By Jean Le Roux (Source:@jean_leroux/DFRLab via Photoshop and Gephi)
The accounts did this by circulating meme-like graphics in a loosely coordinated manner. Over the span of a few minutes to several hours, these images — using the same fonts, colors and graphical elements — would be posted and amplified by both of these networks. The accounts frequently interacted with and amplified each other’s posts through retweets and quote tweets. The accounts coordinated their activity using a distinct set of hashtags, particularly #OneNigeria, #LeadWithLove, #EndViolence, and more recently, #EndViolenceInNigeria.
Considering the scale and persistence of the #EndSARS movement on social media, such a campaign stands to benefit President Buhari and his government. Although there is no direct evidence linking President Buhari’s government to these accounts, the content being shared is strongly biased in favor of President Buhari, his government and the Nigerian armed forces.
Background
The current cycle of #EndSARS activism was sparked on October 4, 2020, when video footage taken near the Wetland Hotel and posted on Twitter claimed the Nigerian Special Anti-Robbery Squad (SARS) shot and killed a young Nigerian man before speeding off in his car. The scale and resilience of the #EndSARS campaign on social media is noteworthy — the hashtag made 302 billion impressions between October 1 and November 18, 2020.
The claims surrounding the Waterfront Hotel video was false, though: it was later revealed the man had jumped from his moving car after being arrested by Delta Safe, a different law enforcement unit from the area. But despite the questionable narrative surrounding the Wetland Hotel video, the incident served as a catalyst: numerous Nigerians shared other videos of police brutality perpetrated by SARS officers against civilians under the same hashtag.
Within a week, nationwide protests were organized to call on the Nigerian government to disband the unit altogether. Within another week, international celebrities and Twitter’s Jack Dorsey rallied behind calls to #EndSARS.
An inflection point was October 20, 2020, at the Lekki toll gate in the south of Lagos. Video footage and social media posts suggested Nigerian soldiers had opened fire at protesters at the toll gate: a DFRLab investigation confirmed that Nigerian soldiers, firing their weapons, could be placed at the scene along with injured civilians. The Nigerian military labelled these initial reports as “fake news.”
While the governor of Lagos has since instituted a commission of inquiry into the incident, fears remain of a possible cover-up. The Nigerian army initially denied deploying any soldiers to the scene at all, but in a series of cascading retractions it later admitted to the deployment, but not opening fire, then subsequently admitting that soldiers fired their rifles, but claimed no live ammunition was used. The Nigerian minister of Justice Abubakar Malami has also suggested that hoodlums dressed in Nigerian military uniforms could be behind the shooting.
It is amid these fears of a cover-up and the rewriting of the narrative by state forces that these suspicious networks of accounts have now surfaced.
Repeat performers
During October and early November 2020, several Twitter accounts began sharing similarly stylized content using a combination of recurring hashtags: #OneNigeria, #LetLoveLead, and #EndViolence. Later, #EndViolenceInNigeria would also be used.
Although some of these hashtags were used organically for real-world events at the time — such as #OneNigeria during celebrations of Nigeria’s 60th year of independence on October 1 and 2 — some of the accounts persistently engaging with these hashtags appeared suspicious. A recurring set of Twitter accounts used the hashtags to post, retweet and quote-tweet meme-like graphics.
The similarities between these images were striking; across multiple topics and subjects, the slides used a similar font, typographical style and artistic assets. This suggested that the content was created centrally for distribution by these accounts.
These users’ timelines revealed that they were tweeting the same images in a loosely coordinated way. Although there were slight variations in the accompanying text, the central message remained the same. The accounts also shared the same series of images within a timespan of a few minutes to several hours, again suggesting a very relaxed level of coordination. The accounts also frequently retweeted and quote-tweeted each other’s posts. This behavior could be observed over multiple days.
In addition, these high-follower accounts were seemingly supported by a group of low-follower sockpuppet accounts. Several of these were recurringly found to have retweeted and quote-tweeted tweets using the hashtags or related images.
Content without moderation
Specific examples of campaign “tracks” shared by this network included celebrating the Nigerian army’s victory over Boko Haram rebels; spotlighting infrastructure spending by the incumbent government; and a series of questions delegitimizing Obianuju Catherine Udeh, a popular Nigerian musician and eyewitness to the Lekki toll gate shootings. Shortly after an NGO with links to the Nigerian military provided Amnesty International Nigeria with an ultimatum to leave Nigeria or risk being lynched, this network circulated graphics that labeled Amnesty International “a threat to Nigerian national security.”
