The government’s personal firefighters: how fake accounts took over the Kyrgyz Internet

December 31, 2020

Pro-Japarov accounts, pro-Matraimov accounts, pro-Jeenbekov accounts — the Kyrgyzstani Internet has transformed into a place where “troll factories” are operating constantly. Kloop’s journalists analyzed approximately 800 fake accounts to find out how these so-called “fake farms» work, who they protect, and how much they cost.

Contents:

How fake accounts and anonymous users protected Sadyr Japarov from the Mekenim Kyrgyzstan (My Homeland Kyrgyzstan) political party

How fake accounts operated on the eve of the 2020 elections

Fake accounts supporting the Matraimovs

Fake accounts supporting two different presidents:

• Pro-Jeenbekov accounts
• Pro-Atambayev accounts

How much does a fake department cost and why is it necessary?

The protests that swept Bishkek on the night of October 6 led to a regime change in the country. These protests broke out amid dissatisfaction with the results of the parliamentary elections, which were won by three pro-government parties: Mekenim Kyrgyzstan (My Homeland Kyrgyzstan), Birimdik (Unity), and Kyrgyzstan.

This unrest led to Sooronbay Jeenbekov’s departure from office, and control of the country ended up in the hands of Sadyr Japarov, who had been released from prison after the seizure of the White House.

For several days after the protests, one of Kloop’s correspondents observed how people close to the Mekenim Kyrgyzstan party began to hide publications that referenced their party connections. Fake accounts began writing posts in support of Sadyr Japarov, who was imprisoned during the election. It is worth noting that his face was used by the Mekenchil (Patriotic) party in their propaganda campaign during the parliamentary elections.

It became clear from studying several fake profiles supporting Japarov that these same accounts had supported the Mekenim Kyrgyzstan party just one day before the protests.

For example, a fake profile using the name “Aya Ryzykova” frequently commented on the posts of one journalist and candidate in the parliamentary elections from the Mekenim Kyrgyzstan party. However, after the events of October 6, this account switched to supporting Sadyr Japarov, who had just come to power. Now, the “Aya Ryzykova” profile no longer exists.

Just like Ryzykova, “Joomart Amatov” initially posted about the Mekenim Kyrgyzstan party, but switched to supporting Sadyr Japarov after October 6.

Our colleagues from Kaktus Media have written more on this.

Journalists also noticed that after the annulment of the parliamentary election results, once-hidden fake accounts became active. They began writing comments in favor of presidential candidate Sadyr Japarov. Threats were sent to the inbox of Kloop’s page or left in the comments sections of Instagram posts.

Japarov is not the first Kyrgyzstani politician to have been supported online by accounts that appear to be fake. Kloop’s journalists analyzed approximately 800 Facebook and Instagram accounts and spoke with a dozen independent sources to identify the main troll farms that are either currently operating on the Kyrgyz Internet or have done so in the past.

*We studied comments that seemed suspicious to us and then checked the content on their accounts. We discovered when the accounts were created, whether they existed on other social media platforms, what kind of content they posted, if they posted any at all, what tactics they used when posting information, and whose photos they used. We found out that many of the fake accounts are friends with each other, they sometimes post photos from the same sites, and they make the same posts at the same time. We isolated a group of 5-10 fake accounts that seem to be managed by one admin based on their similar behavior.

Journalists began studying fake accounts after the publication of the first investigation into a customs corruption scandal where the main person of interest was Raimbek Matraimov the ex-deputy chair of the State Customs Service of Kyrgyzstan.

People writing from fake accounts tried to discredit content against the former customs officer and exonerate him.

From talking to sources and conducting research on social networks, the team of journalists discovered at least five fake farms in Kyrgyzstan.

How fake accounts operated on the eve of the 2020 elections

The culture of fake comments originated in the commerce sector even before the rise of social networks. One of the journalists who worked on this piece, for example, was paid to leave comments on various companies’ websites in 2010 when he was still in high school. Companies most often used this method to sell dietary supplements. Another example is the popular forum Diesel, where identical posts could be found supporting a particular party during the elections.

