Today we removed three separate networks for violating our policy against foreign or government interference which is coordinated inauthentic behavior (CIB) on behalf of a foreign or government entity. These networks originated in France and Russia and targeted multiple countries in North Africa and the Middle East.
In each case, the people behind this activity coordinated with one another and used fake accounts as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove these operations, we focus on behavior rather than content, no matter who’s behind them, what they post, or whether they’re foreign or domestic.
Over the past three years, we’ve shared our findings on over 100 networks of coordinated inauthentic behavior we detected and removed from our platforms. Earlier this year, we started publishing monthly CIB reports where we share information about the networks we take down to make it easier for people to see the progress we’re making in one place. In some cases, like today, we also share our findings soon after our enforcement. Today’s takedowns will also be included in our December report.
Before we share the details on each network, here are a few trends to note.
Each of the networks we removed today targeted people outside of their country of origin, primarily targeting Africa, and also some countries in the Middle East. We found all three of them as a result of our proactive internal investigations and worked with external researchers to assess the full scope of these activities across the internet.
While we’ve seen influence operations target the same regions in the past, this was the first time our team found two campaigns — from France and Russia — actively engage with one another, including by befriending, commenting and criticizing the opposing side for being fake. It appears that this Russian network was an attempt to rebuild their operations after our October 2019 takedown, which also coincided with a notable shift in focus of the French campaign to begin to post about Russia’s manipulation campaigns in Africa.
Unlike the operation from France, both Russia-linked networks relied on local nationals in the countries they targeted to generate content and manage their activity across internet services. This is consistent with cases we exposed in the past, including in Ghana and the US, where we saw the Russian campaigns co-opt authentic voices to join their influence operations, likely to avoid detection and help appear more authentic. Despite these efforts, our investigation identified some links between these two Russian campaigns and also with our past enforcements.
We know operations like these will continue to evolve their tactics in response to both the evolution of the information environment but also in reaction to our detection and removals. Over time, it’s become clear that the more we and others in the defender community learn these deceptive behaviors and technical signals associated with particular threat actors, the more consistent we now are in detecting them earlier in their life cycle, making it harder for these campaigns to go undetected for long periods of time.
We shared information about our findings with law enforcement and industry partners. We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort and we’re committed to continually improving to stay ahead.
What We Found
1. We removed 84 Facebook accounts, 6 Pages, 9 Groups and 14 Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in France and targeted primarily the Central African Republic and Mali, and to a lesser extent Niger, Burkina Faso, Algeria, Cote d’Ivoire and Chad.
The people behind this activity used fake accounts — some of which had already been detected and disabled by our automated systems — to pose as locals in the countries they targeted, post and comment on content, and manage Pages and Groups. They posted primarily in French and Arabic about news and current events including France’s policies in Francophone Africa, the security situation in various African countries, claims of potential Russian interference in the election in the Central African Republic (CAR), supportive commentary about French military, and criticism of Russia’s involvement in CAR. Some of these accounts also commented on the content that criticized France posted by one of the Russian operations.
We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in Francophone Africa. Although the people behind it attempted to conceal their identities and coordination, our investigation found links to individuals associated with French military.
- Presence on Facebook and Instagram: 84 Facebook accounts, 6 Pages, 9 Groups and 14 accounts on Instagram.
- Followers: About 5,000 accounts followed one or more of these Pages, about 1,600 accounts joined one or more of these Groups and around 200 people followed one or more of these Instagram accounts.
Below is a sample of the content posted by some of these Pages and accounts:
2. We also removed 63 Facebook accounts, 29 Pages, 7 Groups and 1 Instagram account for coordinated inauthentic behavior. This network originated in Russia and focused primarily on the Central African Republic (CAR), and to a lesser extent on Madagascar, Cameroon, Equatorial Guinea, Mozambique, South Africa and the CAR diaspora in France.
We identified several clusters of connected activity that relied on local nationals from Central African Republic and South Africa. This network used a combination of fake and compromised accounts — some of which had been already detected and disabled by our automated systems — to comment, amplify their own content, drive people to off-platform domains and run Groups and Pages posing as news and civic-focused entities. They also solicited content from local journalists. The people behind this activity took operational security steps to conceal their location and identity.
This network posted primarily in French, English, Portuguese and Arabic about news and current events, including COVID-19 and the Russian vaccine against the virus, the upcoming election in CAR, terrorism, Russia’s presence in Sub-Saharan Africa, supportive commentary about the CAR government, criticism of the French foreign policy and a fictitious coup d’etat in Equatorial Guinea. Some of these accounts commented on the content by the France-based CIB network described above, including in response to its criticism of Russia.
We found this activity as a result of our investigation into the suspected coordinated inauthentic behavior with links to the network we removed in October 2019. Our assessment benefited from information shared with us by researchers at Graphika. Although the people behind this campaign attempted to conceal their identities and coordination, our investigation found links to individuals associated with past activity by the Internet Research Agency (IRA) and previous operations we attributed to entities associated with Russian financier Yevgeniy Prigozhin, who was indicted by the US Justice Department.
- Presence on Facebook and Instagram: 63 Facebook accounts, 29 Pages, 7 Groups and 1 Instagram account.
- Followers: About 263,000 accounts followed one or more of these Pages, around 29,000 people joined one or more of these Groups and 0 people followed this Instagram account.
- Advertising: About $38,000 in spending for ads on Facebook and Instagram paid for primarily in South African rand and US dollars.
Below is a sample of the content posted by some of these Pages and accounts:
3. We also removed 211 Facebook accounts, 126 Page, 16 Groups and 17 Instagram accounts for coordinated inauthentic behavior. This network originated in Russia and focused primarily on Libya, Sudan and Syria.
We identified several decentralized clusters of connected activity that relied on local nationals from Libya, Egypt, Sudan and Syria. This operation used fake accounts — many of which had been detected and removed by our automated systems at the time of creation or soon thereafter — to post in Groups, amplify the off-platform domains posing as news outlets, evade enforcement, and manage Pages masquerading as news entities and military-affiliated entities in Libya. These accounts posed as locals based in the countries they targeted. Some of these Pages went through significant name changes over time.
The people behind this activity posted primarily in Arabic about regional news and events, including misinformation; supportive commentary about Khalifa Haftar, head of the Libyan National Army, the Libyan army, and Saif Islam Gaddafi; and criticism of Turkey, Muslim Brotherhood, the Tripoli-based Government of National Accord and the peace talks at the Libyan Political Dialogue Forum in Tunisia.
We found this activity as a result of our proactive internal investigation into the suspected coordinated inauthentic behavior in the region — with some limited links to the networks we removed in October 2019. Our assessment benefited from public reporting by the Stanford Internet Observatory on a portion of this activity. Although the people behind this activity attempted to conceal their identity and coordination, our investigation found links to individuals associated with past activity by the Russian Internet Research Agency (IRA).
- Presence on Facebook and Instagram: 211 Facebook accounts, 126 Pages, 16 Groups and 17 Instagram accounts
- Followers: About 5.7 million accounts followed one or more of these Pages, 64,500 accounts joined one or more of these Groups and about 99,500 people followed one or more of these Instagram accounts.
- Advertising: Around $186,000 in spending for ads on Facebook paid for primarily in US dollars and rubles.
Below is a sample of the content posted by some of these Pages and accounts:
Both captions: “Lavrov shows that the American presence impedes Syria’s unity.”
“Establishing a Russian military post near the town of Ain-Issa to block the path for any possible Turkish attack.”
The spokesman for the Libyan Arab Armed Forces, Major General Ahmed Al-Mismari, confirmed Tuesday that his country is at war with Turkey, and that it is a real showdown exacerbated by the Turkish fool, Erdogan.
