7 de agosto 2023
AA
A complex network with more than 1,400 pages, groups and users which was dismantled by Meta in 2021, has been reactivated in Nicaragua and continues its influence operations to distort opinion and distribute propaganda and hate messages.
In November 2021, Meta, the company that owns Facebook, deleted 896 personal accounts, 132 pages, 24 Facebook groups, and 362 Instagram accounts that were part of government-run "troll farms", that is, networks of fake accounts that published content in favor of the Daniel Ortega and Rosario Murillo regime. Within hours, a coordinated effort began within Nicaragua, which this international journalistic investigation has dubbed "Operation Lázaro."
Some of the main propaganda accounts that had been deleted from Facebook and Instagram were reactivated and brought back to life. That is, they reopened with a similar or identical name. These were fake accounts, Meta had determined, created within government institutions and coordinated to distribute often false political messages favorable to the dictatorship and hostile to the opposition.
Meta published its statement regarding the dismantling of the accountson November 1, 2021, a week before Ortega and Murillo were re-elected as president and vice-president of Nicaragua, he for the fourth consecutive time, she for the second. The elections were deemed fraudulent, as independent observers claimed there was up to 82% abstentionism and the government had prevented the participation of the opposition by imprisoning its leaders.
As part of Digital Mercenaries, an investigation coordinated by the Latin American Center for Investigative Journalism (CLIP) in alliance with 20 media outlets, five organizations specialized in digital research, and master's students at Columbia University, CONFIDENCIAL found that many of the deleted accounts had returned to the Facebook platform with only slight modifications.
Two years and eight months after the suspension of the troll network, considered by Meta as "one of the most cross-government troll operations we've disrupted to date, with multiple state entities participating in this activity at once," it continues to implement the kinds of influence activities it had carried out since 2018: the boosting of state propaganda, attacks on the opposition, and an attempt to dominate the political discourse on social media.
Two analyses carried out by the media alliance managed to identify several of the fake accounts that were reactivated after their suspension. The DFRLab, an ally of Digital Mercenaries, gave us access to a database of publications deleted by Meta. At the same time, CONFIDENCIAL followed Sandinista profiles that, in several social networks and even in pro-government media, had complained about the suspension of certain accounts related to the government. With this information, we set up another database in which we were able to identify accounts with identical or similar names to those that had been eliminated and to verify that they continued to publish propaganda.
Using these two methodologies, the alliance identified more than 130 accounts, which we have dubbed "Lazarus accounts" in reference to their sudden resurrection. It is highly likely that there are additional accounts that were resurrected under other names.
Political strategy: propaganda and hate
In the database of posts deleted by Meta, DFRLab did a search using special access to CrowdTangle, a Facebook and Instagram analysis and tracking tool. They found 269,505 posts from the deleted fake Nicaraguan accounts. These comments or posts were produced on 240 Facebook or Instagram pages, groups or profiles out of the 1,414 that Meta claims to have deleted. (The social media company had originally reported a higher number of accounts, but updated the data on November 5, 2021.)
We then did social media searches for the names of those 240 accounts and found that 35% (84 accounts) had been revived and were still posting pro-regime disinformation. Of the reactivated accounts, the five with the highest number of entries in the database are Vamos Comunicando (Let's Communicate) with 25,813 publications, Barricada (Barricade) with 25,211, Red de Jóvenes Comunicadores Redvolución (Redvolution Young Communicators Network) with 10,005, and Tropa Digital "Tomás Borge" ("Tomás Borge" Digital Troops) with 6,505. All these pages had returned to the platform and had accumulated more than 58,000 followers by mid-2023.
The posts and publications included in the database –both from the accounts that had been reactivated and those that had not been– show patterns in language, political discourse, use of hashtags and selection of photographs, all consistent with the coordinated operation described in the Meta report published in November 2021.
A total of 95,831 hashtags were used in the publications and posts in the database. The most prominent ones are: #Nicaragua, #Nicaragua40Revolución (Nicaragua 40 Revolution), #VivirBonito (Living Pretty), #ElAtabal (The Drum), #MolotovDigital (Digital Molotov), #NicaraguaQuierePaz (Nicaragua Wants Peace), #TODOSCONDANIEL (EVERYONE WITH DANIEL), and #UnidosEnVictorias (United in Victories), among others.
The messages range from official government press releases to kudos for public works inaugurated in Nicaragua, messages against the opposition, and even attacks on the Catholic Church.
Some examples of these messages are: "The church belongs to the people and should not be used to organize terrorist acts"; "The Sandinista militant Pablo Ramos was 21 years old when he was assassinated by groups of delinquents who carried out terror in Jinotega"; "The Public Attorney for the Defense of Human Rights, Corina Centeno, reported on actions carried out in the implementation of the Work Plan of the Law for Integral Attention to Victims (Sandinistas of April)." The latter is one of the publications where persons sympathetic to the government who were injured in the protests are given visibility while ignoring the victims of state repression.
These troll networks published disinformation between June 9, 2010, and October 31, 2021. However, our analysis revealed that 57% of the publications were posted between January 2018 and October 2021. Starting in August 2018, four months after the start of the civic protests that were brutally repressed by the Ortega-Murillo dictatorship, there was a first big increase in the frequency of publications. Then, starting in June 2021, five months prior to that year's elections, publications increased at an even faster pace.
The style of troll farm publications can be seen in posts such as: "In 14 years of Sandinista Government #SeguimosCambiandoNicaragua (We Keep On Changing Nicaragua) and where #TodosTriunfosSonDelPueblo Nicaragüense (All Triumphs Are Of The Nicaraguan People) #SiempreMasAllá (Always Beyond)." This was published during a period of repression and imprisonment of the main opposition figures, among them the seven presidential aspirants who were detained for "treason" and whose own posts on social media were used months later by the regime as alleged "evidence" in judicial proceedings.
According to Meta's report, this network of influence was operated by employees of Telcor, the Nicaraguan Institute of Telecommunications and Postal Service, who worked from the institution's headquarters, but there were also other smaller groups of fake accounts managed from other government institutions, including the Supreme Court and the Nicaraguan Social Security Institute.
"This campaign was multiplatform and from several government entities. It used a complex network of media brands on Facebook, TikTok, Instagram, Twitter, YouTube, Blogspot and Telegram, as well as websites linked to these news entities," Meta's report detailed.
CONFIDENCIAL sent a list of questions to Meta about the dismantling of these accounts and the reactivation of these same accounts. They were asked about what parameters Meta uses to ensure that these deleted accounts do not return to the platform. They were also asked if Meta knows if a new network of influence operators in favor of Daniel Ortega's government has re-emerged or been created in Nicaragua.
In its response, Meta assured us that they are aware that "these types of networks always try to return and evade detection in various Internet services. For this reason, we have automatic and manual systems to detect and eliminate these networks on a continuous basis." CONFIDENCIAL also asked Meta if this network had bought advertising space from them. Meta responded that they had received payments of $12,000 for advertising on Facebook and Instagram to promote content. However, the Meta team did not specify who had made these payments. They also did not respond about what updated information they have on the deleted accounts or whether these have returned or if a new network of operations has been created.
Lazarus accounts beyond Meta's report
"I am not a bot, I am not a troll and I have been censored on my social networks. Does Facebook not allow us to be Sandinistas?," asked Ligia Sevilla, a user who was included in Meta's dismantling, in a video released in propaganda media.
With the tracking on Facebook, Instagram, Twitter, and government and pro-government media of posts similar to this one, in which alleged individuals or groups complain about the removal of their profile, CONFIDENCIAL, as previously mentioned, assembled a second database.
In the case of Meta, this second database was necessary because the CrowdTangle tool did not give DFRLab access to all suspended accounts. In the case of Twitter it was also necessary because although the company carried out an account deletion operation in October 2021 –and had previously carried out other suspensions in Nicaragua–, it did not publish reports about it. The elimination of Twitter accounts only became known when its users began to denounce these suspensions as censorship.
After identifying 51 Twitter accounts, 30 Facebook accounts, pages and groups, and four Instagram profiles that had been deleted, CONFIDENCIAL found that 52 of these had returned to the platforms in less than a year. That is, of 85 accounts, pages, groups, and profiles taken down by the platforms for misinforming, 61% had returned. These accounts, totaling more than 418,000 followers, use the same names with only slight modifications and have already regained almost all the followers they had before.
