Facebook: Removing Coordinated Inauthentic Behavior

By Nathaniel Gleicher, Head of Security Policy, Facebook

We removed three separate networks for violating our policy against foreign or government interference which is coordinated inauthentic behavior (CIB) on behalf of a foreign or government entity. These networks originated in Russia.

In each case, the people behind this activity coordinated with one another and used fake accounts as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove these operations, we focus on behavior rather than content, no matter who’s behind them, what they post, or whether they’re foreign or domestic.

Over the past three years, we’ve shared our findings about over 100 networks of coordinated inauthentic behavior we detected and removed from our platforms. Earlier this year, we started publishing monthly CIB reports where we share information about the networks we take down to make it easier for people to see progress we’re making in one place. In some cases, like today, we also share our findings soon after our enforcement. Today’s takedowns will also be included in our September report. You can find more information about our previous CIB enforcement actions here.

The networks we’re announcing today targeted many countries around the world and had very limited following globally at the time of disruption. Much of this activity focused on two things: 1) creating fictitious or seemingly independent media entities and personas to engage unwitting individuals to amplify their content and 2) driving people to other websites that these operations control. Similarly to the Russia-based network we removed in August, these operations worked across many internet services and attempted to hire contributors and seed their stories with news organizations.

We’ve seen deceptive campaigns target journalists and public figures in the past, including as part of hack-and-leak operations. Hack-and-leak — where a bad actor steals sensitive information, sometimes manipulates it, and then strategically releases it to influence public debate — is one of the threats we’re particularly focused on and concerned about ahead of the November elections in the US. While we have not seen the networks we removed today engage in these efforts, or directly target the US 2020 election, they are linked to actors associated with election interference in the US in the past, including those involved in “DC leaks” in 2016. We anticipate that operations like these may attempt to pivot at any time and we will keep vigilant to find and remove them. We will also continue to share our findings publicly to provide context for the adversarial trends we see.

These threats are a whole-of-society challenge, and we’re working with partners across industry to tackle them. We have shared information about our findings with law enforcement, policymakers and industry partners. We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead.

What We Found

1. We removed 214 Facebook users, 35 Pages, 18 Groups and 34 Instagram accounts for violating our policy against foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This activity originated in Russia and focused primarily on Syria and Ukraine, and to a lesser extent on Turkey, Japan, Armenia, Georgia, Belarus, and Moldova A small portion of this activity focused on the UK and the US.

We identified several clusters of connected activity that relied on fake accounts — many of which had been detected and removed by our automated systems. This network appears to have centered around a number of regions including the Far East, Russia’s neighboring countries, and Syria. They used fake accounts to create elaborate fictitious personas across many internet services, posing as journalists to contact news organizations, purporting to be locals in countries they targeted, and managing Groups and Pages, some of which proclaimed to be hacktivist groups. These clusters also focused on driving people to their off-platform sites and other social media platforms where, among other themes, they promoted content related to past alleged leaks of compromising information. The operation had almost no following on our platforms when we removed it.

The people behind this campaign posted in many languages including English, Ukrainian, Russian and Arabic as they tailored their activity to each audience. They frequently posted about news and current events, including the Syrian civil war, Turkish domestic politics, geopolitical issues in the Asia-Pacific region, NATO, the war in Ukraine, and politics in the Baltics, Georgia, Armenia, Ukraine, Russia, Belarus, and the US.

We identified this activity as part of our investigation into suspected coordinated inauthentic behavior connected to the networks we had removed in August 2018 and February 2020. Although the people behind this operation took steps to conceal their identities and coordination, our investigation connected these clusters to the Russian military including military intelligence services.

• Presence on Facebook and Instagram: 214 Facebook accounts, 35 Pages, 18 Groups and 34 Instagram accounts
• Followers: About 8,500 accounts followed one or more of these Pages, about 9,500 accounts joined one or more of these Groups, and around 7,500 people followed one or more of these Instagram accounts
• Advertising: About $60 in spending for ads on Facebook paid for in US dollars and rubles.

Below is a sample of the content posted by some of these Pages and accounts:

2. We also removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.

The people behind this activity posted off-platform articles primarily in English and Turkish about global news and current events relevant to the countries they targeted, including local elections; geopolitical conspiracies; presidential and parliamentary elections in Hong Kong, Spain, the UK, and the US; social and racial injustice; police brutality; the coronavirus pandemic; criticism of US sanctions in the Middle East, US foreign policy, and US allies including Israel; and politics in Venezuela.

We began this investigation based on information from the FBI about this network’s off-platform activity. Our internal investigation enabled us to find the full scope of this network on Facebook. Although the people behind this activity attempted to conceal their identity and coordination, our investigation found links to individuals associated with past activity by the Russian Internet Research Agency (IRA).

• Presence on Facebook and Instagram: 5 Facebook accounts, 1 Pages, 1 Group and 3 Instagram accounts
• Followers: About 4,900 accounts followed this Page, 1 account joined this Group and about 5,600 people followed one of more of these Instagram accounts.
• Advertising: Around $4,800 in spending for ads on Facebook paid for in euros and rubles.

Below is a sample of the content posted by some of these Pages and accounts:

3. We also removed 23 Facebook accounts, 6 Pages, and 8 Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This network originated in Russia and focused on global audiences, Russia’s neighboring countries including Belarus.

We identified several clusters of connected activity that used a combination of authentic and fake accounts — some of which had been already disabled by our automated detection systems — to create fictitious personas, post and comment on content, manage Pages, amplify their content, and drive people to off-platform sites posing as independent journals. These fake personas posed as editors and researchers to solicit articles for these websites. This network posted primarily in Russian and English about news and current events, including protests and elections in Belarus, Russian and Ukrainian politics, geopolitical conspiracies, Russia-NATO relations, Russia’s relations with neighboring countries, and criticism of US foreign policy, socio-economic issues in the US, and US political candidates on both sides of the political spectrum.

We found this activity as a result of our investigation into the suspected coordinated inauthentic behavior linked to our previous enforcement in July 2019. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to individuals in Russia, including those associated with Russian intelligence services.

• Presence on Facebook and Instagram: 23 Facebook accounts, 6 Pages, and 8 Instagram accounts.
• Followers: About 59,000 accounts followed one or more of these Pages and around 2,000 people followed one or more of these Instagram accounts.
• Advertising: About $10,000 in spending for ads on Facebook and Instagram paid for primarily in rubles.

Below is a sample of the content posted by some of these Pages and accounts:

By Nathaniel Gleicher, Head of Security Policy, Facebook