Covert online campaigns: a primer

Following last week’s Question Time, the BBC’s Have Your Say forum was red hot with sympathy for old Nick.

This led to some soul searching in the media, and across the social sphere. To what extent can we say that this mass-protest; much of which condemned the ‘bullying’ of a panellist rather than openly endorsing his party’s policies, fairly reflects public opinion? Are we looking at an orchestrated online campaign?

Without access to HYS log data, it is very hard to say. And even with an extensive list of IP addresses, and a breakdown of traffic by source, the free availability of anonymous proxies and easy-to-set-up email and social network accounts will always leave breathing space for a well-regimented astroturfing campaign.

So how can we shed light on covert political campaigns online? Any group who have been infiltrated in the past will be ultra security-conscious – so events last week may be untraceable to outsiders. Other groups may not be as well organised – so here are some pointers.


Spreading an effective mass-campaign across a forum or social network requires speed. People who work quickly don’t have time to spell-check, or type accurately. But hunting out spelling errors won’t help you unearth a conspiracy here.

Typos are a different matter – if you spot regularly occurring mis-types, this could suggest a common origin.

Punctuation and the use of capital letters can also slow the process of rapid posting. Conversely, evidence of the sporadic and distinctive use of upper-case shouting (within ordinary text), can also be indicative of a single personality expressed across multiple accounts.

Phrase searching” excerpts from suspicious sentences can provide a simple way of tracking down duplicate content across the web. This can be useful where people are trolling across different forums (which might, in this case, include a perceived spike in support on the Sky News forums). But testing an adequate number of sentences can be time consuming.

Alternatively, there are a few freely available services out there intended to detect plagiarism, which can be used to track duplicate posting across parts of the web.

However, it is likely that well organised and long-term campaigns will already have organised participants into cells who are responsible for trolling particular domains, thus lending uniqueness and authenticity to their posting. Such decisions will most likely take place offline, or at least via encrypted communications – which some groups are known to use.

Getting back to the analysis of output, it is possible to mine large volumes of text (i.e. a large number of posts in one domain), via software such as Analysts Notebook. This could certainly help establish grammatical trends, and those phrases which are hard for the human eye to spot systematically. But this software is far too expensive for most media organisations.


In the unlikely event that a covert campaign to influence public opinion is discussed openly on the web, there are a number of places to check for mobilisation, and linking.

A search of Omgili (covering keywords, or URLs) will highlight any attempts on public discussion boards to mobilise on a given subject and/or target (though this is of little use for private boards).

Alternatively, Yahoo’s site explorer can be used to eke out all the inbound links to any page across the web. This source gives an insight into just how skewed political opinion on the web can be. If you search for Ron Paul’s Campaign for Liberty you will find it has over 600,000 inbound links, by comparison with the Republican National Committee which has just over 220,000. You might wonder which party’s representative came runner up at the last presidential election on this analysis.

For the social web,’s search option allows you either to search for linking by keyword or by URL. When the results come back, check Info for a particular entry, then select View all from the Conversations option to track the development of conversation around the page in question, and tease out other associated links and trends.

Lost in hyperspace

Sometimes the most obvious indication that something’s going on is when that thing’s not going on somewhere you’d expect it to. The relative inactivity on Thursday night from those who publicise their affiliations (a bio: search in Tweepz will help here) is noteworthy.

On the eve of the greatest public exposure in the party’s history, some might question where were the pro- trending topics – there were no shortage of anti- topics that night. A cynic might suggest that mobilising on Twitter, where real identities often crowd out fakes, is not the ideal medium for pushing an unpopular agenda.

Dummy accounts represent a different challenge. Forum owners can easily keep track on accounts which spark unerringly to life when a particular issue comes along which fits with a particular agenda. But the surfer can replicate this too – IceRocket’s Twitter search tab allows you to browse vital statistics – including tweet count – which can be indicative of a dummy account (as can long periods of inactivity between non-specific tweeting, and proactive tweets).

A trawl through the names posted on forums may highlight a number of plausible but bogus identities (see for domestic names, or Infobel for international ones), which should arouse suspicion. The age-range option in 192 can be especially useful in analysing Facebook accounts. Where you see a profile picture of someone in their twenties, if everyone by that name on the electoral roll is over 40, something is surely up.

Likewise one or two people finders, such as 123people or Yasni, when used in conjunction with 192, can highlight anomalies between real and online identities.

When browsing through the real names posted on a forum, if you can’t find names who elsewhere publicly declare their affiliations, especially in relation to a contentious issue, then alarm bells may start ringing.

But then, where a campaign groups’ leadership encourage members to hide their true identity in public, it’s little wonder conspiracy abounds. Such advice accommodates a reactive approach to online campaigning, away from the direct expression of party support, and towards (for example) outrage at a perceived injustice. Yet the absence of significant online connections between a party and its activists would indicate that this type of strategy is working perhaps a little too well.

Linking and transparency in online politics

Groups who seek to hide their true colours online can come embarrassingly undone if they aren’t careful. The link can cut a swathe through façade – it can bring transparency to our politics, as well as to our journalism.

For this reason the Identify Firefox extension can bring insight. This plugin reads links on social network and blog profiles tagged rel=”me” (more information on the plugin can be found on Read Write Web). Use the keyword combination Ctr+i on any public profile to bring back other social networks and blogs which also link to these web sources.

Try it out on a couple of prominent public profiles – you may be surprised (or possibly appalled) at what you find.

Investigative journalism – accept no substitute

While conventional online research techniques offer options in terms of digging out evidence, there remains no substitute for good old fashioned investigative journalism.

With this in mind, a first port of call for guidance on approaching online groups for any investigator should be the internet research clinic.