“In 2012, there was Diesel. We hired [people to post] in the “Politics and Society” section of the forum to attract and galvanize like-minded people,” said a media specialist who works with parties during elections. The Kyrgyz political commentator Azim Azimov also openly reported on the role of bots on Diesel. Screenshots from his personal Twitter profile are displayed below.

By 2015, during the next parliamentary elections, the significance of social networks had already increased: they accounted for around 10% of all electoral work then. But this was a small amount: there were about 8 people on each social media platform according to a political strategist that has been working with elections for a long time.

However, during the 2016 parliamentary elections, using social networks accounted for about 30% of voter outreach on the Internet. Then everything completely changed — social media practically became political parties’ main PR focus, according to one of Kloop’s correspondents. At the end of 2016, when social media was believed to play a decisive role in Donald Trump’s victory in the U.S. presidential election, it changed the way Kyrgyz “fake” factories viewed Facebook and Instagram.

Social networks became more accessible to the seedier sides of life than mainstream media.

This was also seen in the 2020 elections. Fake accounts that sent messages in support of the three pro-government parties, Birimdik, Mekenim Kyrgyzstan, Kyrgyzstan, were especially prominent in the days leading up to the election. Kloop’s journalists put together a database of fake accounts from the pre-election period consisting of 425 profiles.

The database included accounts that posted exactly the same comments and used either mirrored photographs or photographs of real people.

The mutual likes and follows between bots and fake accounts formed a web of connections — interestingly, some fake accounts that stole other peoples’ photos also used names similar to the originals. For example, a fake account called “Lilia Zaitova” used a picture of a girl named Lilith from a makeup site. “Andrey Andrey” used a photo of the Russian sociologist Andrey Kuznetsova.

The database includes fake accounts that supported the Mekenim Kyrgyzstan, Birimdik, Kyrgyzstan, and Republika parties. If the account could have belonged to a real person and we were not 100% sure that it was fake, we marked it as “doubtful” in the database.

After review, the database of fake accounts from the pre-election period was submitted to Facebook’s administration for consideration. Nearly 400 of the 425 accounts listed in the database were ultimately deleted.

Fake accounts that posted in support of the Mekenim Kyrgyzstan party (which is associated with the influential Matraimov clan) mostly conducted positive discussions. They left words of support or shared their campaign platforms on candidates’ posts.

Here are some examples: Comments on the post of Elnura Alkanova, a candidate from the Mekenim Kyrgyzstan party, about how the mayor’s office in Bishkek hindered the party’s campaign.

These accounts were deleted from the platform after the database of fake accounts was sent to Facebook.

Like Mekenim Kyrgyzstan’s bots, the bots posting in support of Birimdik employed a similar tactic of promoting accounts. The difference was the way avatar photos were selected: among them were photos of Mongolian models, beautiful Yakut women, and various stock photos.

[Photo 1]: The fake account Denis Zhivaykin used a photo of the British actor Cillian Murphy.

[Photo 2]: Both fake accounts were deleted after Kloop sent the database of fakes to Facebook.

[Photo 3]: The fake account Anastasia Demyanova used a photo of Anatasia Popova from Tomsk. This account was deleted after the database of fakes was sent to Facebook.

[Photo 4]: Both fake accounts were deleted after Kloop sent the database of fakes to Facebook.

[Photo 5]: Both accounts were removed from the platform after the database of fakes was sent to Facebook.

Here, for example, the fake account Azamat Kayipov used a stock photo from this site. This is a specialized platform where images are published, and they can be used in illustrations or advertising.

The account was deleted after the database was sent to Facebook.

The fact that the major political parties really did campaign using methods like fake accounts to canvass votes was confirmed by two of Kloop’s sources: a media specialist who works in elections and an individual who worked for the government.

“I know that both the Social Democratic Party of Kyrgyzstan and Babanov, a former prime minister of Kyrgyzstan, had fake accounts manned by approximately 10-20 people. They said they had 100, but that’s not the case. I’ve been in their office, and there weren’t that many people,” said a media specialist who works on campaigns.

