February 21, 2018

Automating Hate: Documenting the anatomy of an automated propaganda machine.

The biggest weapon today’s hatemongers have is the internet. There they can be whatever they want to be pretend they have numbers behind them and that their positions matter. Erin Gallagher makes all of this IRL.

How does hate spread online? Sensationalized, fear-bait content tends to spread quickly on social media. The ability to automate almost everything helps to push propaganda distribution to new levels. I documented an automated propaganda network so we as media consumers can begin to understand how these systems work and be able to recognize fakery.

After documenting the spread of joy on twitter, I was curious to look at the opposite end of the spectrum; I wanted to study how hate spreads online. I started by looking at gephi network graphs of tweets containing the phrase “religion of peace.” One twitter account appeared in my data as the top influencer for this phrase so I took a closer look and found it’s much more than just a twitter account. AgendaOfEvil is a propaganda distribution network that is creating, curating and disseminating content using automation. Its focus is anti-Islam propaganda.

The following network graph shows 24 hours worth of tweets & retweets from AgendaOfEvil’s twitter account which are being amplified by an automated retweet network. The edges are weighted; when an account retweets AgendaOfEvil many times it produces a heavier edge between the main account and the account retweeting it.

gephi network graphi: @3r1nG

The AgendaOfEvil twitter account and retweet network are just components of a larger broadcasting system that both produces and aggregates content and also amplifies that content on a large scale using automation; a technique known as “megaphoning.”

AgendaOfEvil Infographic by @3r1nG

The main URL, agendaofevil [dot] com, is a bot that creates and curates content then pushes it out to other bots across many social media platforms. It’s also boosted by alt-right swarms on social media — as is the case with most social media automation, distribution is boosted by a combination of both bots and real people.

The AgendaOfEvil website acts as a content farm and distribution hub. It’s currently aggregating 214 “resources” ranging from US alt-right to PEGIDA/German far-right and also violent jihadi propaganda.

It’s connected to at least 9 social media platforms and accepting donations via Paypal. Until this past week it was also listed in the top 750 experts on political Islam on Agilience but has recently been removed. Google search results still show it as a “Top Authority on American politics”:

Screenshot May 13, 2017 @3r1nG

I consulted with a specialist who builds bots and had them inspect AgendaOfEvil. They prefer to remain anonymous but gave me permission to publish some of their analysis based on what they observed:

AgendaOfEvil was launched 1 year ago. It’s a huge aggregator archiving hundreds of sources — it’s able to aggregate twitter accounts, facebook pages, pinterest pages — all which are being fed directly to its website. It acts as a content pool for people to amplify but is also monitoring tons of content from European far-right to jihadist portals. It’s creating a huge concentration of content from blogs, YouTube channels, spreakers, etc then pushes it out from the website to various social media platforms.

It’s a well organized system and seems like a custom code. Its creator hides behind CDNs (Content Delivery Networks) and the backend has applications that can read and write directly into each social media platform’s API. It’s not pushing everything it collects otherwise it would produce a much larger volume.

The website has an option to create a campaign which appears can be used to make a campaign and select content to push and then other people can amplify the campaign. The campaign functions appears not to be working.

The following is a breakdown of how AgendaOfEvil works, starting with automated content creation, curation and finally distribution mechanisms on social media. It is basically one big bot that’s curating propaganda and pushing it out to other bots for distribution.

Automated Content Creation

AgendaOfEvil is using YouTube and Pinterest as repositories for content which it then embeds into unique links on the main website. It’s YouTube channel currently has 142 playlists containing 17,705 videos which are all embedded individually into AgendaOfEvil URLs under the Videos section of its website.

AgendaOfEvil Images page vs YouTube — screenshot May 13, 2017 — @3r1nG

Its Pinterest account has 44 boards containing 992 pins which are also each embedded into unique URLs under the Images section of the website.

AgendaOfEvil Images page vs Pinterest — screenshot May 13, 2017 — @3r1nG

The process of collecting content on YouTube and Pinterest then embedding it into a new URL can be fully automated. This type of Black Hat SEO link-building boosts google ranking and provides the bot with an endless supply of media to push out.

Automated Content Curation

The bot is also curating content which contributes to its aggressive link-building efforts. It’s currently “promoting” 214 resources. Each resource has it’s own page and each page contains links to that resource’s various social media feeds.

Screenshot AgendaOfEvil homepage — May 13, 2017 — @3r1nG

Each resource page features buttons to view live social media feeds for the resource and links to each platform — these links also contribute to its link-building scheme and boost SEO.

AgendaOfEvil Resouce page vs Twitter — screenshot May 13, 2017 — @3r1nG

The top right corner of the main website features a Log In button. Twitter users can log into AgendaOfEvil using OAuth which authorizes the website to access their account and broadcast AgendaOfEvil content to their own Twitter feeds.

