Meta

Removing Coordinated Inauthentic Behavior from Russia

By Nathaniel Gleicher, Head of Cybersecurity Policy

Today we removed multiple Pages, groups and accounts that engaged in coordinated inauthentic behavior on Facebook and Instagram. The two operations we found originated in Russia, and one was active in a variety of countries while the other was specific to Ukraine. We didn’t find any links between these operations, but they used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.

We are constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages and accounts based on their behavior, not the content they post. In these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.

While we are making progress rooting out this abuse, as we’ve said before, it’s an ongoing challenge because the people responsible are determined and well funded. We constantly have to improve to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies. Their collaboration was critical to these investigations.

We’ll update this post with more details when we have them, or if the facts change.

January 17, 2019
What We’ve Found So Far
By Nathaniel Gleicher, Head of Cybersecurity Policy

Today we removed 364 Facebook Pages and accounts for engaging in coordinated inauthentic behavior as part of a network that originated in Russia and operated in the Baltics, Central Asia, the Caucasus, and Central and Eastern European countries. The Page administrators and account owners primarily represented themselves as independent news Pages or general interest Pages on topics like weather, travel, sports, economics, or politicians in Romania, Latvia, Estonia, Lithuania, Armenia, Azerbaijan, Georgia, Tajikistan, Uzbekistan, Kazakhstan, Moldova, Russia, and Kyrgyzstan. Despite their misrepresentations of their identities, we found that these Pages and accounts were linked to employees of Sputnik, a news agency based in Moscow, and that some of the Pages frequently posted about topics like anti-NATO sentiment, protest movements, and anti-corruption.

Our analysis benefited from open source reporting and work by our partners who investigate this kind of activity. We have also shared information about our investigation with US law enforcement, the US Congress, other technology companies, and policymakers in impacted countries.

Below is a sample of the content posted by some of these Pages:

Separately, based on an initial tip from US law enforcement, we also removed 107 Facebook Pages, Groups, and accounts, as well as 41 Instagram accounts, for engaging in coordinated inauthentic behavior as part of a network that originated in Russia and operated in Ukraine. The individuals behind these accounts primarily represented themselves as Ukrainian, and they operated a variety of fake accounts while sharing local Ukrainian news stories on a variety of topics, such as weather, protests, NATO, and health conditions at schools. We identified some technical overlap with Russia-based activity we saw prior to the US midterm elections, including behavior that shared characteristics with previous Internet Research Agency (IRA) activity.

Below is a sample of the content posted by some of these Pages:

Our security efforts are ongoing to help us stay a step ahead and uncover this kind of abuse, particularly in light of important political moments and elections in Europe this year. We are committed to making improvements and building stronger partnerships around the world to more effectively detect and stop this activity.

Read more about our investigations into cyber threats and information operations.