Comments on a post from the Republika party. The fake account Dayrakan Mukashova had pictures from the Kazakh artist Asel Sadyvakasova. The accounts of Akerke Koichumanova and Guljamal Sabyrova were blocked after the database of fake accounts was sent to Facebook. Sabyrova also used Asel Sadyvakasova’s photos.

During the pre-election period, we attempted to get a job with one of these fake farms. One of Kloop’s employees contacted a journalist who, according to our sources, recruited people for this kind of work. This man communicated through the secure messenger Signal, and he asked her to send him a link to her Facebook profile. He explained that he would need to review her profile. Clients reported that they did not like how empty and inactive her profile was, and, as a result, the man said that they wouldn’t be working with her.

Fake accounts are an important tool in elections where all methods, including insults and rude remarks, are used against opponents, according to a political strategist who has long studied elections in Kyrgyzstan.

“The goal of any party, good or bad, is to gain power. Otherwise, it’s not a party, and then why do we even need it? If you need to throw shit at your opponents, then that’s what you have to do. But that can also lead to the spread of misinformation and insults to an individual’s honor and dignity, which are actually criminal offenses. You can call someone a f*ggot, but that is in fact a crime. That’s why they’re anonymous,” he said.

However, as our investigation has shown, elections and street protests are not the only times when politicians and businessmen need fake accounts.

Fake accounts supporting the Matraimovs

At the end of 2019, journalists from a number of media outlets noticed a trend: outlets that published news about investigations into the customs corruption scandal were being attacked by fake accounts.

Among them, for example, was Lyudmila Bondareva, a fake account for a non-existent person. Another example was an account with the name Alina Seitova.

The Facebook pages of both of these users were registered in 2019: one appeared in October, the other in August. The similarity arises in how both users actively commented on news and posts dealing with the Matraimov clan and how they entered discussions with detractors of the family of the former customs officer, Raimbek Matraimov. They also managed their profiles in similar ways.

Both accounts posted the news that Alay district residents withdrew their claims to the Matraimov family because of the assault on the athlete Tologon Rahmanberdi. The post appeared simultaneously on Lyudmila’s and Alina’s pages amid news about complaints of the Matraimov family to the president.

After the release of these investigations, Kloop began collecting data on fake accounts that supported the Matraimov clan. In addition to Bondareva’s and Seitova’s aforementioned accounts, there ended up being around 400 accounts in the database. Kloop’s journalists were unable to ascertain the IP addresses of the fake accounts that commented on posts mentioning the Matraimovs. However, our colleagues from Kaktus, who have the ability to trace IP addresses from their site, found that a large number of comments are left from different devices, but often from a single IP address.

[Photo 1]: The fake account Timur Amanov was created in December 2019. He doesn’t make any posts; he just leaves comments. His only photo is a blurry, heavily filtered picture. This account has been removed from Facebook.

[Photo 2]: The fake account Aselya Sary was created July 13, 2019. The account used other people’s pictures including photos from Sardana Makarova, a resident of Yakutsk. This fake account has been removed from Facebook.

[Photo 3]: The fake account Gulbarchin Tabysheva used a photo from the Kazakh woman Radina Ashirova. Its Facebook page was created in August 2018. The account has been removed from Facebook.

[Photo 4]: The account Aziz used photos from the Kazakh man Talgat Yun. This account appeared in August 2019.

[Photo 5]: This was an active fake account that appeared in August 2018. It no longer exists.

[Photo 6]: The fake account Mirgul Sagynbek Kyzy used a picture of the model Laneya Grace as their avatar. The account only commented on other posts. It appeared in August 2019.

[Photo 7]: Both of these fake accounts have been removed since the database of fakes was sent to Facebook.

[Photo 8]: The first two of these fake accounts have been deleted, but the account Nazira Sharapova can still be found on Facebook.

We soon began to understand who could be behind this attack. The team of fake accounts was recruited primarily by “illiterate journalists and bloggers,” according to research done by one of Kyrgyzstan’s law enforcement agencies. A source who had access to this research told Kloop about the results of the study.

