March 2021 Coordinated Inauthentic Behavior Report

We’re constantly working to find and stop coordinated campaigns that seek to manipulate public debate across our apps.

The Purpose of This Report

Over the past three and a half years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. As part of our regular CIB reports, we’re sharing information about all networks we take down over the course of a month to make it easier for people to see progress we’re making in one place.

Summary of March 2021 Findings

Our teams continue to focus on finding and removing deceptive campaigns around the world — whether they are foreign or domestic. In March, we removed 14 networks from 11 countries. Five networks — from Albania, Iran, Spain, Argentina, and Egypt — targeted primarily people outside of their countries. Nine others — from Israel, Benin, Comoros, Georgia, and Mexico — focused on domestic audiences in their respective countries. We have shared information about our findings with industry partners, researchers, law enforcement and policymakers.

Here are a few notable highlights:

Early detection and continuous enforcement: The vast majority of the networks we removed in March had limited following or were in the early stages of building their audiences when we removed them. The small Iranian network is a good example: the threat actor behind it attempted to re-create their presence after we disrupted their operation targeting Israel in October 2020. Late last year and in early 2021, they began creating Pages and accounts, some of which were detected and disabled by our automated systems. About a month after their first Page was created our teams began investigating the rest of the network. Ongoing enforcement against these threat actors across the internet has made these operations less effective in building their following. With each removal, we set back the actors behind these networks, forcing them to re-build their operations and slowing them down.

A deep dive into a troll farm: In addition to these newer networks, we also investigated and disrupted a long-running operation from Albania that targeted primarily Iran. While not successful in building significant audiences over several years of operation, this campaign was run by what appears to be a tightly organized troll farm linked to an exiled militant opposition group from Iran, Mojahedin-e Khalq (MEK). To shine light on how such operations manifest on our platform, we’re adding a detailed research and analysis section at the end of this report. We’ve shared our findings with other platforms and researchers to contribute to additional discoveries into similar activity on the broader internet.

AI-generated images: We’ve removed three CIB networks that made use of profile photos likely generated using machine learning technologies capable of creating realistic images. Since 2019, we have now disrupted seven operations that used such synthetic photos. Notably, although the use of GAN-generated images can make an account look authentic to an external observer, it doesn’t materially change the deceptive behavior patterns that we look for to identify inauthentic activity.

We know that influence operations will keep evolving in response to our enforcement, and new deceptive behaviors will emerge. We will continue to refine our enforcement and share our findings publicly. We are making progress rooting out this abuse, but as we’ve said before – it’s an ongoing effort. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working closely with law enforcement, security experts and other companies.

Here are the numbers related to the new 14 CIB networks we removed in March:

• Total number of Facebook accounts removed: 1,167
• Total number of Instagram accounts removed: 290
• Total number of Pages removed: 255
• Total number of Groups removed: 34

Networks removed in March 2021:

1. Albania: We removed 128 accounts, 41 Pages, 21 Groups, and 146 Instagram accounts from Albania that targeted global audiences including Iran. We found this network as part of our internal investigation and linked it to MEK, an exiled militant opposition group from Iran now based in Albania. (See a detailed analysis of this network’s activity at the end of this report).
2. Iran: We removed 29 Facebook accounts, two Pages, one Group, and 10 Instagram accounts from Iran that targeted Israel. We found this network as a result of our internal investigation into the suspected coordinated inauthentic behavior linked to the network we removed in October 2020.
3. Spain and El Salvador: We removed 118 Facebook accounts, eight Pages, and ten Instagram accounts from Spain and El Salvador that targeted El Salvador. We found this network after reviewing research about some of this activity by FireEye, a cyber security company. Our investigation found links to Spain-based employees of the Italian PR firm Reputation Up and individuals with a background in digital marketing working on behalf of the ARENA party in El Salvador.
4. Spain and Argentina: We removed 390 Facebook accounts, six Pages, and 17 Instagram accounts from Spain and Argentina that targeted Ecuador. We found this network after reviewing research about some of this activity on other platforms by FireEye, a cyber security company. Our investigation found links to Leanga Software, a social media management company in Spain.
5. Egypt: We removed 17 Facebook accounts, six Pages, and three Instagram accounts from Egypt that targeted Ethiopia, Sudan, and Turkey. We found this network as part of our internal investigation and linked it to Bee Interactive, a marketing firm in Egypt.
6. Israel: We removed 37 Facebook accounts, 20 Pages, and one Instagram accounts from Israel that targeted domestic audiences in that country. We found this network as part of our internal investigation. Our assessment benefited from information shared with us by local civil society in Israel. Our investigation found links to ElBaladd, a news website in Israel.
7. Benin: We removed 21 Facebook accounts, 16 Pages, and 9 Instagram accounts from Benin that targeted domestic audiences in that country. We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region.
8. Comoros: We removed 33 Facebook accounts, 12 Pages, and 5 Instagram accounts from Comoros that targeted domestic audiences in that country. We found this network as part of our internal investigation and linked it to Centre Médiatique Moderne des Comores (CMMC), a communications company in Comoros.
9. Georgia: We removed 23 Facebook accounts, 24 Pages, 12 Groups, and 11 Instagram accounts from the country of Georgia that targeted domestic audiences in that country. We found this network after reviewing public reporting on this activity by researchers at the Digital Forensic Research Lab at the Atlantic Council. Our investigation found links to individuals associated with Georgian March, a political party in Georgia, and its youth wing.
10. Mexico: We removed 71 Facebook accounts, 18 Pages, and seven Instagram accounts from the state of Quintana Roo in Mexico that targeted domestic audiences in that state. We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region.
11. Mexico: We removed 56 Facebook accounts from the state of Colima in Mexico that targeted domestic audiences in that state. We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region.
12. Mexico: We removed 54 Facebook accounts and 73 Pages from the state of Baja California in Mexico that targeted audiences in that state. We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region.
13. Mexico: We removed 39 Facebook accounts, 15 Pages, and eight Instagram accounts that originated in Mexico and targeted domestic audiences. We found this activity as part of our internal investigation and linked it to Flow Agency, a PR firm in Mexico.
14. Mexico: We removed 151 Facebook accounts, 14 Pages, and 63 Instagram accounts from the state of Nayarit in Mexico that targeted domestic audiences in that state. We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region.

Learn More About What Is Coordinated Inauthentic Behavior or CIB

We view CIB as coordinated efforts to manipulate public debate for a strategic goal where fake accounts are central to the operation. There are two tiers of these activities that we work to stop: 1) coordinated inauthentic behavior in the context of domestic, non-government campaigns and 2) coordinated inauthentic behavior on behalf of a foreign or government actor.

Coordinated Inauthentic Behavior (CIB)
When we find domestic, non-government campaigns that include groups of accounts and Pages seeking to mislead people about who they are and what they are doing while relying on fake accounts, we remove both inauthentic and authentic accounts, Pages and Groups directly involved in this activity.

Foreign or Government Interference (FGI)
If we find any instances of CIB conducted on behalf of a government entity or by a foreign actor, we apply the broadest enforcement measures including the removal of every on-platform property connected to the operation itself and the people and organizations behind it.

Continuous Enforcement
We monitor for efforts to re-establish a presence on Facebook by networks we previously removed. Using both automated and manual detection, we continuously remove accounts and Pages connected to networks we took down in the past.

See the full report for more information.