Meta

Removing Coordinated Inauthentic Behavior

By Nathaniel Gleicher, Head of Security Policy

Today, we removed four separate networks for violating our policy against foreign interference and coordinated inauthentic behavior (CIB). These networks originated in Canada and Ecuador, Brazil, Ukraine, and the United States.

In each case, the people behind this activity coordinated with one another and used fake accounts as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove these operations, we focus on behavior rather than content, no matter who’s behind them, what they post, or whether they’re foreign or domestic.

The majority of the activity we removed today focused on domestic audiences in each country and was linked to commercial entities and individuals associated with political campaigns and political offices. We’ve seen and taken action against domestic political figures using CIB in the past, and we know they will continue to attempt to deceive and mislead people. Domestic campaigns like these raise a particularly complex challenge by blurring the line between healthy public debate and manipulation. Our teams will continue to find, remove and expose these coordinated manipulation campaigns, but we know these threats extend beyond our platform and no single organization can tackle them alone. That’s why it’s critical that we, as a society, have a broader discussion about what is acceptable political advocacy and take steps to deter people from crossing the line.

Over the past three years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. In 2019 alone, we announced the removal of over 50 networks globally, including ahead of major democratic elections. Earlier this year, we started publishing regular CIB reports where we share information about all new networks we take down over the course of a month to make it easier for people to see progress we’re making in one place. In addition, in some cases, like today, we share our findings at the time of enforcement. Today’s takedowns will also be included in our July report. You can find more information about our previous CIB enforcement actions here.

We have shared information about our analysis with law enforcement, policymakers and industry partners. We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead.

What We Found

1. We removed 38 Facebook accounts, 76 Pages, and 55 Instagram accounts for violating our policy against foreign interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. (Updated on July 21, 2020 at 6:50PM PT to reflect the latest enforcement numbers for accounts and Pages removed.) This activity originated in Canada and Ecuador and focused on El Salvador, Argentina, Uruguay, Venezuela, Ecuador, and Chile.

This network relied on a combination of authentic and inauthentic accounts, some of which had already been detected and disabled by our automated systems. This operation — which was also active on other internet platforms — activated around civic events such as elections, at times posting on both sides of the political debate, and then abandon or pause its activity. They used fake accounts to pose as locals in countries they targeted, post and like their own content, drive people to off-platform sites, and manage Pages posing as independent news in countries they targeted. Some individuals behind this activity created multiple duplicate accounts under their own name. This network posted about domestic news in the countries it targeted, including topics such as politics, activism, praise and criticism of political candidates, elections, the government of Venezuela, both support and criticism of the President of Ecuador, political parties in the region including Farabundo Martí National Liberation Front in El Salvador, Peronist party in Argentina, and the Progressive party in Chile.

We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to political consultants and former government employees in Ecuador and Estraterra, a Canada-based PR firm. Estraterra is now banned from our platforms.

Below is a sample of the content posted by some of these Pages and accounts:

Page Name Translation: VE Economics Caption Translation: “British Newspaper Financial Times asks for an end to sanctions against Venezuela”
Caption Translation: “Leaked chat: Assemblymen Mendoza and Arteage wanted a sewage contract with Chone”
Caption Translation: “It is false that in every year that ends in 20 of each century there is a new pandemic”

2. We also removed 33 Facebook accounts, 14 Pages, 1 Group and 37 Instagram accounts that were involved in coordinated inauthentic behavior in Brazil. (Updated on July 21, 2020 at 6:50PM PT to reflect the latest enforcement numbers for accounts and Pages removed.) This network focused on domestic audiences.

This network consisted of several clusters of connected activity that relied on a combination of duplicate and fake accounts — some of which had been detected and disabled by our automated systems — to evade enforcement, create fictitious personas posing as reporters, post content, and manage Pages masquerading as news outlets. They posted about local news and events including domestic politics and elections, political memes, criticism of the political opposition, media organizations and journalists, and most recently they posted about the coronavirus pandemic. Some of the content posted by this network had already been taken down for Community Standards violations including hate speech.

