By Nathaniel Gleicher, Head of Cybersecurity Policy

We removed multiple Pages, Groups and accounts that were involved in coordinated inauthentic behavior on Facebook and Instagram. We found three separate operations: one of which originated in the United Arab Emirates, Egypt and Nigeria, and the other two in Indonesia and Egypt. These three campaigns we removed were unconnected, but each created networks of accounts to mislead others about who they were and what they were doing. We have shared information about our findings with industry partners.

We’re constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people. We’re taking down these Pages, Groups and accounts based on their behavior, not the content they posted. In each of these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action.

We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing challenge. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working closer with law enforcement, security experts and other companies.

What We’ve Found So Far

We removed 211 Facebook accounts, 107 Pages, 43 Groups and 87 Instagram accounts for engaging in coordinated inauthentic behavior that originated in the UAE, Egypt and Nigeria. There were multiple sets of activity, each localized for a specific country or region, primarily in the Middle East and Africa, and some in Europe, North and South America, South Asia and East Asia, and Australia. The people behind this network used fake accounts – some of which had already been disabled by our automated systems — to run Pages, post in Groups, disseminate their content and artificially increase engagement. They managed Pages — some of which changed names over time — sharing local news in targeted countries and promoting content about UAE. The Page admins and account owners primarily posted videos, photos and web links related to local events and issues in a particular country, and some content on topics including elections and candidates; UAE’s activity in Yemen; the first Emirati astronaut; criticism of Qatar, Turkey, and Iran; the Iran nuclear deal, and criticism of the Muslim Brotherhood. Although the people behind this activity attempted to conceal their identities, our investigation found links to three marketing firms — Charles Communications in UAE, MintReach in Nigeria and Flexell in Egypt.

• Presence on Facebook and Instagram: 211 Facebook accounts, 107 Pages, 43 Groups and 87 Instagram accounts.
• Followers: Less than 1.4 million accounts followed one or more of these Pages, less than 100 accounts joined one or more of the Groups and less than 70,000 accounts followed at least one of these Instagram accounts.
• Advertising: Less than $150,000 spent on Facebook ads paid for primarily in US dollars, Emirati dirham and Indian rupee.

We identified these accounts as part of our follow-on investigation into the coordinated inauthentic behavior in the region we had previously removed.

Below is a sample of the content posted by some of these Pages:

We also removed 69 Facebook accounts, 42 Pages and 34 Instagram accounts that were involved in domestic-focused coordinated inauthentic behavior in Indonesia. The people behind this network used fake accounts to manage Pages, disseminate their content and drive people to off-platform sites. They primarily posted in English and Bahasa Indonesia about West Papua with some Pages sharing content in support of the independence movement, while others posting criticism of it. Although the people behind this activity attempted to conceal their identities, our investigation found links to an Indonesia media firm InsightID.

• Presence on Facebook and Instagram: 69 Facebook accounts, 42 Pages and 34 Instagram accounts.
• Followers: About 410,000 accounts followed one or more of these Pages and around 120,000 accounts followed at least one of these Instagram accounts.
• Advertising: About $300,000 spent on Facebook ads paid for primarily in Indonesian rupiah.

We identified these accounts through ongoing investigations into suspected coordinated inauthentic behavior in the region.

Below is a sample of the content posted by some of these Pages:

Finally, we removed 163 Facebook accounts, 51 Pages, 33 Groups and 4 Instagram accounts that were involved in coordinated inauthentic behavior originating from Egypt that focused on Somalia, Yemen, Saudi Arabia, Sudan, Yemen, Tunisia, Iran, Turkey, Lebanon and Qatar. The people behind this activity used fake accounts — some of which had previously been disabled by our automated systems — to manage Pages posing as independent local news organizations, post in Groups, amplify their content and drive people to off-platform domains. Some of these Pages appear to be purchased and some changed names over time. The Page admins and account owners typically posted about domestic news and political topics including content in support of the United Arab Emirates, Saudi Arabia, and Egypt; criticism of Qatar, Iran, and Turkey; and Yemen’s southern separatist movement. Although the people behind this activity attempted to conceal their identities, our investigation found links to an Egyptian newspaper El Fagr.

• Presence on Facebook and Instagram: 163 Facebook accounts, 51 Pages, 33 Groups and 4 Instagram accounts.
• Followers: Around 5.6 million accounts followed one or more of these Pages, less than 3,000 accounts joined one or more of the Groups and less than 3,000 accounts followed at least one of these Instagram accounts.
• Advertising:Less than $31,000 spent on Facebook ads paid for primarily in US dollars and Egyptian pounds.

We identified these accounts through ongoing investigations into suspected coordinated inauthentic behavior in the region.

Below is a sample of the content posted by some of these Pages: