Benjamin Strick is an open source researcher and consultant with a legal, military, and technical background. He specializes in the areas of influence operations, geolocation, and new data finding methods.

A new online influence operation aimed at countering the West Papua independence movement seems to have appeared on the famous social media website. This discovery occurred about a year after Bellingcat discovered a similar network of fake accounts.

Although this new network of 100 to 200 accounts has had little impact so far, it seems to span Twitter, Facebook, Youtube, and Instagram, using methods previously undocumented in independent online conversations around West Papua .

These include the use of fake profile pictures generated by machine learning tools to deploy accounts, and the use of Dutch and German posts that appear to be designed to influence debates abroad. 

However, the network also adopted practices found in previous investigations, such as using fake accounts with stolen profile pictures, anti-independence infographics, and self-hosted news sites to spread content that supports the special autonomy of West Papua rather than being completely independent. .

In the past week, there has been an increase in pro-Indonesia fake accounts written in Dutch to influence the debate on West Papua’s independence.

These tweets mainly use the hashtag #FreeWestPapua. This post is to show an example of a low-impact account👇

CC @TwitterSafety pic.twitter.com/F79Nybjz2g

— Benjamin Strick (@BenDoBrown), September 18, 2020

After publishing its own research earlier this week, a separate study by Leiden University in the Netherlands appears to be the first to publish its findings on the new network. It is not clear whether the accounts found in this study are the same as those found by Bellingcat, which has been investigating the issue independently for the past month.

Bellingcat's previous work on this topic revealed a large cross-platform influence operation related to West Papua in October 2019, attributing it to a Jakarta communications company called InsightID. The social media platform subsequently cleared most of the content, pages and accounts involved, while InsightID was completely shut down and disappeared. 

It is not clear who or what is behind the new account network.

Bellingcat has let Twitter, Facebook, Instagram and YouTube know the exposed accounts. Twitter stated that it has "suspended" the highlighted accounts in accordance with its platform manipulation and spam policies. YouTube and Facebook, which own Instagram, did not respond to requests for comment before publishing.

The debate on the independence of West Papua has been around for a long time and has gone through fierce struggles.

West Papua is a mineral-rich former Dutch colony that became part of Indonesia after the controversial referendum in 1969. Many West Papuans still yearn for independence and claim that they often face racism and discrimination from the Indonesian authorities. 

However, Indonesia continues to firmly oppose the prospect of independence for West Papua.

Recent demonstrations have witnessed clashes between Indonesian troops and reportedly opened fire on pro-independence protesters. 

But controversy and fighting are also unfolding online, and it seems that someone is trying to manipulate the conversation.

As our research has discovered, using computer-generated images to modify fake user profiles seems to be the key method for this operation.

However, although this approach was interesting and difficult to spot immediately, it eventually helped to unravel this latest unreal network.

Nowadays, it's easy to create a fake profile image of a person who doesn't exist, just click a button through a website like thispersondoesnotexist.

Although such tools work well, they are not without flaws. 

The image may look perfect to the naked eye, but a closer look will reveal imperfections, such as unparalleled wrinkles or imperfect symmetry. 

These images are created by the so-called Generative Adversarial Network (GAN). This is a type of machine learning framework that creates new images from selected old real-world images.

Influencing operations are likely to use GAN, because doing so prevents researchers from using reverse image search tools to identify pictures that may be stolen from social profiles, as happened in previous unrealistic influencing operations.

Nevertheless, the researchers began to determine the method of analyzing GAN images. A key gift is the position of the eyes. They are always kept in the same place, enabling researchers to develop techniques to discover them.

Ben Nimmo of the social media analysis company Graphika "layered" a series of GAN images in a recent unreal network. As shown in the figure below, the eyes are located in exactly the same position, which would not happen in real photos.

The latest network related to the independence issue of West Papua was first discovered on Twitter through the monitoring hashtags #WestPapua and #PapuanLivesMatter. 

After the protests in West Papua were inspired by the Black American Life Issues Movement earlier this year, the second label was widely used. 

