Removing Coordinated Inauthentic Behavior From Ethiopia

By Nathaniel Gleicher, Head of Security Policy

We removed a network of accounts, Pages and Groups in Ethiopia for coordinated inauthentic behavior (CIB). It targeted domestic audiences in its own country.

The people behind this activity coordinated with one another and used fake accounts as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove CIB operations, we focus on behavior rather than content, no matter who’s behind them, what they post, or whether they’re foreign or domestic.

Over the past four years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. Each month, we publish CIB reports where we share information about the networks we take down over the course of each month to make it easier for people to see the progress we’re making in one place. In some cases, like today, we also share our findings at the time of enforcement. The takedown we are announcing today will also be included in our June 2021 report. You can find more information about our previous CIB enforcement actions here.

We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead.

(We will update the numbers as soon as the latest data becomes available)

We removed 62 Facebook accounts, 49 Pages, 26 Groups, and 32 accounts on Instagram for violating our policy against coordinated inauthentic behavior. (Updated on July 7, 2021 at 6:00PM PT to reflect the latest enforcement numbers.) This network originated in and focused on domestic audiences in Ethiopia.

The operation used duplicate and fake accounts — some of which were already detected and disabled by our automated systems — to post and comment on their own content, and manage Groups and Pages, including those posing as media entities. The campaign appeared to accelerate their posting activity in 2020 and into 2021, and some of its recent content was rated false by independent fact-checkers and labeled as misleading. Some of the accounts went through significant name changes over time. They also used spam-like inauthentic distribution tactics to post the same content across multiple Pages and Groups simultaneously, including other people’s Groups.

This network posted primarily in Amharic about news and current events in Ethiopia, including the Prosperity party, Prime Minister Abiy Ahmed, and criticism of Egypt and Sudan related to Ethiopia’s mega dam project. They also posted critical commentary about various opposition politicians and groups in Ethiopia, including Oromo Liberation Front, Ethiopian Democratic Party, and the Tigray People’s Liberation Front among others. Most recently, they commented about protests against the US sanctions on Ethiopia. We assess that this activity was not directly focused on the Tigray region or the ongoing conflict in Tigray.

We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region. Although the people behind it attempted to conceal their identities and coordination, our investigation found links to individuals associated with INSA, the Information Network Security Agency in Ethiopia.

  • Presence on Facebook and Instagram: 62 Facebook accounts, 49 Pages, 26 Groups and 32 Instagram accounts. (Updated on July 7, 2021 at 6:00PM PT to reflect the latest enforcement numbers.)
  • Followers: About 1.1 million accounts followed one or more of these Pages, about 766,000 accounts joined one or more of these Groups, and around 1,700 people followed one or more of these Instagram accounts.
  • Advertising: About $7,200 in spending for ads paid for in US dollars. (Updated on July 7, 2021 at 6:00PM PT to reflect the latest numbers.)

Below is a sample of the content posted by some of these Pages and accounts:

Caption: Debretseion’s death is being talked about on social media. It seems all that threat has gone to grave. It is usually the case that an empty threat of a “shiro” is until a spoon finds it.
Image overlay: Debretsion, the warthog, has been making threats wearing his gloves but he has gone to the grave. Ego takes one to
the grave.
Image overlay: Those who know him, know him well. Those who don’t know him are getting to know him now. he knows how to persuade his enemies with his bright path.
Stay strong our leader. Millions of us have decided to stand with you.
Post and comments by this network’s Page and account.
Caption: The supporters of the junta which has been blown to ashes in two weeks by our military and amhara special forces are now using hashtag campaigns to get international intervention and support. this is a nightmare. Does one think the group which has been defeated while having tanks and missiles can come back to life through a false campaign? Never. This is like trying to hug a cloud.
Image overlay: The Tigray genocide is only happening on social media, particularly on Twitter.

To help personalize content, tailor and measure ads, and provide a safer experience, we use cookies. By clicking or navigating the site, you agree to allow our collection of information on and off Facebook through cookies. Learn more, including about available controls: Cookie Policy