Brazilian Capitol attack: The interaction between Bolsonaro’s supporters’ content, WhatsApp, Twitter, and news media

---

Implications

The Capitol attack on January 6, 2020, in the United States holds several similarities and political connections with the attack on January 8, 2022, in Brazil, when Lula da Silva won the election over former president Jair Bolsonaro. Many have noted that, in both cases, the proliferation of election fraud allegations and conspiratorial claims on social media platforms contributed to physical attacks on the official buildings (Wendling, 2023). These similarities may also reflect a troubling international trend to refute elections on the false basis of election fraud, particularly among far-right political leaders. Attacks on the electoral system have implications for worldwide democracies, as it could be extremely risky if the blueprint laid by Donald Trump and Jair Bolsonaro were followed in other political contexts. 

Disinformation about the alleged election fraud and a “rigged campaign” contributed greatly to the Brasília attack (Deliso, 2023), as was the case in the U.S. Capitol attack (Soto-Vásquez & Sánchez-Santos, 2022). An important factor for this study is the use of nationalist discourse features that pit “patriots” (those loyal to the far-right populist leader) not only against their fellow citizens but also against democratic institutions. Research indicates that far-right populists, such as Trump, manipulate the concept of patriotism to advance anti-pluralism, consolidate their authoritarian power, and oppose liberal institutions such as the judiciary system and free press (Curren, 2020). The same type of extremist discourse proliferated on several different social media platforms in the days leading up to the Brasília attack (Frenkel, 2023). Bolsonaro’s supporters heavily adopted the nickname “patriots” (in Portuguese “patriotas”) as an identification of the pro-Bolsonaro movement. Thus, we investigated the use of the term “patriots” in the Brasília attack, recognizing its important symbolic meaning. In the United States, the term has been utilized not only to convey support for Trump but also to identify anti-communists—bearing in mind that “the communist label is often conflated with and used to signify the other” (Soto-Vásquez & Sánchez-Santos, 2022, p. 8). Similarly, the Brazilian term carries the symbolic meaning of support for Bolsonaro and, following the populist playbook, opposition to “the other.” Insurrectionists have employed the term “patriots” to identify and organize people in favor of the Capitol attack in the United States (Munn, 2021), as well as in Brazil (Frenkel, 2023). Studying how Bolsonaro’s supporters adopted the term has important implications for the literature that identifies right-wing extremism as a transnational movement as it allows us to understand propaganda flows between different countries.

Our evidence suggests that, in addition to spreading content directly related to Brazilian politics (e.g.,  praise for the military and criticism of Lula da Silva’s government), Bolsonaro’s supporters used nomenclature and narratives similar to those used at the U.S. Capitol attack, such as religious language (Bastos & Recuero, 2023) and false information that members of the left have infiltrated the patriots and orchestrated the attack (Wendling, 2023). These findings establish that there are common values spread by right-wing extremists in the United States and Brazil. Future studies should address the reasons behind these common values and whether there is a relationship between the U.S. patriot agenda and its counterpart in Brazil. Understanding transnational patterns among extremist movements will help us understand why they spread and how to counter them. 

This study also investigated how Bolsonaro’s supporters spread content on WhatsApp and Twitter during the January 8 Brasília attack. The Brazilian population widely adopted WhatsApp for personal communication, with over 165 million WhatsApp users in the country (Mari, 2022). However, the app became a fundamental source of news, as 41% of Brazilians receive news from WhatsApp (Newman et al., 2022). Research suggests that WhatsApp was an important platform for spreading pro-Bolsonaro propaganda during the 2018 presidential election, and later, the former president kept an official department for propaganda spread during his term in office (Ozawa et al., 2023). Our study focuses on Bolsonaro’s propaganda in the period immediately following his government and the beginning of Lula da Silva’s new term in office. Our unique dataset of more than 15,000 WhatsApp public groups allowed us to get a significant glimpse of Bolsonaro’s supporters’ content on the WhatsApp space. We also analyzed content spread on Twitter given that this platform was widely adopted by right-wing extremists in Brazil (Santini et al., 2021). In the face of the prominence of WhatsApp among the Brazilian population and the importance of Twitter to right-wing extremism in the country, we found that comparing content spread through these two platforms brings important insight into still understudied cross-platform behaviors (Guess & Lyons, 2020).

