Twitter Analysis: Identifying A Pro-Indonesian Propaganda Bot Network 

The ongoing conflict in West Papua has surged recently as the West Papuan freedom movement seeks independence from Indonesia. 

While aggression has been documented on both sides, there are grave concerns that Indonesian security forces have been responsible for human rights abuses through the violent suppression of West Papuans in their pursuit of independence. 

Hostilities have recently erupted in both Indonesia and West Papua. In August, protests were quashed by security forces with events seeing Papuan students tear gassed in their dormitories in East Java and security forces assisting violent mobs in an attack on Papuan protestors in Fakfak.

Much of the conflict has been waged on the streets, but the fight has also spilled over into the digital world — as censorship and disinformation. While there has been targeted internet disruption in Papua and Indonesia, and the banning of counter narrative YouTube content, something that has not been exposed, until now, is an active bot network disseminating pro-government content through major social media platforms.

The campaign, fuelled by a network of bot accounts on Twitter, expands to Instagram, Facebook and YouTube. The content is spread in Tweets using specific hashtags such as #FreeWestPapua, #WestPapuaGenocide, #WestPapua and #fwpc.

Conducting The Network Analysis

These findings came after capturing activity from Twitter using the #WestPapua and #FreeWestPapua tags from August 29 — September 2, 2019. The captured data was used to perform the network analysis.

Using this data, I built an itemised dataset of:

• Usernames that tweeted the above tags
• Usernames that retweeted and liked the posts
• Timestamps
• URL 
• The type of activity (tweet, retweet, quote, mention). 

With this working dataset, I was able to visualise the respective networks via the open source visualisation platform Gephi. Below is a visualisation of the entire capture. 

Opening the graph for analysis, labels and clusters are illustrated below:

The data is represented through two mediums: nodes and edges. 

The nodes are the round coloured circles you are seeing, they are twitter accounts and vary in size based on the interaction of the account. 

The edges are the lines between them. They represent the relationship between the accounts. In the captured data this is a mention, like, retweet or quote. 

Most networks have “influencer” bubbles. These are the larger circles. They’re often accounts that have a large following. On the visualisation, they are represented much like perfectly shaped fireworks. Any interactions they have had are captured around them in circular fashion.

Below is a representation of what happens when an “influencer” bubble usually posts a tweet. In this example, the account in the center is @thejuicemedia. They recently posted a satire video on YouTube which was banned in Indonesia after the Indonesian Government made a legal complaint to YouTube.  

One of these networks has a unique appearance in comparison to the others. I have highlighted it below in a red box.

Zooming in on that constellation provides me with a series of Twitter accounts acting in a behaviour that is not normal in comparison to the other networks. 

I’ll zoom in on the cluster of accounts causing this irregularity in the system so we can identify the accounts responsible. 

Twitter Level Analysis

In that network we can identify the individual accounts that are reacting with each other in this different manner. First, let’s take a look at the account @marco26700420. I archived the account through the Wayback Machine.

This bot was created in June 2019. Its purpose is to disseminate information attached to various hashtags about West Papua and the freedom movement. 

A simple Yandex reverse image search on the profile image shows this account is not genuine.

We can identify it is a bot as its followers and the accounts it is following match with the names in this network. All of the tweets are the same as the others, with the same tags. Many of those tweets imply that this account is pushing an interesting perspective, for example: 

“What are some secrets that Indonesia have been hiding in West Papua? Find out the answers here.” 

This exact sentence was published by many of the other bots in their own individual tweets using the hashtags #westpapuagenocide and #freewestpapua. The content of the video is about “what Indonesia is trying to hide in West Papua.” It lists better budget monitoring through an app built by the government. 

A gif-version of the video can be viewed here.

This same text and video has been re-uploaded to other accounts in the network — all at similar times. All of these accounts use stolen profile images.

Another bot going by the handle @yerxi1, focuses more on retweeting action. We can see it in the graph below. It tags other accounts when it does a retweet mention. 

Here is the Twitter account:

For the profile image, after a quick Yandex reverse image search and a termed Google reverse image search I found out that the Twitter name gives it away. It’s Jennie Kim – a South Korean rapper (obviously not the real one).

These two accounts are only a part of the network visualised, and the data of that network is only made of tweets captured during a five-day period, so it is likely that there are many more accounts in this bot network than what has been displayed on the graph. Those accounts can be identified by viewing each individual account’s followers, and accounts that it is following. 

We have seen that there are a number of correlating accounts in this network, but what are they promoting, and where?

Website, Facebook, Youtube & Instagram Accounts

Many of the accounts refer back to more active accounts. One of the more active accounts in the network is @PapuaWestcom. 

This account runs tweets with video campaigns, some of which are promotional material for the Indonesian government and military in their work in West Papua. The video in the tweet below can be viewed here.

This twitter account promotes the website Papua West. The about section of the site claims: “PapuaWest.com is an online media which provides updated information related to business in the West Papua region”. The page is not only running a Twitter account, but also a Facebook Page with 50,000+ followers and a YouTube channel, where it spreads the same video content. 

If you peruse the network, you will find another interesting Twitter account — @West_Papua_ID. It works in conjunction with the network to boost tweets and, much like the bot account of Papua West (above), it has its own accounts on other social media platforms and a website. 

@West_Papua_ID’s website is westpapuaindonesia.com, and links to a popular YouTube account, an Instagram account with 10.3k followers and a Facebook page with 152k followers, all of which are disseminating the same pro-Indonesian Government material about West Papua. 

The Instagram account of Westpapua.id runs all of the same content as what the bot network was posting on Twitter.

I ran an Instagram audit on the account which resulted in a 34% real follower count.

We now know that these accounts are pushing and circulating promotional content on the Indonesian relationship with West Papua, we have identified who (or what) is doing it, and where it is taking place. Now we can look at how the bot network runs.

Bot Deployment Analysis

A further analysis of the bot network can tell us how it works in its automated posting. For this we can look at the time any activity was deployed from the accounts. 

To do that, I selected and compared randomly chosen accounts out of the network cluster identified earlier. 

For the purpose of this post, I will use the following two in the comparison: @kevinma40204275 and @bellanow1. 

To identify when these bots deployed their content, I pulled all of their past tweets into a spreadsheet. I did this by using a Python script available on GitHub called Twint.

I pulled all of the tweets using the code: 

sudo twint -u bellanow1 –media -o papuabots1 –csv

Below is a screenshot of what that looks like when the command is performed. 

What I now have is a spreadsheet with all of the tweet data from the @bellanow1 bot account. It is itemised in columns as I commanded Twint to pull it into a csv file.

I repeated the same process for @kevinma40204275 to match the two up and compare them. I could map these into a data visualiser, but my only interest was in looking at when the activity occurred. 

In lining up the two against each other, we can see that the activity is indicative of automated processes. These accounts are working in an automated flow in sync with one another to post at different times in part of a much larger network of bots. 

In looking at the sequences we can see that on the evening of the 25th, the bots conducted activity on 23:32:52, 23:32:54 and 0:32:54, 0:32:56, 3:32:54 and 3:32:55. There is repetition in timecodes and similarities across the board. 

Through these findings, I am able to say that an automated bot network is being used on Twitter and utlises other major social media platforms to disseminate propaganda about the Indonesian Government’s involvement in West Papua, and that it is doing so by using hashtags on genocide and the West Papua freedom movement to drown out any anti-Indonesian government narrative.