Political campaigning in India is on the rise as the West Bengali elections near, and so are the mass information campaigns to promote agendas, discredit opposition, and skew narratives.

All of this activity has the overarching goal to win the hearts and minds of voters and discredit the opposition through social media manipulation.

This case looks at one recent campaign that was waged on social media platforms which saw a hashtag boosted to one of the highest in India for that day. It looks at exactly how that campaign was ran, its tactics, techniques and the digital breadcrumbs left behind by this campaign, and others like it, that identify who is behind them.

What this research will show is:

1. Framework: How This Campaign Was Run
2. The Nature of the Promoters
3. Measuring Operation Traction
4. Visualising the Operation
5. Past TTPs and IOCs
6. Operation Relation To Platform Policies

Brief Summary on Pro-BJP Information Operation Targeting Bengali Politics

This report is based on an information operation campaign to amplify the hashtag #AmitShahInBengal on Twitter on Thursday, 18 February, 2021. The hashtag was one of the most popular tags within a 24 hour period.

I was able to access the organising framework of the operation and identify how it was structured in a Google Drive with a public Google Document containing suggested tweets in Bengali, English and Hindu.

These tweets were to discredit the TMC-Government and boost the profile of former BJP-President and Modi Government member Amit Shah during his visit to Bengal ahead of the West Bengal Elections.

Those suggested texts were copied from the document, along with the tag #AmitShahInBengal, and were tweeted by users supportive of the BJP, or BJP-labelled and affiliated accounts. I captured more than 5000 accounts through the #AmitShahInBengal hashtag while the operation was in effect and found the primary accounts amplified in the network were amitshah, bjp4india, bjp4bengal and kailashonline.

These techniques have been used in the past to amplify similar content and the same actors. It indicates that this operation is not unique and appears to be a standard operating procedure for pro-BJP content. Open source evidence also indicates the parties responsible for these campaigns have been BJP affiliated and from Indian Government social media teams.

Background and Context

First, a bit of context as to the main parties and area of interest in this setting of West Bengal.

There are two parties at heads with each other in this area of interest:

• The Bharatiya Janata Party (or BJP), a major political party in India, led by Jagat Prakash Nadda, with current Prime Minister Narendra Modi in a senior role.
• The All India Trinamool Congress (abbreviated as TMC) which is an Indian national party. It’s currently led by Mamata Banerjee.

Each organisation and its many civilian supporters has been active on the streets, and online, to get their voice heard. Both sides have been active in using social media to run campaigns and win voter support.

This has resulted in mass social media activity from both sides, especially in the lead-up to crucial election areas such as the state of West Bengal with more than 90 million people residing in it.

A note on this research

The data collected in this research is not a definitive result on the size, impact or spread of pro-BJP networks. That data is better assessed by social media platforms that have unfettered access to user data, trends and information to make valid assessments.

The data I have included in this research piece is publicly available, except for the data I have collected through platform APIs (indicated when in use). The rest of the information included here is open source – meaning publicly available to anyone with a computer and an internet connection.

In terms of other countries where similar politically motivated influence operations targeting geographical areas has been done in the past, there is a research piece I worked on in collaboration with another researcher focussing on Indonesia and West Papua here.

Transparency updates are available through Facebook and Twitter and are regularly updated as they announce network takedowns. An overarching collection of many of these takedowns can be found here.

1. Framework: How This Campaign Was Run

A brief summary on exactly how this campaign operated, is as follows:

1. A link to a Google Drive and Google Document is shared on WhatsApp and Twitter with the mention of a specific hashtag and a time to post
2. The Google Document has suggested tweet texts in Hindi, English and Bengali all with the same hashtag included in the tweets
3. Those texts are tweeted out by pro-BJP networks all at the same time indicated in the original call to action
4. The hashtag is made to trend in India and consume the online narrative of that specific issue

When the campaign is viewed through the news feed on Twitter by an average user, the content looks authentic with a legitimate Twitter trend using the tag #AmitShahInBengal.