It didn’t take long to notice that some accounts with few followers were sending spam to these labels, with content linking to the same several websites. 

A closer examination revealed that many spam Twitter accounts were created in June, July, and August 2020. The obvious sign that affects the operation is usually multiple accounts, but there are few followers, created at about the same time, and only focusing on one issue. 

The screenshot below is one of the accounts created during this period.

One of the websites that the account in question seems to link to frequently is papuanlivesmatter.com. 

The shared articles generally support the idea of ​​special autonomy rather than independence for West Papua, support Indonesia's good influence on West Papua, and criticize any activists who oppose special autonomy. 

This survey collected accounts that used popular hashtags and linked to papuanlivesmatter.com in the past two months. Of these accounts, 21 were marked for testing to see if they used GAN-generated images. This is just an example of suspicious accounts posting articles from papuanlivesmatter.com, there are more profile pictures showing unused faces or pictures that appear to be stolen from Instagram. 

Below is an example of these 21 accounts to show their details

These are the faces in the tiled view.

By looking at keeping the same eye position in each image, we can see that these seem to be created by a machine learning platform. 

Further study these images, there are other signs of synthetically generated faces. 

The arrows in the image above highlight differences and imperfections, including eyebrows that don’t look matching and hats that don’t match around the logo and sun visor, and there appears to be a lot of extra material on the left side. 

This picture was used as an introduction to an apparently German-speaking account that posted about special autonomy and countermeasures against groups seeking independence, as shown below.

Efforts have been made to include a short personal profile in some English accounts on the Internet, such as the following account purporting to be an "Australian reporter" [sic].

Other accounts communicate in Dutch, and some of these accounts have successfully gained a considerable number of followers. Some of these followers appear to be real human Twitter users. 

The network tends to raise false news about anything that may have a positive impact on the pro-independence movement, or to cast doubt on many of the arguments used by pro-Western Papua activists and those who pursue independence. 

An example of this can be seen in the following tweet, which describes and links to the papuanlivesmatter.com website and an article about pro-independent parties that allegedly produced “hoax” news or fake news. 

The influence action seems to have also extended to Facebook, using a similar strategy to Twitter.

One of the specific terms we can use to find accounts that post the same content is "Papua's special autonomy." Through the "friends" listed on these accounts, accounts that may be untrue can be further identified. Repeated searches for Twitter content cross-posted to Facebook also found more accounts.

Here are some results of this search.

This survey did not extensively search all accounts on Facebook that may have appeared as part of this operation, but it did identify at least 8 samples, which will provide a way to identify whether they are part of the same network and appear on Twitter . 

The effectiveness of these eight accounts is evaluated based on friends, activities and profile pictures. Most people have no friends, and three people have up to 10 friends on Facebook—some of them are interconnected, or more accounts show characteristics similar to the rest of the network.

As shown in the figure below, the profile pictures of these 8 accounts seem to be created manually using the GAN method.

As mentioned earlier, suspicious GAN images should always be evaluated to obtain additional details beyond the eye position. 

For example, in the image below, taken from one of the Facebook profiles, we can see multiple points where the image was not properly "blended". Images including glasses can often be the weakness of images created by GAN. 

In the identified box, we can see that there are extra lines, lack of symmetry, and unnatural curves, which will not appear in the natural image. 

In the next picture, we can see that one ear has earrings and the other does not. The left ear is also turned slightly out. There are other inconsistencies.

As for the content posted by these Facebook accounts, it seems that there is no detailed information about normal human posting activities, hobbies or interests. These accounts appear to be used only for posting content that criticizes the independence of West Papua.

However, there are signs that certain identified Facebook accounts may have previous owners. Some have a large number of human user followers, and some have original cover photos (these photos have been boxed for privacy purposes). This may indicate that these accounts have been hacked or hijacked.

Infographics seem to be the standard way to amplify online information on Facebook. All the accounts we found appeared to have posted posts with graphics detailing anti-independence sentiment at one stage or another. Sometimes, they also link to common URLs. For an example of an account’s image posting history, see below. 

