Anonymous Complainant Targeting Zubair Tweet Linked to Tek Fog App, BJYM Leader in Gujarat

The Wire's investigation into a network of 757 Twitter accounts used to mount attacks against AltNews found that the recovery email ID for the anonymous Twitter handle that sparked the original FIR was 'contact@vikashahir.in'

Ayushman Kaul, Naomi Barton and Devesh Kumar / 02 July 2022

New Delhi: The arrest of Mohammed Zubair, journalist and co-founder of AltNews, is the culmination of a years-long campaign by a network of anonymous and inauthentic accounts linked to Vikash Ahir, state president of the Hindu Yuva Vahini (HYV) and co-convenor of the Bharatiya Janata Yuva Morcha (BJYM) in Gujarat, an investigation by The Wire has established.

Mohammed Zubair was arrested on June 27 under section 153A (giving provocation with intent to cause riot) and 295A (deliberate and malicious acts, intended to outrage religious feelings of any class by insulting its religion or religious beliefs) of the Indian Penal Code. The arrest was made following a complaint tweet by an anonymous account going by the handle @balajikijaiin, which flagged a 2018 tweet by Zubair that included a photograph of a hotel sign board on which the word ‘honeymoon’ – written in Hindi – had been changed to Hanuman. The complainant, who said the photo hurt his religious sentiments, may or may not have known that it was a screenshot of a scene from a four decade-old film, ‘Kissi Se Na Kehna’, made in 1983.

When Zubair’s counsel, Vrinda Grover, pointed out in court during Zubair’s bail hearing on June 29 that the complaint had been made by an anonymous account which could have been made ‘to create mischief in the country’, the prosecution responded by saying, “He is not an anonymous complainant. His details are here. Without details, no one can get a Twitter account.” The prosecution failed to reveal the account holder’s identity in court, but the Indian Express reported that the police later sent Twitter a notice under Section 91 of Criminal Procedure Code on the evening of June 29, asking them to provide details of the account @balajikijaiin that goes by the name ‘Hanuman Bhakt’.

The Wire has reached out to DCP KPS Malhotra regarding the identity of the complainant, and will update this story if we receive a response.

A network of linked accounts

Investigations by The Wire have uncovered a network of 757 accounts linked to Ahir that have attempted – since 2018 – to incriminate the fact-checker alongside Pratik Sinha, co-founder at AltNews, by highlighting and misconstruing old tweets uploaded by the two journalists to portray them as “Hinduphobic” and then tagging the local authorities in order to have the two journalists arrested for supposedly hurting religious sentiments.

In particular, this network also included eight replica accounts of @balajikijaiin – the anonymous account whose complaint formed the basis of Zubair’s arrest by the Delhi police. Each of these eight accounts exhibited similar properties – profile picture, tweets and usernames – and employed the same modus operandi to target the AltNews co-founders on Twitter. While five of these eight replica accounts have been deleted, two other accounts - @balajikijain and @HanumanBhakt101 - remain active at the time of analysis.

A closer scrutiny of this network of 757 accounts reveals a subset of 283 accounts which exhibited multiple characteristics associated with bot-like and inauthentic behaviour. In addition to maintaining functional anonymity, these accounts also posted more than 500 times a day over the last month at all hours of the day with little down time for organic human processes. They also used third-party tools like Cheap Bots, Done Quick to automate and spam targeted hashtags related to Zubair’s arrest.

Graph showing the top amplifiers by volume for #ArrestZubair, #ArrestMohammedZubair and #ArrestBlasphemerMdZubair on Twitter between June 20 and June 30, 2022. (Source: Brandwatch)

Complementing this activity was a larger network of 18,364 accounts which were also used to trend other hashtags – #ArrestZubair, #ArrestMohamedZubair and #ArrestBlasphemerMdZubair – that targeted the journalist.

The use of inauthentic accounts to trend the hashtags targeting the journalist was further corroborated by analysis by Logically, a tech company which aims to combat the harms associated with mis-and-disinformation. Logically also analysed these three hashtags between June 1 and June 30, 2022. This analysis found they went on to ‘trend’ after being promoted by right-wing ideologues and politicians associated with the ruling Bharatiya Janata Party (BJP) with large followings on the platform. This activity was complemented by secondary accounts with smaller followings that exhibited multiple characteristics associated with bot-like and inauthentic behaviour who spammed the hashtag thousands of times on the platform.

Clear footprints of Tek Fog

Significantly, around 62% (11,380 accounts) of this larger network that sought to manipulate public perception around the arrest were also part of the original Tek Fog network, revealed by The Wire in January this year.

In June 2021, the Tek Fog network had 77,800 users, many of which became inactive following the publication of our three part investigation. The activation of this cluster to manipulate public perception around the Zubair case is the first time in the last six months that the use of this network has been detected.

Network graph of the original Tek Fog network with the clusters engaging in hashtags targeting Mohammed Zubair depicted in red.

