Benjamin Strick is an open-source investigator for the BBC, a Bellingcat contributor and an instructor in open-source techniques, geospatial intelligence and network analysis. He has a background in law and the military, and focuses on using OSINT/GEOINT, geolocation and intelligence methods for good, through human rights, conflict and privacy.

Elise Thomas is a freelance journalist and a researcher working with the International Cyber Policy Centre at the Australian Strategic Policy Institute. Her writing has appeared in Wired, Foreign Policy, The Daily Beast, The Guardian and others. She also previously worked as an editorial assistant for the U.N. Office for the Coordination of Humanitarian Affairs, and as a podcast writer and researcher.

In August 2019, separatist tensions flared up yet again in West Papua, a province that became part of Indonesia in a controversial decision in the 1960s. Since then, the region has suffered from widespread allegations of human rights abuses committed by Indonesian authorities to quash dissent.

Access to the region is heavily restricted, and foreign journalists have been banned from reporting in the province. All of this makes social media a crucial resource for monitoring and reporting on West Papua.

While trying to geolocate some of the footage that was coming out of the violence in FakFak, one of us identified two hashtags spreading on Twitter, #WestPapua and #FreeWestPapua.

Searches under those hashtags revealed a wave of fake accounts autoposting the same videos and same text using these same hashtags. The accounts also retweeted and liked one another’s content, helping further amplify it and increase engagement on the hashtags.

The process for analyzing these automated accounts was detailed in Chapter 3. Building on that work, we expanded our investigation by working to identify the people or groups behind the operations. In the process, we uncovered a similar, smaller and apparently unrelated campaign, and were also able to identify the individual responsible. Operators of both campaigns eventually admitted their involvement after being approached by the BBC.

The size of the first campaign and the fact that it was operating across multiple platforms gave us a range of opportunities to find clues we could use to pivot on to find more information about the campaign’s operators.

The first useful piece of information was the websites being shared by the network of Twitter and Facebook accounts. Whois searches revealed that four of the domains were registered using a fake name and a dummy email address, but with a real phone number. We entered the number into WhatsApp to see if it was connected to an account. It was, and that account also had a profile photo. Using Yandex reverse image search on that profile photo, we were able to connect the profile photo to Facebook, LinkedIn and Freelancer.com accounts. Through that associated LinkedIn account, we were able to find the person’s current workplace, and see their colleagues.

The individual was an employee of a Jakarta-based company called InsightID, whose website said it offered “integrated PR and digital marketing program[s].”

We also gathered additional data points that InsightID was responsible for the information operation. On its website, InsightID referred to its work on the “Papua Program Development Initiative,” which “examines Papua rapid socio-economic development and explores its challenges.” Former InsightID employees and interns described producing video content, writing copy and translating content as part of their work on the Papua Development Project.

One former employee stated on their LinkedIn profile that their work could be seen on “West Papuan (Instagram, Facebook, Website).” West Papuan was one of five news websites involved in the campaign. Another InsightID employee created a YouTube account in their own name to host a video as part of the campaign. This video was then embedded on westpapuan.org.

Further domain record searches revealed that InsightID’s co-founder used his company email address to register 14 domains on the same day, most of which clearly related directly to West Papua. These included westpapuafreedom.com, westpapuagenocide.com and westpapuafact.com. Each additional piece of information added to the evidence that InsightID was responsible for the operation.

At that point, BBC journalists attempted to contact InsightID for comment. Although the company didn’t respond, InsightID ultimately acknowledged its responsibility, saying in a social media post that “our content defends Indonesia against the hoax narrative of the Free Papua separatist groups.”

We were not able to identify the client who hired InsightID to conduct the information campaign.

While uncovering this larger operation, we also investigated a smaller network of three websites that masqueraded as independent news sources and had associated social media profiles. Although apparently not connected to the first campaign, these sites targeted international perceptions of the situation in West Papua, focusing on audiences in New Zealand and Australia.

The key to identifying the individual responsible was that the Facebook page for one brand, the Wawawa Journal, was originally called Tell the Truth NZ. We were able to see this by looking at the page’s naming history. This allowed us to link it back to the domain tellthetruthnz.com, which was registered to Muhamad Rosyid Jazuli.

When approached by BBC journalists, Jazuli admitted to being the operator of the campaign. He works with the Jenggala Center, an organization created by Indonesia’s vice president, Jusuf Kalla. It was created in 2014 to promote his reelection and support President Jokowi’s administration.

What this investigation demonstrates is that identifying information campaigns and attributing them to the individuals and groups responsible does not necessarily require complicated techniques or tools — but it does require both patience and a certain amount of luck. This investigation relied on open-source resources such as Whois records, reverse image search, social media profiles and analysis of website source codes. The fact that the campaign was in operation across multiple platforms, in combination with the social media and LinkedIn profiles of InsightID’s employees, was crucial in allowing us to piece together many small clues to build the bigger picture.

If there is a key lesson to take away from this example, it is to think about how you can use details or clues from one platform to pivot to another.