Via the Atlantic Council’s Digital Forensic Research Lab (@DFRLab)
Ahead of Germany’s parliamentary election on Sunday, online supporters of the far-right Alternative für Deutschland (AfD) party began warning their voter base of possible election fraud and calling for observers. On Saturday, the eve of the election, their efforts increased, driven by anonymous troll accounts and boosted by a Russian-language botnet.
@DFRLab investigated some of the claims made and the bots which amplified them.
The probable fake
On the morning of September 22, an apparently left-wing @Twitter user named @von_Sahringen claimed to have been made an election helper, and that as a result, “AfD ballots will be made invalid” – a clear indication of fraud.
The post triggered a swift response from a number of users, including Germany’s official election bureau, which pointed out that election fraud is a punishable offense.
Wahlfälschung ist strafbar. Der Wahlvorstand hat seine Aufgaben unparteiisch auszuführen.
— Die Bundeswahlleiterin (@Wahlleitung_de) September 23, 2017
Four hours later, the same user tweeted that they had been visited by the police and their status as an election helper revoked.
By then, the post had triggered a Twitter storm from AfD supporters, using the hashtag #Wahlbetrug (“election fraud”).
The above tweet from user @Hartes_Geld, for example, was shared over 300 times.
However, a quick reverse image search of the @von_Sahringen account suggests that it is a fake account, rather than a genuine user. Its profile picture is a Pakistani actress named Aiza Khan.
Its activity profile is unusual. It was created in February, but, according to a machine scan of its posts, only began posting high quantities in August, in the build-up to the election.
The activity indicates a high likelihood this is a fake account pushing a message to provoke a reaction from the far right, and, potentially, to call the legitimacy of the election into question.
A definite botnet
The #WahlBetrug hashtag was used by AfD supporters throughout the last week of campaigning, but it showed a sudden spike on Saturday afternoon, the eve of the vote. @DFRLab conducted a machine scan of traffic on the tag.
The scan shows that the traffic was not organic, but boosted by a network of automated “bot” accounts which operates largely in Russian, and which @DFRLab previously identified in an our #ElectionWatch coverage.
On Saturday, one #Wahlbetrug tweet from an account called @RenateBiller was especially boosted by this network. Posted at noon, it had achieved over 500 retweets by the evening.
This is a spectacular result, since @RenateBiller was created on September 9 and only had 16 followers by September 23.
The tweet was amplified by a large number of Russian-language accounts, many of them faceless, a key indicator for bots.
The accounts which amplified @RenateBiller’s tweet had a number of other indications of being a network of bots. Many were faceless; they posted a range of commercial and pornographic content in Russian and English, as well as pro-AfD posts and attacks on Russian anti-corruption campaigner Alexey Navalny.
Diagnostically, some of the tweets this botnet shared were also shared by a botnet identifed in one of our earlier posts on German elections, such as this ad for Finnish heated floors and complaint about a Moscow surgical clinic.
This is, in fact, the same Russian-language botnet which amplified calls for AfD election observers on Friday. Its continued amplification of the far-right messaging suggests either that the bot manager is an AfD supporter, or that AfD supporters have paid for a Russian botnet to amplify their messaging.
Warning of fraud
More generally, AfD supporters took to social media on Saturday to predict election fraud.
This was not limited to bots and troll accounts: official AfD accounts attached to the party’s regional chapters shared content raising the same possibility.
AfD chapter in the Saalekreis, for example, shared a post from anti-migrant magazine Compact calling supporters to gather on Sunday at 2pm local time to watch the counting of postal votes.
The same chapter shared a post from anti-migrant activist Jürgen Elsässer, whose blog is featured on the Compact magazine website, together with an appeal headlined, “FINAL PHASE – MOBILIZE, ACTIVATE!”.
Elsässer’s post read:
This is the last possible hope for our future, for our children, for our Fatherland. Drag all non-voters and undecideds along, set up car pools and a pick-up/ drop-off service for old people, the sick, mobility-reduced and fragile people! Show what the people is capable of, something that the money-mad gluttons in the elite would never manage! Take your right to election monitoring seriously, to prove and prevent the greatest election fraud!
The AfD chapter in Osnabrück, meanwhile, shared a call for its members to:
…monitor the counting as an election observer, and then go to the election party. We don’t want our votes to disappear all of a sudden.
Comments from the fringe on the eve of the German election took various forms, including official posts, posts from probable fake accounts, and bot amplification. While no evidence of fraud was presented in the posts, the narrative they all spread is the same: the AfD is in danger of election fraud, and its members should be on the alert to prevent it.
This behavior seems pitched to increase tensions, not least in the polling stations and counting areas. Had the AfD failed to perform well at the urns, it [would] likely [have] led to online accusations of election fraud, potentially undermining the legitimacy of the vote.
