December 2020 Coordinated Inauthentic Behavior Report

We’re constantly working to find and stop coordinated campaigns that seek to manipulate public debate across our apps.

The Purpose of This Report

Over the past three years, we’ve shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. As part of our regular CIB reports, we’re sharing information about all networks we take down over the course of a month to make it easier for people to see progress we’re making in one place.

What is CIB?

We view CIB as coordinated efforts to manipulate public debate for a strategic goal where fake accounts are central to the operation. There are two tiers of these activities that we work to stop: 1) coordinated inauthentic behavior in the context of domestic, non-government campaigns and 2) coordinated inauthentic behavior on behalf of a foreign or government actor.

Coordinated Inauthentic Behavior (CIB)

When we find domestic, non-government campaigns that include groups of accounts and Pages seeking to mislead people about who they are and what they are doing while relying on fake accounts, we remove both inauthentic and authentic accounts, Pages and Groups directly involved in this activity.

Foreign or Government Interference (FGI)

If we find any instances of CIB conducted on behalf of a government entity or by a foreign actor, we apply the broadest enforcement measures including the removal of every on-platform property connected to the operation itself and the people and organizations behind it.

Continuous Enforcement

We monitor for efforts to re-establish a presence on Facebook by networks we previously removed. Using both automated and manual detection, we continuously remove accounts and Pages connected to networks we took down in the past.

Summary of December 2020 Findings

Our teams continue to focus on finding and removing deceptive campaigns around the world — both foreign and domestic. In December, we removed 17 networks of accounts, Pages and Groups, the most we’ve removed in any one month. We took down deceptive campaigns from nearly every continent and shared information about our findings with law enforcement, policymakers and industry partners. Here are a few trends and tactics we saw:

Targeting of domestic audiences: At least 12 out of 17 networks we investigated and took down last month — in Ukraine, Kyrgyzstan, Kazakhstan, Brazil, Argentina, Pakistan, Indonesia and Morocco — targeted domestic audiences in their own countries. At least five networks — from Iran, Ukraine, France, Morocco, and Russia — focused on people outside of their countries. We know these actors will continue to attempt to deceive and mislead people, including making particular viewpoints appear more widely supported or criticized than they are to sway public debate in their respective countries.

Election targeting and importance of regulations: At least 12 of 17 influence operations focused on elections, primarily (but not exclusively) on behalf of domestic actors. Deceptive campaigns like these raise a complex challenge by blurring the line between healthy public debate and manipulation. Our teams will continue to find, remove and expose these coordinated manipulation campaigns, but we know these threats extend beyond our platform, and no single organization can tackle them alone. That’s why it’s critical that we, as a society, have a broader discussion about what is acceptable political advocacy and take steps to deter people from crossing the line. As part of our contribution to this conversation, we outlined recommendations for regulatory and legislative principles against these deceptive campaigns here.

Early detection and limited reach: The vast majority of the networks we removed in December had limited following or were in the early stages of building their audiences when we removed them. The small Iranian network is a good example: many of the recent CIB operations from Iran have continued to become smaller and less effective as we and our peers in the industry find and remove them before they are able to build their audiences, including through improving automated detection systems. To remain active if detected by researchers and platforms, some of the networks we took down last month relied on off-platform websites to host their content while using social media to amplify these domains. Ongoing enforcement against these threat actors across the internet has made these operations less effective in building their following. With each removal, we set back the actors behind these networks, forcing them to re-build their operations and slowing them down.

Fictitious news entities and targeting of the media: At least 7 operations we removed last month ran Pages posing as news entities sharing local updates about current events in the countries they targeted. This continued the trend we’ve seen over the years. Some of the networks in today’s report appeared to also target traditional media to place their stories under fictitious bylines. It’s critical that all of us, including journalists and influential public figures, remain vigilant about the messages we amplify and verify information we give credence.

