Anatomy of a hate campaign: How a few powerful actors targeted an editor to frame journalism as a crime

A small number of highly active users, including a few prominent public figures, led a structured, organised and strategically amplified campaign on X against Guatemalan journalist José Rubén Zamora, who’s been in arbitrary detention for more than a thousand days.

This is one of the findings of an independent study of 675,835 X posts on Zamora’s case shared from July 2022 to January 2026 and collected by academic researcher Harald Waxenecker.

According to the study, presented here for the first time, most of the posts analysed were in support of the journalist. But the rest were shared and amplified in a way designed to harass Zamora and his family, portray his detention as a product of established criminal facts, and frame his journalistic work as an illegal activity that deserves prosecution and imprisonment.

1. Who is José Rubén Zamora?

Zamora is one of the most renowned investigative journalists in Latin America. In 1996, he founded elPeriódico, a newspaper known for its hard-hitting investigation into government corruption which was forced to shut down in 2023. Arrested in July 2022 under unsubstantiated money laundering charges, Zamora was sentenced to six years in prison in 2023.

The conviction was later overturned and a judge ordered a new trial. But Zamora remained in custody pending trial for more than three years before being granted substitute measures in February 2026. In July 2026, Guatemala’s Constitutional Court ordered Zamora’s release from prison. But he remains subject to other criminal proceedings four years after his arrest.

Zamora and his colleagues have investigated political corruption in Guatemala for decades. During President Alejandro Giammattei’s administration (2020–2024), Zamora’s newspaper elPeriódico published hundreds of investigations into alleged corruption. This included cases involving figures in the president’s inner circle, such as Miguel Martínez, who headed the government’s Centro de Gobierno.

Zamora’s column El Peladero regularly exposed alleged corruption and influence networks, including what he described as the capture of the Public Prosecutor’s Office and attacks against independent prosecutors and judges. His newspaper also contributed to scrutiny of the corruption scandals that led to President Otto Pérez Molina’s resignation in 2015.

In 2024, while Zamora was imprisoned, the Fundación Gabo awarded him its Recognition for Excellence, its career-achievement distinction. The Foundation cited his more than 30 years of “tenacious and courageous” journalism exposing corruption and human-rights abuses and described him as a paradigm of investigative journalism and a major symbol of Latin American journalism’s struggle against corruption. The award also recognised the broader legacy of elPeriódico, a newspaper which spent nearly 27 years investigating corruption, abuses by powerful actors, and crimes connected to Guatemala’s armed conflict.

2. What does the data say?

According to Waxenecker’s study, 76,681 of the 675,835 X posts on the case mentioned José Rubén Zamora by name, handle or nickname, and 3,717 posts mentioned Zamora and his sons, either by names or handles. Almost half of those posts (47.9%) attacked them with insults, dehumanisation, reputational discrediting, criminal allegations, threats and calls for punishment.

The research’s content, semantics, and network analysis showed a discursive strategy: the attacks focused on narratives of criminalisation that serve to portray Zamora’s family as dangerous, and his journalistic work as illegitimate. The data also shows a small network leading the attacks and amplifying them through repeated interactions between accounts, with certain influential voices playing a central role in setting and spreading narratives.

This network’s posts are not evenly distributed over time, but concentrate around key milestones in Zamora’s legal case, such as the closure of elPeriódico or the court granting him house arrest, showing narrative coherence and their capacity to maintain visibility around Zamora and his family over extended periods.

The increase in online activity also coincided with key legal developments in Zamora’s case, which has been criticised by international organisations. In 2024, the UN Working Group on Arbitrary Detention concluded that his detention lacked a legal basis and failed to meet international fair-trial standards. The IACHR documented prolonged pretrial detention, restrictions on his defence, judicial delays and pressure on his lawyers. Amnesty International raised similar concerns and designated him a prisoner of conscience in 2024.

Zamora went through as many as ten defence lawyers in nine months, with some of them facing criminal complaints, detentions or other forms of pressure, details mentioned in Waxenecker’s analysis.

“The legal proceedings against my father have been riddled with irregularities and can’t be understood without considering the digital campaign of which he has also been a victim,” said José Carlos Zamora, son of the Guatemalan journalist and editor. “Just creating doubt about his innocence because of his journalistic work is already a victory for the propagandists, because some people absorb that propaganda, believe it, and spread it.”

The data shows that posts containing criminal allegations and punitive narratives tend to be highly amplified. For example, each message with criminal allegations generates almost 50% more interactions than a non-attacking post.

