This is the second and final installment in a First Draft investigation into how an anti-Muslim influence operation in India hijacked conversations about Israel and Palestine. The previous piece focused on the content of the network, prominent narratives and the context of Islamophobia in India. 

Last month, as violence escalated in Israel and Palestine, the hashtag #UnitedAgainstJehad trended, sparked by an open call to propel an anti-Muslim narrative to prominence. 

An analysis of the network of accounts behind the campaign has revealed some key tactics that were used to spread Islamophobia online, exploiting the conflict while targeting India’s minority Muslim community. 

First Draft used Twitter’s API to scrape more than 6,000 tweets that were posted over a six-day period and which produced nearly 70,000 interactions on the platform. We created multiple visualizations to depict the relationship between accounts using the hashtag and the complexity of the network; you can learn more about network visualizations here. 

Here are some key takeaways that emerged from the analysis:

• Demonstrating inauthentic behavior on social media is complicated. There are no unique definitions and metrics experts agree on, and influence campaigns can often include a mix of deliberately manipulative tactics and organic social media activity. 
• However, there are some reliable indicators of manipulation. The accounts in the network we uncovered showed signs of coordinated efforts to manipulate Twitter traffic, both in the content of the tweets and in unusual patterns of activity.
• A qualitative analysis demonstrated the consistency of harmful messaging. 
• Numerous images and memes used within the network referenced controversial historical events and had been previously shared by Hindu nationalist communities online.

The timeline

At the very beginning of our dataset, the first post by the Twitter account @Randm_indianguy kicked off the campaign May 12 at 2:57 p.m. GMT. 

The hashtag took off quickly; over the course of two hours, it was tweeted and retweeted 500 times. Twenty-four hours later, it had appeared 45,000 times. 

On May 13 at 3 p.m. GMT, the hashtag reached its highest volume of activity: a spike of 18,784 tweets and retweets in an hour. Almost as quickly as it emerged, the hashtag’s activity then sharply deflated. 

Indicators of inauthenticity

So what were the main factors that made the hashtag spread so widely so quickly? 

There are reasons to be cautious before attributing suspicious online activity to a “bot,” as we noted in a 2019 essay: Accounts may in reality be operated by people pushing a political agenda. What’s more, researchers often disagree about the criteria for labeling activity as inauthentic. 

Still, influence operations often present multiple indicators of coordination and inauthenticity — and in some cases automation — as part of efforts to amplify sensitive content. 

The network diagram below maps the constellation of accounts that tweeted the #UnitedAgainstJehad hashtag.

Each node represents an account and each connection between two dots is a retweet. The size of the nodes shows accounts that were retweeted the most in the network and reveals the most influential accounts in making the hashtag trend.

The account that first launched the open call – @Randm_indianguy – is by far the most retweeted account in the campaign, followed by similar accounts, @Indianrightwing and @_spiritualgirl_. In one of their later tweets, @Randm_indianguy indicated that @_spiritualgirl_ is managed by the same person or group of people.

An analysis of these accounts’ Twitter bios and the content of their tweets reveals a strong Hindu nationalist theme. They each promote a political agenda and repeatedly participate in calls to get Hindu nationalist hashtags trending. 

As the network diagram shows, their posts were among the most retweeted in the network. The content of their most influential posts was copied and pasted hundreds of times by other accounts and the small clusters of accounts next to the most retweeted accounts were likely engaged in copy-and-pasting the main accounts’ tweets.

As the hashtag began trending, some accounts were more active than others; some of them tweeted frequently and only at specific times. 

One low-follower account tweeted and retweeted the hashtag over 734 times within one hour and then stopped. A sudden, concentrated spike in account activity such as this is commonly regarded as a red flag for manipulative behavior. 

Using the Account Analysis tool, we can see that this account, like others in the network, tweeted only on certain days or at certain times – on Wednesdays and Thursdays between 5 a.m. and 10 a.m. GMT. 

This account was just one of dozens that followed a similar pattern of suspicious activity. 

Taking a closer look at two other accounts from our dataset, each with a similarly low number of followers, we see they also tweeted only on certain days and times. One of them tweeted 192 times between 1 p.m. and 2 p.m. on Thursday — an eyebrow-raising 3.2 tweets per minute.

Some of the accounts in the dataset were created on May 13, 2021 — the day the hashtag reached its peak. This indicates that these accounts were likely created for the explicit purpose of artificially pushing the hashtag. The recent creation date of a group of accounts is another widely accepted key indicator of suspicious activity by a network.

The network visualization below is designed to show the complexity of the overall network, and the role older and new accounts alike played in promoting the hashtag.

The network shows accounts that posted the hashtag. This time the size of the circles shows the volume of tweets posted by each account (node) and in red, it highlights the accounts that were created in May 2021. 

 

The network illustrates a mix of old (in gray) and new accounts (in red) that actively participate in spreading the hashtag — demonstrating the complexity of actors and how an influence campaign is often the result of a heterogeneous combination of types of accounts. The diagram shows that some of the accounts that were created in May 2021 were also some of the accounts that tweeted the most. 

The messaging

Some of these accounts exhibit tendencies associated with automation, but regardless of whether they were bots or operated by people, the available evidence points to a coordinated effort to manipulate Twitter traffic to promote an Islamophobic agenda and talking points in India. 

#UnitedAgainstJehad was the top hashtag along with other pro-Israeli hashtags —#IndiastandswithIsrael, #IstandwithIsrael and #hamasterrorist — as well as explicitly Islamophobic hashtags like #radicalislamicterror.

There were hundreds of references to the Hindu god Lord Ram in the dataset, either within tweets or in the bios of accounts promoting the anti-Muslim hashtags. 

Lord Ram’s name has been increasingly misused as a violent slogan among Hindu nationalist groups. 

The invocation of Ram was just one facet of the hyperpartisan narrative advanced by the network, revealed by the word cloud above. Automated or not, the accounts in the network serve to amplify Islamophobic and far-right Hindu nationalist messages, and a portion was likely created for just that purpose.

Use of images and memes

An examination of the visual media contained in the network’s tweets confirmed the use of the hashtag to spread harmful disinformation about Muslims in India.

First Draft examined all images included in the top 100 most-shared tweets in the network. 

Of those 100 most-shared tweets, 87% contained an image, meme or caricature.

Many images in our dataset conveyed messages suggesting that Islam was a “threat,” while other images referenced controversial historical events or figures. Some of the images used are staples of the Hindu nationalist movement online.

More than a third of the images in the dataset were graphics that included violent imagery along with the hashtag. Several key Twitter handles were mentioned in, or responsible for, retweeting a number of the graphics.

The similarity of the graphics and elements of uniformity suggests many of the graphics were created by the same group of accounts or that copycat graphics were created. 

A photo shared in the network of a man damaging India’s memorial to the fallen soldiers of the India-Pakistan war of 1971 during the 2012 Azad Maidan riots in Mumbai has previously been shared on Hindu nationalist blogs and misleadingly used to represent different events. 

One painted image of the 15th century Maratha ruler Shivaji included in posts in the network also appeared on Hindu nationalist blogs as well as on YouTube, Facebook and Reddit.

A number of trends we identified through our review of images within the hashtag — such as the use of old images that were taken out of context, the use of manipulated or edited images and the use of memes — were in line with the findings of a study of thousands of misinformation images in politically oriented WhatsApp Groups in India, conducted by the Harvard Kennedy School’s Misinformation Review.

Why it matters

Our research outlines the signs of coordination in a Twitter campaign that spread Islamophobic messages.

There are some indicators that this hashtag and associated accounts violated Twitter’s own policies, specifically against artificially amplifying or disrupting conversations through the use of multiple accounts or by coordinating with others, as well as its policy against coordinated harmful activity. Additionally, a number of accounts within the hashtag appear to have violated Twitter’s policies on hateful conduct and hateful imagery. At least one account we uncovered was suspended by Twitter for violating the platform’s policies.

Despite the growing body of evidence on how easily Twitter hashtags can be manipulated, organized campaigns such as this are becoming increasingly common in India. Since scraping and analyzing the tweets in this hashtag, several other campaigns with similar features have emerged. For example, the pro-Hindu nationalist hashtag #WakeUpBJP suddenly spiked on May 25, driven in large part by posts from the @Randm_indianguy account we identified. 

The government of Indian Prime Minister Narendra Modi, of the Hindu nationalist BJP party, is currently engaged in a campaign to pressure Twitter to take down posts that criticize it, claiming the posts amount to disinformation. 

The network that exploited the violence in Israel and Palestine to push Islamophobic content is a sign that Twitter may indeed have a disinformation problem in India – just not the one the government diagnosed. Instead, religious minorities in India are a focal point of disinformation online, pointing to the risk of further deterioration of religious freedom.  

Note on methodology

We gathered 46,170 tweets and retweets containing the #UnitedAgainstJehad hashtag between May 12 and May 17. We used Python’s Pandas to analyze the main actors, extract their creation dates and select the most common hashtags in the tweets and accounts’ bio. Here is the repository with data and code to reproduce the analysis. Network analysis was performed on Gephi, resizing the nodes based on the in-degree (picture 1) and out-degree values (picture 2). We used the «ForceAtlas 2» layout to bring accounts that frequently mentioned each other closer together. 

Data visualizations by Ali Abbas Ahmadi. 

Stay up to date with First Draft’s work by becoming a subscriber and following us on Facebook and Twitter.