Unmasking the network
targeting the co-founders of AltNews

The original @balajikijaiin was the complainant cited in the Delhi Police’s case against Mohammed Zubair. The account was temporarily disabled after the public outcry generated by the case; when it returned, it proceeded to make a similar tweet against the co-founder of AltNews, Pratik Sinha, targeting out a tweet of his from seven years ago and asking for police action to be taken against him.

Curiously, this was the same tweet that had formed the basis of a police complaint by Vikash Ahir registered against Sinha last year, in 2021.

We analysed the tweet on which a complaint was registered against Zubair, along with Pratik Sinha’s tweet, to search for other accounts who have retweeted these tweets in the past four years and tagged the verified accounts of the Delhi police and other local authorities. This analysis gave us a list of 3,699 accounts, out of which 1,257 accounts had shared those two tweets tagging Delhi police before Zubair’s arrest. Majority of these 1,257 accounts had shared the tweets in 2021. This suggests these accounts have been part of the network since well before Zubair called Nupur Sharma a “hate monger” and became a target of coordinated attack.

By extracting data from the Twitter API, the social connections of these accounts were made visible. Out of these 1257 accounts, 757 accounts showed a unique pattern - each one of them were part of at least one Twitter List where Vikas Ahir was the only common member.

A Twitter list is a group of people collected by a single account in order to view tweets on a curated timeline. This allows the curator to have easier access to tweets made by a pre-organised group of people, as against the larger volume of tweets provided by a more diversely populated timeline.

There wasn’t one single list featuring these 757 accounts – each account featured on an individual list, making it 757 lists, with the only common factor between them being the presence of Vikash Ahir on each of these lists.

It was in this list that we found the 8 replica accounts of ‘@balajikijaiin’ with variations in the username, but with identical profile pictures and Twitter biographies. The last of these accounts was made in January 2022 – proving that these were not copycat accounts following the public attention paid to the complainant against Zubair.

Left: Twitter profile and tweet from @Balajikijaiin, the original complainant against Zubair. Right: Twitter profile and tweet from @balajkijain, one of the eight replica accounts linked to Vikash Ahir that employed the same modus operandi since 2018.

Screengrab showing @balajikijaiin Twitter Lists, one of the 757 individual lists that has Vikas Ahir as a member.

For the reader not familiar with the patterns of how Twitter works, it is necessary to note how unlikely it is to find a list featuring a single person so unilaterally. As such, it led our team to suspect that Vikash Ahir was involved in the accounts personally – given that the accounts themselves had no distinguishing characteristics indicating that they were run by ‘real’ people.

To that end, we attempted an unorthodox attempt to confirm this hypothesis. Vikash Ahir has a personal website – vikashahir.in. When purchasing a domain name, one is commonly given an email id for free associated with the domain name. The free email ids generally tend towards the format of ‘contact@domainname.com’ (or admin@domain.com/support@domain.com).

We decided to use the email id contact@vikashahir.in to ask Twitter to reassign a password – the goal not being to get access to the account, but to move to the second step in the verification process – where Twitter reiterates the accurate email id associated with the account, in order to send the password change email. In case you input the wrong email, Twitter shows a screen saying that the attempt was ‘Incorrect’, asking you to try again.

We did not have to try again – the email id affiliated with the @balajikijaiin account responsible for the complaint against Mohammed Zubair belonged to a domain associated with the personal website of Vikash Ahir. The email of the recovery email has since been changed, likely because they received the reset password email. We however retain a video of the same before the change.

Who is
Vikash Ahir?

Vikash Ahir is from Gujarat, and according to his website, the state president of the Hindu Yuva Vahini, a militant organisation founded by Uttar Pradesh Chief Minister Yogi Adityanath, and city coordinator of the student wing of the Bhartiya Janata Yuva Morcha, the youth front of the Bharatiya Janata Party (BJP). His digital footprint connecting to the BJP goes back at least four years, during which his loyalty to the party was matched by consistently anti-Muslim sentiments put forth on his social media channels, which have huge reach.

His Twitter handle, which was the link to the extended network targeting Zubair, measured 107k followers, and is followed by a number of BJP functionaries.

He also recently put out a tweet supporting ‘Rambhakt Gopal’, the extremist who opened fire on Jamia students in 2020, when he made public a video showing him taking away a man at gunpoint claiming that he was a cow-smuggler. The Jamia shooter also reportedly aimed the gun at women and children.

The tweet itself features text that is suspiciously repeated across multiple other accounts with the same hashtag – activity that is indicative of a larger choreographed campaign with bot-support.

An outspoken supporter of killer Shambhulal Regar

On his Youtube channel, which has 1.35k subscribers, there are a number of incendiary videos against the Muslim community:

  1. In December 2017, he uploaded a video speaking out in sympathy with Shambu Lal Regar, the Hindutva extremist who hacked and burnt alive a Muslim man while videotaping the incident and releasing it on social media. Large protests had erupted following the incident in favour of Regar.) In the video, Vikash Ahir personally pledged (though we don’t know if he ever gave) 51,000 rupees to the family of Shambulal Regar, and urged his followers to aid in his fundraising efforts to raise at least 10 lakhs for the family.
  2. In the video, Ahir says, “Theek hai bhai normal sa murder kiya koi isme kuch bada nahi hai uski galti ye hai ki uska video usne banaya aur usne do shabd galat bol diye ki love jihad. Usne sahi bola hai – love jihad karoge toh ham marenge. Jabh jabh tum log jihad karonge tabh tak Shambhu nikalega, aur tab tak marenge.” (This was a normal murder, there wasn’t anything majorly bad about it - his mistake was that he took a video and he said two wrong words – Love Jihad. But he was right – if you do love jihad, we will kill you. Whenever you people do jihad, a Shambhu will emerge, and you will be killed.)

His Facebook page is also one replete with more recent iterations of similar sentiments.

  1. In 2020, he posted a series of photographs of the Hindu Yuva Vahini in Surat conducting a ‘Shastra Pooja’ at what appears to be a school. The photograph shows a table full of swords, knives, and rifles surrounded by garlands, and his caption reads, “Shastra nahi padoge toh rashtra kho doge, Sastra nahi uthaoge toh dharm kho doge.” (If you don’t read the shastras you will lose your nation, if you don’t pick up your weapons you will lose your faith.)
  2. The Hindu Yuva Vahini Gujarat Page also as of 5 June posted pictures of Ahir in close proximity to UP Chief Minister Yogi Adityanath.

The images of him with Yogi Adityanath are unsurprising given his status in the Hindu Yuva Vahini – an organisation created by Adityanath himself in 2002. The HYV cadres wield enormous power in the state of Uttar Pradesh, and are called locally ‘Yogiji ki sena’. An inhabitant of Gorakhpur points out that the Vahini is sustained by only one thing: fear—fear of public humiliation or of being beaten up—which is what makes people afraid of the Vahini.

More recently, the Hindu Yuva Vahini was in the news when Sudarshan Chavanke addressed one of their meetings in Delhi, calling for the killing of Muslims as part of the making of a Hindu rashtra. BJP leader and Uttar Pradesh minister Rajeshwar Singh was also present at the event.

The Gujarat wing of the Hindu Yuva Vahini is relatively new, established in 2014, but staying dormant until 2017, when they decided to expand their base on the subjects of “love jihad, cow protection and religious conversion". Incidentally, in 2017, a number of dailies featured a paid advertorial extolling the various positive qualities of Vikash Ahir – a press release presently available on his website, and which was featured on Deccan Herald, DNA India and Mid-Day.

As a BJYM leader, of course, Ahir is frequently seen in close contact with a number of senior level BJP functionaries. On March 16, 2022, he posted a photograph with Chandrakant Raghunath Patil, president of the BJP in Gujarat and MP from Navsari. On June 30, 2022, he posted a photograph of himself with Bhupendra Yadav, Union minister of labour and employment, environment, forest and climate change, and the national general secretary of the Bharatiya Janata Party.

Connecting the dots

The coordinated campaign targeting the two journalists provides an unprecedented and chilling case study into the weaponization of social media accounts by malicious actors to both intimidate and incriminate journalists deemed to be critical of the BJP and whose work undermines attempts to promote a communal-majoritarian agenda in the country.

In Zubair’s case, not only was he targeted by a network of inauthentic bot accounts calling for his incarceration, the person to whom this network is linked is deeply embedded into the party currently in power in India. This is particularly troubling when viewed in light of the fact that during his appeal in the Delhi high court against his remand today, the person arguing for the prosecution was the solicitor general of India. That the Union government would deploy one of its seniormost counsels – ostensibly for a case about a joke tweet – underlines the political nature of the entire campaign.

As mentioned earlier, the network targeting Zubair was also cross-referenced against the database of actors The Wire was in possession of on the Tek Fog network, and produced a 62% overlap between the two groups. This means that almost 2/3rds of the accounts targeting Zubair have previously been noted on the Tek Fog networks as engaging in coordinated attacks against journalists, among other malign activities. The Wire expose which covered Tek Fog also connected the secret app to Devang Dave – a Bharatiya Janata Yuva Morcha leader, like Ahir – and showcased numerous campaigns run on the app in support of the BJP. Interestingly, on the day of the complaint, the @balajikijaiin account managed by Ahir, had liked only one tweet – that of @signpostindia - a company belonging to Dave. When the account was resurrected after its deletion, this like was removed, presumably because the connection with Dave had been flagged on Twitter.

Ayushman Kaul is a senior threat intelligence analyst at Logically AI.

Naomi Barton works with The Wire and runs the The Heartland Hatewatch Project.

Devesh Kumar is an independent data analyst and Senior Data Visualizer with The Wire.