Carnegie Mellon University

Center for Informed Democracy & Social - cybersecurity (IDeaS)

CMU's center for disinformation, hate speech and extremism online

IDeaS Center for Informed Democracy & Social-cybersecurity

cogs and screws

August 12, 2022

From Curious Hashtags to Polarized Effect: Profiling Coordinated Actions in Indonesian Twitter Discourse

By Lynnette Ng

Tags: Coordinated actions, indonesian, curious hashtags, polarization

Image Source:

Recent Publication:

Reference for paper: Danaditya, A., Ng, L.H.X. & Carley, K.M. From curious hashtags to polarized effect: profiling coordinated actions in indonesian twitter discourse. Soc. Netw. Anal. Min. 12, 105 (2022).

What is Coordinated Action?

Coordinated action is action performed by a group of people working together to deliberately manipulate the online conversation.

Social media is crucial in how the public consumes and processes information. Due to this fact, the medium has become a battleground of sorts, with actors pulling coordinated actions to push their narrative to the public. Researchers far and wide have tried to analyze these coordinated actions, noting that these actions can materialize into serious risks that threaten security and stability at the global, national, and local levels.

Most of the work analyzing coordinated action in social media skews toward the western world: there are many works analyzing such actions in the context of US, UK, and Europe (take the many research covering the information operation done by the RU-IRA during the Black Lives Matter discourse, for example), but very little has research been done to analyze these phenomenons in other parts of the world. We cover coordinated actions happening on Indonesian Twitter discourse, the world's third largest democracy and a nation that's very active and engaged on social media.

In our analysis of the matter, we used a pipeline that attempts to cover the coordinated actions holistically. The analysis will give a clear picture of how the coordinated action happened (what is actually being done), the perpetrators, the target, why they did it, as well as how we detect the action and how severe was the impact. We applied this pipeline to two hotly debated issues in Indonesian public discourse.

Two Case Studies in Indonesian Twitter

The first case study we analyzed is an international event: The Palestine-Israel conflict. The conflict is a part of Islamic identity politics in the modern Indonesian political scene. The strong-voiced support for Palestine led Indonesia to formally call for international support to resolve the conflict in mid-May 2021 as reported in The Jakarta Post

The second case study is a regional case study: the alcoholic beverage issue. The Indonesian president issued a decree in February 2021, which allowed several cities to receive investment in the previously off-limits alcohol industry, sparking public debate. 

The contrast of these two cases shows that our pipeline can be generalized.


Pipeline for profiling coordinating actions


Caption: Pipeline for Profiling Coordinating Actions. Source: original image from the paper


We identified patterns of hashtag hijacking through anomalous hashtags. In hashtag hijacking, actors steer conversations to tangential topics by piggybacking on trending hashtags. Using a hashtag-hashtag co-occurence network, where two hashtags are linked together if they occur in the same tweet, we can identify two main types of hashtag-clusters: proper-word hashtags and 4-character hashtags. This curious 4-character hashtags group is likely an indicator of coordinated behavior.

ng-hashtags3.pngCaption: Hashtag-hashtag cooccurence network. We see a cluster of curious 4-character hashtag as signs of coordinated action. Source: Original image from paper


We extract the corresponding agents and their tweets from the clusters of 4-character hashtags that do not fit. Around 23% of each discovered agent groups are bots. What is interesting is that 2% of the agents that first appeared in the alcohol beverages event in Feb 2021 emerge again in the Palestine-Israel conflict in May 2021, and all were classified as bots.

Did What

We use the BEND framework to empirically characterize the activity of the coordinating agents. The BEND framework argues that online campaigns are comprised of sets of narrative and network maneuvers carried out by a group of actors engaging others in the social environment with the intent of altering topic-oriented communities.

The agents make most of their tweets within a short burst of time, the second or third day of our collection timeframe, suggesting synchronized tweeting behavior.The tweets originating from these agents are mostly canned messaging that shows sympathy to the notion of Khilafah (an Islamic state in Indonesia), both independently or in conjunction with the events. The top four maneuvers the discovered agents performed are: Back (increase importance of influencers), Bridge (connect groups), Build (create groups) and Distract (post on a different topic).

To Whom

We obtained the B- and D-maneuver ratios of agents that were targeted by the coordinated activity and performed a correlation analysis of the ratios between the BEND maneuver scores agent meta-data scores. All maneuvers were employed on agents with high total-degree centrality and large number of followers,indicating the leveraging on the target agents’ connections. There is a lower positive correlation between maneuver and the number of verified accounts, suggesting that maneuvers were performed on both verified and non-verified accounts. Finally, we observed negative correlation with bot probability score, signifying that maneuvers were more often performed on non-bot accounts.


Through narrative analysis using LDA, we observe the formation of two main narrative themes for each case study, indicating the deliberate direction of information narratives towards those topics. The Palestine-Israel conflict shows the following themes: strong and diplomatic support; radical messaging. The alcoholic beverage conflict shows: clear call to action and discursive tweets.



Caption: Impact of B- and D- maneuvers on the social network. Red nodes represent the discovered agents and blue nodes are general agents in the network. Key agents in the network are highlighted in yellow and sized by their total-degree network centrality values. Source: Original image from paper

Last words…

Our study shows that coordinated activity can be detected through hashtag hijacking and measured through network and narrative analysis techniques.

In both case studies, we observe the worrying trend that a small group of coordinated agents (around 6.5% of agents collected) can cause narrative and network polarization.

We hope our study has shed light on understanding social phenomena in an understudied region of Southeast Asia. The early detection of coordinated effort online may present the possibility of stopping any resulting violence in the real world.