The resurrected profiles and groups are easy to identify: They use images of the Sandinista Revolution or Ortega and Murillo as photos or covers. Some are identified in their description with the hashtags #DeZurdaTeam ("From the Lefty Team," a network of tweeters operating between Cuba and Venezuela), #TropaSandinista (Sandinista Troops), or #Plomo (in Spanish, short for the slogan Free Country or Die). These have high publication rates and almost all the content they share is for dissemination of propaganda. This list also includes personal accounts of influencers and pro-government journalists.
Similarly, the research alliance established the dates of creation, number of followers, influence in social networks, and how they cooperate with networks in Cuba, Venezuela, and Russia. Communication agreements have been signed between Russia and the Ortega-Murillo dictatorship. These agreements have been announced publicly through propaganda press releases and, in general, their purpose is to establish alliances between Russian media (Sputnik and RT) and Nicaraguan propagandists to share content.
Some of the accounts had profiles that were suspended on more than one social media platform. Such is the case of Barricada and Redvolución, which were removed from Facebook, Instagram, and Twitter, and the Red de Jóvenes Comunicadores and La MoraLimpia Sandinista, which were deleted from both Facebook and Instagram.
The Facebook pages and groups of this sample that were reactivated and have the highest number of followers are: Plomo 1979 with 42,000, Barricada with 25,000, Daniel Mi Presidente (Daniel My President) with 23,886 and the Red de Jóvenes Comunicadores with 22,000. The latter also created several local accounts in different provinces of the country.
On Twitter, the most popular accounts that resurfaced belong to “Sandinista influencers.” The account @taniasandinista (which had already been temporarily suspended in November 2018), for example, was definitively suspended in October 2021. However, it resurfaced as @nicasoberana in November of the same year and already has more than 23 000 followers. Another of her accounts, @TaniSandinista3, was also suspended.
Another influencer, who identifies himself as El Cuervo Sandinista, also had two accounts suspended: @ElCuervoNica (which was suspended in 2018) and @ElCuervoNinja (suspended in October 2021). Since March 2018, this influencer owns the account @ElCuerv0Nica (with a zero instead of an o), where he built up more than 18 000 followers.
Other Twitter accounts that are part of this propaganda network have been temporarily suspended but have resumed operations on the same account (i.e. without having to open another one). This is the case of @FlorYCantoX, which was suspended along with @taniasandinista and @ElCuervoNica in 2018, but is now still running and has 35 000 followers. Or that of @MaryuriRG, which was briefly suspended in February 2021 and now has more than 15 000 followers. The @nicasoberana account reached a blue Twitter checkmark in March 2023. The @FlorYCantoX account still has this label.
Previously that checkmark involved verification of the identity of the person or group behind a Twitter account. But since that month, Twitter changed its policies and gives the checkmark to anyone who pays eight dollars a month. This has caused confusion among several users of the platform (which in July also changed its name from Twitter to X), causing problems for journalists and media who may be impersonated.
Interconnected propaganda
Several of the Facebook pages we found with the DFRLab ally coordinated with each other, prior to the suspension, to post and share the same content. We found that, between August 2019 and October 2021, there were 297 crossposts or cross-postings on different pages. At least 17 of the 24 pages Meta suspended in its 2021 operation made at least one crosspost.
According to the analysis of the evidence found through this alliance, two pages having a common crosspost is evidence that their administrators acted in a coordinated manner. But the fact that three pages have it does not necessarily imply that there is coordination among the three: one page could be coordinated with the other two, but the other two could not be.
Many of the pages were connected with others, which reinforces the hypothesis that it was the same coordinated operation. The main nodes of pages that were most coordinated were El Atabal, Redvolución, and Unidos Si Podemos. There were also links between the pages of Barricada, Red de Jóvenes Comunicadores, Panorama Electoral 2021, La MoraLimpia Sandinista, Tania Sandinista, and Osman Reyes, administrator of social networks of the Ministry of Education (Mined).
The propaganda network expands
In addition to the accounts that were reactivated after suspension, the Nicaraguan government's propaganda network has continued to operate with many other accounts. Only on Facebook, doing a quick review of groups and pages that have the word “Sandinista” in their names, this journalistic team counted a hundred that share propaganda and disinformation content. These accumulate some 669,883 followers.
