MANILA, Philippines — Dozens of suspicious social media accounts that bear the markings of coordinated and inauthentic behavior have sought to amplify allegations of corruption against the Commission on Elections and its chairperson, George Garcia.
Philstar.com has identified at least 28 accounts on X (formerly Twitter) that bombarded media outlets’ posts with similar replies that either demanded Garcia’s resignation or urged media outlets to shift their focus away from voting technology company Smartmatic’s cases to Garcia’s purported offshore bank accounts.
The bot-like accounts spammed media organizations’ X posts with near-identical messages in the wake of two news events:
- First, when news outlets reported on Rep. Rodante Marcoleta (Sagip Party-list)’s August 1 press conference where he accused Garcia of owning offshore bank accounts in the Cayman Islands;
- Then more than a week later, when local and international media reported on the bribery charges filed against Smartmatic executives and former Comelec chair Andy Bautista.
While there are several posts online critical of the Comelec that are legitimate, Philstar.com’s monitoring from August 1 to August 16 shows that these same 28 accounts were deployed to flood the mentions of the X accounts of at least four news outlets: Interaksyon (Philstar.com’s sister publication), ABS-CBN News, Manila Bulletin and The Daily Tribune.
These accounts appear to be part of an influence operation that Philstar.com is tracking across all social media platforms, groups and spaces on the internet.
Bot accounts: Zero followers, jumbled usernames
The bot-like accounts showed multiple indicators of coordinated and inauthentic behavior, including overlapping account creation dates, similar naming conventions and near-identical wording of posts published within minutes of each other.
Of the 28 social media accounts, at least 20 also appear to have branded themselves as “stan” accounts of Filipino actress Belle Mariano through regular reposts of the actress.
All accounts either have single-digit followers or none at all. At least 10 accounts were created in May 2024, while the rest were set up in 2016 or earlier. Most accounts have less than 1,000 posts.
Based on Philstar.com’s monitoring on X, these bot-like accounts spammed the X accounts of Interaksyon, ABS-CBN News, Manila Bulletin and the Daily Tribune from August 1 to 16.
Coordinated spamming behavior
The coordinated campaign to flood Interaksyon’s mentions with posts criticizing Garcia unfolded in three distinct waves on August 14.
These posts targeted an X post made by Interaksyon on August 12 that featured a syndicated Reuters news report about the bribery charges filed against Smartmatic executives.
FOREIGN BRIBERY AND MONEY LAUNDERING
Three executives of voting technology company Smartmatic have been charged with funneling $1 million in bribes to a former Philippine election official to secure the country’s business.
Read: https://t.co/1DULsrosD2 pic.twitter.com/mp8uuwhi7X
— Interaksyon (@interaksyon) August 12, 2024
First wave. The first wave of replies occurred between 10:27 a.m. and 10:30 a.m., coming from eight accounts that were all created in August 2016 and had no followers.
The accounts posted a range of messages that similarly criticized the Comelec for supposedly diverting attention away from allegations that Garcia owners offshore bank accounts to the Smartmatic controversy.
Unlike the accounts that spammed Interaksyon’s X post in the afternoon, this batch used pictures of non-celebrities or unidentifiable Filipino women.
Their usernames also used seemingly realistic first and last names such as “marilynballete” and “lorrainejumalon,” among others.
These screengrabs show some of the replies from the bot-like accounts on Interaksyon’s August 12 post. These are part of the first batch or first wave of posts that were deployed from 10:27 a.m. to 10:30 a.m. (Screengrabs taken August 19, 2024; 9:24 a.m.)
Second wave. The second wave followed in the early afternoon from 2:38 p.m. to 2:42 p.m. involving 10 accounts. This time, their messages focused on calling for Garcia to resign or questioning why Miru was the lone bidder for the Comelec’s contract for vote counting machines in the 2025 elections.
These accounts’ usernames used a combination of jumbled letters and numbers, a feature typical of bot accounts. Most were created in 2016, but others were made in 2012 or earlier.
All of these accounts regularly reposted content supportive of Mariano’s latest projects and activities. Most of these accounts had profile pictures of popular K-pop idols or illustrations.
The use of fan posts for K-pop idols or celebrities is a common strategy for bot accounts to disguise their inauthentic behavior and purportedly blend in with legitimate users, as reported in a 2019 Washington Post investigation about troll farms in the Philippines.
These bot accounts, however, appear to have been shoddily made with minimal attempts to differentiate themselves from each other.
For instance, in the second wave of replies, Philstar.com noted two accounts named “ReniBieber1” and “ReniBieber3” with nearly identical bio descriptions. Their profile pictures both featured K-pop group TWICE member Nayeon.
These screengrabs show nearly identical bot accounts with similar usernames and bio descriptions. (Screengrabs taken August 19, 2024; 9:49 a.m.)
Third wave. The final flood of replies came later in the afternoon from 4:18 to 4:25 p.m. featuring another set of 10 accounts created in May 2024, this time with messages that more directly urged media organizations to investigate whether Garcia was bribed into granting Miru the contract for the 2025 midterm polls.
Similar to the previous batches, these accounts had a mix of jumbled usernames and legitimate first and last names. They used more generic profile pictures displaying non-celebrities.
All of these accounts also reposted content supportive of Mariano.
These screengrabs show replies from bot-like accounts in the third wave of posts targeting Interaksyon’s X post on August 12. (Screengrabs taken August 19, 2024; 9:55 a.m.)
These screengrabs show the posts made by the bot accounts in support of Filipino actress Belle Mariano. (Screengrabs taken Aug. 19, 2024; 2:30 p.m.)
Targeting news outlets
These same 28 accounts also flooded the mentions of the following news organizations:
- Daily Tribune (@tribunephl)’s X post on August 1 reporting on Garcia’s denial of Marcoleta’s claim that he owns offshore accounts.
- Manila Bulletin (@manilabulletin)’s X post on August 1 reporting on Garcia’s call for Marcoleta to prove his accusations.
- ABS-CBN News Channel (@ANCALERTS)’s video on August 12 where Garcia said he has never been to the United States, where he was accused of opening bank accounts.
- ABS-CBN News (@ABSBCBNNews)’s X post on August 12 reporting on news of Bautista’s bribery charges.
Garcia told Philstar.com in an online message that he has been notified of “this very alarming pattern in social media” and that he has been targeted by a “well-oiled demolition job focused more on social media.”
— with reports by Rosette Adel
Be the first to comment