Right-wing groups are exploiting OSINT to spread propaganda in India

Under an anonymous Twitter handle, @thehawkeyex has been on a mission to expose what they perceive as “anti-India” forces — mostly critics of the Hindu nationalist ruling Bharatiya Janata Party (BJP), including prominent journalists and media outlets. The handle frequently publishes threads citing news articles and other public documents as evidence of alleged misappropriation of funds or tax evasion.

The handle describes its work as open-source intelligence (OSINT), with a following of nearly 100,000. But experts say it’s part of a new wave of partisan content that uses the image of OSINT to appear unbiased.

Besides @thehawkeyex, anonymous self-described OSINT accounts such as @AgentVinod03, @OsintUpdates, and @OSINTWa_com claim to be frontline warriors in support of the Indian government. Most of their tweets have a clear right-of-center ideological leaning, which makes any and all critics of Prime Minister Narendra Modi — including journalists — “anti-India” to them. “We try to burst the Anti India Propaganda by Anti National Organizations. We expose the links and their funding pattern,” reads the mission statement of @AgentVinod03.

Social media researchers who analyzed the output of some of these accounts, on Rest of World’s request, found these handles to be part of the larger right-wing influence operations piggybacking on the rise of OSINT culture, and even co-opting it for narrative building. These Twitter accounts have garnered thousands of followers over the past year, including prominent right-wing politicians and intellectuals. A number of the accounts operate donation pages, where well-wishers can send funds to support their work.

“A majority of the threads I’ve seen from these accounts are just regurgitation of historical facts or relations, or a partial presentation of what is already out there in the public. And it’s painted as path-breaking in the vocabulary,” said a researcher at the London School of Economics (LSE) who is working on social media platforms and majoritarian violence in India. They wanted to remain anonymous because their fieldwork is in sensitive areas, where they have to keep a low profile.

Seemingly to avoid being flagged by platform moderators, @thehawkeyex obscures highly charged words, using special characters: terr0r!st, Roh!ngya, gen0c!de, k!ll!ing. By discrediting fact-checking organizations or Bollywood actors, these motivated accounts seek engagement over truth, and the messaging elicits an emotional response. “I think it was @[the]hawkeyex, where every tweet starts with ‘[EXPOSED],’ for instance,” the LSE researcher said. “That vocabulary makes it feel like these people are trying to hide it from you, and somehow we have uncovered it.”

Until at least 2014, OSINT was largely the domain of intelligence agencies that were gathering information about adversaries’ troop movement or military capabilities for threat forecasting, using data collected from public sources. The ubiquity of smartphones and social media has spawned the rise of professional investigative groups and amateur OSINT accounts on social media, where individuals comb through Google Maps, body cam footage, facial recognition searches, and freely available satellite imagery, to share intelligence and analysis of conflicts.

Globally, OSINT has become a powerful tool for journalists and researchers to hold power to account. In India, these self-proclaimed OSINT accounts are now using those same tools to delegitimize journalists and activists critical of the government.

“Though this handle [was] created way back in 2010 … it was never meant to be [an] OSINT handle,” @thehawkeyex told Rest of World over Telegram chats. “To be honest, I wasn’t even aware [of] this term.” Inspired by other self-styled OSINT accounts that offer analysis of Russia-Ukraine troop movements and right-leaning accounts such as Vijay Patel, @thehawkeyex rebranded as an OSINT account a few months ago.

The account began to draw attention in May 2021, when it published a series of Twitter threads citing public information from online crowdfunding platform Ketto, which it claimed showed that journalist and Washington Post columnist Rana Ayyub had allegedly misappropriated Covid-19 relief donations for personal gain and evaded taxes. The allegations were echoed and assisted by other right-wing activist accounts, such as @MODIfiedVikas, @Rajput_Ramesh, @tigerAkD, and @AgentVinod03.

In September 2021, Vikas Sankrityayan, the co-founder of the Hindu IT Cell, a Hindu supremacist group, filed a police complaint against Ayyub at a police station in the state of Uttar Pradesh. Based on the complaint, local police officials registered a case against Ayyub for alleged misappropriation of public funds, which the journalist has strenuously denied. Ayyub has said that the allegations are completely unsubstantiated and that she has been a target of similar harassment by the Modi government for her work in the past. Ayyub was reached for comment but did not respond.

The complainant, Sankrityayan, who goes by the handle @MODIfiedVikas, collaborated with @thehawkeyex in the lead-up to the police complaint against Ayyub in September. “Here was ‘that’ moment ppl started knowing ‘The Hawk Eye’ handle and I realized the potential of OSINT,” said @thehawkeyex over Telegram chats.

In the wake of the allegation, right-wing Twitter congratulated @thehawkeyex on their dogged work, and online publication OpIndia cited the account as the first one to expose the alleged misuse of funds. Talking to Rest of World, @thehawkeyex credited the team for building on top of their initial Twitter findings, and eventually involving the police. (Last week, Ayyub contested the allegations in court, and the investigation remains ongoing.)

Under the Modi government, India has been tightening the rules on accepting foreign donations and cracking down on nongovernmental organizations. The government has placed restrictions on several religious nonprofits for accepting foreign donations. The principal allegation by the government is that a lot of religious and political evangelism happens in India through foreign money. Institutions like Amnesty International have been targeted for alleged violations over foreign contributions, and the targeted scrutiny of Ayyub’s Covid-19 donation fundraiser is also on similar grounds.

Influential accounts like @thehawkeyex build on this narrative and lay out their motivation as warriors fighting a perceived “industrialized disinformation campaign raged by [a] communist cabal.” The @thehawkeyex account has published threads targeting both Amnesty and Ayyub.

A scan of @thehawkeyex’s viral tweets includes several unsubstantiated claims and conspiracy theories. For instance, @thehawkeyex has claimed that the music-streaming app Spotify is a leftist propaganda platform in India, based on the cherry-picked interpretation of podcast titles. The account also shared conspiratorial threads citing a belief that the Ford Foundation is a plant by the Central Intelligence Agency (CIA) operating and funding anti-India organizations. In some threads, @thehawkeyex cites documents, pamphlets, speeches, or tweets, presenting them as indisputable evidence of a grand conspiracy to destabilize the country. They have targeted Alt News, a prominent Indian fact-checking organization, and claimed to trace the organization’s public corporate filings, lobbing an allegation that its founders were involved in tax evasion. The account alleged that Pieter Friedrich, an activist and author critical of Hindu nationalism, was “running a non-stop unrest [campaign] in India.” Friedrich was reached for comment but did not respond.

Joyojeet Pal, a professor at the University of Michigan, and Aditya Kadam, a research intern, ran a forensic analysis of the reach and engagement of @thehawkeyex and found that all the quoted mentions of the tweets from the handle are from pro-BJP sources that appear to be making an effort to sway public opinion. The duo who study the use of social media in mainstream politics observed that a large number of Twitter threads by @thehawkeyex received roughly the same number of retweets.

“This strongly suggests a pattern of astroturfing,” Pal told Rest of World.

Astroturfing is when political interests fabricate engagement across social media to give the impression of an independent grassroots movement, as described by Sharyl Attkisson, an investigative journalist who studies astroturfing and manipulation of media. Pal’s analysis shows that these carefully constructed narrative threads by @thehawkeyex and other right-wing OSINT accounts are motivated operations to sway public opinion.

“The astroturfing in India right now is potentially more insidious than a single entity running the show; it has evolved into a mix of various members of IT cells [domestic cyber troop accounts], not necessarily centrally organized, free agents, and radicalized citizens who aggressively put forth messaging that aligns with their political and social agendas,” Pal said. “So yes, the messages [of @thehawkeyex] are astroturfed, in the sense that they appear to be a lot more ‘viral’ than they actually are, but that in and of itself does not mean that there is a consistent single driver of the astroturfing.”

Pal says that @OsintUpdates, another self-described OSINT account with over 30,000 followers, has also “been involved in several cases of unverified claims or explicit misinformation that went viral.” The @OsintUpdates account drew significant attention when it falsely claimed that Hindu temples will finally be free from government control, a long-standing demand from conservatives. “This was never verified, despite several questions, but serves as a kind of ‘canary in the coalmine’ tweet that feels out online sentiment for a certain issue and puts an idea in the minds of people,” Pal said.

Other unverified viral claims by @OsintUpdates include that the U.S. state of Rhode Island put out an official recognition of the exodus of Hindus from Kashmir, Russia added Iran to its nuclear shield, and former Pakistan Prime Minister Imran Khan gave the moniker pappu — a small boy — to rival Bilawal Bhutto Zardari. The handle also follows accounts engaged in aggressive speech against Muslims.

This contrived use of OSINT for politics has larger implications. The LSE researcher said that as the Modi government increasingly arrests critics over tweets, right-wing OSINT accounts that drive partisan narratives have “become the shoulder from which authorities fire.” It’s becoming a formulaic approach, where something is flagged on Twitter and, months later, is investigated by authorities, they said, citing examples of Alt News co-founder Mohammed Zubair, who was arrested for a four-year-old tweet that was flagged by an anonymous account in June.