It was one of the trending hashtags in India on February 18 with more than 400,000 tweets, as seen below using data from Get Day Trends.

Below is an example of a tweet in a regular news feed using the hashtag.

However this is the product when the exact same text is searched for in the Twitter search bar. You can see below that it has been replicated over numerous accounts.

2. The Nature of the Promoters

The nature of the accounts spreading the content of the campaign are largely human-operated BJP supporter accounts.

We can see an example of these accounts by using the text in the campaign document as a search mechanism.

Take, for example, the following text:

“Unlike the TMC who used the chant of Poriborton to cheat the people of Bengal, the BJP is firmly committed to ushering in Asol Poriborton in Bengal. Shri @AmitShah’s Rath launch from Kawkdwip is another step towards the direction of change in Bengal.”

I chose this text as it makes a claim of a competing party using ‘a chant’ to ‘cheat’ the people of Bengal – keep in mind that this text is part of a political marketing campaign to hijack a hashtag on Twitter and force a political narrative.

Running this text through Twitter provides numerous accounts using the exact same text in a copypasta tactic (copy and paste technique). Below is a sample of those accounts.

In looking at those accounts in a little more detail, first we can see there are obvious BJP-affiliated or local area representative accounts using the copy and paste text. Then second, there are other accounts that appear to be normal users, however only engage in content that is pro-BJP and pro-Modi.

To provide a visualisation of the sort of content those other two accounts were posting, I used AccountAnalysis to view the metrics of the past 1000 tweets of those accounts with a specific look at the hashtags being used by those accounts to indicate content.

The indication of content shows these accounts are heavily engaged in primarily retweeting, and second, tweeting, pro-BJP content.

Having collected many of the accounts that were amplifying the hashtag, we can also take a look at some indicators, such as the names of the accounts.

For example, in these three screenshots below, of accounts collected through the API, we can see a large number of the accounts start with the letters “bjp” – relating to the political party.

• 

• 

• 

Here are some of the accounts that started their Twitter bios with the letters “BJP”.

• 

• 

• 

3. Measuring Operation Traction

Measuring the effectiveness or impact of an information operation is difficult and may be better assessed by platforms with access to the full range of data.

However, two ways to assess the reach of this specific campaign is to look at the status of the hashtag over the day in the country, and then the number of interactions (retweets and likes) different text packets have received when posted to Twitter.

First, did this hashtag reach a trending status? Yes it did. It was the sixth top hashtag in India at one point, with a total of 402,600 total tweets as seen here.

There is no doubt there is substantial authentic activity based on the #AmitShahInBengal tag, however what the suggested text packets do is throw a widely reflected and shared narrative into the context of the tag to dominate the conversation.

Metaphorically, this is like a prompter sitting in a room full of people steering a conversation with their own personal points, except some people in the room don’t know there’s a prompter, and are unaware of the coordinated narrative in what would otherwise seem an authentic group conversation.

The main area of use of that tag was in West Bengal, as seen on Trendsmap, here.

Next, to look at the number of retweets and traction gained on some of the copypasta text, I used a Twitter code to search the exact text filtered with a minimum number of retweets and likes. The code was:

“TEXT” min_faves:10 min_retweets:50

I used the first three English texts of suggested tweets provided in the Google Document for this process.

Below are the tweets with engagement for the first text.

Below are the tweets with engagement for the second text.

Below are the tweets with engagement for the third text.

What we can see in these tweets is that there appears to be a high retweet to like ratio. Some users of the copypasta text have more than 300 retweets, yet less than 20 likes. This may indicate off platform retweet campaigns to amplify the content of specific users.

However this might be better assessed by a platform, to look at the times of when the activity took place.

The fact that accounts with public standing, as well as some verified accounts, were involved in the copypasta campaign, indicates the wide effect of the message of the campaign.

4. Visualising the Operation

Using the Twitter API, I collected a sample of the network as the campaign grew. This data allows me to visualise the hashtag activity and identify central points of the network.

