Removing More Coordinated Inauthentic Behavior From Russia

6 years ago

By Nathaniel Gleicher, Head of Cybersecurity Policy

Today we removed multiple Pages, Groups and accounts that were involved in coordinated inauthentic behavior on Facebook and Instagram. We found two separate, unconnected operations that originated in Russia and used similar tactics, creating networks of accounts to mislead others about who they were and what they were doing.

We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, Groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.

We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies.

We’ll update this post with more details when we have them, or if the facts change.

What We’ve Found So Far

We removed 97 Facebook accounts, Pages and Groups that were involved in coordinated inauthentic behavior as part of a network emanating from Russia that focused on Ukraine. The individuals behind this activity operated fake accounts to run Pages and Groups, disseminate their content, and increase engagement, and also to drive people to an off-platform domain that aggregated various web content. They frequently posted about local and political news including topics like the military conflict in Eastern Ukraine, Russian politics, political news in Europe, politics in Ukraine and the Syrian civil war. We had already disabled many accounts run by the people behind this operation for various violations, including impersonation, and some of the activity we found was linked to accounts we removed in prior enforcement actions.

Presence on Facebook: 62 Facebook accounts, 10 Pages and 25 Groups.
Followers: About 34,000 accounts followed one or more of these Pages and about 86,000 accounts joined at least one of these Groups.
Advertising: Around $1 in spending for ads on Facebook paid for in US dollars. The ad ran in March 2017.

We identified some of these accounts and Pages through follow-on investigations of the accounts and Pages we removed earlier this year ahead of the elections in Ukraine. We have shared information about our analysis with law enforcement, policymakers and industry partners.

Below is a sample of the content posted by some of these Pages:

[Image updated on May 6, 2019 at 10:15AM PT]
**Top text**: “…Crimea is transferred as a sign of eternal friendship of UkSSR and RSFSR”.
**Bottom left text**: Klimkin congratulated Ukrainians with the cease of the Treaty of Friendship with Russia. The irony is that it contained an article recognizing the borders of Ukraine. The article is no longer in force, and with that, one can congratulate Klimkin and Poroshenko. “Only two things are infinite, the universe and human stupidity” – A. Einstein.
**Bottom right text**: As of today, the Russian Federation has no borderland, but there is a territory occupied by Nazi gangs

**Headline**: The Russian Federation’s MOFA has blamed the Ukrainian armed forces for intentional attacks on Russian journalists in Donetsk **(Updated on May 14, 2019 at 11:30AM PT to correct the headline translation.)**

**Post**: Forgive, my sister, Yugoslavia.. [website URL] On March 24, 1999, the air force of NATO countries launched “Operation Allied Force” against the former Republic of Yugoslavia. The result of the bombing was the rejection of the historical region of Kosovo and Metohija from Serbia. [website URL] 20 years later, NATO still believes that the bombing of Yugoslavia was necessary and legitimate. [website URL]

We also removed 21 Facebook accounts, Pages and Instagram accounts that were involved in coordinated inauthentic behavior as part of a small network emanating from Russia that focused on Austria, the Baltics, Germany, Spain, Ukraine and the United Kingdom. The individuals behind this campaign — which was also active on other internet platforms — engaged in a number of deceptive tactics, including the use of fake accounts to join Groups, impersonate other users and to amplify allegations about a public figure working on behalf of intelligence services. They also posted content about local politics including topics like immigration, religious issues and NATO.

Presence on Facebook and Instagram: 16 Facebook accounts, four Pages and one Instagram account.
Followers: About 1,100 accounts followed one or more of these Pages and around 80 accounts followed the Instagram account.

We identified these accounts and Pages through our ongoing internal investigations into suspected Russia-linked coordinated inauthentic behavior. Like the other operation, we’ve shared our analysis with law enforcement, policymakers and industry partners.

Below is a sample of the content posted by some of these Pages: