By Nathaniel Gleicher, Head of Cybersecurity Policy
Today, we removed multiple Pages, Groups and accounts that were involved in coordinated inauthentic behavior on Facebook and Instagram. We found two separate, unconnected operations that originated in Iraq and Ukraine. We didn’t find any links between the campaigns we removed, but they both created networks of accounts to mislead others about who they were and what they were doing.
We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, Groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action. We have shared information about our analysis with our industry partners.
We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies.
What We’ve Found So Far
We removed 76 accounts, 120 Facebook Pages, one Group, two Events and seven Instagram accounts for engaging in domestic-focused coordinated inauthentic behavior in Iraq. The people behind this activity used fake accounts to amplify their content and manage Pages — some of which were likely purchased. Many of these Pages merged with one another and changed names over time. They also impersonated other people and used their IDs to conceal their identity and attempt to avoid detection and removal. The Page admins and account owners typically posted about domestic political and societal issues such as religion, various public figures including Saddam Hussein, the state of the military under the Saddam rule, tensions with Iran, the US military action in Iraq, Iranian-backed militia operating in Iraq and Kurdish-Iraqi politics.
- Presence on Facebook and Instagram: 76 accounts, 120 Facebook Pages, 1 Group, 2 Events and 7 accounts on Instagram.
- Followers: Less than 1.6 million accounts followed one or more of these Pages, about 339,000 accounts joined at least one of these Groups and around 2,000 people followed one or more of these Instagram accounts.
- Advertising: Less than $1,600 spent on Facebook and Instagram ads paid for in US dollars, Canadian dollars and Malaysian ringgits.
- Events: 2 Events were hosted by these Pages. The first was scheduled for February 2016 and the most recent was scheduled for May 2016. Up to 15 people expressed interest in at least one of these events. We cannot confirm whether any of these events actually occurred.
We identified these accounts through our investigation into suspected coordinated inauthentic behavior in the region.
Below is a sample of the content posted by some of these Pages.
We also removed 168 accounts, 149 Facebook Pages and 79 Groups for engaging in domestic-focused coordinated inauthentic behavior in Ukraine. The people behind this activity used fake accounts to manage Groups and a number of Pages — some of which changed their names over time, and also to increase engagement, disseminate content and drive people to off-platform sites posing as news outlets. The Page admins and account owners typically posted about celebrities, show business, sports, local and international news, political and economic issues including Ukrainian elections, political candidates and criticism of various public figures. Although the people behind this activity attempted to conceal their identities, our review linked this activity to Pragmatico, a Ukrainian PR firm.
- Presence on Facebook: 168 Facebook accounts, 149 Pages and 79 Groups.
- Followers: Less than 4.2 million accounts followed one or more of these Pages and about 401,000 accounts joined at least one of these Groups.
- Advertising: About $1.6 million spent on Facebook and Instagram ads paid for in US dollars.
We identified these accounts through our internal investigation into suspected coordinated inauthentic behavior in the region.
Below is a sample of the content posted by some of these Pages.
