A t 6:02 a.m. on August 27, 2017, the president of Guatemala, Jimmy Morales, uploaded a video statement to Twitter declaring the former Colombian judge Iván Velásquez a persona non grata and ordering his expulsion from the country. Velásquez is investigating corruption on behalf of a United Nations-backed commission in Guatemala, and had recently moved to strip Morales of immunity from prosecution and open an investigation into his campaign financing. Velásquez’s commission had already helped send the president’s son and brother to trial for defrauding the government. The expulsion order was immediately decried as an outrageous act of blatant self-interest. Anger grew further when Guatemala’s congress, concerned that the anti-corruption efforts would reach them, too, voted to preserve the president’s immunity, and also tried to soften penalties for campaign finance violations so that some criminals could buy their way out of prison sentences with fines. Morales’s declaration was blocked in court and, on September 20, a national strike shut down both the capital city and the provinces in protest of the “pacto de corruptos,” or the “pact of the corrupt.” But amid the cries for Morales to step down, a counter-campaign surged, mostly online, in defense of Morales, and against Velásquez and his commission, which is known by its Spanish-language acronym CICIG. Vicious attacks against Velásquez and his supporters circulated on Twitter and Facebook, as well as in blasts to WhatsApp groups. CICIG was a plot by the United States, an “invasion of sovereignty.” Or, it was a communist scheme, “extortion” that would lead to a “dictatorship equal to Venezuela, equal to [Hugo] Chávez.” Some of the attacks combined these arguments into a confusing mishmash. Velásquez was a stooge, a plant, accused of fomenting a coup. His main ally in government, Attorney General Thelma Aldana, received the same abuse. The falsehoods flew, often clearly originating from fake accounts, but also retweeted and reposted by prominent right-wing commentators. It was the Guatemalan version of a form of information warfare now familiar the world over, with a homegrown name: the net center. Interviews conducted in Guatemala with researchers, journalists, activists, and other sources, as well as reports in the Guatemalan press, show how net centers are now used routinely and relentlessly to harass and intimidate opponents of Guatemala’s entrenched elite. They also reveal what precious little intelligence has been gleaned on the ground about these shadowy operations, which leave little or no paper trail and which appear to operate with protection from the nation’s powerful business interests, long allied with the military. Details vary, but net centers often involve dozens of young men managing hundreds of fabricated accounts, are often attached to more conventional online marketing businesses based in Guatemala City — and usually operate on behalf of the far right. The name net center is a riff on “call center,” which is a big business in Guatemala, especially for English-speaking deportees from the U.S. The ultimate funding of the net centers remains murky, but they’ve come to stand for the latest technologically-enabled iteration of Guatemala’s long experience with violent campaigns to crush democratic organizing. And despite the fact that well under half the country’s population is online, the falsehoods still quickly contaminate the broader public discourse, observers say. Guatemala is caught up in what has become a global problem. “Armies of ‘opinion shapers’” are now used on social media by the governments of 30 countries to support their agendas and attack detractors, according to a report by the nonprofit Freedom House. The report also said that digital malfeasance was used to manipulate elections in at least 18 countries from mid-2016 to mid-2017. Other analysts have documented local variants of political social media manipulation around the world: Mexicans, Peruvians, and Hondurans refer to theirs as “Peñabots,” “Fujitrolls,” and “JOHBots,” after their current or former presidents; Turks have “AK Trolls”; Philippine president Rodrigo Duterte reportedly has a “keyboard army” defending his murderous regime. Guatemala may be unique in the degree to which private interests have been implicated in the trolling, as well as the pervasiveness of the phenomenon. “It’s happening in other countries, but not with the intensity and strength that it’s happening here,” said Luis Assardo, a Guatemalan journalist who has tracked the rise of net centers. When attorneys for Facebook and Twitter were hauled in front of a U.S. Senate committee in October, most lawmakers were laser-focused on how those social networks were used by Russia to spread propaganda in favor of Donald Trump during the 2016 elections. But Democratic Sen. Patrick Leahy made the point that the companies had an even greater responsibility in developing countries, where, he said, “the consequences of divisive fake information can be dire, not just in an election, but [in] people’s lives.”