The content of these images could be classified into positive, negative and suppressive content. The positive content celebrated the achievements of the incumbent government, the Nigerian armed forces, or President Buhari himself. These were contrasted with negative content that cast doubt on the events of the Lekki shooting, criticized prominent witnesses and targeted the media and NGO’s such as Amnesty International Nigeria, who has been vocal in calling for accountability of the shootings.
A third category of content seemed aimed at dissuading social media users from participating in the protests. These urged the so-called Soro Soke generation (Yoruba for “Speak louder!”) participating in the protests to reconsider, as they can expect to be outmaneuvered politically by the children of the leaders they are protesting against. This echoed similar narratives delegitimizing the protests, insinuating the protests are an excuse for hooliganism and urging protesters to heed calls for a unified Nigeria.
Stockpuppets
To explore the nature of this network of accounts, the DFRLab extracted tweets using the hashtags #OneNigeria, #LetLoveLead and #EndViolence for the period from October 30, 2020 until November 12, 2020. The resulting data was visualized as a social network graph using Gephi to identify the most prolific tweeters and the accounts that amplified them. This revealed two distinct networks.
The first of these networks, indicated in green above, bore hallmarks of a sockpuppet or astroturfing network. These accounts tried to create the impression of grassroots or organic support for tweets using either the hashtags or the related graphics. The accounts retweeted and quote-tweeted each other frequently, creating the dense network seen in the network graph.
The active accounts within this sockpuppet network had relatively small followings, and in some cases their followers consisted mainly of other accounts within the same network. Many of the newer created accounts also used the stock profile picture.
One of the most prolific accounts in this network (@abubaka62933112) was created five days after the Lekki toll gate shooting, but has to date tweeted 846 times. Of these tweets, 95% were retweets or quote-tweets of accounts which form a part of this network.
Some of the accounts in this network were created recently, and even in short succession: for example, three of the accounts in this network — @abuduwyinmi, @FeyiOfada, and @FardaGobir- were created within the span of five minutes. There are indications that at least two of these accounts were created using the same mobile phone number.
The account creation dates for this part of the network varied, and not all of them were newly created. Some of the accounts were created as far back as 2014, but only recently returned from extended periods of inactivity to engage exclusively with the same hashtags and graphics.
There are also indications that multiple Twitter accounts are being created and used within the network; examples such as @faysal306/@306faysal, @1unitednaija/@1unitednaija1, and @aliyuAfar/@aliyuafaru were found within the network.
Shillfluencers
The second portion of the network consisted of a group of highly active influencer and digital marketer accounts with relatively high followings. Some of these accounts are overtly aligned with the incumbent government and President Buhari, while others were paid marketers.
These accounts were very prominent in the network of tweets, likely as a result of their substantial followings. Whereas the sockpuppet accounts had mostly single digit follower numbers, these accounts had substantially more: the most prominent accounts had at least 20,000 followers, with the largest clearing just north of 81,000 followers. This is evidenced in the large number of engagements their accounts were responsible for within the network, visible as the size of their respective nodes.
As already demonstrated, these accounts posted the same content related to the campaign in a loosely coordinated manner. Their activity does not appear to be either fake or automated, but instead present as real social media influencers that are participating in this campaign.
Conclusion
This network appears to be an attempted counter of the #EndSARS movement’s popularity online, combining a mixture of social media influencers and sockpuppet accounts to amplify content beneficial to the Nigerian armed forces, President Buhari and the Nigerian government. At the same time, these accounts cast doubt at the legitimacy of the protests and the demands underpinning them.
This behavior is deceptive, and creates the impression of support for this content where there is little authentic support for it. There are also indications that the network is expanding: new sockpuppet accounts have already joined the accounts indicated here since our research began.
Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab and is based in Cape Town.
The DFRLab team in Cape Town works in partnership with Code for Africa.
This report is published with permission from DFRLab
Accountant General, Pastor Uwem Andrew-Essien during the Press briefing. Photo Credit: Akwa Ibom State Ministry of Information and Strategy
