By Nathaniel Gleicher, Head of Cybersecurity Policy

Today we removed 265 Facebook and Instagram accounts, Facebook Pages, Groups and events involved in coordinated inauthentic behavior. This activity originated in Israel and focused on Nigeria, Senegal, Togo, Angola, Niger and Tunisia along with some activity in Latin America and Southeast Asia. The people behind this network used fake accounts to run Pages, disseminate their content and artificially increase engagement. They also represented themselves as locals, including local news organizations, and published allegedly leaked information about politicians. The Page administrators and account owners frequently posted about political news, including topics like elections in various countries, candidate views and criticism of political opponents.

Although the individuals behind this network attempted to conceal their identities, our investigation found that some of this activity was linked to an Israeli commercial entity, Archimedes Group. It has repeatedly violated our misrepresentation and other policies, including by engaging in coordinated inauthentic behavior. This organization and all its subsidiaries are now banned from Facebook, and it has been issued a cease and desist letter.

• Presence on Facebook and Instagram: 65 Facebook accounts, 161 Pages, 23 Groups, 12 events and four Instagram accounts.
• Followers: About 2.8 million accounts followed one or more of these Pages, about 5,500 accounts joined at least one of these Groups and around 920 people followed one or more of these Instagram accounts.
• Advertising: Around $812,000 in spending for ads on Facebook paid for in Brazilian reals, Israeli shekel, and US dollars. The first ad ran in December 2012 and the most recent ad ran in April 2019.
• Events: Nine events were hosted by these Pages. The first was scheduled for October 2017 and the most recent was scheduled for May 2019. Up to 2,900 people expressed interest in at least one of these events, and a portion of their accounts were previously identified and disabled as fake. We cannot confirm whether any of these events actually occurred.

We identified these accounts and Pages through our internal investigations into suspected coordinated inauthentic behavior. We have shared information about our analysis with industry partners and policymakers.

We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages and accounts based on their behavior, not the content they posted. As in other cases involving coordinated inauthentic behavior, the individuals behind this activity coordinated with one another to mislead others about who they were and what they were doing, and that was the basis for our action.

We are making progress rooting out this abuse, and, as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That’s why we’re investing heavily in building better technology, hiring more people and working more closely with law enforcement, security experts and other companies.

Below is a sample of the content posted by some of these Pages: