How we found the people behind a bot network

Summary

The video uncovers a coordinated disinformation network surrounding West Papua, led by fake social media accounts like Marco267 and orchestrated by a Jakarta-based marketing firm, Insight ID. These accounts hijacked hashtags, posted duplicate content, and promoted pro-Indonesian narratives while masking their true origins. Using open-source investigative techniques—reverse image searches, timestamp analysis, network mapping, and website tracing—the investigation exposes automated bots, AI-generated profile pictures, and the persistence of the campaign even after takedowns. The report emphasizes ethical methods to reveal how social media manipulation shapes narratives in regions with restricted media access, highlighting the importance of vigilance and transparency online.

Takeaways

• 😀 Fake accounts and bots were part of a coordinated information operation targeting West Papua's independence movement.
• 😀 Marco267, a fake account, was part of a larger network of bots spreading propaganda and misinformation related to West Papua.
• 😀 West Papua has been a region of tension, with a long-standing independence movement and frequent crackdowns from Indonesian authorities.
• 😀 Social media has become the battleground for shaping the narrative about West Papua, with fake accounts influencing public opinion.
• 😀 The marketing firm behind the fake bot network operated out of Indonesia and used tactics like hijacking hashtags and creating fake pro-independence pages to push anti-independence content.
• 😀 Reverse image search revealed that Marco267's profile picture had been stolen and used across multiple scam websites and dating platforms.
• 😀 Analyzing post times revealed automation patterns, suggesting that many of the accounts involved were run by bots rather than real people.
• 😀 Using open-source investigative tools, researchers traced fake accounts, websites, and other digital footprints back to a marketing firm named Insight ID.
• 😀 The marketing firm behind the operation registered numerous domains, including several news sites that spread biased content about West Papua.
• 😀 After the investigation was published, social media platforms like Facebook, Twitter, and Google took action, removing fake accounts and content promoting pro-government viewpoints on West Papua.
• 😀 Despite the takedown of the initial bot networks, new tactics emerged, including the use of memes and targeting specific languages (Dutch, German) to continue influencing the narrative around West Papua.

Q & A

Who is Marco267 and why is he significant in the investigation?

Marco267 is a social media account that appears normal but is actually part of a network of fake bot accounts. He is significant because analyzing his activity revealed the existence of a coordinated disinformation network targeting West Papua.

What historical and political context about West Papua is relevant to this investigation?

West Papua was a Dutch colony that declared independence in 1961 and was annexed by Indonesia in 1969 through a controversial vote. The region has experienced decades of unrest, a strong independence movement, and repeated crackdowns, including media restrictions and internet blackouts, making social media a key battleground for narratives.

How were the bot accounts identified in the investigation?

Bot accounts were identified by analyzing repeated content, identical hashtags, copy-paste behavior, posting time patterns suggesting automation, and connections between accounts within the network.

What techniques were used to verify whether Marco267 and other accounts were real?

Investigators used reverse image searches, profile photo verification, and analysis of posting patterns. They found that many profile photos were either stolen from other websites or generated using AI (thispersondoesnotexist.com).

What role did the Jakarta-based marketing firm Insight ID play in this network?

Insight ID orchestrated the network of fake accounts, managing propaganda campaigns to manipulate public opinion on West Papua. Employees created multiple accounts, registered domains, and ran targeted social media campaigns.

How did the investigation trace the people behind the bot network?

Investigators traced phone numbers, emails, and profile images to freelancer profiles, LinkedIn accounts, and company information, responsibly avoiding the exposure of personal data while identifying organizational involvement.

What types of content were these bot accounts promoting?

The accounts shared pro-government propaganda, hijacked hashtags related to West Papua independence, created fake pro-independence pages, and posted videos and articles presenting Indonesia positively while undermining independence movements.

What actions did social media platforms take after the investigation was published?

Facebook and Instagram removed the network present on their platforms, Twitter took down 795 accounts associated with the campaign, and Google removed related content from YouTube. The marketing firm’s website was also taken offline.

How did the network attempt to continue disinformation campaigns after takedowns?

The network adapted by creating new accounts, posting in multiple languages (English, Dutch, German), using graphic memes, and continuing to target keywords like 'special autonomy' and 'independence,' showing persistence despite prior removals.

What open-source investigative techniques were highlighted in this investigation?

Techniques included reverse image searches, network mapping, analyzing posting times and patterns, domain registration tracing, monitoring linked websites, checking social media transparency tools, and identifying AI-generated profile photos.

Why is monitoring disinformation in West Papua especially important?

Because West Papua has limited press access due to government restrictions and internet blackouts, social media often serves as the primary source of information. Disinformation networks can therefore heavily influence narratives and public perception without challenge.