Automated Distribution

Creating and curating content is only part of AgendaOfEvil’s purpose, it also distributes its propaganda across multiple social media platforms including Twitter, Facebook, Gab, Google Plus among others — the majority of which offer an API interface that allows a developer to connect 3rd party applications that automate content publishing. There are many 3rd party applications that can be used to schedule posts and facilitate social media automation. Hootsuite is one of the more well known, but it’s also possible to create your own application which is what AgendaOfEvil appears to have done.


AgendaOfEvil’s twitter account is the most powerful distribution platform in its network, broadcasting to over 33K twitter followers directly not including its automated retweet network. It averages an astounding 900+ tweets per day, and pushes out 15–20 tweets at a time.

Many of the accounts that retweet AgendaOfEvil multiple times per day show obvious signs of automation. According to Social Bearing, @BurkasOff was created on April 3, 2017 and averages 100 tweets per day. @mobileal2017 joined in February 21, 2017 and has already amassed an impressive 13,271 tweets, averaging 165 tweets per day. @MakariosM1 joined April 18, 2017, according to their bio it’s their “third attempt to get an account” because of alleged censorship however it’s more likely they keep getting suspended because they’re tweeting a whopping 312 tweets per day. These repeat retweeters show as heavy edges in gephi network maps.

Gephi network map: @3r1nG

From the Twitter API, some (but not all) of AgendaOfEvil’s tweets show the website as the source of the tweets.

Screenshot: @3r1nG

Data analysis via Social Bearing shows 79.2% of tweets originated directly from the website and AgendaOfEvil.com was the top domain it shared.

Charts taken May 8, 2017 via Social Bearing

I downloaded a list of some 1700 accounts that had retweeted AgendaOfEvil and scanned it for signs of automation using the python API for Truthy BotOrNot. The results came back positive for the presence of bots

Results via Bot or Not API — May 1, 2017 — @3r1nG

Just a few days worth of tweets have a huge reach. Data I collected using Tweet Archivist shows 13,082 tweets and retweets made over 31 million impressions over just 3 days.

Screenshot via Tweet Archivist — @3r1nG

AgendaOfEvil on twitter has an impressive reach considering all it does is recycle and repeat other people’s propaganda.

Screenshot: @3r1nG

And finally, the phrase that brought this network to my attention, AgendaOfEvil is the top user for the phrase “religion of peace” — a common phrase used ironically and repeated ad nauseam by islamophobes to denounce Islam as an inherently violent religion.

Chart via Tweet Archivist

Here is an inventory I took of AgendaOfEvil’s social media army as of May 12, 2017:

  • Twitter: 33.6K followers & retweet network
  • Gab: 4591 follows & 18,248 posts
  • YouTube: 142 playlists containing 17,705 videos
  • Pinterest: 44 boards containing 992 pins & 39 followers
  • Medium: 960 followers but no posts as of time of publishing
  • Facebook: 87 fans (very small page) but actively posting
  • Google Plus: 18 followers (not active)
  • Minds: 34 followers (not active)
  • Votable: 4 followers (not active)
  • Instagram: 1 follower (not active) following Breitbart
  • Paypal: accepting donations
Screenshot from Votable May 1, 2017 — @3r1nG

It seems likely that the AgendaOfEvil is still building its automated social media army. As of May 1, the Votable account had been created only 3 months previous and it inquired as to access to an API which is not yet available on the platform.

All other platforms besides Votable offer API access to developers.

Unfortunately, despite all of this information I was able to gather about this propaganda network, it is impossible to determine the location of AgendaOfEvil’s operator(s). The bot builder I consulted for this blog seemed to think they might be German but there’s no way to determine the origin for sure. Twitter might know their location but that’s only if the operator(s) have not anonymized their IP address, which they likely did.

Online tools such as Trendsmap and Social Bearing offer heat maps that show approximate locations of tweets but those are not accurate tools. Heat maps pull location data based on the location a user enters in their Twitter bio which can be almost anything. Users can put that they’re in Alaska for example and their tweets will look like they’re coming from Alaska even though they are physically in another place. Many users also put non-existent places in their bios, like Narnia or “The Internet,” which will resolve incorrectly on a heat map and produce erroneous data.

All of these techniques used by AgendaOfEvil are tools that come from the marketing and advertising industry and they have legitimate, real-world applications. Most businesses automate their social media across multiple platforms and use content hubs and 3rd party applications to schedule posts.

The most important take away from AgendaOfEvil is that some content found on the internet is not coming from genuine news sources and the dissemination of that content can be easily faked on a massive scale. As media consumers we need to become more educated about how these systems work so we can recognize fakery and not add to its diffusion.

Right wing media spreads sensationalized content that regularly demonizes Muslims and this kind of automated distribution of anti-Islam propaganda amplifies the climate of fear that targets Muslims around the world.


Be the first to comment

Leave a Reply

Your email address will not be published.