“This demonstrates that content circulation is not neutral but selectively favours specific types of discourse,” concludes Waxenecker, lead author of the study. “Harassment and criminalisation [posts] co-occur more than five times more frequently than [it’s] expected by chance, indicating an intention of reputational degradation.”

Waxenecker’s work focuses on the intersection of corruption, organised crime and illicit networks, applying advanced Social Network Analysis (SNA) and data-driven methodologies. His recent work in Guatemala includes the research “Illicit Networks in Guatemala’s Congress: The Criminal Subversion of Democracy”, which examines how clientelism or illicit campaign financing influences the institution; and “Prosecution of Complex Criminal Networks: A Multilevel ERGMs Approach to CICIG’s Judicial Cases”, which uses advanced network modelling to analyse the International Commission against Impunity in Guatemala’s investigations.

3. What do those posts say?

The corpus of posts analysed by Waxenecker includes more than 55,000 distinct keywords, and it’s dominated by a small core of criminalising terms. These terms frame Zamora and his work as illegitimate and dangerous, and argue that he and his family deserve punishment. Zamora is often referred to as “criminal” (in Spanish, “delincuente”), “money launderer”, “corrupt” and “extortionist”.

Criminal allegations account for 21,250 keywords in unique messages (posts not duplicated in retweets or quotes), and 48,417 when criminalisation was amplified through reposts, shares, and quotes.

Messages with direct threats were posted 9,816 times as unique messages, but they received a “disproportionately high number of interactions,” showing an amplification almost three times higher than the original posting, with 26,559 interactions.

“Even when you develop ways to defend yourself against digital attacks, little by little you begin to feel their impact in real life as threats start to come in,” said Ramón Zamora, also a son of José Rubén. The network started publishing pictures of him when he was working as a professor at Universidad del Valle de Guatemala, along with mentions of the university.

Ramón recalls how this campaign also targeted and threatened elPeriódico’s advertisers, and how, one by one, they pulled out their support from the newspaper. “We lost every single one of them because of the fear of stigmatisation,” he told me.

Journalists were not immune to threats either. “The newsroom staff began asking, ‘Could we publish all our articles simply under the byline “Newsroom”?’ They began censoring themselves after seeing the threats online,” Ramón said. The newspaper shut down in May 2023, 27 years after its launch. Only its X account remains active, sharing updates on Zamora’s case and supporting investigations by other media outlets in Guatemala.

José Carlos Zamora, now Regional Director for the Americas at the Committee to Protect Journalists, was attacked by the same voices. One of the accounts even posted his home address and warned Univision, his employer at the time, that he was a “money launderer.”

“I thought that I was going to get fired and that anyone would just appear in my house with this violent message in their heads,” he told me. “The fear was tremendous. It was real.”

Both José Carlos and Ramón live outside Guatemala. A recently published report led by Carlos Martín Beristain and Sonja Perkič-Kremp identified José Rubén Zamora as an example of how criminalisation and imprisonment can extend their effects to family members. Being in exile, the report stresses, makes it even more difficult for the family to cover José Rubén Zamora’s basic needs in prison such as food, clothing and medical care, while supporting his legal defence and advocating publicly on his case.

4. The 44 accounts behind the attacks

The study by Waxenecker identified 95,265 accounts in X interactions, namely mentioning, reposting, replying or quoting messages about Zamora’s case 1.57 million times from July 2022 to January 2026. Only 13,471 of those accounts attacked Zamora and, most significantly, only 44 accounts initiated hostile narratives that other accounts then repeated and amplified.

As Waxenecker puts it, most accounts are peripheral or low-activity actors (84.2%) and the attacking network is organised around a relatively small but highly differentiated core of central participants which he calls “agenda-setters.”

The most prolific of these agenda-setters is the account @raulfalla31, with more than 21,000 attacking interactions. The account belongs to Guatemalan lawyer Raúl Amílcar Falla Ovalle.

Falla Ovalle is the legal representative of the Fundación Contra el Terrorismo (FCT), a right-wing NGO sanctioned by the European Union for using spurious criminal proceedings to target journalists, prosecutors, judges and government officials. According to the EU, these activities have contributed to the persecution of some of these actors and to undermining the rule of law in Guatemala.

The FCT was formally registered in July 2013 to defend former military officers prosecuted for crimes committed during Guatemala’s internal armed conflict. Its founders included businessman Ricardo Méndez-Ruiz (who’s still its president), Falla Ovalle, and several current or former military officers.

Over time, the FCT moved beyond its original purpose and became an actor in Guatemala’s political and judicial conflicts, filing criminal complaints and participating as a third-party plaintiff (in Spanish, “querellante adhesivo”) in cases involving anti-corruption prosecutors, judges, politicians and journalists, such as Zamora.

