Meta

Removing Coordinated Inauthentic Behavior

By Nathaniel Gleicher, Head of Security Policy

We removed two separate networks for violating our policy against coordinated inauthentic behavior (CIB). One of these networks originated in China and the other in the Philippines.

In each case, the people behind this activity coordinated with one another and used fake accounts as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove these operations, we focus on behavior rather than content, no matter who’s behind them, what they post, or whether they’re foreign or domestic.

Over the past three years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. Earlier this year, we started publishing regular CIB reports where we share information about the networks we take down over the course of each month to make it easier for people to see progress we’re making in one place. In some cases, like today, we also share our findings soon after our enforcement. The takedowns we are announcing today will also be included in our September report. You can find more information about our previous CIB enforcement actions here.

We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead.

WHAT WE FOUND
(We will update the numbers as soon as the latest data becomes available)

We removed 155 accounts, 11 Pages, 9 Groups and 6 Instagram accounts for violating our policy against foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This activity originated in China and focused primarily on the Philippines and Southeast Asia more broadly, and also on the United States.

We identified several clusters of connected activity that relied on fake accounts to pose as locals in countries they targeted, post in Groups, amplify their own content, manage Pages, like and comment on other people’s posts particularly about naval activity in the South China Sea, including US Navy ships. This campaign took operational security steps to conceal their identity and location including through the use of VPNs. Some of this network’s Pages were previously removed for violating our inauthentic behavior and spam policies.

In Southeast Asia where this network focused most of its activity, they posted in Chinese, Filipino and English about global news and current events including Beijing’s interests in the South China Sea; Hong Kong; content supportive of President Rodrigo Duterte and Sarah Duterte’s potential run in the 2022 Presidential election; criticism of Rappler, an independent news organization in the Philippines; issues relevant to the overseas Filipino workers; and praise and some criticism of China. In the US, where this network focused the least and gained almost no following, they posted content both in support of and against presidential candidates Pete Buttigieg, Joe Biden and Donald Trump.

We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to individuals in the Fujian province of China.

Below is a sample of the content posted by some of these Pages and accounts:

Translation: “There is no use for emergency powers. We will oppose it in the Senate.”
– Sen. Franklin Drilon
Where is your shame Drilon? Right now you are a nuisance you did nothing but harass and talk nonsense things.
You did nothing but oppose!
You don’t think anything but personal interest only..

We also removed 64 Facebook accounts, 32 Pages and 33 Instagram accounts for violating our policy against foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This network originated in in the Philippines and focused on domestic audiences. (Updated on October 12, 2020 at 6:35PM PT to reflect the latest enforcement numbers.)

This network consisted of several clusters of connected activity that relied on fake accounts to evade enforcement, post content, comment and manage Pages. This operation appeared to have accelerated between 2019 and 2020. They posted in Filipino and English about local news and events including domestic politics, military activities against terrorism, pending anti-terrorism bill, criticism of communism, youth activists and opposition, the Communist Party of the Philippines and its military wing the New People’s Army, and the National Democratic Front of the Philippines.

We found the full scope of this activity after investigating information about a portion of this network brought to our attention by civil society in the Philippines and Rappler, an independent news organization in the Philippines. Although the people behind this activity attempted to conceal their identities, our investigation found links to Philippine military and Philippine police.

Below is a sample of the content posted by some of these Pages and accounts:

Translation: caption: Joining any organizations of the terrorist CPP-NPA-NDF is suicide because it is like slowly approaching your death. Which is why my fellow country men, be smart and do not be deceived by the terrorist CPP-NPA-NDF, because they take delight in Filipino citizens joining their cause. Please share! Text overlay: Joining any organizations of CPP-NPA-NDF is like suicide because you are slowly approaching your own death. Stairway to death
Translation:
Let’s all unite to defeat the terrorists that are an obstacle to the freedom of our fellow countrymen which they’ve poisoned with their beliefs!
Translation:
Be cautious of progressive groups such as these…
They use these schools as recruitment basins of CPP NPA in Central Luzon
#ThoseWhoKnowAreSafe
Translation: Aktibista noon = An activist in the past Virus ngayon = Now a virus