We found this activity as part of our investigation into suspected coordinated inauthentic behavior in Brazil reported on by press and referenced in recent congressional testimony in Brazil. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to individuals associated with the Social Liberal Party and some of the employees of the offices of Anderson Moraes, Alana Passos, Eduardo Bolsonaro, Flavio Bolsonaro and Jair Bolsonaro.

Below is a sample of the content posted by some of these Pages and accounts:

Page Title Translation: Political Game
Caption Translation: “Segio Moro is Cancelled online”
Caption Translation: Communist Doctrine:
accuse others of what you are
Caption Translation: Globo Lies
Text Overlay on Video Translation: Globo is fabricating the coronavirus deaths/death rate

3. We also removed 65 Facebook accounts, 32 Pages, and 8 Instagram accounts that were involved in coordinated inauthentic behavior in Ukraine. (Updated on July 21, 2020 at 6:50PM PT to reflect the latest enforcement numbers for accounts and Pages removed.) This network focused on domestic audiences.

The people behind this activity used fake accounts — some of which had already been detected and disabled by our automated systems — to create fictitious personas, post in Groups and on Pages, comment on their own content, evade enforcement, and manage Pages. Some of this network’s accounts had also been removed for hate speech and impersonation. This network was particularly active during the 2019 presidential and parliamentary elections in Ukraine. Some of its accounts have gone through significant name changes over time. The Page admins and account owners posted political memes, satire and other content including about Crimea, NATO, economic policies in Ukraine, domestic politics, elections, criticism and support of various candidates, including Volodymyr Zelensky, Yulia Tymoshenko, and Petro Poroshenko.

We identified this activity as a result of our internal investigation into coordinated inauthentic behavior in Ukraine. Our assessment benefited from public reporting in Ukraine. Although the people behind this activity attempted to conceal their identities and coordination, our investigation linked this activity to Postmen DA, an advertising agency in Ukraine.

Below is a sample of the content posted by some of these Pages and accounts:

Page Name Translation: Betrayal/Victory
Caption Translation: Ukraine returns to Europe
Video Caption Translation: “Why do you support Poroshenko?”
Page Name Translation: Stop Yulia
Page Name Translation: Goat
Caption Translation: Press LIKE if you want to press the button (of a lavatory)
Image Caption Translation: We need to flush everyone

4. Finally, we removed 54 Facebook accounts, 50 Pages, and 4 Instagram accounts that were involved in coordinated inauthentic behavior in the United States. This network focused on domestic audiences.

The people behind this activity used fake accounts — some of which had already been detected and disabled by our automated systems — to pose as residents of Florida, post and comment on their own content to make it appear more popular than it is, evade enforcement, and manage Pages. Several of these Pages had links to Proud Boys, a hate group we banned in 2018. Some Pages appeared to have acquired followers from Pakistan and Egypt to make themselves seem more popular than they were. This network — which was also active on other internet platforms — was most active between 2015 and 2017. Since then, the majority of these accounts have been dormant, and some were permanently deleted by the users. The Page admins and account owners posted about local politics in Florida, Roger Stone and his Pages, websites, books, and media appearances, a Florida land and water resources bill, the hacked materials released by Wikileaks ahead of the US 2016 election, candidates in the 2016 primaries and general election, and the Roger Stone trial.

We first started looking into this network as part of our investigation into the Proud Boys’ attempts to return to Facebook after we had designated and banned them from the platform. We identified the full scope of this network following the recent public release of search warrants pertaining to the investigation by Special Counsel Robert Mueller in response to a joint petition from The New York Times, CNN, the Associated Press, The Washington Post, and Politico. Our investigation linked this network to Roger Stone and his associates.

Below is a sample of the content posted by some of these Pages and accounts: