Removing Coordinated Inauthentic Behavior
Today, we’re sharing an update on the enforcement actions we’ve taken since our last monthly report on coordinated inauthentic behavior (CIB). This includes both our September CIB report and a set of enforcement actions we’ve taken in the last few days. In total, we are publishing our findings about 10 networks — six operations we removed in September, most of which we already announced, and four new operations that we removed since October 1, including those we disabled this morning.
In each case, the people behind this activity coordinated with one another and used fictitious accounts and personas as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove these operations, we focus on behavior rather than content, whether they’re foreign or domestic, and regardless of who’s behind them or what they post.
Over the past three years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. Earlier this year, we started publishing regular CIB reports where we share information about the networks we take down over the course of each month to make it easier for people to see progress we’re making in one place. In some cases, like today, we also share our findings soon after our enforcement. The latest takedowns we are announcing today will also be included in our October report. You can find more information about our previous CIB enforcement actions here.
Before we share the details on each network, here are a few trends to note.
More than half of the networks we’re sharing today targeted domestic audiences in their countries and many of them were linked to groups and individuals associated with politically affiliated actors in the US, Myanmar, Russia, Nigeria, Philippines and Azerbaijan. Over the past three years, we’ve seen and taken action against domestic political actors around the world using CIB. We know these actors will continue to attempt to deceive and mislead people, including by making particular viewpoints appear more widely supported or criticized than they are, or by targeting influencers to unwittingly amplify their narratives.
Two of the networks we’re sharing today engaged primarily in commenting on content — relying on real people, not automation — to create the perception of wide-spread support of their narratives by leaving comments on posts by media entities and public figures. Other campaigns — like the ones from Russia (that we removed in late September) — focused on tricking unwitting freelance journalists into writing on behalf of these operations.
Deceptive campaigns like these raise a particularly complex challenge by blurring the line between healthy public debate and manipulation. Our teams will continue to find, remove and expose these coordinated manipulation campaigns, but we know these threats extend beyond our platform and no single organization can tackle them alone. That’s why it’s critical that we, as a society, have a broader discussion about what is acceptable political advocacy and take steps to deter people from crossing the line.
As part of our contribution to this conversation, based on the past three years of studying and taking down influence operations, my team has outlined recommendations for regulatory and legislative principles against these deceptive campaigns here.
We have shared information about our findings with law enforcement, policymakers and industry partners. We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead.
What We Found
(Note: We’ll update these numbers in the coming days when more data for this reporting period becomes available.)
Networks removed October 1-8, 2020:
1. We removed 200 Facebook accounts, 55 Pages and 76 Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in the US and focused primarily on domestic US audiences and also on Kenya and Botswana.
The people behind this activity used fake accounts — a large portion of which had been automatically removed by our systems — to comment on other people’s content. Many of these accounts used stock profile photos and posed as right-leaning individuals from across the US. In 2018, some of these accounts posed as left-leaning individuals to comment on content as well. This activity was centered primarily around commenting on news articles posted by news organizations and public figures, rather than posting their own content. These comments included topics like trophy or sport hunting in the US and Kenya, the midterm elections in 2018, the 2020 presidential election, COVID-19, criticism of the Democratic party and presidential candidate Joe Biden, and praise of President Trump and the Republican party. Most recently, the people behind this activity commented most frequently on Pages of the Washington Post, Fox News, MSNBC, CNN and The New York Times. This network showed some links to on-platform activity by Turning Point USA.
This network appears to have started its operations in 2018 and continued through 2020. Its election-focused behavior began in 2018 in the run-up to the midterms, it then went largely dormant until June 2020. The most recent activity included creating what we call “thinly veiled personas” whose names were slight variations of the names of the people behind them and whose sole activity on our platform was associated with this deceptive campaign. We assess this shift in tactics is likely due to the majority of this network’s fake accounts getting caught by our automated detection systems.
We began our investigation after public reporting about some elements of this activity by the Washington Post. Although the people behind this network attempted to conceal their identities and coordination, our investigation linked this activity to Rally Forge, a US marketing firm, working on behalf of Turning Point USA and Inclusive Conservation Group. Rally Forge is now banned from Facebook. We are continuing to investigate all linked networks, and will take action as appropriate if we determine they are engaged in deceptive behavior.
Presence on Facebook and Instagram: 200 Facebook accounts, 55 Pages and 76 Instagram accounts.
Followers: About 373,000 accounts followed one or more of these Pages and around 22,000 people followed one or more of these Instagram accounts.
Advertising: Around $973,000 in spending for ads on Facebook and Instagram paid for in US dollars. This includes the entirety of advertising activity by both inauthentic and authentic accounts removed as part of this network.
Below is a sample of the content posted by some of these Pages and accounts:
Screenshot of post Sample of content Screenshot of post Screenshot of post
2. We removed 17 Pages, 50 Facebook accounts and 6 Instagram accounts for violating our policy against coordinated inauthentic behavior. This domestic-focused activity originated in Myanmar.
We identified clusters of connected activity that relied on a combination of fake, duplicate and authentic accounts to post content, evade enforcement and removal, manage Pages and drive people to off-platform websites including military-controlled media domains. These accounts often used stock female profile photos and photos of celebrities and social media influencers. The individuals behind this network posted primarily in Burmese about local news and current events including topics like military activities, the Union Solidarity and Development Party, local COVID-19 response, criticism of the the National League for Democracy, a political party in Myanmar, and Aung San Suu Kyi, as well as a small number of anti-Rohingya posts.
We began our investigation after reviewing local public reporting about some elements of this activity as part of our proactive work ahead of the upcoming election in Myanmar. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to members of the Myanmar military.
Presence on Facebook: 17 Pages, 50 Facebook accounts and 6 accounts on Instagram.
Followers: About 538,000 accounts followed one or more of these Pages and around 800 accounts followed one or more of these Instagram accounts.
Advertising: Around $1,850 in spending for ads on Facebook paid for in US dollars.
3. We removed 589 Facebook accounts, 7,906 Pages and 447 accounts on Instagram that were involved in coordinated inauthentic behavior. This network originated in Azerbaijan and focused primarily on domestic audiences.
While the individuals behind this activity used fake accounts — some of which had been already detected and disabled by our automated systems, they primarily relied on authentic accounts to create Pages designed to look like user profiles — using false names and stock images — to comment and artificially boost the popularity of particular pro-government content. This network appeared to engage individuals in Azerbaijan to manage Pages with the sole purpose of leaving supportive and critical commentary on Pages of international and local media, public figures including opposition and the ruling party of Azerbaijan, to create a perception of wide-spread criticism of some views and wide-spread support of others. From what we’ve seen, it appears that most of the engagement these comments received were from within this network of Pages themselves. Our analysis shows that these comments were posted in what appears to be regular shifts during working hours in Azerbaijan on weekdays.
This network posted primarily in Azerbaijani, and also in Russian and English. Their comments frequently touched on local and regional news and events, politics, government policies, tensions between Armenia and Azerbaijan, Armenia’s actions during past escalations in Nagorno-Karabakh, praise of President Ilham Aliev and the New Azerbaijani Party, criticism of the opposition party and leaders accusing them of treason, and denials of human rights abuse allegations in Azerbaijan.