The five most influential accounts are Soy Sandinista with 157 000 followers, El Lobo Sandinista with 130 000, El Gato Sandinista with 45 000, Somos Sandinistas with 22 000, and La Gaceta Sandinista with 21 000. These pages have the same patterns that were identified in the "Lazaro" accounts of the troll farm.
The Sandinista Twitter accounts that were revived and others, which are part of the influence operations, but have not been eliminated, are distinguished by their almost automatic behavior. They use the same photos, the same propaganda posters, and infographics. Likewise, they recycle hashtags and tag three or five Sandinista accounts in each publication.
Why do influence operations matter?
The Ortega-Murillo regime used targeted influence operations as part of the political strategy to reduce spaces for opinion and freedom and to combat what Ortega himself classified as a war on social networks.
“There has been a preparation here, there has been financing for that preparation (for the protests), for what? To transfer the lessons of other countries where this type of coup has taken place and transfer them to Nicaragua," Ortega said in July 2018.
The president's version of events is that in Nicaragua there was no civic uprising against his administration, but rather an “attempted coup” financed by the United States. “Venezuelans have come here, of those who have participated in the 'guarimbas' (organized protests against the government of Nicolás Maduro), of those who are experts in the management of social networks, to transfer that experience here and young people have also traveled here financed by US Agencies to assimilate a greater experience,” Ortega justified in an interview granted to Telesur.
Social networks were a crucial instrument during the protests detonated in April 2018 to document the acts of violence and repression committed by the National Police, the main repressive arm of the dictatorship, and paramilitary groups. This content disseminated through live broadcasts, photographs, and videos later served as evidence for international Human Rights organizations to point out the dictatorship of committing crimes against humanity.
Likewise, it was through social networks that the population “self-convened” to march, organize quick protests and express their discontent with the acts committed by the Ortega-Murillo regime.
Since then, laws have been passed, such as the Special Law on Cybercrimes, known as the “Gag Law,” which criminalizes publications on social networks, by arbitrarily classifying them as propagation of “false or distorted news” that produce alarm, fear, and anxiety in the population. Almost a hundred Nicaraguan opponents have already been prosecuted for the content they share on these platforms.
A great irony emerges from this investigation, following Ortega's claims of digital conspiracies against him: that it is his own government that keeps alive a network of disinformation and propaganda, even after the platforms have been identified as inauthentic and coordinated from official institutions.
This article was originally published in Spanish in Confidencial and translated by our staff.
*This special CONFIDENCIAL report is part of the cross-border journalistic investigation Mercenarios Digitales (Digital Mercenaries), coordinated by CLIP, where it can be found under the title: Cuentas Lázaro del régimen nicaragüense reviven tras la suspensión de Meta.
__________
Download a Glossary that specifies the meanings of words or phrases referring to the digital phenomena used in this research here.
Mercenarios Digitales (Digital Mercenaries) is an investigation by Chequeado (Argentina), UOL y Agência Pública (Brasil), LaBot (Chile), Colombiacheck and Cuestión Pública (Colombia), CRHoy, Interferencia and Lado B (Costa Rica), GK (Ecuador), Factchequeado (USA) Ocote (Guatemala), Contracorriente (Honduras), Animal Político y Mexicanos Contra la Corrupción y la Impunidad (Mexico), Confidencial y República 18 (Nicaragua), Ojo Público (Peru), El Surti (Paraguay), La Diaria (Uruguay) and three investigative journalists (Bolivia and Spain/Colombia); the digital research organizations Cazadores de Fake News (Venezuela), Fundación Karisma (Colombia), Interpreta Lab (Chile), Lab Ciudadano (Honduras) and DFRLab (USA); and students of the master's course Using Data to Investigate Across Borders by professor Giannina Segnini (Universidad de Columbia USA), with the coordination of the Latin American Center for Investigative Journalism, CLIP. Review and legal advice: El Veinte.
With financial support from Free Press Unlimited, the Networks Against Silence program (ASDI), Seattle International Foundation, and Rockefeller Brothers Foundation.
