Mexican Cyber-Mercenaries

 Translated from Proceso by Erin Gallagher ...follow Erin on Medium

After reporting threats against him, Mexican journalist Alberto Escorcia is more threatened than ever.

The following is a translation of a July 22, 2017 report by Mathieu Tourliere in Proceso magazine...

Mexico City (Proceso): When Alberto Escorcia Gordiano decided to dedicate himself to social network analysis about three years ago, he thought that he entered in a “calmer” world that he could “control.”

However, he started receiving death threats that forced him to leave the country twice. He even had to change his address after two individuals forced the door of his apartment open the night June 9. The police told him that they were “probably thieves,” reports Escorcia in an interview with Proceso.

- What part of your work could set off these attacks? he’s asked.

- I don’t really publish very severe things, but I do show that the cyber attacks and threats are coordinated operations; They’re not just two or three accounts spreading a rumor. My graphs and articles show that they are the product of two or three thousand organized accounts that have a purpose and an impact.

On his website LoQueSigue he revealed that an army of 75,000 bots — fake accounts on social media controlled by computer programs impeded the protests for the disappearance of the 43 normalistas from Ayotzinapa. Escorcia also documented the attacks launched from these accounts against journalists and showed that they reactivated in Alfredo del Mazo’s campaign for governor of Mexico State.

He also documented links between trolls accounts, famous for threatening and harassing journalists, including Carmen Aristegui, Álvaro Delgado, Proceso reporter; Héctor de Mauleón, Denise Dresser, and American journalist Andrea Noel. These accounts “woke up” on the eve of the last state elections and made a dirty war against Delfina Gómez and Josefina Vázquez Mota.

“Something that would seem like a rumor, I make it visible. It’s like with the government spying: for a long time it was denounced by activists, until they had evidence and they could demonstrate it,” he adds.

Escorcia explains that coordinating tens of thousands of bots involves the hiring of dozens of operators — who program the accounts and relaunch discussion topics — at a high level of sophistication. In other words, these methods can’t be done by just anyone.

“All the political parties use them, the PRI especially; The PAN with (Rafael) Moreno Valle, and I’ve even detected that Ricardo Monreal (from Morena) used them,” he says.

Hidden Attackers

Botnets remained “dormant” for months, but reactivated as the Mexican state elections approached: they boosted the messages of Alfredo del Mazo from the PRI and participated in defamation campaigns.

In news portal sinembargo.mx, Escorcia documented that eight out of ten massive bot attacks were carried out against Delfina Gómez. “On election day and the day previous, there were 17 trending topics against Delfina,” he says.

During the campaign, these networks amplified the dissemination of both true and fake news. They were particularly active on April 11, when a helicopter threw leaflets over Texcoco municipality — a Morena bastion in the state — signed by a non-existent group of narco-traffickers. The bots spread that news, and a few days later boosted another piece of fake news that linked that group with the former mayor Higinio Martínez Miranda.

They also activated this past June 3 — the day before the election — when a group of unknown persons left bloody pig heads and crosses at the doors of Morena’s headquarters in the municipality of Tlalnepantla.

Desconocidos lanzan cabezas de cerdo ensangrentadas y cruces en sede de Morena en Tlalne https://t.co/ctdIEsQyhl pic.twitter.com/BmM1qE2kOa

— Sin Embargo MX (@SinEmbargoMX) June 5, 2017

“The Mexican government responds to people organizing on social media with spying, repression and internet censorship. One day a researcher is going to realize there’s a relationship between the dirty war and the bots. Everything that happened with Alfredo Del Mazo, which was brutal, certainly influenced some people,” he estimates.

The activist explains that in Mexico there are four main groups of trolls: The Underground — the most violent group who send death threats with the victim’s name spelled out with bullets, the Legión Holk and the Legión Científica made up of large numbers of teenagers, and the Ingenieros, the oldest that changed course since “they practically don’t send threats but make Trending Topics for companies.”

Mexico’s misinformation wars : How organized troll networks attack and harass journalists and activists in Mexico

“They’re like cyber-mercenaries. Of the testimonies I’ve collected, they operate from troll centers that work for various parties and companies. I doubt they plan the attacks. According to my research, the agencies that hire them are the ones who design the campaigns. It may be the Ministry of the Interior or the state governments,” he adds.

The threats online follow the same pattern: a small account launches the message, and then larger accounts boost it, details the activist, and although there is no evidence that the same person or entity is behind the bots, trolls and fake news portals, he notes that those three elements are usually triggered at times that coincide.

“Mental Hell”

Proceso interviewed Escorcia for the first time in October 2014. At that time, he had enthusiastically developed an interactive map of cases of disappearances in Mexico. He described it as a “Wikileaks of the disappeared.”

His features now are more drawn. The last 2.5 years have been a “mental hell” for him.

“I’m very tired now. I hardly published anything on my website. I don’t have the energy I used to, I don’t go to protests anymore. I think it’s drained me. And when I realize the objective was to sow fear, it gives me more courage. Because I am very afraid.”

On December 5 2014, in the middle of the protests for the disappearance of the Ayotzinapa students, Escorcia gave an interview to journalist Carmen Aristegui. Almost 400 threats flooded in from Twitter and his website was attacked.

“You have to understand how it is: your phone doesn’t stop ringing, they curse you, send you pictures of dismembered bodies,” he says.

After that interview, death threats became part of his daily life. And when one of the trolls doxxed him and published his address and phone number online — after he documented the troll networks behind calls to loot shops during the gasolinazo protests, the virtual violence became reality.

En lugar de detener a mis agresores el Gobierno de la Ciudad pide datos sobre si estoy trabajando o no como periodista, a ese paso...

— Alberto Escorcia (@AlbertoEscorcia) July 27, 2017

[Instead of arresting my attackers, the city government asks whether or not I am working as a journalist]

He suffered assaults and harassment: individuals entered his building asking about him, between January and February they rang his doorbell every night, one day they forced open his neighbor’s door and on at least three occasions men with handheld radios followed him on his way to the subway.

Mexico’s Troll Bots Are Threatening the Lives of Activists

Until recently few people took the attacks on social media seriously. That incomprehension then cast doubt on Escorcia: They wondered, in the midst of murders of journalists and activists, if his case was legitimate or even real.

“More serious things happen. I can’t compare myself with Javier (Valdez, the journalist assassinated on May 15 in Culiacán). Someone knocked on my door and another killed him. Obviously my case is a lesser priority and I understand. But the torment stays with you, and it’s been three years.”

While this was happening, the PGJDF’s investigation (the attorney general of Mexico City) remained stagnant. Last May 12, when he went to the agency’s offices for a routine appearance, he noticed the officials had misplaced key evidence that identified people behind the accounts sending threats, including Daniel Carlos Penagos García, hiding behind the alias Perrito.

He deduced that the authorities had stopped investigating his case, which passed to the  Special Prosecutors’s Office for Crimes Against Freedom of Expression (FEADLE — Fiscalía Especial para la Atención de Delitos Cometidos contra la Libertad de Expresión).

“So if they fail to investigate them and then activate them to attack their political opponents, they are already part of the system. Maybe I have false hope that they will be stopped.” he laments

Below:  Thousands of bots performed in the Edomexcampaign. Delfina the main target of attacks

Click on image to enlarge

This report was published in edition 2124 of Proceso magazine dated July 16, 2017