On May 18 of this year, the insidious hashtag #AnarchistJudges appeared on Kenyan Twitter timelines. Apparently driven by a number of faceless bots, and retweeted by a series of sock puppet accounts, the deluge of tweets cast suspicion on both the competence and integrity of senior High Court of Kenya judges that had just shot down the Constitutional Amendments Bill of 2021. Many falsely claimed the judges were involved in narcotics dealings, bribery, and political partisanship. It quickly became one of the country’s top trending topics.

Such malicious, coordinated disinformation attacks are rapidly growing in Kenya, my Mozilla Foundation colleague Brian Obilo and I have found in a new investigation. Through a series of interviews with influencers involved in these campaigns, we reviewed evidence of a booming, shadowy industry of social media influencers for political hire in Kenya. Members of civil society and journalists alike have increasingly come under disinformation attacks that seek to silence them, muddy their reputations, and stifle their reach.

Twitter, which strongly influences the country’s news cycle and has exploitable features like its trending algorithm, has been central to these operations. Many of the accounts and individuals involved promote causes and political ideologies without disclosing that they are part of paid campaigns. Even some verified accounts are complicit.

With the aid of Twint, Sprinklr, and Trendinalia, we trailed two months of data (May 1 to June 30) of disinformation attacks by mapping and analyzing specific hashtags that the perpetrators used on Twitter. In particular, we focused on Kenya’s Constitutional Amendment Bill, famously known as the Building Bridges Initiative (BBI), debates over which were roiling at the time. The criteria involved mapping certain accounts that posted malicious content targeted at Kenyan activists and judicial officers. Timestamps within the metadata of these tweets suggested strong synchronization: sharp bursts of activity in a very short period of time.

In total, we flagged 23,606 tweets and retweets released by 3,742 accounts under the 11 hashtags. The campaigns we took an interest in directly attacked citizens and prominent civil society activists who were vocally opposed to it. They also sought to discredit civil society organizations and activists by portraying them as villains who were being funded by Kenya’s deputy president, William Ruto, who had been vocally against.

The well-coordinated attacks are directed through WhatsApp groups to avoid detection. In groups whose conversations were shared with us, administrators gave instructions about what to post, the hashtags to use, which tweets to engage with, who to target, and how to synchronize posts so that they trend. “The main goal is to go trending on Twitter,” said one influencer, who requested to remain anonymous for fear of retribution. “I’m not sure what our jobs would look like without that target.”

There is money to be made. Our sources said that they get paid between $10 and $15 to participate in three campaigns per day. Others are on a retainer that can go as high as $250 a month. This is in a country where many citizens earn $1 a day.

The three most frequent types of victims of these campaigns, our analysis found, were Kenyan journalists, judges, and activists. Many of the attacks against Jerotich Seii, a prominent member of the anti-BBB Linda Katiba campaign, for example, used her or her father’s likeness, pretending to be them and allege that her efforts were being funded by William Ruto. She told us that the attacks against her were so defamatory and effective she “had to spend a good chunk of my time defending my position as someone who is actually a patriot who does what they do out of love for their country.” Other activists have resorted to self-censorship.

In response to our investigation, Twitter removed over 100 accounts in Kenya that had violated its platform manipulation and spam policies. In an emailed statement, a Twitter spokesperson wrote, “Some accounts relied on inauthentic behavior to attempt to gain followers or retweets (not solely on political themes, from what we observed); but many of the tweets associated with hashtags cited in the report (e.g. #AnarchistJudges) were legitimate.”