Facebook Just Removed 2 Networks of Pages and Accounts for Inauthentic Activity in Russia

The social network found no links between the groups

An example of content from one of the accounts Facebook removed
Facebook

Facebook removed two separate groups of pages and accounts for engaging in coordinated inauthentic activity in Russia: 289 Facebook pages and 75 Facebook accounts from a network that originated in Russia and operated in the Baltics, central Asia, the Caucasus and countries in central and Eastern Europe; and 107 Facebook pages, groups and accounts, along with 41 Instagram accounts, from a network that originated in Russia and operated in Ukraine.

Head of cybersecurity policy Nathaniel Gleicher said in a Newsroom post that while the two networks used similar tactics, Facebook did not find any links between them.

Page administrators and account holders in the first network represented themselves as independent news pages or general interest pages on topics including weather, travel, sports, economics and politicians, and they focused on Romania, Latvia, Estonia, Lithuania, Armenia, Azerbaijan, Georgia, Tajikistan, Uzbekistan, Kazakhstan, Moldova, Russia and Kyrgyzstan.

Gleicher said those pages and accounts were found to be linked to employees of Moscow-based news agency Sputnik—which was banned from advertising on Twitter in October 2017—and they frequently posted about topics such as anti-NATO sentiment, protest movements and corruption.

Some 790,000 accounts followed one or more of the pages in this group, Gleicher said, and they spent about $135,000 on Facebook ads from October 2013 through this month, paid for in euros, rubles and U.S. dollars.

The pages also hosted approximately 190 events) between August 2015 and this month, with up to 1,200 people expressing interest in those events, but Facebook could not confirm whether any of the events actually took place.

Gleicher wrote, “Our analysis benefited from open-source reporting and work by our partners who investigate this kind of activity. We have also shared information about our investigation with U.S. law enforcement, the U.S. Congress, other technology companies and policymakers in impacted countries.”

Samples of content posted by the pages in this network appear below:

Facebook
Facebook
Facebook
Facebook
Facebook
Facebook

The individuals behind the pages and accounts in the second network primarily represented themselves as Ukrainian and shared local news stories on topics including weather, protests, NATO and health conditions at schools.

Gleicher said Facebook identified some overlap with Russia-based activity it discovered prior to last November’s midterm elections in the U.S., including behavior that shared characteristics with previous activity by Russia’s Internet Research Agency.

Around 180,000 accounts followed at least one of the pages in this network, and over 95,000 Instagram accounts followed one or more of the accounts on that platform.

This network spent some $25,000 on ads on Facebook and Instagram throughout 2018. Paid for in rubles.

Samples of content posted by the pages in this network appear below:

Facebook
Facebook
Facebook
Facebook
Facebook
Facebook

Gleicher wrote, “We’re taking down these pages and accounts based on their behavior, not the content they post. In these cases, the people behind this activity coordinated with one another and used fake accounts to misrepresent themselves, and that was the basis for our action … Our security efforts are ongoing to help us stay a step ahead and uncover this kind of abuse, particularly in light of important political moments and elections in Europe this year. We are committed to making improvements and building stronger partnerships around the world to more effectively detect and stop this activity.”