Our analysis shows that Bolsonaro’s supporters spread the largest number of messages on WhatsApp and Twitter during key events related to the Brasília attack, as detailed in the Findings section. Interestingly, these messages were especially concentrated in the immediate days after those key events. For instance, we found peaks in message volume after Lula’s victory and after the Brasília attack. This suggests that political actors look to present narratives to supply their supporters with information so they can make sense of the events of the previous days. In practice, this would be an attempt to manufacture consensus (Woolley, 2023) in favor of a conspiracy theory of a fraudulent election right after Lula’s victory and, later, in favor of disinformation related to the Brasília attack. This evidence has implications for our understanding of how extremists use propaganda. In this study, Bolsonaro’s supporters spread content in reaction to events, either to mobilize supporters against the election results and ask for a military coup or to spread narratives about the events that took place during the Brasília attack.

Our analysis presented evidence that Bolsonaro’s supporters’ content on Twitter anteceded the spread of content on WhatsApp. By the same token, the variation in the volume of messages on Twitter could predict the variation in the volume of messages on WhatsApp.  This temporal pattern may suggest that Bolsonaro’s supporters used Twitter to initially publish propaganda to manufacture consensus around the coup d’etat. Then, users spread these messages organically on WhatsApp. Using an open platform such as Twitter to spread this content is reasonable given that there was no attempt to hide Bolsonaro’s propaganda about a fraudulent election. On July 18, 2022, Bolsonaro invited diplomats from 40 countries to present his charges that Brazil’s election system was open to fraud (Boadle, 2022). The Brazilian Supreme Court used his presentation as a central argument to make Bolsonaro ineligible to hold public office for the next eight years (Nicas, 2023). Bolsonaro’s public allegations would help explain why activity on an open platform such as Twitter would predict organic activity on a closed platform like WhatsApp. While previous research found consistent evidence that Bolsonaro has taken advantage of the closed features of WhatsApp to spread propaganda in the past (Ozawa et al., 2013), he used open platforms to openly discredit the electoral system in Brazil. Although our analysis certainly has limitations on conclusions about causality, our findings bring insight into the understanding of cross-platform patterns of disinformation spread, a research gap this study attempts to fill (Guess & Lyons, 2020).

During the 2018 election, journalistic reports documented the extensive spread of pro-Bolsonaro propaganda by marketing agencies, which published a large number of messages on WhatsApp (Mello, 2018). These journalistic reports prompted investigations by the Electoral Supreme Court. Subsequent research found evidence suggesting that the marketing agencies were likely not used after the investigation (Ozawa et al., 2013). Also, the WhatsApp company stated that it took down thousands of WhatsApp accounts dedicated to spreading propaganda (Sögur Hous, 2018). If political actors are indeed not using mechanisms to automatize the spread of messages on WhatsApp, our findings may add evidence to the effectiveness of public policy and journalistic investigation in reducing propaganda and misinformation spread on social media platforms.

Additionally, we investigated mainstream media coverage of Bolsonaro’s supporters who identified as “patriots.” We found evidence that the variation in the volume of messages about “patriots” posted by Bolsonaro’s supporters on Twitter could predict the variation in the volume of news coverage of “patriots.” This finding may suggest that the content of the “patriot” discourse about the insurrection on social media platforms managed to set the mainstream media agenda. Our longitudinal analysis potentially suggests that propaganda went higher up the chain to mainstream media, possibly feeding a propaganda feedback loop, which happens when politicians, the public, and the media enter a vicious circle of propaganda spread (Benkler et al., 2018). This would make sense given that Bolsonaro’s supporters first organized and executed the attacks, which were then covered by the press. After all, it was only days after the attack that news media reported that Bolsonaro’s supporters were planning the attack days earlier on encrypted messaging apps (Frenkel, 2023). Although our findings have limitations on causality that future studies should address, we add evidence to journalistic investigations that reported about the insurrection first being organized through encrypted messaging apps. In this sense, investigative journalism could benefit from data journalism efforts, which could harvest important information for investigative stories. Monitoring encrypted messaging apps could bring insight into important political movements. 

