About Us
Who’s behind the pro-DICT troll wave?
- Art Samaniego
- PHT
- DICT
A cluster of suspicious Facebook accounts appeared to amplify positive comments defending the Department of Information and Communications Technology (DICT) following an online report about the alleged resignation of a DICT Undersecretary, based on a review of comment activity conducted by a security researcher.
The analysis focused on reactions to a Facebook post published by the verified page Politiko on February 25, 2026 at 8:02 p.m. The post reported that an undersecretary had resigned amid claims that DICT Secretary Henry Aguda interfered in a cybersecurity contract related to the 2026 ASEAN Summit.
The post generated 79 reactions, 38 comments and 20 shares. A closer examination of the comment section showed that a significant number of the positive responses defending the DICT and its leadership appeared to originate from accounts exhibiting patterns consistent with coordinated inauthentic behavior.
IN PHOTO: A Facebook post by the verified Politiko page reporting the alleged resignation of a DICT undersecretary triggered a wave of comments defending the agency and its leadership. A review of the comment section later found that the majority of the accounts posting supportive messages exhibited patterns commonly associated with coordinated or inauthentic activity.
Cluster of newly created accounts
The accounts identified in the analysis were largely created within a narrow window between February 10 and February 11, 2025, suggesting bulk account registration.
Many of these profiles also shared similar characteristics, including:
- Recovery emails using the zohomail domain, a platform frequently associated with anonymously created accounts.
- Near-identical follow lists including pages related to dropshipping, gaming, aviation services and online retail.
- Mutual connections among the same group of accounts, forming a tightly linked cluster.
- Minimal activity, typically posting only one to three emotional or generic posts per month.
Despite their limited activity histories, the accounts were observed posting defensive or supportive comments about DICT leadership within an hour of the Politiko post being published.
The analysis also noted instances of duplicate names and stolen profile images, including one case in which a profile reportedly used a photograph belonging to another person.
Possible coordination hub
Another profile was identified as a potential coordination or distribution account.
The Cebu City-based account, active since 2019 with around 2,800 friends and more than 5,000 followers, repeatedly tagged large groups of accounts in promotional posts.
In one instance documented in January 2026, the account tagged more than 40 users in a single product promotion, while another post tagged nearly 90 accounts, many of which overlapped with the cluster of suspicious profiles.
Such tagging behavior is commonly associated with engagement networks that test whether accounts remain active before deploying them in political or reputational campaigns.
Signs of coordinated amplification
The timing and similarity of comments supporting DICT leadership raised concerns about coordinated amplification rather than organic public reaction.
The accounts typically posted short, positive statements praising DICT programs, transparency, or leadership, often accompanied by heavy emoji use. Several comments also appeared within minutes of each other.
The pattern resembles previously documented troll amplification strategies in the Philippines, where networks of low-activity accounts are activated to influence online narratives during political controversies.
No direct evidence of government involvement
At present, there is no evidence indicating that the DICT or any government official paid for or directly controlled the accounts involved.
However, the pattern strongly suggests that a number of the positive comments defending the agency were not authentic expressions of public opinion, but instead originated from accounts exhibiting characteristics commonly associated with troll or sock-puppet networks.
Call for platform scrutiny
The digital researcher who helped me for this study said that cases like this highlight the need for stronger detection of coordinated inauthentic behavior on social media platforms, particularly when discussions involve government institutions and public accountability.
Monitoring and reporting suspicious accounts to platform moderators remain among the most effective tools available to curb the spread of manipulated online discourse.
As of this writing, the accounts identified in the analysis remain visible on Facebook