Meta

Removing Coordinated Inauthentic Behavior

By Nathaniel Gleicher, Head of Security Policy

Today, we’re sharing an update on the enforcement actions we’ve taken since our last monthly report on coordinated inauthentic behavior (CIB). This includes both our September CIB report and a set of enforcement actions we’ve taken in the last few days. In total, we are publishing our findings about 10 networks — six operations we removed in September, most of which we already announced, and four new operations that we removed since October 1, including those we disabled this morning.

In each case, the people behind this activity coordinated with one another and used fictitious accounts and personas as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove these operations, we focus on behavior rather than content, whether they’re foreign or domestic, and regardless of who’s behind them or what they post.

Over the past three years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. Earlier this year, we started publishing regular CIB reports where we share information about the networks we take down over the course of each month to make it easier for people to see progress we’re making in one place. In some cases, like today, we also share our findings soon after our enforcement. The latest takedowns we are announcing today will also be included in our October report. You can find more information about our previous CIB enforcement actions here.

Before we share the details on each network, here are a few trends to note.

More than half of the networks we’re sharing today targeted domestic audiences in their countries and many of them were linked to groups and individuals associated with politically affiliated actors in the US, Myanmar, Russia, Nigeria, Philippines and Azerbaijan. Over the past three years, we’ve seen and taken action against domestic political actors around the world using CIB. We know these actors will continue to attempt to deceive and mislead people, including by making particular viewpoints appear more widely supported or criticized than they are, or by targeting influencers to unwittingly amplify their narratives.

Two of the networks we’re sharing today engaged primarily in commenting on content — relying on real people, not automation — to create the perception of wide-spread support of their narratives by leaving comments on posts by media entities and public figures. Other campaigns — like the ones from Russia (that we removed in late September) — focused on tricking unwitting freelance journalists into writing on behalf of these operations.

Deceptive campaigns like these raise a particularly complex challenge by blurring the line between healthy public debate and manipulation. Our teams will continue to find, remove and expose these coordinated manipulation campaigns, but we know these threats extend beyond our platform and no single organization can tackle them alone. That’s why it’s critical that we, as a society, have a broader discussion about what is acceptable political advocacy and take steps to deter people from crossing the line.

As part of our contribution to this conversation, based on the past three years of studying and taking down influence operations, my team has outlined recommendations for regulatory and legislative principles against these deceptive campaigns here.

We have shared information about our findings with law enforcement, policymakers and industry partners. We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead.

What We Found

(Note: We’ll update these numbers in the coming days when more data for this reporting period becomes available.)

Networks removed October 1-8, 2020:

1. We removed 202 Facebook accounts, 54 Pages and 76 Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in the US and focused primarily on domestic US audiences and also on Kenya and Botswana. (Updated on November 6, 2020 at 9:00AM PT to reflect the latest enforcement numbers.)

The people behind this activity used fake accounts — a large portion of which had been automatically removed by our systems — to comment on other people’s content. Many of these accounts used stock profile photos and posed as right-leaning individuals from across the US. In 2018, some of these accounts posed as left-leaning individuals to comment on content as well. This activity was centered primarily around commenting on news articles posted by news organizations and public figures, rather than posting their own content. These comments included topics like trophy or sport hunting in the US and Kenya, the midterm elections in 2018, the 2020 presidential election, COVID-19, criticism of the Democratic party and presidential candidate Joe Biden, and praise of President Trump and the Republican party. Most recently, the people behind this activity commented most frequently on Pages of the Washington Post, Fox News, MSNBC, CNN and The New York Times. This network showed some links to on-platform activity by Turning Point USA.

This network appears to have started its operations in 2018 and continued through 2020. Its election-focused behavior began in 2018 in the run-up to the midterms, it then went largely dormant until June 2020. The most recent activity included creating what we call “thinly veiled personas” whose names were slight variations of the names of the people behind them and whose sole activity on our platform was associated with this deceptive campaign. We assess this shift in tactics is likely due to the majority of this network’s fake accounts getting caught by our automated detection systems.

We began our investigation after public reporting about some elements of this activity by the Washington Post. Although the people behind this network attempted to conceal their identities and coordination, our investigation linked this activity to Rally Forge, a US marketing firm, working on behalf of Turning Point USA and Inclusive Conservation Group. Rally Forge is now banned from Facebook. We are continuing to investigate all linked networks, and will take action as appropriate if we determine they are engaged in deceptive behavior.