One of the new features noted in the network is the use of Dutch and German posts to amplify content as well as English. The networks we discovered in 2019 mainly use English as a means of communication. 

The new Facebook network is also trying to tag Dutch towns, possibly hoping to piggyback on interest in content related to these locations. For example, many Dutch towns are marked in the following post about special autonomy.

This strategy is used repeatedly throughout the Facebook network. Below is another example using the same labels for Dutch cities and towns. 

The above post was posted by some Facebook pages claiming to be news sources. These accounts usually also publish the same infographics published by many other accounts on the network, as well as topics related to West Papua's independence and special autonomy issues. 

A screenshot of the latest post showing these infographics is shown below.

Accounts in the same style as those seen on Twitter and Facebook have reappeared on Instagram. These accounts cross-posted the same infographics previously seen on the network, as well as profile pictures created using GAN.

The image below shows the posting activity of seven accounts using GAN profile pictures on Instagram. It seems that all accounts have published infographics with anti-independence sentiment. 

Through the developer tools in Google Chrome, you can access the full-size Instagram profile picture for closer inspection. 

Below is a tiled gallery of selected profile pictures compiled from Instagram. Once again, the eyes seem to be a gift of their authenticity. 

Likewise, the same process is applied to recognize man-made images. 

To be clear, our research also found that other suspicious Instagram profiles have published infographics detailing anti-independence sentiments. These infographics appear to show celebrities, anime characters, or photos taken from elsewhere in the profile picture slot. These accounts are also very likely to be fake.

There is also evidence that YouTube may be used to amplify web content. 

The papuanlivesmatter website links to various social media handles of related accounts. One of them is the YouTube channel of the site. 

The content contained in this channel is similar in nature to the content on other social platforms, detailing why West Papua is better as part of Indonesia and the false information claimed by West Papua separatists. 

Ironically, these videos specifically pointed to specific human rights activists such as Veronika Koman, claiming that they "provoke and spread pranks for their own personal and group interests."

Two other YouTube accounts (below) were identified as uploading similar content. They used Western names in their personal data, and uploaded content mainly about West Papua under Indonesian rule, the benefits of West Papua's special autonomy, and a short video attempting to discredit independence seekers again.

Many video reports have similar graphic design features, styles, subtitles, and backgrounds to videos seen in past influence operations focused on West Papua.

Below is a series of screenshots detailing the videos that Bellingcat confirmed last year.

We can see similar styles in the recent videos below, many of which have the "Better Papua Community" brand logo,

Some of these videos also appear on the papuanlivesmatter website, which is regularly linked by the aforementioned untrue Twitter and Facebook accounts.

Some recent YouTube videos have also been given titles in Dutch, which is clearly similar to previous posts on Twitter and Facebook. 

Like the Facebook, Twitter, and Instagram accounts we recorded, these videos did not seem to have any impact. Some generated less than 10 page views. However, they do show that a lot of time has been spent supporting the content that the network aims to amplify. 

As seen in the above platforms, especially Twitter and Facebook, the network specifically links to a site papuanlivesmatter.com

According to the registration details of the website, the domain name was created on June 22, 2020. 

Although the domain registration details are private, the data registrant protection details are listed in Yogyakarta, Indonesia. Although this is not conclusive, it may indicate the origin and location of the network. 

The website itself does not seem to have contact information. The "Contact Information" tab links to the website instead of an email address or form, which allows network users to get in touch with the website operator.

From all the above evidence, it seems clear that in recent months, a new information campaign targeting West Papua independence aimed at supporting Indonesia’s narrative has been operating on major social networks.

Although the network’s impact so far has been minimal, the use of unreal user profile images distinguishes it from previous operations, the use of Dutch and German, and the act of marking Dutch towns in Facebook posts.

It remains to be seen whether social media companies can further investigate using back-end data to identify and attribute responsible persons or organizations.

Your donation to Bellingcat is a direct contribution to our research. With your support, we will continue to publish groundbreaking investigations and expose illegal activities around the world.

In addition to the content we have published, we will also introduce readers to the activities our employees and contributors participate in, such as noteworthy interviews and training seminars.