The Chief of the International Commission Against Impunity in Guatemala, or CICIG, Colombian Iván Velásquez, second to the left, participates in the events marking International Anti-Corruption Day, in Guatemala City, on Dec. 9, 2015. Photo: Johan Ordonez/AFP/Getty Images

T he online disinformation campaign against CICIG has roots that go all the way back to Guatemala’s brutal civil war. The conflict, between right-wing military forces and leftist guerrillas, began in 1960, a few years after the United States backed a coup that overthrew Guatemala’s president Jacobo Árbenz. Over the course of 36 years, more than 200,000 people were killed. A U.N. commission later found that Guatemalan security forces, with funding and training from the U.S., were responsible for more than 90 percent of arbitrary executions, forced disappearances, and other human rights violations during the war.

“This resistance is because justice is arriving to sectors where it never reached before.”

After the peace accords that ended the war in 1996, the army was given amnesty for many wartime crimes; the military remains an entrenched and often lethal force, joined in an unholy alliance with business interests and the political elite. It was ongoing threats posed by clandestine intelligence and paramilitary forces, as well as pressure from civil society to do something about them, that led to the formation of CICIG. The commission began work in 2008 with a mandate to help dismantle the secret military apparatus, to investigate corruption and organized crime, and to propose policies to strengthen Guatemala’s judicial institutions. But the commission really gained momentum after Velásquez, who had spent years prosecuting politicians linked to the paramilitary in Colombia, came to the country in 2013. “Corruption in Guatemala isn’t episodic, temporary, a one-off,” Velásquez said in an interview with The Intercept, in his office in Guatemala City last December. “Instead, it’s structural and systematic. It’s corruption that has led to a complete capture of the state; that’s how it perpetuates itself and that’s why it continues despite the arrest and prosecution of the leaders of these structures.” Working with the attorney general, Thelma Aldana, Velásquez has rolled out one case after another, turning the two anti-corruption crusaders into beloved household names. Beyond the investigation into the current president, Jimmy Morales, the commission has taken on three former leaders of Guatemala. It brought down Morales’s predecessor, Otto Pérez Molina, by uncovering a multi-million-dollar customs bribery scheme allegedly involving Pérez Molina and his vice president. The revelation sparked the biggest protests Guatemala had ever seen, culminating in Pérez Molina’s resignation and arrest in a single day in September 2015. Last fall, CICIG accused Álvaro Arzú, another former president and the current mayor of Guatemala City, of financing part of his campaign for re-election as mayor with municipal funds obtained by creating fake payrolls. And in February, police arrested former president Álvaro Colom and nine members of his cabinet, as a result of an investigation into a deal for a new bus system in Guatemala City. Corruption investigations by CICIG have also hit the private sector, leading to arrest warrants for executives at two of the country’s biggest banks; a former executive at the behemoth cellphone company Claro; the former manager of the Guatemalan mining firm Montana Exploradora (a subsidiary of the Canadian GoldCorp); and the owner of a local television monopoly. Another group recently marked by CICIG includes leading businessmen, a judge, and the vice president of congress, all accused of running a bribery scheme with the Guatemalan tax authority to expedite tax returns. This January, CICIG and Attorney General Aldana announced that they had traced $17.9 million in bribes paid to local officials, politicians, and private citizens by the Brazilian construction giant Odebrecht, which has confessed to paying kickbacks throughout Latin America. “This resistance against CICIG and Iván Velásquez is because justice is arriving to sectors where it never reached before,” Jordán Rodas Andrade, Guatemala’s ombudsman for human rights, told The Intercept. The current president, Morales, once publicly supported CICIG’s charge. Commonly called just “Jimmy,” Morales is a former TV star, a comedian known for an offensive blackface routine, who had never before held elected office. His populist 2015 campaign surged after Pérez Molina’s downfall, as he rode to the presidency with the message that he was “not corrupt, not a thief.” But the candidacy that Morales touted as clean-slate had in fact been sullied by some of Guatemala’s darker forces; Dina Fernandez, a journalist with Soy502, said, “the general perception is that he’s the puppet of other interests.” He ran with the far-right National Convergence Front, a party of retired army officers, some of whom were accused of participating in war crimes. Recently, he was criticized for appearing with wealthy ranchers who are, according to Ricardo Barrientos, a former official in the Ministry of Finance writing on the news site Plaza Pública, “most famous for their possible ties to narco-trafficking and for their traditional and shameless record of evasion of taxes” Morales’s clumsy attempt to expel Velásquez, which came almost two years to the day after Velásquez brought down Pérez Molina, showed audacity but also political naiveté. Elite Guatemala, in contrast, wields power through stealth. Corruption is mostly committed below labyrinthine layers of deniability; murders usually ordered through a chain ending in the man who fires the weapon. The networks now defending Morales are deep-rooted and agile, and as technology evolved, they have adopted net centers as a new undercover attack mechanism.

Campaign posters featuring presidential candidate Jimmy Morales, of the National Convergence Front, are passed out during a rally in Chichicastenango, Guatemala, on Oct. 17, 2015. Photo: Moises Castillo/AP

N et center is a term used loosely in Guatemala, to describe anything from a troll at their laptop to a full professional public relations campaign. But principally, it refers to people paid to produce and disseminate fake news stories, and to fabricate Facebook and Twitter profiles in order to attack foes and spread misinformation. Tactics can include viral WhatsApp campaigns, doxxing, and hacking; targets are typically activists or journalists. By most accounts, net centers operate from nondescript offices in Guatemala City, often as part of companies that also do legitimate communications work. One source, who has never been involved with a net center but was exposed to their operations during a career in marketing, said that one such operation comprised about 15 to 20 young men, sitting at rows of computers, each wielding between 100 and 200 fake accounts. (The source asked not to be identified out of fear of retaliation from the owner of the center.) The men worked from a handbook of scripts, blasting out comments and links, targeting users, and exploiting strategies to get their tweets shared widely and featured on TV news shows. The center also ran WhatsApp campaigns using a third-party database of phone numbers, the source said. A 2016 investigation in the Guatemalan news magazine ContraPoder reported that net center employees made hundreds of profiles, which regularly posted about sports and religion so that they looked like real people; when needed, the accounts would pivot to posting in support of a political candidate. ContraPoder uncovered a proposal from the 2015 election from a net center, which, for $375,000, would work seven days a week on both positive marketing and attack campaigns. The contract also suggested that the company would continue working with the government if the candidate should win. An anonymous account published in the Guatemalan daily Diario Digital in 2016 described the same sort of work. Teams of about 20 young men, paid a few hundred dollars a month, without any particular political affiliation but with marching orders to defend a client candidate or attack their opponents. The work is mercenary: According to most accounts, at least in the 2015 campaign, a single net center might work for multiple campaigns simultaneously, or shift to another candidate when the original client drops out. “There are marketing businesses that have net center services to generate public opinion via social media, and they’re at the service of the highest bidder,” said researcher David Oliva, a digital security consult with Fundación Acceso, a Costa Rica-based organization that works on internet freedom. The journalist Assardo said that there were two big net center operations that worked for all the major candidates in the 2015 elections. Since then, former employees told him, those businesses have taken on clients in other Latin American countries, bringing managers and supervisors from Guatemala to set up the new operations. Domestically, Assardo believes, much of the postelection political trolling comes from smaller, less sophisticated shops — often marketing agencies — which offer services ranging from social media monitoring and support to full-on attack campaigns. “The majority of net center offerings are smear campaigns,” Assardo said. “They are directed to destroy the reputation of whichever people are on their list.” Human rights activists and media figures have also described hack attacks against their Twitter and email accounts. The online newspaper Nómada, which takes an outspoken anti-government line, was subjected to months of denial-of-service attacks last year, editor-in-chief Martín Rodríguez Pellecer said in an interview. Pellecer’s personal Twitter account was also hacked and his direct messages published.

Guatemala’s former dictator, Gen. Efraín Ríos Montt, enters court in Guatemala City, on April 19, 2013. Ríos Montt seized power in a March 23, 1982, coup and ruled until he himself was overthrown just over a year later. Prosecutors say that, while in power, he was aware of, and thus responsible for, the slaughter by subordinates of at least 1,771 Ixil Mayans in Guatemala’s western highlands. Photo: Luis Soto/AP

Outside the electoral realm, the motivations behind online attacks vary, but most seem aimed at maintaining the ecosystem favored by the military and its allies in business and politics. Online trolls sprouted up during the 2013 trial of former dictator Efraín Ríos Montt, going after the lawyers and activists trying to convict Montt and other officials of acts of genocide committed during the civil war. Montt was convicted at trial, but the conviction was overturned, and a retrial was under way when the general died earlier this week in Guatemala City at the age of 91. Sandra Morán, a leftist senator new to politics, told The Intercept she frequently receives net center threats and insults related to her anti-corruption posture, the fact that she’s a lesbian — the first out congressperson in the country’s history — and to her support for reproductive rights. Mariel Aguilar-Støen, an associate professor at the University of Oslo, who studies conflict between social movements and the elite in Guatemala, said that she has seen a profusion of online smear campaigns against Mayan activists protesting infrastructure projects in the rural highlands — smears that make use of racist stereotypes about indigenous people. “It’s been amazing to see how the public sphere gets contaminated with all of these false profiles,” Aguilar-Støen said. “It really has an effect on public opinion.” Andrea Ixchíu, a K’iche Mayan writer and activist, said, for her, it’s clear that “these tools of dark forces that have always been at work in Guatemala are going to keep going, now on the internet,” she said. “Just like in the old days, they came to your house to threaten you, now the cheaper and easier way to do it is online.”

“The public sphere gets contaminated with all of these false profiles. It really has an effect.”

Now, net centers seem to have coalesced against CICIG. Nearly everyone that we spoke to who has taken a public stance on CICIG could show us a smartphone’s worth of slanderous posts against them. Álvaro Montenegro, a 29-year-old student activist and one of the co-founders of #JusticiaYa, a civil society anti-corruption coalition, said that he and his fellow organizers had been “systematically attacked” on Twitter and other social media. He was featured in a YouTube video that accused him of destabilizing the state. A professor of his had seen it and approached him about it, teasing him but also genuinely concerned for his welfare. Some of the pro-Morales propaganda likely originates with the government itself. Persuasive evidence emerged that a notorious Twitter persona called DictaLord was likely a member of Morales’s campaign communications team: Marvin Palacios Castillo, the son of a powerful family within Morales’s party who has himself run for congress in the past. Castillo is known to still have two contracts with the presidency, totaling over $100,000, related to social media monitoring. Though widely referenced as DictaLord in Guatemala, Castillo denies running the Twitter handle (Multiple requests for comment to the presidency went unanswered.) CICIG and the attorney general “have made powerful enemies who have sought to undermine the fight against corruption, including through smear campaigns,” U.S. Rep. Norma Torres wrote in response to questions from The Intercept. Torres, a Democrat from California who was born in Guatemala, has been outspoken on issues related to the country. It’s still not clear who is paying for the net centers or the recent anti-CICIG campaigns specifically. In a hearing before the House Foreign Affairs Committee in February, on U.S. “cyber diplomacy,” Torres asked cybersecurity experts how they might “find out who is actually paying for them” and “push back.” Many people we spoke to insinuated that the real money behind the campaigns comes from business elite allied with former military, but tying particular backers to net center campaigns is still tricky. “There are lots of hints that the private sector is funding net centers, but little evidence,” said Aguilar-Støen. What is clear, however, is that there is an echo chamber between pro-Morales, anti-CIGIG accounts and the public positions of many tied to the Guatemalan military and their conservative sponsors.

Guatemalan President Jimmy Morales, third from the right, attends a military parade during the celebration of the Army Day in Guatemala City, on July 3, 2016. Photo: Johan Ordonez/AFP/Getty Images

During the summer of 2016, for instance, a slew of near-identical social media comments suddenly appeared to support Morales’s decision to authorize a military parade through the streets of the capital. The decision was controversial, because for years the parade had been held at a military facility, so as not to flaunt the forces that had killed so many people during the civil war. The copy-paste nature of the commentary was so obvious that the media quickly labeled it a net center campaign, though Morales denied any knowledge of one. The message pushed by anti-CICIG bots gets amplified by real conservative political commentators and fans. In November, Nómada published an analysis by a sociologist, Harald Waxenecker, of an anti-CICIG, pro-Morales hashtag that first emerged the day that Morales declared Velásquez a persona non grata. The hashtag appears to have originated with a fake account that tweeted at notorious conservative personalities, whose retweets and replies were then further magnified by the “secondary nodes” of anonymous Twitter users. Waxenecker’s analysis of this and other incidents throughout the fall showed how anti-CICIG hashtags flourished, via both fake and real accounts, in response to political developments. One of the real accounts on which Nómada focused was that of Ricardo Méndez Ruiz, creator of the Foundation Against Terrorism, who is known for bringing dubious legal cases against lawyers and activists, and intimidating journalists online. During Montt’s war crimes trial, the foundation called accounts of genocide during the civil war a “farce.” Méndez Ruiz is former military himself, as well as the son of a colonel and former minister of the interior who was sought by the public prosecutor for allegations he was implicated in war crimes but died just before capture, while the foundation’s members have also included high-level military men, themselves implicated in crimes. Méndez Ruiz has become a notorious troll, his Twitter feed a litany of anti-CICIG memes and commentary. He also has used columns and media appearances to push his line. Funding for his enterprise remains opaque; in 2013, Méndez Ruiz told Plaza Pública that he could not say who financed the organization, but that money came from “major businessmen in the country.” A lawyer close to the foundation is suing Nómada for including her in their analysis. (Méndez Ruiz did not respond to multiple requests for comment.) Also contributing to the echo chamber, according to Nómada and others we spoke to in Guatemala, was Rodrigo Polo, a social media specialist who activists like the feminist Isabel Juarez say is behind online campaigns attacking human rights defenders. Juarez says she was targeted by a Polo video after she pioneered the hashtag #fueelestado, or “it was the state,” when 43 girls in a government-run shelter burned alive. Polo, whose Twitter account was suspended in February, told The Intercept, “I do not participate in any net center, nor does it interest me to do so,” and said he had never been paid by any politician. His fight, he says, is against what he believes to be networks that promote beliefs like a “third wave feminism … that in practice seeks a gender vengeance,” made up of actors like Velásquez, Aldana, human rights activists, George Soros, U.S. Agency for International Development, Oxfam, and others. He argues that the work of CICIG violates Guatemalan law. The fake profiles are difficult to trace because their host platforms, like Twitter, Facebook, and YouTube, mask their precise location, said Oliva, of Fundación Acceso. Journalists in Central America have denounced fake profiles and reported them to social platform operators to no avail, said Rodrigo Baires, a Salvadoran data journalist who, like Oliva, trains regional human rights workers and journalists in digital safety. Baires said that a new focus of his courses is teaching people easy ways to trace online attacks to IP addresses. Identifying and exposing those who spread disinformation is one thing; prosecuting them is something else. In November, at the prompting of Nómada, Plaza Pública, and other independent news media, the public prosecutor’s office opened an investigation into net center attacks against journalists. Assardo pointed out that Guatemalan law provides no protections against doxxing, or ways to unmask people committing fraud online. But most of the media commentators we interviewed in Guatemala expressed concern about regulating net centers, worried that any law that could be used against them could also limit freedom of expression. Such reservations mirror concerns in the U.S. over measures intended to curb Russian propaganda. Velásquez told The Intercept that CICIG cannot investigate net centers just “for being net centers.” Rather, he said, “our investigative interest is the extent to which they’re tied to organized crime,” he said. He declined to confirm or deny whether sufficient evidence has materialized for him to open such an investigation, although, in a tweet in January, he suggested that he might. Criminal enterprises use propaganda, he tweeted, “to make crimes seem normal and push defamation campaigns to take away the credibility of investigators.”

Former Guatemalan President Otto Pérez Molina arrives in a police vehicle to a court hearing in Guatemala City, on Monday, June 13, 2016. The ex-president faces charges of money laundering and conspiracy. Photo: Moises Castillo/AP

I n Guatemala, the global problem of fake news roosts in the country’s history. And given that history, it’s small wonder that a net center attack is understood to foreshadow something worse. Guatemalan activists, especially in indigenous communities, are still killed with impunity and face other repression. Many Guatemalans believe that provocateurs have infiltrated recent protests, and worry about online menaces turning violent. The genocide trial and the unprecedented popular uprisings of recent years may have threatened the corrupt status quo, but haven’t yet ended it, as Guatemalans learned from the fall of Pérez Molina and the rise of Morales. “The army, the intelligence agencies, they are more like the heart, the deep state, because as Jimmy Morales proved, they can take away the president, and they’re still there,” said Pellecer, of Nómada. The stakes may be even higher now, Pellecer added, because “they don’t want to lose a president again.” The online disinformation campaign against CICIG has had an impact, said Fernandez, the Soy502 journalist: “It’s appealed to deep fears of this society, especially among its elite and its urban population.” The net centers’ reach is especially potent among the urban middle class, traditionally a more conservative sector, which has been activated for the recent anti-corruption marches but could shy away from bigger reforms. Carlos Arrazola, editor of Plaza Pública, said, “This is a very conservative, religious country, extremely racist and classist.” For those people, he said, “Velásquez became the head of the communist plot.”

“The deep state… they don’t want to lose a president again.”

Guatemala’s very poor are still mostly offline, but Assardo noted that even in “places where there’s no internet, [people] know perfectly well the problems that [smear campaigns] have tried to cause Iván Velásquez, and others will say that the CICIG is bad and has done bad things.” What the net centers “do in the end is pure propaganda. Distort information so that when it reaches the population its very difficult for them to tell what is truth and what’s a lie.” Assardo believes that net centers currently supporting Morales against CICIG are preparing, already, for the 2019 elections, “sharpening their strategies to be the most precise in who they attack and how, and who benefits.” (Guatemala limits presidents to a single term, so Morales cannot run.) Some fear that those in power will also move to protect themselves with more traditional means. While efforts to remove Velásquez have so far been blocked in court, recent months have seen the firing of the reform-minded head of Guatemala’s tax agency, the head of the national police, and the interior minister — moves widely seen as being in relation to their support for CICIG. The term of Aldana, the attorney general, is up in May. To choose her successor, a committee of 15 lawyers — themselves “prone to political manipulation,” according to the International Justice Monitor — will choose a pool of six candidates; from that group, Morales himself will pick the new attorney general. Already there are signs that the old power alliance is trying to stymie the process. In January, Aldana told the press that Morales “is not an ally” in the fight against corruption. Thus far, at least, Morales’s alleged acts of corruption pale in comparison to his predecessor, who CICIG found to be part of a clandestine network that accepted some $3.7 million in bribes for customs fraud, and to the kinds of brazen and byzantine corruption that CICIG regularly turns up. But the level of tolerance among the public for embezzlement and ongoing inequality is lower now, and Morales’s voters have been quickly disillusioned. CICIG says Morales’s party’s 2015 campaign included more than $800,000 in funds from unknown origins, and there’s also a matter of a previously undisclosed “bonus” of $7,300, which he was paid monthly by the military — a sum that raises his salary by more than one-third and places him among the best-paid leaders in Latin America — and which previous Guatemalan presidents say they did not receive. He’s also recently come under fire for using state money for $40,000 in personal expenses, including top-shelf whiskey, $3,000 sunglasses, dry cleaning, and even breath mints. The personal expenses story “has majorly damaged his image in front of the population,” said Pellecer. “The president is now nothing more than a political actor for a corrupt congress and the economic elite, who support him as a force against CICIG.” CICIG remains very popular, and its recent announcement of charges against former president Colom and his deputies, among them respected left-wing figures, have helped insulate it against charges that it only targets right-wing politicians.

House Homeland Security Committee member Rep. Norma Torres, D-Ca., questions witnesses during a hearing about worldwide threats to the U.S. in Washington, D.C., on Oct. 21, 2015, Photo: Chip Somodevilla/Getty Images