Social Media Spam Tactics in Indonesia

Inauthentic activity by spam accounts boosted pro-Jokowi hashtags just days before Indonesia general elections

@DFRLab
@DFRLab
Apr 17, 2019 · 5 min read
Image for post
(Source: @KaranKanishk/DFRLab)

Spam accounts manipulated Twitter campaigns and hashtags in favor of the incumbent President of Indonesia, Joko Widodo, posting them repeatedly in a bid to make them trend.

The episode shows how social-media platforms, major battlegrounds for political campaigns around the world, are being targeted for manipulation ahead of the Indonesian elections. With the elections scheduled for April 17, 2019, inauthentic activity may become increasingly active in amplifying hashtags.

According to DFRLab’s analysis, the hashtag #JokowiLagi (“Jokowi Again,” translated from Indonesian) received about 25 percent of tweets from automated applications from March 10 to April 10. “Jokowi” refers to Joko Widodo, using a common Indonesian naming convention wherein a person’s name is shortened through combination. Along with these automated tweets, there was a significant amount of duplicate content posted by the accounts.

Indonesia is the world’s fifth largest country in terms of Twitter users. According to a report by Reuters, political parties in Indonesia hire “buzzers,” or local social-media consultants, that help to spread paid but organic content on the platform.

Twitter has been active in purging bot-like accounts as part of its effort against platform misuse and misinformation. In its rules and policies document for automation, Twitter states:

Trending topics: You may not automatically post about trending topics on Twitter or use automation to attempt to influence or manipulate trending topics.

Multiple posts/accounts: You may not post duplicative or substantially similar Tweets on one account or over multiple accounts you operate.

According to DFRLab’s analysis, some accounts may have violated automation policy by duplicate posting of substantially similar tweets with same content. These accounts repeatedly shared the same hashtags, suggesting that they belonged to the same network.

As part of its election monitoring effort, the DFRLab analyzed the Indonesian Twitter environment and found spam-like accounts that amplified pro-Jokowi messages.

Spam Activity in Indonesia

Image for post
Network graph of accounts with spam activity for #JOKOWILAGI from March 10-April 10, 2019. A network graph is a structural graph that indicates relationships between communities, where the density of colored lines represents the intensity of the different types of accounts. The communities here are linked on the basis of mentions, tweets, and retweets. The pink group indicates tweets from accounts that amplified hashtags using spam-like techniques, such as posting repetitive content. (Source: @KaranKanishk/DFRLab)

From March 10 to April 10, 2019, about 25 percent of tweets were posted using automating applications. The analysis shows apps like IFTTT, TweetCaster, and Twittbot.net were used by some accounts. These apps allow users to automate their posts, including retweeting particular hashtags.

Image for post
Tweet source for #JOKOWILAGI from period (March 10, 2019, to April 10, 2019). (Source: @KaranKanishk/DFRLab)

Other than the accounts using automated applications, others reproduced identical content without signs of automation, amplifying other accounts’ posts by including the same repeated hashtags over multiple posts.

Image for post
Inauthentic posting used by the accounts @abangenta and @berkelana_jauh. (Source: @abangenta/archive, left; @berkelana_jauh/archive, right)

Additionally, as the accounts frequently posted the same hashtags in the same order, they also did so in a narrow timeframe.

Image for post
Tweets using the same hashtags in the same order, including the time of the posts, from the accounts @BudimanCaptain, @LilisNugraha, and @DimaSanjaya5. (Source: @BudimanCaptain/archive, left; @LilisNugraha/archive, center; @DimaSanjaya5/archive, right)

The #JokowiLagi hashtag was used in tandem with other hashtags to garner more attention. This is a common technique employed by hyperpartisan accounts engaging in spam activity. Furthermore, a hashtag search showed that a network of these accounts posted the same hashtags with identical tweets within a very close timeframe. This behavior suggests that the accounts were either operated by a single person through some form of automation or, alternatively, a closed network.

Image for post
Accounts quoting identical tweets with duplicated hashtags, indicating an inauthentic hashtag amplifying technique. (Source: Twitter/archive)

The other hashtags that were used alongside #JokowiLagi also favored Jokowi: #01IndonesiaMaju, #JokowiOrangyaBaik, #SlapPutikanGBK, #KarenaKamuCuma01 and #JabarJuaraHiji.

#JokowiLagi is a popular hashtag and is also used by the National Awakening Party (NAP) to support the Jokowi-Amin ticket for the elections. NAP is an Islamic political party that is allied with the Indonesian Democratic Party of Struggle.

Image for post
Spam accounts using #01IndonesiaMaju. (Source: @KaranKanishk/DFRLab)

After examining #JokowiLagi, the DFRLab investigated #01IndonesiaMaju (roughly translated as “#01 Indonesia Onward”), which had amplifiers who tagged Jokowi throughout the posts. The accounts using this hashtag exhibited a similar pattern of quoting to those that amplified #JokowiLagi. According to Twitter, accounts that “post duplicative or substantially similar tweets” may constitute spam activity.

Image for post
Spam-like tweets posted by different accounts. While many accounts have been taken down by Twitter since their discovery, these accounts were active as of the writing of this piece. (Source: Twitter/archive)

The accounts posted tweets with similar content and hashtags within a short timeframe.

Image for post
Spam tweets posted from different accounts within a short timeframe. (Source: Twitter/archive)

Conclusion

The DFRLab identified many accounts using spam-like activity to amplify hashtags in support of Indonesia’s incumbent President Joko Widodo ahead of the country’s elections.

There was, however, insufficient open-source evidence to determine who deployed the accounts amplifying the hashtag #JokowiLagi. Since political parties in Indonesia increasingly rely on the use of buzzer teams that employ spamming and bot-like tactics to turn the political tide in their favor, it is possible that this operation may have been conducted by a buzzer team favoring the Jokowi campaign. At the time of writing, Twitter had already disabled some of the accounts.

This network of accounts was noteworthy for the extent to which it dominated select hashtags and the relative ease with which it bypassed Twitter’s spam filters. It also serves as a potential reminder of the risks posed by hashtag hijacking in online electoral discourse.


Kanishk Karan is a Digital Forensic Research Associate at the DFRLab.

Register for the DFRLab’s upcoming 360/OS summit, to be held in London on June 20–21. Join us for two days of interactive sessions and join a growing network of #DigitalSherlocks fighting for facts worldwide!

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch

Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore

Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store