Meta

February 2021 Coordinated Inauthentic Behavior Report

We’re constantly working to find and stop coordinated campaigns that seek to manipulate public debate across our apps.

The Purpose of This Report

Over the past three and a half years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. As part of our regular CIB reports, we’re sharing information about all networks we take down over the course of a month to make it easier for people to see progress we’re making in one place.

What is CIB?

We view CIB as coordinated efforts to manipulate public debate for a strategic goal where fake accounts are central to the operation. There are two tiers of these activities that we work to stop: 1) coordinated inauthentic behavior in the context of domestic, non-government campaigns and 2) coordinated inauthentic behavior on behalf of a foreign or government actor.

Coordinated Inauthentic Behavior (CIB)
When we find domestic, non-government campaigns that include groups of accounts and Pages seeking to mislead people about who they are and what they are doing while relying on fake accounts, we remove both inauthentic and authentic accounts, Pages and Groups directly involved in this activity.

Foreign or Government Interference (FGI)
If we find any instances of CIB conducted on behalf of a government entity or by a foreign actor, we apply the broadest enforcement measures including the removal of every on-platform property connected to the operation itself and the people and organizations behind it.

Continuous Enforcement
We monitor for efforts to re-establish a presence on Facebook by networks we previously removed. Using both automated and manual detection, we continuously remove accounts and Pages connected to networks we took down in the past.

Summary of February 2021 Findings

Our teams continue to focus on finding and removing deceptive campaigns around the world — whether they are foreign or domestic. In February, we removed five networks from Thailand, Iran, Morocco and Russia. Two Iranian networks primarily targeted people outside of Iran, and three others — from Thailand, Morocco and Russia — focused on domestic audiences in their respective countries. We have shared information about our findings with industry partners, researchers and policymakers.

In addition to these five networks, in February we also detected and removed attempts to reestablish a presence on Facebook by the military-linked networks we had previously removed for CIB in Myanmar. These repeat violations over the past few years and continuous attempts to circumvent our CIB enforcement were among the factors that led to our broader decision to ban the Myanmar military from Facebook and Instagram, which we shared last week.

Much of the CIB activity we removed worldwide in February was consistent with what we’ve seen from various threat actors over the past 3 years, including the prevalence of domestic targeting. The Russia-based network, however, was an interesting example of tactics we often see from spam and financially motivated actors being deployed to mislead people during civic protests. In an attempt to drown out relevant information, this network used hundreds of accounts and mass-posted content with the same hashtags and location tags used by people posting about the protests against the arrest of Alexey Navalny, an anti-corruption activist and politician. These accounts were automatically detected by our systems and then disabled as fake.

We know that influence operations will keep evolving in response to our enforcement, and new deceptive behaviors will emerge. We will continue to refine our enforcement and share our findings publicly. We are making progress rooting out this abuse, but as we’ve said before – it’s an ongoing effort. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working closely with law enforcement, security experts and other companies.

Here are the numbers of removed assets as part of the five CIB networks:

Networks removed in February 2021:

  1. Thailand: We removed 77 Accounts, 72 Pages, 18 Groups and 18 Instagram accounts that originated in Thailand and targeted domestic audiences in the Southern provinces of Thailand. Our investigation found links to the Thai Military’s Internal Security Operations Command. We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region.
  2. Iran: We removed 446 Facebook accounts, 4 Pages, 3 Groups and 2 Instagram accounts that originated in Iran and targeted primarily Iraq, and to a lesser extent Israel, the United Kingdom, and Afghanistan. Our investigation found links to individuals in Tehran. We found this network after reviewing public reporting about a handful of its accounts focused on Israel. Our internal investigation uncovered the broader network.
  3. Iran: We removed 7 Facebook accounts, 4 Pages and 16 Instagram accounts that originated primarily in Iran and targeted both domestic audiences in Iran and also Lebanon, Iraq, and the United Arab Emirates. Our investigation found links to individuals in Iran with academic backgrounds. We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region.
  4. Morocco: We removed 385 Facebook accounts, 6 Pages and 40 Instagram accounts that originated primarily in Morocco and targeted domestic audiences. We found this network after reviewing information about a small portion of this activity in the region shared by Amnesty International.
  5. Russia: We removed 530 Instagram accounts that originated primarily in Russia and targeted domestic audiences throughout the recent protests in support of Alexey Navalny, an anti-corruption activist and opposition politician in Russia. We detected and disabled the vast majority of these accounts, including through automation, as they began posting.

See the full report for more information.