How a Filipino reporter exposed the disinformation networks defending Duterte after his arrest

On 11 March, former Philippines President Rodrigo Duterte was arrested in Manila and flown to the International Criminal Court (ICC) at the Hague. The ICC warrant accuses Duterte of criminal responsibility for the murder of at least 43 people between 2011 and 2019 as part of his so-called ‘war on drugs’. 

After taking oath as president in June 2016, Duterte vowed to wage a war on the country’s illegal drug problem. “I don’t care about human rights, believe me,” he said. He claimed there were 3.7 million “drug addicts” in the Philippines and said he would “have to slaughter these idiots for destroying my country.” 

As president, Duterte withdrew the Philippines from the ICC in March 2019.  By 2022, when his term as President ended, human rights advocates and the ICC prosecutor estimated some 30,000 people had been killed by police and unidentified individuals. In 2021, prosecutors launched the investigation that resulted in his arrest. 

During the 12-hour window between Duterte's morning arrest and his late-night flight to The Hague, reporter Cristina Chi  discovered at least 200 different Facebook accounts and pages publicly posting an identical messages framing Duterte’s arrest as “kidnapping” and an “illegal detention.”  

“The coordinated message blitz bears signs of what disinformation researchers call copypasta – identical text copied and pasted across the internet by individuals, usually at the same time,” wrote Chi, a reporter covering influence operations and disinformation for Philstar.com. 

In subsequent weeks, media outlets such as Reuters confirmed that “the wave of pro-Duterte disinformation” was boosting support for the narrative that Duterte was kidnapped by the court at the behest of his successor’s government.  

I recently spoke to Chi about her research into these narratives. She explained how she identified the story, what lessons she draws from her investigation, and what others can learn from her work.  

Q. Can you walk me through the process of identifying the story? Who identified it? What caught their eye? 

A. I was in charge of the story from start to finish – from gathering data, to the cleaning of data, to its analysis, to the organisation of findings, until the writing of the story.  

Shortly after the arrest of Duterte, I already had the sense that the arrest itself would be spun and framed misleadingly by the online disinformation networks that typically spread pro-Duterte narratives. 

I have been reporting on influence operations since 2023, so I already have an inkling of how these narratives start and spread. As we know, polarising news events are like dry tinder for the spread of disinformation and influence operations. 

I work for a relatively small newsroom and I don’t have access to a lot of paid tools. Since the death of CrowdTangle – the free tool we previously used for monitoring disinformation – I’ve been manually using Facebook search to track and compile posts or “observables.” I can’t emphasise how this has made our jobs difficult.  

I picked up on threads of the coordinated narrative when I noticed terms like “kidnapping” and “abduction” repeatedly appearing in statements from Duterte’s camp — his former spokesperson Harry Roque, his daughter Veronica, and Vice President Sara Duterte. I had a hunch that they were trying to make the word “kidnapped” stick.  

Following this lead, I used Facebook’s search tool and entered various combinations of “Duterte was kidnapped” and “ICC kidnapping” in both Filipino and English to identify possible identical posts – essentially coordinated attempts to spread the narrative. My hunch was correct.  

Q. When real people post fake information, does it make it harder to track? 

A. I wouldn’t say it is harder to track. But I would say that the presence of real people (or, more accurately, accounts that appear to be real) requires the reporter to dig even deeper to look for concrete signs of coordinated behaviour. For instance, our story wouldn’t have stood if I just tracked 10-20 posts with the same “script.” That I found 200 — all within minutes and hours of each other — made the story more solid. 

Because real-looking accounts are part of the mix, I had to click on all of them and briefly look at their account characteristics. That’s the display picture, comments on the display picture, number of friends, photos, nature of posts (for instance, if they were freshly created, that’s an immediate sign of inauthenticity), among others. 

That’s how I was able to say that several labelled themselves as content creators or used Facebook to sell various products – because I looked at them one by one.  

Q. Walk us through the process – how did you go about identifying the fake posts? What did you spot? 

A. First, I used various search terms to try to look for any repetitive messages (or scripts) being used to spread a narrative.  

When I pinned down the ICC kidnapping script, I didn’t enter the full message on Facebook search, just the first few sentences. Based on my experience, Facebook tends to malfunction if the search term is too long. It would also likely limit the search results to exclude those who are inserting minor variations in terms of style and spacing. Just a part of the message was enough. 

Once I had the search results, I used a Google Chrome extension to scrape the data and scrolled as far back as I could.

I would like to emphasise that this extension isn’t really that helpful. It didn’t provide me with working links to all of the posts. Something about the Facebook API or the layout of the page made it struggle to get the individual links for each post. So I had to go back and manually enter each post and their link on Google Sheets. 

Most importantly, I screen-grabbed each post in case they were deleted before we could run the story. I joked with colleagues in the newsroom that I turned into the human version of CrowdTangle. I did this manual entry for about four to five days. I had no choice – we didn’t have any other tool.  

The end product after all my manual data entries is a Google Sheet with at least 200 posts. The story repeatedly kept using the word “at least 200” because I stopped at 200. It was just too taxing. I just made sure to collect a big enough sample size without delaying the story longer than a week.  

Q. Why is the acronym "CTTO" important to note in the context of this story?  

A. CTTO is the shortened version of “credits to the owner.” Filipino social media users typically use this shorthand to refer to posts they are intentionally reposting.  I included this detail so that readers know some of the accounts were publicly saying they were just reposting the message. 

Q. What do you think is the cumulative impact of such a blitzkrieg?  

A. The impact would be most serious for those who are “on the fence” on Duterte. If someone without a strong political stance reads more than a dozen posts repeating the claim that the ICC kidnapped a former Philippine president and they don’t do their own research, they would likely start to doubt the legitimacy of the arrest or entertain thoughts that it was done illegally.  

Subjecting Filipinos to a torrent of disinformation – as what these networks have done and continue to do – is always harmful. Our country suffers from weak media literacy. Journalism is already somehow demonised here, thanks of course to Duterte himself.  

Q. What kind of work has Philstar.com done in the past, when it was tracking influence operations involving pro-duterte networks? 

A. Philstar.com has exposed and uncovered influence operations related to the South China Seaa. We have seen evidence that pro-China or Chinese state media are involved in spreading pro-Duterte narratives.  

Some of our reports have documented how Chinese media repeatedly paints the Philippines as the aggressor in the South China Sea and how pro-China accounts seeded the narrative that Mindanao (a major island in southern Philippines) may soon secede due to a supposed 'civil war' in Philippines. We also produced a report documenting an underhanded attempt to persuade the media to paint Vietnam as the aggressor, not China. These are what we believe are foreign influence operations or evidence of foreign interference.  

Meanwhile, some of the domestic influence operations we’ve reported on focus on attempts to discredit the Commission on Elections and the demonisation of Afghan refugees temporarily staying in the Philippines for the processing of their US visa. 

Q. What would be your advice to journalists covering misinformation and disinformation? 

A. Our coverage of influence operations aims to shut these networks down or at least make people more aware of coordinated attempts to shape their perception of an issue. 

Many of these narratives use facts to paint a misleading picture of an issue. In this context, fact-checking is not enough. At times, it is not the correct response at all. 

For the ICC kidnapping story, I would say that it’s a no-brainer. They really did use false information. Additionally, the use of copypasta to spread a narrative is somehow a giveaway compared to other methods. Nothing screams coordinated more clearly than literally dozens and dozens of identical posts.  

It is also not the only narrative related to Duterte’s arrest and current detention. There have been other problematic messages spread since then. It’s always a journalist’s wish to have enough time and energy to report on all of these. But it takes a lot of time.

I do these investigations after my regular shift as a beat reporter. So it is definitely additional work, so to speak. I have no choice but to go out of my way just to do them. As a beat reporter, I also have to do my best to write the daily stories in my beats. 

Honestly, it also makes me feel guilty. We don’t have fancy tools to complete our data collection more quickly. As long as Facebook search still works, and I can use Google Sheets, I’ll still try my best.  

My goal is to produce reports that other people can replicate for themselves, so they know that we’re just documenting what’s out there. If someone uses Facebook search and uses my methodology, they’d arrive at the same findings. It’s just a matter of counting and analysing accounts.