Finally, our findings can help to guide those who are interested in developing strategies to counter the advancement of extremist content online. From a public policy perspective, monitoring public groups on encrypted messaging apps can bring important information on organized movements that represent a threat to democracy. While early information can help authorities prevent future insurrections, monitoring online spaces after real-world events can help understand how political actors are manipulating narratives to justify their actions. This information should drive fact-checking initiatives and inform the population.

Findings

Finding 1: The spread of disinformation on WhatsApp and Twitter closely followed key events in preparation for the Brasília attack.

We analyzed messages published on WhatsApp between September 1, 2022, and January 31, 2023—the five months that comprise the total period around the presidential election and the Brasília attack. Our analysis period began one month before the presidential election and ended three weeks after the Brasília attack. The volume of patriot-related messages on both WhatsApp and Twitter roughly tripled after the presidential election. In the first two months of the analysis, we found 4,836 patriot-related messages on WhatsApp and 310,291 on Twitter. In the last three months of the analysis, there were 11,402 messages on WhatsApp and 1,100,606 on Twitter. More importantly, WhatsApp and Twitter received the largest volume of patriot-related messages on the days after key events that led to the Brasília attack (see Figure 1).

The first peak of the volume of messages happened between November 1 and 3, 2022—the days that followed Lula’s victory in the election runoff. The messages called on Bolsonaro’s supporters to protest Lula’s allegedly fraudulentvictory. The content was spread in images, videos, audio messages, and especially long-form texts. This content spread false news stories, false explanations for political events, conspiracy theories, instructions for the next protests, and requests for donations in favor of the protests. 

The next peak occurred on the day after the first Brasília attack, on December 12, 2022. This initial attack occurred before the large insurrection that took place on January 8, 2023. In this initial attack, Bolsonaro’s supporters set cars and buses on fire and tried to break into the Federal Police headquarters. The subsequent peak in messages occurred in the days following the Brasília attack. The messages spread false information, blaming members of the left for infiltrating the patriots and orchestrating the attack. Another prevalent and false narrative involved claims of mistreatment of Bolsonaro’s supporters who were in prison.

Finding 2: The main topics associated with Bolsonaro’s supporters were religion, infiltrators, armed forces, left-wing, and nationalism.

Figure 2 shows the results of a 15-topic model that we created to identify the main topics spread on Twitter. Each of the 15 graphs shows clusters of words that users posted frequently alongside the hashtag #patriotas, which allowed us to qualitatively assess the main topics. We identified the following topics that were relevant to our interest in far-right extremist discourse: religion, infiltrators, armed forces, left-wing, and nationalism. It is worth noting that some topics occurred multiple times within the 15 identified. Religion relates to the frequent use of the word “God.” Research suggested evidence that religious nationalism (Armaly et al., 2022) and appeal to God (Bond & Neville-Shepard, 2021) were associated with the Capitol attack. Infiltrators relates to a disinformation narrative stating that rioters at the Brasília attack were left-wing infiltrators dressed up as Bolsonaro’s supporters. An identical narrative was spread after the Capitol attack (Reuters, 2021). Armed forces references praise for the military and mentions the headquarters where the Brasília attack was organized. Left-wing is related to Lula and his left-wing government. Nationalism references nationalist language, nationalist symbols, and other patriots’ Twitter profiles. 

Finding 3: The spread of Bolsonaro’s supporters’ messages on Twitter predicted the spread of their messages on WhatsApp.

