Deception and data: Inside pro-Anwar CIB network investigation

Summary

• The pro-Anwar CIB network was identified using a two-criterion test - boilerplate phrases and “rapid crossposting” - on a dataset of over 25,000 comments.

• Malaysiakini is releasing an anonymised dataset for scrutiny.

• The network operated for months without apparent action from Meta, raising questions about the platform's content moderation.

Yesterday, Malaysiakini revealed the existence of a 263-account network engaged in a coordinated campaign to artificially boost support for Prime Minister Anwar Ibrahim on his official Facebook page.

But proving that such a campaign is a centrally coordinated, inauthentic operation - and not just the work of passionate supporters - requires more than just suspicion. It calls for a rigorous, evidence-based methodology.

This report details how that case was built.

Building the case

The investigation began with a dataset of over 25,000 public comments.

The first step was to build a reliable tool to identify the network's shared script.

After a computational analysis identified thousands of frequently repeated phrases, a final manual selection was made to create a “boilerplate library”.

This curation was guided by a single, conservative principle: to distinguish between common topic keywords and specific, repeated linguistic artefacts that are unlikely to be generated independently.

For example, while many authentic users might comment about “batik” on a post about an Asean event, the analysis identified the exact five-word phrase “tgk delegasi asean pakai batik” (to see the Asean delegation wear batik) being used verbatim at a frequency that suggests a shared script rather than spontaneous expression.

With this library established, a high and conservative bar was set to define the network.

An account was only included in the coordinated inauthentic behaviour (CIB) network if it met two independent criteria simultaneously: it used at least two phrases from the boilerplate library and engaged in spam-like “rapid crossposting”.

To prove this network's behaviour was truly abnormal, its activity was benchmarked against a control group of 171 active commenters.

While no on-platform analysis can know a user's true intent, this group serves as a rigorous proxy for authentic behaviour for one key reason: by definition, its members exhibited zero of the specific, coordinated inauthentic signals this investigation was designed to detect.

Nuurrianti Jalli, an expert on online disinformation at Oklahoma State University who reviewed the investigation, endorsed this multi-layered approach.

“By requiring both conditions (boilerplate phrases and rapid crossposting), you minimise the chance of mistaking ordinary supporter behaviour for something more coordinated.

“The other checks you ran strengthen the case,” she told Malaysiakini.

For full transparency, Malaysiakini acknowledges that this investigation was based entirely on public data, lacking access to non-public information like IP addresses, which only Meta can access.

Furthermore, a different investigation might have used looser or stricter rules, or picked different phrases for the boilerplate library. These could produce a slightly different list of accounts.

To allow full scrutiny, Malaysiakini is publishing its complete dataset of over 25,000 comments and the full boilerplate library.

It has been anonymised in line with ethical best practices for social media research, and some data - such as the exact posts where comments were collected - have been removed to reduce the risk of de-anonymisation.

An organised, artificial network

With the network and its control group defined, the investigation could then analyse the network's collective character. The results paint a picture of an operation that is both organised and artificial.

A linguistic analysis known as a Type-Token Ratio (TTR) test, which measures vocabulary diversity, found the CIB network's language to be quantifiably artificial.

The accounts' vocabulary was significantly more repetitive and less diverse than that of both the “organic” proxy group and casual, one-off commenters on the page.

This artificiality was matched by a high degree of organisation.

To understand the network's internal structure, the investigation mapped out which accounts frequently posted in the same 10-minute time windows.

This analysis revealed that the network is not a random mob, but is compartmentalised into 27 distinct, coordinated clusters.

This cellular structure is a strong indicator of organised activity, where different groups of accounts appear to be activated in coordinated pockets.

Anatomy of deception

This artificial language was often deployed through deceptive personas designed to lend credibility to the scripted messages.

One of the network's most central operators, identified as “User08812” in the public dataset, provides a striking example.

In one comment, the account claimed to be a “university student” to praise the government's focus on Islamic heritage. In another, it claimed, “I myself work with foreign investors” to lend authority to a comment about foreign investment.

Both claims contradict the account's own public profile, which states its holder has been an engineer since 2013.

The network also frequently used religious framing to advance political messages.

Benjamin Loh, a researcher at Monash University Malaysia who studies Malaysian cybertroopers, noted this serves a strategic purpose: to “astroturf public support for Madani to show that ‘people’ are accepting that it is a more religiously considerate conservative government and not ‘liberal’.”

A test of policy

The 263-account network operated for months without any apparent public action from Meta, raising questions about the platform's content moderation practices.

Experts argue that platforms have a fundamental responsibility to act.

Ross Tapsell of the Australian National University suggests that platforms can be “complicit in the masking of influence operations” when they fail to act, as they “rely on consumers believing that what appears on their sites is largely useful and trustworthy.”

The call for such platform accountability has been the policy of the current government.

In an April 2024 meeting with social media companies, Communications Minister Fahmi Fadzil - who is also the PKR information chief - publicly urged Facebook and TikTok to increase their monitoring and “review the efficiency of algorithms” to detect CIB.

The discovery of this 263-account network, operating for months in 2025 in support of the government, now puts that stated policy and the platform's response to the test.

Unanswered questions

The coordinated disappearance of 76 accounts after official inquiries were made leaves the responsibility for a full accounting with Meta.

The platform's internal data, including non-public information like IP addresses, holds the key to definitively identifying the operators behind this network.

In response to Malaysiakini’s queries, Meta said its review “has not found evidence of violations of our coordinated inauthentic behaviour policy”.

The statement does not address the evidence of coordinated scripts and temporal clustering documented in this investigation.

It does not clarify whether this activity violates other platform policies, such as those against spam or “inauthentic behaviour”.

The Centre for Independent Journalism warns that CIB, if left unchecked, can “distort perceptions of public sentiment, drown out dissenting voices, and weaken the public’s ability to engage meaningfully in debate”.

Part 1: Investigation: Network of 263 ‘cybertroopers’ boosts Anwar's FB support

Part 3: Experts: Systemic challenges enable persistent influence networks

No sign of policy violations on Anwar's FB page, says Meta

Meta suspends Mkini's accounts following exposé on 'cybertroopers'

Investigation: Network of 263 'cybertroopers' spurs Anwar's FB support

Social media firms urged to implement verification using govt documents