Facebook said it has removed three networks — the largest having 300 accounts, pages, and groups — that originated in Russia for coordinated inauthentic behavior that targeted several countries over geopolitical issues and regional politics. The first, larger network targeted the Far East, Russia’s neighbours, Ukraine, and even the US and the UK. Another 37-strong network focussed on Russia’s neighbours including Belarus. The smallest operation focused on Turkey, Europe and the US.
The networks main activities revolved around creating fictitious personas or seemingly independent media entities to engage users and amplify their content. They also drove users to other websites they operated. Facebook said this activity was not just on its own platform, but was spread across platforms.
Although the networks did not directly target the upcoming US elections, it was linked to actors associated with US election interference in the past, including those involved in the 2016 DC leaks, Facebook said. In 2016, Russia’s military intelligence agency — GRU — had deployed fake journalist identities to sow disinformation. One of them was the Alice Donovan persona, which created the DC leaks Facebook page, and posted disinformation about geopolitics and conflict. Fake journalist and media personas were similarly used in these networks.
These operations worked across many internet services and attempted to hire contributors and seed their stories with news organisations, Facebook noted.
300-strong network worked in clusters, targeted Syrian civil war, geopolitical issues
The largest network, totaling to 301 accounts, pages, and groups, originated in Russia and focused primarily on Syria and Ukraine, and to a lesser extent on Turkey, Japan, Armenia, Georgia, Belarus, and Moldova. A small portion of this activity focused on the UK and the US. Facebook said its investigation connected clusters of the network to the Russian military, including to Russian military intelligence services.
Facebook said it identified “several clusters of connected activity”, something also stressed upon by Graphika — a social analytics company focussed on disinformation — which independently analysed a subset of this network before they were removed. “This operation was run by different Russian actors by different entities and locations, rather than being a single operation”, it wrote.
Importantly, this network was identified as part of Facebook’s earlier investigations that resulted in removing accounts, linked to Russian military intelligence — one focusing on Syria and Ukraine (removed in August 2018), and another targeting Ukraine and Russia’s neighbours (removed in February 2020).
The modus operandi: On Facebook and Instagram, the network created elaborate pages of non-existent media organisations and people in order to amplify their content. It used fake accounts to create elaborate fictitious personas across, often posing as journalists to be able to contact news organisations. Facebook said its automated systems had identified and removed some of the fake accounts. A similar method, wherein a network hires contributors and tries to seed their stories with news organisations, has been used before on a Russia-linked network, which Facebook removed in August.
- These clusters focused on driving people to their off-platform sites, and other social media platforms, where they “they promoted content related to past alleged leaks of compromising information”, per Facebook. Graphika also said it found assets on YouTube, Blogspot, Twitter, Medium, Reddit and a range of blogging sites.
- They posed as locals from the targeted countries, managing groups and pages, some even claiming to be from hacktivist groups.
What the network posted about: Posting in multiple languages, including English, Ukrainian, Russian and Arabic, the network frequently posted about news and current events, including the Syrian civil war, Turkish domestic politics, geopolitical issues in the Asia-Pacific region, NATO, the war in Ukraine, and politics in the Baltics, Georgia, Armenia, Ukraine, Russia, Belarus, and the US.
Network removal in numbers
- Extent: 214 Facebook users, 35 Pages, 18 Groups and 34 Instagram accounts. According to Graphika, most of the accounts, pages, and groups were created in 2018, and in early 2019.
- Following: “The operation had almost no following on our platforms when we removed it,” Facebook said. Facebook said that 8,500 people followed one or more of the pages, 9,500 accounts joined at least one group, 7,500 people followed at least one Instagram account.
- Advertising: $60 spent on Facebook ads, paid for in US dollars and rubles.
Network linked with IRA operatives, targeting Europe, Turkey, removed
A much smaller network totaling to 10 accounts, pages, and groups originating from Russia was also removed. This network targeted Turkey, Europe, and the US. Facebook’s investigation began after information from the FBI about the network’s activity outside of Facebook. This network was found to be linked to people who have been associated with Russia’s Internet Research Agency (IRA) in the past. IRA has been linked with the Russian government and was infamously credited with interfering with the 2016 US elections via online disinformation on Facebook.
The modus operandi: It used fake accounts to drive users to a website purportedly operated by an independent think-tank based primarily in Turkey. The accounts posed as locals based in Turkey, Canada and the US. They recruited people to write for their website. Facebook said its automated systems detected some of the fake accounts and removed them.
What the network posted about: The network posted external links in English and Turkish about global news and current events relevant to the countries they targeted, including local elections; geopolitical conspiracies; presidential and parliamentary elections in Hong Kong, Spain, the UK, and the US; social and racial injustice; police brutality; the coronavirus pandemic; criticism of US sanctions in the Middle East, US foreign policy, and US allies including Israel; and politics in Venezuela.
Network removal in numbers
- Extent: 1 page, 5 Facebook accounts, 1 Facebook group, and 3 Instagram accounts. “This network had almost no following on our platforms when we removed it,” Facebook said.
- Following: 4,900 accounts followed this Page, 1 account joined the group, and 5,600 people followed one or more Instagram accounts.
- Advertising: $4,800 spent on Facebook ads paid for in euros and rubles.
Smaller network targeting Belarus, Russia’s neighbours removed
Separately, Facebook removed 37 pages and accounts also originating in Russia, targeting global audiences and Russia’s neighbours such as Belarus. This network was identified as part of similar behaviour by accounts that were removed in July 2019. This network was also linked to individuals in Russia, including those associated with Russian intelligence services.
The modus operandi: Clusters of this network used real and fake accounts to create fictitious personals that posted content and managed pages to drive users to external websites posing as independent journals. The fake accounts posed as editors and researchers to solicit articles for these websites. Facebook said its automated tools removed some of these fake accounts.
What the network posted about: Posting primarily in Russian and English about news and current events, including protests and elections in Belarus, Russian and Ukrainian politics, geopolitical conspiracies, Russia-NATO relations, Russia’s relations with neighboring countries, and criticism of US foreign policy, socio-economic issues in the US, and US political candidates on both sides of the political spectrum.
Network removal in numbers:
- Extent: 23 Facebook accounts, 6 Pages, and 8 Instagram accounts were removed.
- Followers: About 59,000 accounts followed one or more of these Pages and around 2,000 people followed one or more of these Instagram accounts.
- Advertising: About $10,000 in spending for ads on Facebook and Instagram paid for primarily in rubles. This is despite the fact that this network was significantly smaller than the first network.
