#AlFath, which translates to “victory” in Arabic, is an English transliteration of #الفتح, the Arabic version of the hashtag. Although both versions of the hashtag were pushed by Taliban-associated accounts — sometimes in the same tweets — the DFRLab analysis focused on #AlFath, not #الفتح. #AlFath tweets were predominantly in English, while #الفتح tweets pushed Pashto content.

How #AlFath was boosted during the election

The Taliban has several official accounts featured on the homepage of its websites. Two of these accounts, @Zabehulah_M33 and @QyAhmadi_1, used #AlFath in tweets.

@Zabehulah_M33 appears to be the largest account on Taliban Twitter; it has roughly 81,400 followers and is retweeted at higher rates by other Taliban-associated accounts. According to TweetBeaver, which allows users to download a Twitter account’s 3,200 most recent tweets, @Zabehulah_M33 posted 36 election day #AlFath tweets, which were in turn retweeted a total of 380 times and liked 1,568 times.

These official accounts’ tweets of the hashtag followed an identical format, in which the hashtag introduced Taliban actions such as electoral disruptions, attacks, and murders. Certain locations in Afghanistan were emphasized via hashtags, while other places were not. The tweets may have also served as a way for the Taliban to convey updates quickly on the state of the insurgency.

Taliban-associated accounts, including both those that outrightly state their Taliban affiliation in their profile as well as accounts that predominantly post pro-Taliban content, amplified the #AlFath campaign in several ways.

Between September 26 and 29, at least 26 accounts, nine of them created in August and September, all directly used #AlFath. Another 41 accounts associated with the Taliban, all created in August or September, tweeted or retweeted #AlFath.

On election day — September 28 — alone, @Zabehulah_M33 was the point of origin for 16 #AlFath notices, which were reposted by various Taliban-associated accounts. Reposting content, in comparison to retweeting, is the identical reuse of language from another tweet, posted as if it is an original tweet. Reposting content over retweeting it allows an account to pretend to be producing its own tweets, while not actually disseminating original content.

The reposts of @Zabehulah_M33’s content happened at a quick pace, suggesting a degree of coordination among the accounts. At 2:09 p.m. local time, @Zabehulah_M33 tweeted an #AlFath update about a blast at a polling site in Kabul and other attacks that “halted” the “electoral process.” In addition to #AlFath, the tweet also used hashtags to identify Khost and Kabul. In minutes, two other accounts — both created in August 2019 within a day of each other, with 237 common followers — reposted the same content.

Reposts of identical text under the #AlFath during the Afghan presidential elections from different accounts in a brief interval of time. Screenshots are in EDT, not AFT. (Source: @Zabehulah_M33/archive, top; @aorpWH7DuiAuxI1/archive, middle; @ansskhan11/archive, bottom)

@aorpWH7DuiAuxI1, an account that reposted @Zabehulah_M33’s update within one minute, exhibits some bot-like behaviors. Signs of bot activity include anonymity, amplification, common content, stolen/shared photos, and alphanumeric account handles. The account had an alphanumeric handle and a display name that, according to Google Translate, means “Afghan fighter.” It mainly amplified Taliban content through retweets and reposts. This account was not hyperactive, however, as is typical of bot-like accounts.

Several minutes after tweeting about events in Khost and Kabul, @Zabehulah_M33 used #AlFath again. This update was a bulletpoint list of some of the attacks that had occurred in Afghanistan so far that day, including the number of gunmen killed and the areas where the Taliban had achieved success. Paktika, Takhar, Baghlan, and Kunduz, all hashtagged in the tweets, are all contested areas that are neither controlled by the Afghan government nor by the Taliban. Within 40 minutes, another official Taliban account and five Taliban-associated accounts tweeted the same content under the hashtag.

An official Taliban account (on the left), along with identical #AlFath posts in the minutes after. (Source: @Zabehulah_M33/archive, left; @ygCfrV8SwOpSw8Z/archive, top right; @AhmadFa85225500/archive, middle right; @aibakaimal/archive, bottom right)

In the hours after, five more accounts copy and pasted the content in tweets without the hashtag #AlFath. In total, this particular #AlFath tweet was spread on 12 accounts, seven of which were created in August and September.

In addition to reposting #AlFath tweets, some of the 67 Taliban-associated accounts displayed similar bot-like activity. Five accounts that tweeted #AlFath between September 26 and September 29 used other suspiciously similar hashtags, often accompanied by an unrelated black-and-white image. All of the accounts still currently tweet hashtags with stock photos attached. These accounts’ common content, anonymity, and stock photo imagery suggest possible bot activity.

Two of the accounts repetitively amplifying #AlFath and other elections-related hashtags, including locations. (Source: @kiri_chey/archive; @FalkBaron/archive)

Notably, 10 of the 13 Afghan areas the five accounts hashtagged in their #AlFath tweets are all contested (parts of Jowzjan, Faryab, Paktika, Ghazni, Kunduz , Kapisa, Logar, Farah, Takhar, and Baghlan). Kabul was also hashtagged 12 times total in #AlFath tweets by these accounts.

Another 12 accounts that tweeted or retweeted #AlFath all displayed alphanumeric usernames likely generated by automation software, such as “lxTz1Wh9WvXCZrn,” “SchsUFAvvzYlbBc,” and “IK6ajMDVLxxXwnq.” Three of these accounts were made in August, and nine were created in September. Nine of the 12 accounts included no identifying information and featured either a stock profile photo or none at all. All of them retweeted official Taliban spokesmen. Two of the profiles have been flagged by Twitter for suspicious account activity, and one has since been deleted.

These indicators do not necessarily mean these accounts were bots; they could be real people or they could be cyborgs, mixing automated and authentic activity. It is also difficult to ascertain via open-source evidence whether the efforts to amplify #AlFath were coordinated by a single entity or many separate ones. Regardless, the effect is the same: various Taliban-associated accounts boosted #AlFath during the presidential election.

Countering #AlFath online

Since the Taliban was so clearly associated with #AlFath, a counter-hashtag supportive of the Afghan government arose. According to Sysomos, 5.5 percent of tweets that used #AlFath also used #AlFathFailed.

#AlFath and #AlFathFailed both registered in the top 10 hashtags on Sysomos over the last six months. (Source: @AlyssaKann/DFRLab via Sysomos)

The accounts that tweeted #AlFathFailed often also tweeted #AlFath, but their tweets were remarkably different in content to the other #AlFath tweets. In contrast to the Taliban-associated accounts’ remarks on the failures of the elections, #AlFathFailed tweets focused on the successes of the election and the Afghan National Security Forces.

Why #AlFath was amplified during the election

It is possible that the use of #AlFath spiked on September 28 — the day of the election — because there were significantly more Al Fath attacks than in any day or month previously. The Taliban’s self-reported monthly attack statistics both confirm and refute this.

On the one hand, their September report explicitly refers to the presidential election, in which the “Mujahidin of the Islamic Emirate, escalated their attacks on the elections day by carrying out nearly 314 major and minor assaults against the enemy.” This could perhaps explain the rise in the use of #AlFath.

On the other hand, the Taliban’s reports also list significant Al Fath operations in a separate section. Their September report mentioned 17 Al Fath operations, in contradiction to their mention of 314; their August report mentioned 12; and their July report mentioned 14. The September number does not alone explain the disproportionate use of #AlFath during the election.

The timing of the amplification, which intensified on September 28, first suggested that the goal of the hashtag was to intimidate Afghans from voting in the elections and assert Taliban dominance over the electoral process.