Below is a sample of the content posted by some of these Pages and accounts:

                

2. We removed 38 Facebook accounts, 15 Pages and 6 Instagram accounts for violating our policy against coordinated inauthentic behavior. This domestic-focused activity originated in Myanmar. (Updated on November 6, 2020 at 9:00AM PT to reflect the latest enforcement numbers.)

We identified clusters of connected activity that relied on a combination of fake, duplicate and authentic accounts to post content, evade enforcement and removal, manage Pages and drive people to off-platform websites including military-controlled media domains. These accounts often used stock female profile photos and photos of celebrities and social media influencers. The individuals behind this network posted primarily in Burmese about local news and current events including topics like military activities, the Union Solidarity and Development Party, local COVID-19 response, criticism of the the National League for Democracy, a political party in Myanmar, and Aung San Suu Kyi, as well as a small number of anti-Rohingya posts.

We began our investigation after reviewing local public reporting about some elements of this activity as part of our proactive work ahead of the upcoming election in Myanmar. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to members of the Myanmar military.

Below is a sample of the content posted by some of these Pages:

Translation:
Page Name: People’s Voice
Caption: Daw Aung San Suu Kyi is so smart….1) She grasped love from people by blaming illegal Bangali problem originated from Military government and U Thien Sein government and by participating in 2015 general elections without a single Muslim candidate. But after the election, she appointed Muslim lawyer U Ko Ni as chairman of Constitutional amendment Committee – an important position – under the pretext of constitution amendment. (Yes! Daw Aung San Suu Kyi is so smart….) 2) She grasped love from people by proclaming to upgrade the outdated education system while blaming the failure of the system at the time of U Thien Sein government. But rumors came out that Daw Su has improved education system by allowing matriculation passing rate to 50 percent with ‘Moderation System’. (Yes! Daw Aung San Suu Kyi is so smart….) ….
Translation:
Page title: Our army
Caption: Nothing special. Just because the country next door is boasting (about their military power) The parade is not about intimidating others. It is a partial demonstration to show how strong the country’s defense capabilities are, how high the country’s defense morale is and how the soldiers of the country are patriotic and possess defense mindset.(Excerpt from an interview between the Office of the Commander-in-Chief of the Defence Services and Russia Today News Agency, 2020) #crd-Phoe Si
Translation
Page title: Public Outcry
Caption: Don’t ask what the government has done in the last five years.Just look at the economic situation in Myanmar from 2016 to 2019
Translation:
Caption: Local farmers’ heartfelt voices on the support of rice, oil, salt, beans and food supplies from military families for families affected by the drought

3. We removed 589 Facebook accounts, 7,665 Pages and 437 accounts on Instagram that were involved in coordinated inauthentic behavior. This network originated in Azerbaijan and focused primarily on domestic audiences. (Updated on November 6, 2020 at 9:00AM PT to reflect the latest enforcement numbers.)

While the individuals behind this activity used fake accounts — some of which had been already detected and disabled by our automated systems, they primarily relied on authentic accounts to create Pages designed to look like user profiles — using false names and stock images — to comment and artificially boost the popularity of particular pro-government content. This network appeared to engage individuals in Azerbaijan to manage Pages with the sole purpose of leaving supportive and critical commentary on Pages of international and local media, public figures including opposition and the ruling party of Azerbaijan, to create a perception of wide-spread criticism of some views and wide-spread support of others. From what we’ve seen, it appears that most of the engagement these comments received were from within this network of Pages themselves. Our analysis shows that these comments were posted in what appears to be regular shifts during working hours in Azerbaijan on weekdays.

This network posted primarily in Azerbaijani, and also in Russian and English. Their comments frequently touched on local and regional news and events, politics, government policies, tensions between Armenia and Azerbaijan, Armenia’s actions during past escalations in Nagorno-Karabakh, praise of President Ilham Aliev and the New Azerbaijani Party, criticism of the opposition party and leaders accusing them of treason, and denials of human rights abuse allegations in Azerbaijan.

We identified this network through an internal investigation into suspected fake engagement activity in the region. Our investigation linked this activity to the Youth Union of New Azerbaijani Party.

