They are also using evasive tactics, such as deleting tweets afterward, and avoiding suspensions by celebrating the planting of a “device” instead of a bomb and by calling for the “political death” of Indian leaders, according to research by Network Contagion Research Institute.
The bursts of activity come as Indian officials wage a manhunt for separatist leader Amritpal Singh, and as protesters have vandalized Indian consulates in San Francisco and around the world and assaulted Indian officials and journalists in America.
The campaign shows that even when it is trying to cut off bots promoting violence, Twitter remains a fertile ground for sowing discontent and real-world action.
Within the Indian state of Punjab, the separatist movement has won significant support among a Sikh farming population that has seen agricultural prices drop and jobs evaporate. A heroin epidemic, locals say, is ravaging the state.
Singh shot from near obscurity to prominence last year by touring through the Punjab countryside, flanked by heavily armed men, to deliver fiery speeches condemning drug usage and calling for a separate homeland.
India recently cut off Punjab’s access to the internet.
Many of the tweets captured by the NCRI urge protesters to gather or take unspecified direct action against such power plants, train tracks and other strategic targets inside India as well as facilities abroad. One widely shared video credited an expatriate Sikh group, Sikhs for Justice, with damaging a railway.
Sikhs for Justice did not return a call seeking comment.
The NCRI found 359 accounts active in the campaign since January. They often worked in networks of 20 to 50 accounts to promote messages or videos, many of them featuring the founder of U.S.-based Sikhs for Justice, which is banned in India. Each account would tweet the same thing dozens of times, tagging different journalists and other public figures to build visibility.
“When you look at the escalation and the intensity of the rhetoric, and how that precedes the events that take place in the real world that result in vandalism or violence, that’s where the concern is,” said Jack Donohue, chief operating officer at the NCRI and a former head of cyber intelligence at the New York Police Department.
Donohue said he would be sending an NCRI report first shared with The Washington Post to local law enforcement in cities with likely targets.
The research also provides grist for those who claim that the Khalistanis are getting significant support from the government of Pakistan, India’s neighbor and strategic rival.
About 20 percent of the accounts identified as part of the Twitter networks claim to be located inside Pakistan. And some of them have tweeted that Sikhs should be thankful for Pakistan or in support of one of the major Pakistani political parties, according to the report.
Attempts to reach some of the accounts deemed by the NCRI to be at the center of the efforts were unsuccessful.
“Involvement by a self-identified Pakistani network of putative SFJ supporters thus suggests not just bot-like activity but raises the possibility of a broader effort for covert influence,” the NCRI wrote. “The fact that this network of self-identified Pakistani accounts amplifies attacks against Hindu houses of worship, agitates for terror and attacks Indian consulates, aligns well with Pakistani strategic interests.”
That is far short of proof, however, and could be misdirection. Indian officials have an incentive to point to foreign powers as being behind domestic unrest to discredit activists and protesters. The Pakistani Embassy in Washington did not respond to an email seeking comment.
Since Elon Musk bought Twitter in October and forced out more than half the company’s staff, researchers and activists have tracked a surge in various forms of hate speech, a replatforming of many users previously banned for spreading lies, and growing connections between online campaigns and real-world confrontations.
In this case, Twitter has acted against the Khalistani campaign, suspending accounts including one that referred to wide use of hand grenades against enemies, the NCRI said. A search showed it has restricted others. But the people behind the accounts have outmaneuvered Twitter, for example returning with slightly altered names.
Twitter’s head of trust and safety did not respond to an email. The company’s press department responded with an emoji.
The U.S. State Department declined to add to a spokesman’s March 28 criticism of the U.S. attacks.
Gerry Shih in New Delhi contributed to this report.