“Opening new accounts one after the other, they begin vilifying those who criticize the Matraimovs. They write false information about the Matraimovs that most people would disapprove of — that they’re gay, they commit fraud, they’re pro-Western agents, they raise issues that divide the north and the south, they’re Tengrists, or they’re pro-Nazarbayev,” he said.

Three sources — a person who worked for the government and two individuals who know the possible supervisors of the farms personally — told Kloop about local journalists Dayirbek Orunbekov and Guljan Sheripbayeva’s connections to fake farms that supported the Matraimovs.

[Photo 1]: Legislator Iskender Matraimov and journalist Dayirbek Orunbekov. Photo taken from Orunbekov’s social media.

[Photo 2]: Guljan Sheripbayeva. Photo taken from Sheripbayeva’s social media.

“Well, behind the Matraimov fake accounts was a man named Dayirbek Orunbekov. I’ve already forgotten most of the names. But they’re always pretentious [usernames] like Patriot Kyrgyz, well, I don’t know exactly, but they’re always ostentatious. Guljan Sheripbayeva also has her own group of four fake accounts, she once told me,” said one of Kloop’s sources who is personally acquainted with Orunbekov.

Orunbekov himself last came to the attention of journalists when he was appointed to the post of advisor to the Minister of Labor and Social Development, Ulugbek Kochkorov. Orunbekov actually worked in the interests of the Matraimov clan before he left for the campaign headquarters of the Birimdik party, according to a journalist friend of his.

“He was a public advisor to the Minister of Social Development. Then, he went on leave to keep his place, but he was actually working for Raim. About 20 journalists work for him,” said the source who knows Orunbekov personally.

According to the source, Orunbekov assures his customers that he has approximately 100 fake Facebook accounts that “shape public opinion.”

Our editorial board tried to contact Dayirbek Orunbekov, but at the time of this piece’s publication, he had not responded. Officially, he refused to answer, but unofficially, he denied his connection to the fake accounts. However, he confirmed that he worked for the Matraimov family during the pandemic, distributing humanitarian aid.

Guljan Sheripbayeva, who used to work in the same building as Dayirbek, now heads the online publication Nazarnews.kg. According to one of the site’s former employees, Guljan was supported by the Matraimov clan after the publication of investigative reports into the customs corruption scandal, but this support was temporary.

“Those who work there claimed that Raimbek Matraimov was one of their sponsors,” she said.

Our colleague tried to find a job with Guljan Sheripbayeva by messaging her on Whatsapp. In response, Sheripbayeva neither confirmed nor denied that you could worked for her on a fake farm.

Journalist: “My friends told me that I could make some money posting comments on social media and advised me to ask you about it. Do you have any vacancies like this for remote work?”

Guljan Sheripbayeva: Hello! We only offer in-person jobs, but there aren’t any vacancies. Try looking for a job elsewhere.

In an interview with Kloop, Sheripbayeva said that she was not working with fake accounts. However, she said that she was approached by people from the teams of three different candidates and offered five thousand and ten thousand dollars. She refused.

“I never wanted to vilify people with fake accounts. I don’t want to lose my humanity because of fakes. I don’t want to argue with or denigrate anyone, whether it’s a relative, friend, or foe. Raimbek Ismailovich has a saying. I have met so many people, but I was surprised by his humanity in particular. He’s always saying, ‘Leave it, we have God. Don’t ever denigrate anyone.’ I will never slander my friends or my enemies. I don’t want to smear their names with fake accounts,” she said.

[Photo]: Elnura Alkanova and legislator Iskender Matraimov. This photo is from Alkanova’s social media.

In addition to Orunbekov, the work of other fake accounts supporting the Matraimovs was supposedly supervised by Elnura Alkanova, a journalist and parliamentary candidate from the Mekenim Kyrgyzstan party, according to a Kyrgyz political activist.

He said that Orunbekov and Alkanova called him after protests against customs corruption. Then, fake accounts began disseminating videos about participants in the protests, calling them gay or accusing them of being pro-West. In response, one of the activists publicly condemned the actions of the fake accounts.

Kloop has obtained a recording of the activist’s conversation. In it, a man and a woman ask the activist to remove several posts from his social media profiles. To further confirm the source’s statements, Kloop sent the recording to the Forensic Laboratory of Audiovisual Documents in St. Petersburg for examination. They concluded that the voices in the recording resembled those of Alkanova and Orunbekov.

Identical information about Alkanov’s connection to the Matraimov fake farm was provided by two more sources — a former government official and another political activist. Additionally, in October 2020, the website OpenDemocracy published an article by journalist Ulugbek Babakulov, who claimed that it was Alkanova herself who allegedly supervised the work of the fake farm that was defending the Matraimovs on the Internet.

In an interview with Kloop, Elnura Alkanova said that she was in no way connected with fake accounts or their actions.

“I’ve never in my life been involved with bot-farms, not during my friendship with the Matraimovs and not during the election campaigns. Let everyone who slandered me have that on their conscience,” she said.

According to her, she doesn’t have the skills for that, and it was actually advertising companies who provided such services.

“There is a whole cloud of advertising agencies and PR companies that, together with programmers, provide similar services. I’m not a programmer, and I don’t have skills like ‘breeding’ bot-farms,” said Alkanova.

Fake farms are used in Kyrgyzstan not only to protect certain clans, but also the current government.

We made an official request to Raimbek Matraimov’s representatives on December 15. But at the time of this piece’s publication, we had not received any comments from his side.

Pro-president bots, two farms, two different situations

The authorities who ruled Kyrgyzstan until the fall of 2020 used fake accounts both during the elections and during more peaceful times to respond quickly to criticism, according one of Kloop’s sources who worked in the government at that time.

“I know that they were used both in the presidential office and in the governmental apparatus,” said the source. “There were people who received money in white envelopes for informally supporting them on social media.”

According to the source, the fake accounts’ work been in full swing since the 2017 presidential elections. At first, the same farm that supported the Matraimovs was used, but after the elections they split up.

Asylbek Jeenbekov.

According to the source, pro-Jeenbekov fake accounts allegedly could have been supervised by Asylbek Jeenbekov, a parliamentary legislator and brother of the country’s former president Sooronbay Jeenbekov.

The source also claimed that the press secretaries of the ex-president and his government were responsible for the work of the fake accounts supporting the president.

“They have a Telegram group. I don’t know who was still left there after the split between the Raimbek Matraimov group and the pro-president group, but there were a lot of people there before,” he said.

On the condition of anonymity, an ex-government official told Kloop that the government has been creating closed groups on social networks for a long time, so that ministry officials and employees could monitor the public mood.

What are some examples of the work of fake accounts supporting Jeenbekov during his turn as president? We recorded their work, in particular, during quarantine from the coronavirus pandemic.

In July, the journalist Raushan Aitkulova filed a complaint against Jeenbekov with the Prosecutor General’s Office and condemned him for his weak response to the coronavirus pandemic. At the same time, she began collecting signatures to impeach the president on the website Change.org, which was blocked in Kyrgyzstan on July 15. Authorities did not explain the reason for blocking the site. But accounts praising Jeenbekov began appearing on Instagram. They defended him and posted comments against Aitkulova at the same time.

Our journalist colleagues from Kloop’s data department analyzed their behavior and described it in this piece. Accounts like vita.0505 were numerous, and they all made negative posts about Aitkulova and defended Jeenbekov. Interestingly, they even made similar typos.

On December 15, we reached out to Tolgonai Stamalieva, who worked as a press secretary for ex-President Sooronbay Jeenbekov. However, at the time of this piece’s publication, she had not responded.

The fake accounts did not work for Jeenbekov exclusively. Their services are so popular and accessible in Kyrgyzstan that they were also used by people in the inner circle of his predecessor, Almazbek Atambayev.

Kloop’s journalists managed to speak with the person who handled fake accounts for Atambayev. He said he had received $350 a month for posts and comments supporting Atambayev. The money was given to him in person, in cash payments.

According to our source, he began working on a fake farm in the spring of 2018. It was then that the conflict between Almazbek Atambayev and Jeenbekov became publicly known for the first time. The conflict between the former and current presidents was accompanied by Jeenbekov’s clearing of the political field and replacement of people who had worked in key positions under Atambayev.