Below is a sample of the content posted by some of these Pages:

Automated Translation:
Page name: Radio Liberty Azerbaijan about
Post: “Regarding the ADB’s forecast figures, I believe that with this trend, GDP will decline by 4.8-5 percent. If there is a 2.8% decline in the first seven months of 2020, it may continue until the end of the year. The consequences of any crisis over time are going to felt even more.”
Comment 1: Despite the negative impact of the pandemic on the country and the world economy and falling oil prices, as noted by President Ilham Aliyev, no social project will be postponed.
Comment 2: It should be noted that during the
pandemic, our country saw a decline in the economy of only 2.8% in 7 months. However, this result is very good for many countries.
Comment 3: Azerbaijan has a strong economy, and the virus has had little effect on growing economic development. This took us an average of 2 years ago, but in countries like Germany, this figure is much higher.
Comment 4: Important reforms are underway in
Azerbaijan to double the economy. The state uses all opportunities to resolve this issue. We have passed many such tests and we will continue to do so.

Automated Translation:
Page name: New Azerbaijani Party Youth Union
Post: PRESIDENT ORDERS ON “DIGLAS”: ENTREPRENEURS WILL BE
COMPENSATED [Link to video]
Comment: Once again, the leader showed who the people should trust and who can provide the solution to their problems.

4. We removed 78 Facebook accounts, 45 Pages, 93 Groups and 46 Instagram accounts engaged in coordinated inauthentic behavior. This activity originated primarily in Nigeria and focused on domestic audiences. (Updated on November 6, 2020 at 9:00AM PT to reflect the latest enforcement numbers.)

The people behind this activity used fake and duplicate accounts to manage Groups and Pages posing as independent news entities, and to drive people to their off-platform sites. Many of these accounts used stock images and photos of Ibrahim Zakzaky, the head of Nigeria’s Islamic Movement (IMN), Ayatollah Khomeini and Qasem Soleimani. This network amplified particular hashtags including #FreeZakzaky after the arrest of IMN’s founder. The Page admins and account owners posted primarily in Hausa, and also in English and Arabic about local news and events including IMN being a peaceful movement, protests across Nigeria, and criticism of the Nigerian armed forces, police, President Buhari and the ban of IMN.

We identified this activity through our investigation into suspected coordinated inauthentic behavior in the region with some limited links to the network we removed in March 2019. Although the people behind this operation attempted to conceal their identities and coordination, our investigation linked this activity to the Islamic Movement in Nigeria.

Below is a sample of the content posted by some of these Pages:

Networks Removed in September 2020:

  1. NEW — Russia: We removed 40 Facebook accounts, 17 Pages, 1 Group and 6 Instagram accounts in Russia. This network focused on domestic audiences. We identified this network after receiving information about its off-platform activity from our colleagues at Twitter. Our investigation linked this activity to individuals associated with the United Russia party.
  2. Russia: We removed 224 Facebook users, 35 Pages, 18 Groups and 34 Instagram accounts linked to the Russian military including military intelligence services. This activity originated in Russia and focused primarily on Syria and Ukraine, and to a lesser extent on Turkey, Japan, Armenia, Georgia, Belarus and Moldova. A small portion of this activity focused on the UK and the US. We identified this network as part of our investigation into suspected coordinated inauthentic behavior connected to the networks we removed in August 2018 and February 2020. (Originally announced on September 24, 2020)
  3. Russia: We removed 1 Page, 5 Facebook accounts, 1 Group and 3 Instagram accounts linked to individuals associated with past activity by the Russian Internet Research Agency (IRA). This small network originated in Russia and focused primarily on Turkey and Europe, and also on the US. We began our investigation based on information from the FBI about this network’s off-platform activity. (Originally announced on September 24, 2020)
  4. Russia: We removed 23 Facebook accounts, 7 Pages and 3 Instagram accounts linked to to individuals in Russia, including those associated with Russian intelligence services. This network focused on global audiences and Russia’s neighboring countries including Belarus. We found this activity as a result of our investigation into the suspected coordinated inauthentic behavior linked to our previous enforcement in July 2019. (Originally announced on September 24, 2020)
  5. China: We removed 155 accounts, 11 Pages, 9 Groups and 6 Instagram accounts linked to individuals in the Fujian province of China. This network focused primarily on the Philippines and South East Asia more broadly, and also on the US. We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region. (Originally announced on September 22, 2020)
  6. Philippines: We removed 64 Facebook accounts, 32 Pages and 33 Instagram accounts linked to Philippine military and Philippine police. This network focused on domestic audiences in the Philippines. We found the full scope of this activity after investigating information about a portion of this network brought to our attention by civil society in the Philippines and Rappler, an independent news organization in the Philippines. (Originally announced on September 22, 2020)

See the detailed report for more information about our CIB enforcements in September 2020.