in other actions that benefited Rosselló and his government.

Unmasking Trolls

Between December 15 and 18, 2018, a large part of the conversation in the group chat concerned Senator Eduardo Bhatia, a political rival of Rosselló’s. On December 18, the Metro newspaper published an interview with the senator in which he claimed that he had voted in favor of bond issues because he was not properly briefed on the proposal.

Ricardo Llerandi, Rosselló’s Chief of Staff, posted the interview in the Telegram chat, adding that the former governor, Alejandro García Padilla, had called Bhatia’s statement a lie. Rosselló then replied, “We have to attack him as vague and incompetent.”

Next, Ramon Rosario, the former public affairs secretary, shared a post (archive) from Aiola Virella, Metro’s chief editor, with Padilla’s reply. Rosselló wrote that “we have to move this.” Anthony O. Maceira Zayas, the current Secretary for Public Affairs, replied with “let’s move this with the non-official [accounts],”a likely veiled reference to troll accounts.

Following this exchange, Virella’s post was retweeted or replied to by accounts that the DFRLab identified as possible trolls, which were also involved in other actions boosting the government or attacking rivals.

CidEloisa, CruzElano and seven other accounts identified by the DFRLab as trolls retweeted this post. (Source: @AiolaVirella)

In addition, after Bhatia’s interview was shared in the group, Maceria Zayas mentioned he was looking for records of legislative sessions from the day Bhatia cast his vote, in an effort to demonstrate that the senator was familiar with the policy details of the proposal and understood the consequences of his vote.

At 5:07 PM, the account @MrLuisRamos shared an article on Twitter from 2014 with the following headline: “Senator’s questions about bond emissions clarified.” The image in the tweet highlighted a paragraph that stated that after a two-hour meeting, García Padilla and Bhatia had said the questions some legislators had were answered.

@MrLuisRamos is among the accounts that the DFRLab identified as possible trolls supporting Rosselló and his allies. The account has a 78.4 percent retweet rate over the past three months, which means that roughly 78 percent of its tweets were amplifying other accounts. There is indication in the chat that Luis Ramos could be an employee of Edwin’s marketing agency, KOI. His Twitter account’s bio, however, does not mention any official connection to the agency or to the government.

On the left, screenshot of chat shows Anthony Maceira Zayas saying, “I’m looking for records of legislative sessions on that day.” On the right, post from @MrLuisRamos sharing news article about a legislative session on the bonds issue. (Sources: Centro de Periodista Investigativo and @MrLuisRamos/archive)

On December 18, Bhatia was mentioned 789 times on Twitter. Most mentions of him came from accounts also identified as possible trolls by the DFRLab.

A Failed Attempt to Boost a Hashtag

Chat participants and troll accounts also tried to boost a hashtag. On December 6, after the publication of a newspaper article about a court decision exonerating the police, Edwin said he was going to “move” the topic and posted the hashtag #NuestrosHéroes (“Our Heroes”) in the chat.

On top, screenshot of Telegram chat shows Edwin Miranda saying “they were going to move” the article and using the hashtag “Our Heroes.” On the bottom, post by @LuisAnthony40 with the same hashtag and the same article shared in the Telegram chat. (Sources: Centro de Periodismo Investigativo and @LuisAnthony40/archive)

Fourteen minutes later, the account @LuisAnthony40, which is part of the network identified by the DFRLab, posted the hashtag and the same news article that was shared in the Telegram group. Until that point, the hashtag had been used in Colombia, but not in Puerto Rico. It did not gain a lot of traction on the island after that, but it was shared by other accounts from the same network.

On his Twitter account, @LuisAnthony40 presented himself as a YouTuber, including a link to his YouTube channel in his bio. He does not appear in the videos he posts on his Youtube channel, however. In addition to that, the description of the channel mentions “videogame walkthroughs,” but the DFRLab found only videos about politics. On January 15, 2019, Miranda wrote in the chat that a video explaining the issue of the island’s debt had been produced and should be uploaded by someone like Luis Anthony.

Two of the chat participants — Ramón Rosario and Alfonso Orona — commented on the court decision via their Twitter accounts, but they did not use the hashtag #NuestrosHéroes. This suggested that Rosario and Orona were not directly responsible for moving the hashtag from the chat to Twitter; either @LuisAnthony40 conceived of the hashtag independently of Miranda — an extreme coincidence — or someone from the chat directed the troll account to post it on Twitter.

Ramón Rosario deleted his Twitter account on July 13, 2019, amid the Telegram chat scandal. Orona’s account is also currently offline.

