Removing Coordinated Inauthentic Behavior From Iraq and Ukraine

5 years ago

By Nathaniel Gleicher, Head of Cybersecurity Policy

Today, we removed multiple Pages, Groups and accounts that were involved in coordinated inauthentic behavior on Facebook and Instagram. We found two separate, unconnected operations that originated in Iraq and Ukraine. We didn’t find any links between the campaigns we removed, but they both created networks of accounts to mislead others about who they were and what they were doing.

We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, Groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action. We have shared information about our analysis with our industry partners.

We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies.

What We’ve Found So Far

We removed 76 accounts, 120 Facebook Pages, one Group, two Events and seven Instagram accounts for engaging in domestic-focused coordinated inauthentic behavior in Iraq. The people behind this activity used fake accounts to amplify their content and manage Pages — some of which were likely purchased. Many of these Pages merged with one another and changed names over time. They also impersonated other people and used their IDs to conceal their identity and attempt to avoid detection and removal. The Page admins and account owners typically posted about domestic political and societal issues such as religion, various public figures including Saddam Hussein, the state of the military under the Saddam rule, tensions with Iran, the US military action in Iraq, Iranian-backed militia operating in Iraq and Kurdish-Iraqi politics.

Presence on Facebook and Instagram: 76 accounts, 120 Facebook Pages, 1 Group, 2 Events and 7 accounts on Instagram.
Followers: Less than 1.6 million accounts followed one or more of these Pages, about 339,000 accounts joined at least one of these Groups and around 2,000 people followed one or more of these Instagram accounts.
Advertising: Less than $1,600 spent on Facebook and Instagram ads paid for in US dollars, Canadian dollars and Malaysian ringgits.
Events: 2 Events were hosted by these Pages. The first was scheduled for February 2016 and the most recent was scheduled for May 2016. Up to 15 people expressed interest in at least one of these events. We cannot confirm whether any of these events actually occurred.

We identified these accounts through our investigation into suspected coordinated inauthentic behavior in the region.

Below is a sample of the content posted by some of these Pages.

**Page name translation:** Iraqi in Turkey **Caption:** Statement on the 15th anniversary of the first Falluja battle. 4/4/2004. In the Name of Allah the Most Merciful…

**Page name translation:** Peace Bird **Caption:** I wanted to present to you a bouquet of flowers in celebration of the blessed Eid Al Adha… But we couldn’t find better than the smiling faces of men in their most difficult situations… An evidence of their bravery and manhood. Don’t choose the leaders that exaggerate their victory and dismiss their responsibility of failure.

**Page name translation:** Al Abbas News Network **Caption:** #BreakingNews Happening Now || Sheikh Faisal al-Issawi and the tribes of Ameriya Fallujah and the security forces with the participation of coalition warplanes launched an attack on the area of Boadij towards the intersection of Al Salam and the area of Hosa, a number of houses in the area have been seized.

**Page title translation:** Author Raghd AlGabri **Caption:** To those who say that Iraq is the aggressor against Iran, here is a summary. Please engage with this post in all the groups. #Lost_Details_We_Present_To_You #Reasons_We_Are_At_War_With_Iran **Yellow snipe on post:** “Reasons that led us to be at war with evil Iran.. Exclusive to “Bird of Peace” page”

We also removed 168 accounts, 149 Facebook Pages and 79 Groups for engaging in domestic-focused coordinated inauthentic behavior in Ukraine. The people behind this activity used fake accounts to manage Groups and a number of Pages — some of which changed their names over time, and also to increase engagement, disseminate content and drive people to off-platform sites posing as news outlets. The Page admins and account owners typically posted about celebrities, show business, sports, local and international news, political and economic issues including Ukrainian elections, political candidates and criticism of various public figures. Although the people behind this activity attempted to conceal their identities, our review linked this activity to Pragmatico, a Ukrainian PR firm.

Presence on Facebook: 168 Facebook accounts, 149 Pages and 79 Groups.
Followers: Less than 4.2 million accounts followed one or more of these Pages and about 401,000 accounts joined at least one of these Groups.
Advertising: About $1.6 million spent on Facebook and Instagram ads paid for in US dollars.

We identified these accounts through our internal investigation into suspected coordinated inauthentic behavior in the region.

Below is a sample of the content posted by some of these Pages.