Importance of collaboration with researchers, investigative journalists and local civil society organizations: We continue to see strong collaboration among companies, researchers, law enforcement and investigative journalists looking for these operations. When one of us finds an operation, we share it with others so we can all investigate and take action according to our policies. At least 10 out of 17 networks in this report were found either in collaboration with our external partners or based on open-source reporting that led our teams to uncover the full extent of coordinated inauthentic behavior on our platforms. We worked with disinformation researchers, investigative journalists and civil society organizations to find and remove these operations. We know that our adversaries will keep evolving their tactics. That’s why we continue to invest in building partnerships – to find these campaigns earlier in their operation.

We are making progress rooting out this abuse – but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead. That means building better technology, hiring more people and working closely with law enforcement, security experts and other companies.

• Total number of Facebook accounts removed: 1,957
• Total number of Instagram accounts removed: 707
• Total number of Pages removed: 156
• Total number of Groups removed: 727

Networks removed in December 2020:

1. NEW – Iran: We removed 4 Facebook accounts, part of a small and largely inactive network from Iran. They targeted primarily Arabic, French and English-speaking audiences globally. This network centered around off-platform typo-squatting domains. The vast majority of this activity was detected and disabled by our automated systems for inauthenticity and spam throughout 2020. We found this operation after reviewing information about some of its activity from FireEye and The Daily Beast.
2. NEW – Morocco: We removed 255 Facebook accounts, 93 Pages, 17 Groups and 60 Instagram accounts that originated in Morocco and targeted Morocco and Algeria. We found links between some of this activity and Qualitia Systems, a marketing firm in Morocco, also known as Marketing Digital Maroc. We found this network as part of our investigation into suspected coordinated inauthentic behavior in the region.
3. NEW – Ukraine: We removed 23 Facebook accounts, 25 Pages, 11 Groups and 19 Instagram accounts that originated in the Luhansk region in Ukraine and targeted Moldova, Kazakhstan, UK, Spain, Kyrgyzstan, Ukraine, Belarus, Germany, and Russia. This network was linked to individuals in the Luhansk region in Ukraine and those associated with Borotba, a political group in Ukraine. It centered around off-platform domains and was early in its audience building when we removed it. We found this activity as a result of reviewing public reporting on a portion of this activity by WELT and netzpolitik.org in Germany.
4. NEW – Ukraine: We removed 13 Facebook accounts, 31 Pages, six Groups and three Instagram accounts. This domestic-focused network originated in Ukraine and was linked to individuals associated with the non-governmental organization Anti-Corruption Blockpost. The operation had almost no following when we removed it. We found it after reviewing public reporting in Ukraine about some of this activity.
5. NEW – Ukraine: We removed 27 Facebook accounts, 37 Pages, 21 Groups and 13 Instagram accounts that originated in Ukraine and focused on domestic audiences. Our investigation found links to individuals associated with both the European Solidarity party and Sprava Gromad, an NGO in Ukraine. This network was early in its audience building when we removed it. We found it as part of our investigation into suspected coordinated inauthentic behavior in the region.
6. NEW – Kyrgyzstan: We removed 193 Facebook accounts, 246 Pages, 50 Groups and 30 Instagram accounts that originated in Kyrgyzstan and targeted domestic audiences. This network was linked to individuals in Kyrgyzstan with backgrounds in media consulting and had a limited following when we removed it. We found it after reviewing public reporting in Kyrgyzstan about a small portion of this activity.
7. NEW – Kyrgyzstan: We removed 92 Facebook accounts, four Pages, 11 Groups and 30 Instagram accounts. This domestic-focused activity originated in Kyrgyzstan and focused primarily on commenting on their content and also on posts by a political party and popular news Pages. This network had almost no following when we removed it. We found it after reviewing public reporting in Kyrgyzstan about a small portion of this activity.
8. NEW – Kyrgyzstan: We removed 121 Facebook accounts, 46 Pages, seven Groups and 41 Instagram accounts that originated in Kyrgyzstan and targeted domestic audiences. Our investigation found links to individuals in Kyrgyzstan with a background in media and government, and also a media company called Media Center. This activity centered around the 2020 Parliamentary election and the 2021 snap presidential election while playing on multiple sides of the political debate at once. This network had almost no following when we removed it. We found it after reviewing public reporting about a small portion of this activity.
9. NEW – Kazakhstan: We removed 31 Facebook accounts, one Group and 28 Instagram accounts that originated in Kazakhstan and targeted domestic audiences. Our investigation found links to individuals associated with the National Security Committee and the Anti-Extremism Unit of the Police Department of the North-Kazakhstan Region. This network appeared to have ramped up in 2019-2020 following protests in Kazakhstan and had nearly no following when we removed it. We found it after reviewing public reporting in Kazakhstan about a portion of this activity.
10. NEW – Argentina: We removed 663 Facebook accounts and 388 Instagram accounts that originated in Argentina and focused on domestic audiences. This network focused primarily on inauthentically amplifying posts and news articles related to Sergio Berni, Buenos Aires’ Minister of Security and had almost no following when we removed it. We found it after reviewing public information about a small portion of this activity shared by an open-source researcher. Our assessment benefited from additional findings shared with us by FireEye, a cybersecurity company.
11. NEW – Brazil: We removed 25 Facebook accounts, three Pages, and 10 Instagram accounts that originated in Paraná and targeted two municipalities in Paraná (Almirante Tamandaré and Colombo) focusing on the 2020 regional elections. Our investigation found links to Continental, a PR Agency based in Curitiba, and other individuals in the state of Paraná in Brazil. This network had almost no following when we removed it. We found this activity as part of our investigation into suspected coordinated inauthentic behavior in the region.
12. NEW – Brazil: We removed 34 Facebook accounts and 18 Instagram accounts that originated in Brazil and focused on three municipalities in the state of Espiríto Santo (Serra, Vitória and Cariacica) to amplify the Pages and posts related to mayoral candidates in each town. Our investigation found links to AP Exata Intelligence in Digital Communications, a public relations firm with offices in Brasília, Vitória and Braga in Portugal. This network had nearly no following when we removed it. We found it as part of our investigation into suspected coordinated inauthentic behavior in the region.
13. NEW – Pakistan: We removed 27 Facebook accounts, seven Pages, and 23 Instagram accounts that originated in Pakistan and targeted domestic audiences. This network created Pages posing as news entities and was early in building its audience when we removed it. We found it as a result of our investigation into the suspected coordinated inauthentic behavior with some limited links to the network we removed in August 2019.
14. NEW – Indonesia: We removed 107 Facebook accounts, 58 Pages, and 34 Instagram accounts that originated in Indonesia and targeted domestic audiences. This network focused primarily on the situation ink West Papua and had limited following when we removed it. We found this activity as part of our investigation into suspected coordinated inauthentic behavior in the region.
15. France: We removed 84 Facebook accounts, 6 Pages, 9 Groups, and 14 Instagram accounts that originated in France and targeted primarily the Central African Republic and Mali, and to a lesser extent Niger, Burkina Faso, Algeria, Cote d’Ivoire and Chad. Our investigation found links to individuals associated with the French military. This network had nearly no following when we removed it. We found this activity as part of our investigation into suspected coordinated inauthentic behavior in the region. (Originally announced on December 15, 2020)
16. Russia: We removed 61 Facebook accounts, 29 Pages, 7 Groups and 1 Instagram account that originated in Russia. They targeted primarily the Central African Republic (CAR), and to a lesser extent Madagascar, Cameroon, Equatorial Guinea, Mozambique, South Africa, and the CAR diaspora in France. We found links to individuals associated with past activity by the Internet Research Agency (IRA) and previous operations we attributed to entities associated with Russian financier Yevgeniy Prigozhin, who was indicted by the US Justice Department. This network was early in its audience building when we removed it. We found this activity as a result of our investigation into the suspected coordinated inauthentic behavior with links to the network we removed in October 2019. Our assessment benefited from information shared with us by researchers at Graphika. (Originally announced on December 15, 2020)
17. Russia: We removed 197 Facebook accounts, 122 Page, 16 Group and 15 Instagram accounts that originated in Russia and focused primarily on Libya, Sudan, and Syria. We found links to individuals associated with past activity by the Russian Internet Research Agency (IRA). We found this activity as a result of our proactive internal investigation into the suspected coordinated inauthentic behavior in the region — with some limited links to the networks we removed in October 2019. (Originally announced on December 15, 2020)

See the detail report for more information.