By targeting the content that was copied from the Google Document and onto the social media platform I was able to string my API query to pick up that activity as it came through using the hashtag #AmitShahInBengal.

This is the visualisation of that network of 5711 accounts as a whole.

By using this visualisation we can identify key nodes (accounts) in the network. The lines between those nodes (edges), are mentions, retweets and tagged tweets.

Below I have displayed the node name and size dependent on the incoming traffic from the network. The larger the name and the node, the more central the account is to the network.

It is clear that as we saw Amit Shah’s Twitter account in some of the copypasta campaign text, that his account would be the largest central node in the network.

There are also other accounts that were mentioned, retweeted and posted, that are indicated as large due to the incoming traffic in the network.

Here is a closer, more visually clear indication of those larger nodes at the center of the network’s activity.

The modularity functionality of Gephi allows for the more clear visualisation of relationships within the network, it’s why you can see four main colours, green, purple, pink and blue (further seen below as nodes).

Those colours represent the networks amplifying, supporting or tagging those accounts, which are:

• amitshah
• bjp4india
• bjp4bengal
• kailashonline.

It should be noted, that the labelling of these accounts in the visualisation does not attribute the creation, or the responsibility of the information campaign to those account owners. Rather, it shows the intentional target of the network to boost (in this case) those accounts and actors in relation to the context of West Bengal.

5. Past TTPs and IOCs

For those of you reading this type of analysis for the first time, here are some definitions used in this section:

• TTP: Tactics, Techniques and Procedures
• IOCs: Indicators of Compromise

First, it should be noted that this is not the first pro-BJP campaign that has been waged on social media, and that these TTPs have been seen before in pro-Modi and pro-BJP campaigns.

Specifically, I’ll address three campaigns that have used the same Google Document-to-tweet tactic in India, where attribution can be made through forensic open source evidence.

First, is a pro-BJP copypasta network I documented in January 2021. You can find the full report here.

In that case, there was a large network attacking the opposing political party, again in the setting of context around West Bengal politics. The network overlapped with another campaign to target the hashtag #YuvaShaktiWithModi. The same technique of using a Google Document with suggested tweet text was used, however the author of the Google Document had failed to secure their email address which was on display in the code of the page.

This in turn led to the LinkedIn account of a social media team leader employed by the Indian Government. Note, I have maintained the privacy of the person responsible for the creation of the Google Document for their wellbeing and safety.

A second case from 2018 saw the amplification of the hashtag #MamataKilledStudents. The name Mamata refers to the leader of the TMC. A screenshot of the Google Document, with suggested tweets, can be seen below.

The containing Google Drive (here) indicates the owner of the drive and the author of the document which was a BJP West Bengal Google Account.

The third campaign, and very similar to the second, in terms of the IOC, is a campaign to promote the tag #ModiWithFarmers.

The Google Document can be found here. A screenshot can be viewed below.

The indicator in that campaign was, again, the author details behind the social media campaign. In this case the author appeared at ‘BJP IT & SM Office’ – this stands for BJP Information Technology and Social Media Office.

This was easily viewable in the Google Drive (found here) much like the other two cases.

6. Operation Relation To Platform Policies

This report is written in detail, for a reason. It is to provide sufficient, publicly available evidence, to indicate a potential breach of the rules of Twitter, and identify parties responsible in this case.

The specific policy this campaign would fall under is the ‘Platform manipulation and spam policy’. You can find a link to this here. It is also below.

Under that, there is a subsection on the ‘Misuse of Twitter product features’.

It says: You can’t misuse Twitter product features to disrupt others’ experience. This includes: repeatedly posting identical or nearly identical Tweets, or repeatedly sending identical Direct Messages;

And about the targeting of hashtags.

What has been documented in this report relates to the copy and paste technique of an influence operation campaign to interfere in the build-up to an election, and to manipulate a trending hashtag, both of which are policies for the social media platform.

Note: there is use of both Twitter and Google’s products in the facilitation of this information operation. It should be noted that this is not a sole platform responsibility.