The next accounts acting as agenda-setters with the most attacking tweets are @eriol_gt (9,661 interactions) and @CEDEguate (9,430).

The former is a pseudonymous Guatemalan political account which publishes commentary amplified by figures associated with the FCT, according to local media. The latter belongs to lawyer Oscar Barrios Osorio, who has publicly defended the legitimacy of the criminal proceedings against Zamora.

Apart from the 44 most prolific posters, Waxenecker identified 226 accounts as “hybrid agenda-setters”. These users differ from the previous ones because, in addition to initiating narratives through content creation, they play an important role in amplification and in engaging with the conversation by replying to posts and sharing other responses.

Ricardo Méndez-Ruiz, president of the FCT, is the central actor in this group, with his account @rmendezruiz posting 13,940 attacking interactions. Other actors in this section include political commentator Luis H. Azmitia and anonymous accounts such as @panchovillai, @siempremiriamh and @_vadergt. This last account was also identified by investigative outlets in Guatemala in November 2025 as part of an anonymous network publishing attacks against journalists, judges and human-rights defenders.

In June 2025, José Rubén Zamora filed a criminal complaint against Ricardo Méndez-Ruiz and Raúl Falla Ovalle. He accused them both of obstruction of justice and described nine incidents that, according to the complaint, formed part of a broader campaign of intimidation, undue pressure and interference with the judicial proceedings against him.

In February 2026, Zamora petitioned Guatemala’s Registry of Legal Entities (REPEJU) to dissolve the Fundación Contra el Terrorismo, arguing that it was being used for purposes contrary to the rule of law and to persecute journalists and public officials. Zamora’s petition was dismissed.

The FCT did not respond to an enquiry requesting their view on the findings of this report. In July 2026, during an interview with Reporters Without Borders for a piece on the Foundation’s role in the persecution of journalists in Guatemala, Ricardo Méndez-Ruiz said that posts by FCT members target public figures who need to be called out for their involvement in corruption cases or money laundering.

5. Who was targeted beyond Zamora?

The study also identifies those receiving the largest volume of incoming mentions while generating little or no outgoing activity. José Rubén Zamora’s account, @ChepeZamora, overwhelmingly dominates this category, which also includes the accounts of his now defunct newspaper @el_periodico and his son José Carlos, as well as several accounts from anti-corruption campaigners and public officials.

“The near absence of outgoing activity among these actors indicates that attacking discourse is heavily organised around symbolic targets that concentrate attention, hostility and public referencing,” concludes Waxenecker. “Many of these actors correspond to journalists, media organisations, public institutions and anti-corruption figures, reinforcing the interpretation of attacks as coordinated forms of discursive targeting.”

The research also identifies two other groups:

• Discourse brokers, who play a key role in keeping conversations active around the hostile narrative imposed by agenda-setters by replying to them and to other accounts who interact, but without receiving replies or interactions themselves.
• Quantitative amplifiers, 990 accounts focusing on scale diffusion through reposting and sharing.

The following figure shows the core attack network and displays some of the central actors. Orange lines represent the replies and quotes shaping the conversations, while green lines represent amplification activity, including quoting and reposting. Agenda-setters are shown in red, discursive targets in green, and other quantitative amplifiers in yellow.

The analysis reveals a “clear pattern of selective amplification” driven by a strategically constructed system that generates higher visibility and has a large impact despite representing a small proportion of the interactions in the case.

José Carlos and Ramón Zamora have spoken with their father about the impact of this online network. “He is not surprised,” said Ramón. “He has lived with this persecution for a long time and this is the continuation of criminalisation campaigns that started decades ago.”

José Carlos said that for his father this online hate campaign is the natural evolution of the kind of institutional attacks and TV propaganda campaigns he’s suffered for decades. “The channels have changed,” he said. “But the final goal is to silence journalism and to kill the truth”.

Both Ramón and José Carlos think the campaign against their father was intended to send a broader message to Guatemala’s journalists and undermine freedom of speech.

José Rubén Zamora’s anti-corruption reporting, Ramón told me, led journalists to believe someone of his stature would be protected. His detention, the harassment campaign he’s suffered and the criminalisation against him have now served as a warning to other journalists and media outlets to silence their reporting on abuse of public power.

José Carlos similarly describes the scale of these digital attacks as “simply overwhelming” for any colleague targeted by it.

“No journalist should have to endure something like this,” he said.

An executive summary of the study ‘Online attacks against José Rubén Zamora’ made by Harald Waxenecker can be found here in English and Spanish.