In July this year, we published an article in The Interpreter that identified an information operation in the Indonesian social media environment centred around Pakistan using their J-10 fighter jets to shoot down at least one Indian Dassault Rafale. Narratives portrayed the Chinese-made J-10s as superior to the French jets, alleged corruption in India's Rafale acquisition, and falsely suggested Indonesia was cancelling its own Rafale order. A portion of this disinformation was circulated on X with the hashtag #HentikanRafaleDeal (#StopRafaleDeal) and echoed pro-Chinese narratives. While Indonesia’s Rafale procurement is proceeding, the country did ultimately purchase 42 J-10s in October.
In recent days, X has introduced a new transparency feature that displays the primary location of user accounts. This feature immediately exposed dozens of popular accounts as possible inauthentic agents – including those associated with US politics. This has prompted our research team to revisit our previous findings and assess the extent of the probable flow of false narratives and foreign interference in the Indonesian social media ecosystem.
We collected user data from the 91 posts using the #HentikanRafaleDeal hashtag on 11 June. Of the 85 unique accounts identified, most have remained active, with only a small number suspended or missing location data. Half of these accounts were less than 12 months old at the time of the campaign and nearly all were located in Indonesia. These newer accounts were responsible for 70% of shares of Zona Jakarta’s allegations of corruption in India’s Rafale acquisition.
A content analysis applied to these narratives reveals behaviour consistent with paid cybertroopers – known in Indonesia as “buzzers”. Most of the accounts advertised Prabowo Subianto government policies, including his flagship free school meal program and initiatives on food self-sufficiency. Yet their loyalties are fluid: for instance, the same networks promoted rival candidates in the same electoral races, suggesting that genuine political partisanship does not dictate their allegiances. A coordinated cluster of these accounts also spread positive narratives about the Indonesian police force, amplifying law-and-order messages and subtly promoting the police amid their ongoing rivalry with the military. At the same time, nearly all accounts moonlighted as digital marketers, promoting mobile phone brands and e-commerce platforms.
The buzzer phenomenon first became noticeable in the 2012 Jakarta gubernatorial election campaign, and has since become a fixture in Indonesian politics. Initially ad hoc and organised around political candidates, cybertrooper networks have evolved into a professionalised industry that operates well beyond election periods – spanning political campaign influence campaigns and marketing, and adopting click-farm tactics to artificially amplify narratives and sway public opinion. Indonesia has a history of using disinformation to sway domestic political outcomes and suppress opposition. One example came in 2021, when an orchestrated pro-government campaign flooded Twitter with content promoting Papua’s special autonomy to undermine separatist sentiments in Indonesia’s easternmost region.
The possibility remains that external powers are exploiting the institutional rivalry between police and military, particularly over state resources.
On the surface, our new data suggests that the anti-Rafale campaign was generated domestically. However, attribution is complex and foreign interference cannot be definitively ruled out. Information operations can and often are outsourced to seemingly independent parties – such as influencers, marketing firms, or local networks– to obfuscate the narrative’s true origins and provide plausible deniability and authenticity. In many cases, these individuals may not be aware of the foreign state links to the narratives they spread. This technique is known as narrative laundering and exploits a person’s trust in familiar or seemingly independent sources, undermining their ability to judge the credibility or ultimate source of information.
Moreover, an account’s location can be easily misrepresented using a virtual private network (VPN). While X's transparency feature flags VPN usage, not all VPN users have malicious intent; many employ them to circumvent censorship, protect personal data, or simply access geoblocked content. Location features can offer some indication of inauthenticity, but are only one element of a broader picture. Malign actors are likely to adapt to these detection methods.
Foreign powers may also seize on existing domestic influence operations to amplify their messages. The Australian Strategic Policy Institute documented such a case in the Philippines in 2024, where a local influencer known for supporting former president Rodrigo Duterte uploaded a deepfake video of President Ferdinand Marcos Jr taking illegal narcotics. Dozens of inauthentic X accounts linked to the Chinese government's Spamouflage network then swept in and amplified the video for their own purposes.
In the Indonesian context, we have yet to see clear evidence of foreign involvement. However, the possibility remains that external powers are exploiting the institutional rivalry between police and military, particularly over state resources. Prabowo, a former military general and defence minister, recently introduced austerity measures while, at the same time, maintaining his longstanding commitment to military modernisation. Some narratives under #HentikanRafaleDeal centred on criticising military procurement amid such budget constraints, framing it as imprudent given the recent Rafale shoot-down in India. It is equally plausible that domestic actors leveraged and amplified China’s Rafale-related disinformation. In such cases, domestic and foreign influence operations can reinforce one another, with or without explicit coordination.
Attributing information operations to a specific actor remains challenging: disinformation can be home-grown, operations can be outsourced, and digital signatures can be falsified. What this data does offer is insight into how disinformation flows through the social media environment – revealing the accounts and networks that amplify and localise misleading narratives, regardless of their ultimate origin.