A Granger-causality test presented evidence that Bolsonaro’s patriots’ messages on Twitter predicted the spread of their messages on WhatsApp (F = 10.399, p < 0.01). Granger causality tests the relationship between two variables over time. The test shows whether past values in a time series can predict future values in another time series.¹Clive Granger initially developed Granger-causality tests in the field of econometrics (Granger, 1969) to examine the temporal relationship between variables. Although the term implies causality, it is more accurate to state that Granger causality tests whether one variable forecasts the other (Hamilton, 1994). Communication scholars have increasingly employed this type of longitudinal analysis, especially due to the availability of granular levels of data in social media (Wells et al., 2019). For instance, research has applied Granger causality to study temporal relationships between disinformation campaigns on different social media platforms (Lukito, 2020). While Granger tests reveal patterns of prediction between variables, impulse response functions (IRFs) allow us to assess the duration of this relationship. Activities on both platforms increased in preparation for the Brasília attack, but we found evidence that an increase in Twitter activity predicted an increase in WhatsApp activity. The reverse does not hold true. An analysis of impulse response functions (IRFs) showed that activity on Twitter tends to predict activity on WhatsApp between 2–4 days in advance (see Figure 3).

Finding 4: The spread of Bolsonaro’s supporters’ messages on Twitter predicted news coverage of Bolsonaro’s supporters.

A Granger-causality test presented evidence that Bolsonaro’s supporters’ messages on Twitter predicted news coverage about Bolsonaro’s supporters (F = 10.323, p < 0.01). Indeed, the first peak in news coverage occurred on November 3, 2022, four days after Lula’s victory in the presidential election. The second peak happened four days later, on November 7, 2022. The third and highest peak occurred on January 9, 2023, the day after the Brasília attack. An analysis of impulse response functions (IRFs) showed that activity on Twitter tends to predict news coverage between 2–3 days in advance (see Figure 4).

Methods

Our period of analysis was between September 1, 2022, and January 31, 2023, for all the three variables that we analyzed. We collected WhatsApp data through a platform developed by Palver, a company that currently monitors more than 25,000 public WhatsApp groups in Brazil. Through a dashboard, the company shows the volume of messages containing chosen keywords along a timeline. The platform recognizes words written or said in images, videos, and audio content. We collected the daily volume of messages with the keywords “#patriotas” and “patriotas” (N = 16,238). Palver monitored 14,480 public groups at the beginning of the analysis and 19,718 groups at the end of the analysis. We also collected all Twitter posts using the hashtag #patriotas, except for retweets, using the R package {academictwitteR} (N = 1,410,897). The tweets were published by 402,015 different users. We used MediaCloud to collect news articles that mentioned the keywords “patriotas” and “patriota” (N = 736) in the online versions of the following media outlets: Globo, UOL, CartaCapital, Veja, Brasil 24/7, JovemPan, Terra, Istoé. This collection considers variations in size, editorial ideology, and platform (e.g., TV vs. magazine).

We first ran a descriptive longitudinal analysis of the daily count of Bolsonaro’s supporters’ messages on WhatsApp and Twitter. We qualitatively assessed which events were taking place during the peaks of message volume by reading WhatsApp and Twitter messages posted on those days and by reviewing news articles published around those dates. We had access to the full dataset of anonymized messages monitored by Palver, but those cannot be extracted directly from the dashboard. Therefore, we used Latent Dirichlet Allocation (LDA) to build a 15-topic model of the main topics that were discussed alongside the hashtag #patriotas on Twitter (but not on WhatsApp). More details on our methods are available in Appendix B.

We applied a time series model (Lütkepohl, 2013) to investigate the temporal interaction between disinformation content spread on WhatsApp and Twitter, as well as the interaction with news coverage. These were treated as endogenous variables. We accounted for the content peak during the Brasília attack as an exogenous control. Twitter was the only time series that did not meet the assumption of stationarity according to the Augmented Dickey-Fuller Test (p = 0.121). After a visual inspection, we found fractional integration through the R package {fracdiff} (p < 000.1), so we fractionally first differenced after an ARFIRMA test. We also visually checked all the time series for seasonality. Only the news coverage had a seasonal component, and we removed it through the decomposition of additive time series. We used a vector autoregression (VAR) model to study temporal relationships. We found the optimal lag structure of our VAR model through Bayesian Information Criteria (BIC) (Korobilis, 2008) and determined that the best model had a lag of 1 (BIC = 3786.607). We used Granger-causality tests to evaluate our findings (Benati & Surico, 2009; Lukito, 2020; Soroka 2002). As a robustness check, we reran the analysis solely with tweets that contained calls to action related to the Brasília attack (see Appendix A). All the results held the same, so this served as confirmatory evidence.