The Troll Accounts

Among the Twitter accounts that were involved in initiatives discussed in the chat, 51 accounts participated in at least six of them. The behavior of these accounts suggests that they might belong to a network of troll accounts, although the DFRLab could not confirm that all of these accounts were trolls.

Most of these accounts did not have personal profile pictures, and many did not belong to individuals, but to “movements.” A significant portion of the accounts identified themselves with the Puerto Rican movement for U.S. statehood. Rosselló and his party support the movement, while their political rivals oppose it, advocating for the territory’s autonomy.

Examples of accounts that acted in the multiple campaigns discussed in the Telegram chat. (Sources: @barricada_azul1/archive, @CidEloisa/archive, @CruzElano/archivo, Cuchy68/archive. BebaDril7/archive, mlaboy15/archive)

One of these accounts was @HablaGuillo, which is currently offline. This account surfaced in the chat in a discussion regarding a specific initiative. On December 18, 2018, Ramon Rosario shared a tweet from Colectivo Feminista (Feminist Collective) calling for protests, and added: “Edwin, tell [them] to ask when they will protest Marazzi,” referring to Mario Marazzi, the Executive Director of the Puerto Rico Institute of Statistics.

Miranda replied one hour later with a tweet from @HablaGuillo, in which the account called Colectivo Feminista “hypocrites” and asked when they planned to protest Marazzi — just as Rosario had directed. Five days later, on Saturday, Rosselló again mentioned Colectivo Feminista. This time, Miranda replied, “we jumped on them.” He then shared a post by @luisanthony40 from Tuesday, in which the account asked when the Colectivo would protest Marazzi.

In the first image, Rosario shares post from Colectivo Feminista and directs Miranda to ask them when the group plans to protest Marazzi. In the second image, Miranda shares a post by @HablaGuido and adds, “Ramon, there you go.” In the third image, Miranda replies to Rosselló, saying they “jumped on them on Tuesday” and sharing a post by @luisanthony40. (Source: Centro de Periodismo Investigativo)
Node graph shows the links among the 50 accounts within the network. The size of each node indicates the number of connections in the network. (Source: @estebanpdl/@DFRLab)

A network analysis revealed linkages among these accounts. Within this network, @barricada_azul1 was the most followed user; 49 out of 50 of the other accounts followed it. The accounts @consuleduc and @AnthonyFlores60, both following 49 and 48 accounts respectively, followed the most users within the network.

The DFRLab used a measure called Eigenvector Centrality to identify which of the accounts in the network was most influential. The measure assigns a relative score to each node in the network, based on the assumption that a node is more important when it is connected to other important nodes. Within this network, the account @barricada_azul1 ranked highest in its eigenvector centrality.

Node graph shows @barricada_azul1’s (yellow) connections within the network. (Source: @estebanpdl/@DFRLab)

An analysis made with the social media listening tool Sysomos also showed that these accounts belong to the same community. The graph below shows communities that used the hashtag #RickySeQueda (“Ricky stays”), in support of the governor. Most of the 51 accounts discovered by the DFRLab are in “Community 2.”

Community graph shows interactions related to #RickySeQueda campaign between July 19 and July 25. Source: @luizabandeira/DFRLab via Sysomos)

In another indicator that the accounts were acting as part of a network, some posted identical tweets and retweets to one another. The account @maramora, for example, retweeted the same content as @CidEloisa 199 times in December 2018. Similarly, it retweeted the same content as @BebaDril7 58 times, @soledad1512 82 times, @VilmaRoman50 65 times, and @Cuchy68 61 times.

These accounts were among the top influencers in most of the campaigns planned in the chat that the DFRLab identified, as the table below shows.

Table of the 12 campaigns identified by the DFRLab. (Source: @luizabandeira/DFRLab)

Conclusion

A group of Puerto Rican officials, among them Governor Rosselló, used a private Telegram chat group to discuss at least 12 specific actions either boosting pro-government messages or targeting government opponents. Shortly after each initiative was discussed, a group of troll accounts mobilized to execute it. In this piece, the DFRLab detailed four such cases.

The DFRLab cannot attribute the troll actions to the chat participants with certainty. Nonetheless, that some of the chat participants explicitly celebrated specific posts by the troll accounts suggested that they were, at the very least, aware of the existence of these accounts. Furthermore, the uncanny degree of specificity with which, and unusually close timeframe within which, the accounts carried out some of the initiatives discussed in the chat suggested that the account operators were privy to some of the details of the officials’ conversation.

The DFRLab will continue to investigate this topic.


Luiza Bandeira is a Digital Forensic Research Assistant for Latin America at the DFRLab.

Esteban Ponce de León is a Digital Forensic Research Assistant for Latin America at the DFRLab.

Sophie Clark is a Research Intern at the DFRLab.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade