Thousands of suspicious accounts followed Swedish political voices, researchers say
At first glance, this X account below appears to belong to a Swedish woman named Ingrid Karlsson. But the profile uses a stolen photograph, according to researchers, rarely publishes its own content and is...
At first glance, this X account below appears to belong to a Swedish woman named Ingrid Karlsson.
But the profile uses a stolen photograph, according to researchers, rarely publishes its own content and is actually listed by the social media platform as being based in Benin, West Africa.
It is one of more than 8,500 accounts identified by Dutch analysis company Trollrensics and the non-profit organisation Alliance4Europe, in collaboration with Swedish broadcaster SVT.
The researchers say the profiles display signs of coordinated behaviour, including similar identities, reused photographs and overlapping patterns in the Swedish political accounts they follow.
Rather than originating in Sweden, these accounts are listed on X as being based in Nigeria, Ghana, and parts of Asia.
They emerged in the run-up to Sweden's general election, held on Sunday. Preliminary results from the vote put the opposition bloc, led by former prime minister Magdalena Andersson's Social Democrats, narrowly ahead of the governing right-wing alliance.
With 95% of districts counted, opposition parties were projected to win 176 of the parliament's 349 seats, compared with 173 for the bloc led by current leader Ulf Kristersson, of the centre-right Moderate Party.
The results remain provisional, with the final result expected a week after election day, according to the Swedish Election Authority.
How were the accounts identified?
Trollrensics co-founder Robert van der Noordaa told The Cube, Euronews' fact-checking team, that his company uses 26 indicators to assess whether a collection of profiles constitutes a coordinated network.
This includes unusual spikes in accounts created on a certain date, stolen photographs, and accounts publishing identical posts simultaneously.
The Swedish accounts studied generally published little to no original content. Instead, they followed large numbers of genuine Swedish accounts involved in political debate in the run-up to the election.
Van der Noordaa said some profiles with thousands of followers appeared to derive as much as 30% of their following from suspicious accounts listed in Nigeria, Benin and parts of Asia.
The accounts followed people from different parts of the political spectrum, with a greater concentration on right-wing voices and those associated with the Moderate Party.
Researchers say mass-following can inflate a profile's popularity, as well as amplify posts through coordinated likes and reposts.
Who's behind the network?
Trollrensics says accounts with similar characteristics were identified in elections around Europe, including in the Netherlands and Hungary. Some even changed their identities when moving between different national political debates.
"They have a German name, a German bio, and then at some point they're sort of repurposed," van der Noordaa said. "We've also found accounts in Sweden that are following a lot of Swedish people that started as Dutch accounts."
Van der Noordaa believes that the accounts form part of a commercial "guns for hire" operation that can be deployed for different clients.
The majority of people hired to generate these troll accounts are either from Africa or the US, according to van der Noordaa.
Darren Linvill, co-director of Clemson University's Media Forensics Hub, separately examined a sample of the accounts. He told The Cube that their behaviour appeared consistent with paid amplification services increasingly used by political and state-linked actors.
Such operations can involve small marketing businesses or individual contractors running accounts and automated bots, whose services are then sold through larger companies or online marketplaces, according to Linvill.
These services include paid-for followers, comments, likes, reposts and automated bots.
"They were giving accounts followers so that those accounts appear more legitimate, appear to have a larger portion of the conversation," Linvill said. "They appear to represent a larger community than they do in real life."
According to Linvill, their activity represents amplification methods seen in Russian influence operations, which also use a network of disposable accounts to promote fake content.
Wider election security concerns
The findings emerged during an election held against a backdrop of heightened concern over foreign interference.
Swedish authorities said before the vote that the country was not considered a priority target for Russian influence. Nevertheless, they warned that the election was taking place amid a serious security situation and that hostile actors could seek to deepen existing divisions or undermine confidence in the electoral process.
Separate pro-Russian activity was detected ahead of the vote, with Alliance4Europe reporting that the pro-Russian influence operation known as Matryoshka circulated fabricated videos targeting the governing coalition and Ukrainian refugees.
During the election, unproven claims of widespread electoral fraud spread after a technical error affected the registration of around 500 advance voters. Other posts falsely alleged that a senior Election Authority official was affiliated with the Social Democrats, and others falsely claimed that Swedes without an identity document would be able to vote several times.
Sweden's Psychological Defence Agency said authorities had undertaken extensive preparations to protect the public from disinformation, propaganda and attempts to manipulate public debate.