Kloop’s source claims that he was offered work because the campaign against Atambayev began on social media, and the former president’s inner circle needed something to counteract this with. His employers, allegedly members from Atambayev’s inner circle, created their own Telegram chat; links to the posts they needed to react to were shared there.

“Everyone who worked in this group, they were all conditional acquaintances. You wouldn’t offer a man on the street a job like this, would you? And that’s why I didn’t have any sort of interview, they just explained the logistics of the job to me. They said they would send some posts or texts that we would need to promote. For example, you would read some text and paraphrase it in your own words, so that it looked like a person had written it. And then you would promote it on different accounts,” the source said.

“Sometimes they gave us specific messages that we had to promote. Like, not just that someone is good, but like indicating how many schools he built, how many police stations, and so on,” he said.

Each employee had to keep a log where they collected their comments on different posts. The source showed an example of his log as confirmation that he had actually worked for a fake farm.

“We needed to manage the account as if it were a real person and not just make political posts. […] The supervisor told us to make posts about the weather, for instance. But we didn’t have targeted training,” the source said.

According to him, he agreed to work for the fake farm supporting the former president because he sincerely believed in Atambayev’s ideas and considered him a decent person.

Kunduz Joldubayeva, a representative for the former president, told Kloop’s journalists that she had nothing to do with managing fake accounts that supported Almazbek Atambayev. She added that she did not know anything about the Telegram channel where the fake farm employees were communicating, or about the salary they received.

How much does a fake department cost and why is it necessary?

So any politician or businessman in Kyrgyzstan with modest funds can launch their own fake farm? “Where there’s demand, there’s supply,” said a source working for one of the parties.

According to him, it’s possible to hire 10-15 people who you can pay $100-150 per month. For this amount, they will manage five fake accounts each. And they will stir up any necessary confusion in any discussion.

But bloggers and journalists are more expensive — they start at a thousand dollars. The cost depends on the size and quality of the audience they’re broadcasting to. They mostly find work there based on recommendations or through personal acquaintances; there are no open job postings.

“Often, I know exactly who works with who. These people have been working this way for years at this job. Because if you approach a social media marketing (SMM) specialist and say, ‘Hey, dude, let’s do some negative PR,’ well, at the very least, that wouldn’t make any sense. It’s mostly through connections,” said a source who pretended to be a customer for a group working on fake accounts.

Many people who manage fake accounts aren’t even offered a workspace; the majority of them work remotely, and they stay in touch through group chats.

“The pay is different for everyone. Again, you have to separate the Kyrgyz-speaking from the Russian-speaking employees. Is a person prepared to post openly, to say something stupid on their own profile? That also determines the price. Negotiations happen with everyone on an individual basis; prices start from 100 dollars a month to 1,000 dollars. I’ve heard of prices reaching $3000,” he said.

Politicians create fake farms because they’re unable to tolerate criticism. But at the same time, hired bots don’t pursue ambitious goals; they only react to news that is negative for their clients, according to a journalist who works with parties in elections.

“Trolls are like firefighters: when there’s a fire, they either extinguish it or redirect it to the other side. We have very few politicians who engage in strategizing, who arrange things in advance. But the trolls just carry out their orders. Let’s say some material came out today that needs to be suppressed, or something negative needs a positive spin. That’s where trolls come in,” he said.

You can calculate the approximate cost of your own fake accounts department below. How much would it cost to hire people for a month?

This investigation was possible with support from the TRACK project, which was implemented by Internews in Kyrgyzstan, and it is an independent work from the editorial board. The opinions expressed in this piece do not necessary reflect the views of Internews and its partners.

The following people contributed to this piece: Alexandra Titova, Rustam Khalimov, Saadat Tologonova, Aidai Irgebayeva. The database was prepared by Aidai Irgebayeva.

International Advisor: Andrey Zakharov. Coordinator Advisor: Metin Jumagulov

Translated by Taylor Wilson from Respond Crisis Translation