Joe Biden's Twitter account got a sizable boost beginning in August from tens of thousands of fake followers purchased on the open market from troll farms in rural India, an investigation has found.
Within two weeks of Biden selecting Kamala Harris as his running mate on August 12, his Twitter following jumped by 738,595 new followers—a 9.1 percent leap. The number hit 11 million by the third week of October.
A close examination has revealed unusual patterns. A large number of Twitter accounts that followed Biden's appear to have been created exclusively for that purpose. And a large number of the users are located in small towns in rural India—in places where English-speakers are rare, and from handles run by people who don't speak English as their first language, nor appear to be genuinely invested in American politics.
A Zenger News investigation reveals that Biden's increasing social media footprint in India came from the country's infamous troll farms boosting his candidacy.
Kamala Harris's ethic heritage is in part rooted in India, but her share of Indian and apparently Indian followers is far lower, about 0.12 percent.
Sock Puppet Sweatshop
Some of the operators who worked on the campaign spoke at length about how propaganda agencies in New Delhi and Mumbai activated a widely distributed troll network to amplify Biden's campaign impact on Twitter.
In discussions over the Telegram app, Harshit Patel and Yajpal Yadav discussed the part they played.
Patel runs a small cybercafé near the railway station at Umbergaon, a small town four hours north of Mumbai near the Maharashtra-Gujarat interstate border. From 8:00 am to 8:00 pm, he scans IDs of customers and allots them a PC for twenty rupees an hour. On the side, he and his Photoshop-savvy wife Sejal make photocopies, print ID cards, do small design jobs and offer lamination services.
"This was started as an internet café by my father in the late 1990s," Patel said, speaking in Gujarati-accented Hindi. "Back then, men came in mostly for chatting in IRC [Internet Relay Chat] rooms and surfing porn. It was brisk business. But then internet became so cheap and everyone got smartphones and business petered out. We had to rely on passengers asking to print railway tickets, fill up online forms, and get documents photocopied. But that didn't even cover the costs of maintaining the PCs and paying the electricity bill. Things changed in 2012–13 when [Narendra] Modi started his campaign for prime minister. And this became my main business."
What Patel means by "this" is the business of running a troll farm after his shutters go down at 8:00 p.m.—which is 10:30 a.m. in New York and 7:30 a.m. in California.
Four of his employees, young men who live in the neighborhood, take their stations at long desks that line two walls of the tiny shop, and open up task sheets assigned to them. A Google Doc tells each one of them who to follow, who to retweet, what to retweet and what comments to leave on specific posts.
Using aliases—each worker controls several hundred—they schedule tweets, check engagement stats and, at the close of their shifts, fill up a spreadsheet with their analytics from the previous day.
Started mostly to serve the 2014 Narendra Modi campaign, India's troll farm business is now one of the most decentralized and robust in the world. They offer nearly anything to paying customers, according to Patel: fake news, Photoshopped images, support and "hate" campaigns, and even incitements of mob violence.
"I came to this because of my ideology," said Patel, who's a member of the youth wing of Modi's Bharatiya Janata Party, "but then this became my profession. My wife got herself trained in Photoshop and now we offer not only these [trolling and propaganda] services, but also content creation" that includes making memes.
Yajpal Yadav, based in the eastern India town of Patna, has a similar story.
The high-school dropout invested in 5 PCs and a broadband connection in 2016. His IT services agency, as he calls his one-room setup, now employs six people in addition to him and his brother Rajpal.
"Each one of us controls two to three hundred profiles across different platforms," Yajpal said in Hindi, his only language. "We get daily targets from agencies in Delhi and Mumbai, and we simply engage with the target as we're told."
"Political parties are our main clients, but even brands and celebrities who need promotion come our way," Yajpal said. "This is a business like any other.
"We don't pick and choose. Joe Biden the person is irrelevant to us. We got a target in August to follow him and engage with his tweets, and we did. The agencies in Delhi who we work with don't tell us any details, and we don't ask," he said.
Yajpal described a pyramid-shaped campaign structure akin to multi-level marketing, but without the mid-level payoffs. "There are so many levels [of subcontractors] in this, nobody can really trace anything back. We don't even get paid through banks. We settle in cash once a month" via Hawala, a popular international money transfer system that uses bookkeepers outside official banking networks.
He declined to share specific financial details: "I won't tell you how much we make, but what I will tell you is this setup is feeding all our families. And I don't have to ever worry about a roof on my head or about paying my children's' school fees."
The Data Story
Zenger News data-dumped a large sample of Joe Biden's new Twitter followers from August 19 to August 28: seven days of 15,000 data points per day, the maximum allowed by Twitter's rate-limits.
Joe Biden's official Twitter handle spiked by 738,595 followers during the 13 days after Kamala Harris joined his campaign, a 9.1 percent increase. A sizable portion of these new followers appear to be created solely for the purpose of following Biden.
"Typically, fake accounts are identified by looking at combinations of attributes of the handles in question," said Saikiran Kannan, a Singapore-based Open Source Intelligence analyst. "The attributes could be the tweet frequency of the handles, the themes, the creation date, the profile picture, the follower list, the following list, etc. And a handle is suspicious when one or more of these attributes are observed."
He flags some suspicious and unusual activities by spotting other factors, too, like Twitter handles that include random-seeming numbers or that leave the default "egg" as their profile pictures. Excessive duplicate tweets raise red flags, as do those in incoherent English and tweets that contradict each other.
Most "sock puppets," as they're called, typically retweet only a few specific accounts in intermittent bursts of high volume. Based on the sample Zenger News examined, it appears that more than 100,000 such accounts joined Biden's legitimate followers in August.
Of the 105,000 followers in the sample, 31,981—more than 30 percent—were created on August 12 or later.
Of the 62,478 accounts created before 2020, 16.5 percent have tweeted fewer than 10 times. Half of those have not tweeted this year at all.
Made in India
About 40 percent of the accounts in Zenger's sample publicly provide information about where the users are located. More than 10 percent of those are Indian. If that percentage were to hold throughout all of Biden's new followers in August, about 30,000 of them would be from India—by far the highest among foreign countries.
Saikiran explained how data analysts determine where other accounts which hide their geographical information are located.
"One way for analysts to overcome this [geolocation] handicap is to use other characteristics," said Saikiran. "Names, language, hours of activity, for example."
Taking this into account, Zenger analyzed the remaining 60,000 accounts. A high percentage have popular Indian last names like Kumar and Singh and display evidence that Hindi is their preferred language.
Saikiran said it was possible but highly unlikely that Americans were using virtual private networks (VPNs) to fool Twitter into thinking they were tweeting from India.
"Twitter is very strict about VPNs," he said. "If you try to sign up or run an account using a VPN, Twitter flags your account and asks for two-factor authentication."
VPN service providers almost universally offer locations in large cities, not the small towns where the troll farm industry has thrived. And Twitter's two-factor authentication scheme requires a phone with a physical SIM card—not a virtual number like those available from Google or Microsoft's Skype platform.
Indian regulations permit only nine registered SIM cards per person. But even that has loopholes, said Patel, the Internet café owner, and if social media platforms were to require identity verification, he's ready.
"Think a bit," he said about identity verification by photo ID. "I just told you that I scan IDs of everyone who uses my cybercafé, didn't I?"
This story was provided to Newsweek by Zenger News.