Facebook purges hundreds of fake accounts from state actors, marketers

In the first of what’s going to be monthly reports on its efforts to battle coordinated inauthentic behavior (CIB) leading up to the 2020 US elections and beyond, Facebook said that it removed five networks of accounts, Pages and Groups engaged in foreign or government interference in February.
The platform is always battling inauthentic behavior, including fake engagement, spam and artificial amplification, but it doesn’t bother to make announcements about those quotidian takedowns, most of which are financially motivated. The five February takedowns are different: they have to do with countering foreign interference or domestic influence operations, Facebook said in a post on Monday.
Facebook says that it views influence operations – also referred to as influence ops (IO) – as “coordinated efforts to manipulate public debate for a strategic goal where fake accounts are central to the operation,” be they carried out by domestic, non-state campaigns (CIB) or CIB done on behalf of a foreign or government actor (FGI).
CIB is against Facebook policy. The platform has been going after perpetrators who use Facebook to meddle with public discourse as was done in the 2016 US presidential election, when Russia targeted all 50 states, and as is still happening today, as we’ve been warned.
In total, last month, Facebook took down 467 Facebook accounts, 1,245 Instagram accounts, 248 Pages, 49 Groups, and $1.2 million worth of advertising.
Ben Nimmo, Nonresident Senior Fellow at the Atlantic Council’s Digital Forensic Research Lab (DFRLab), pointed out that the CIB isn’t just about elections, and the groups behind it aren’t all state actors.
This is a Whack-A-Mole situation, said DFRLab, which worked with Facebook to analyze the networks the platform took down. In an analysis of the “deleted assets,” DFRLab says that it found that some bore “familiar hallmarks” of previous campaigns orchestrated by marketing companies NewWaves and Newave, registered in Egypt and the United Arab Emirates, respectively.

Facebook has already scrubbed the network off, in August 2019. Here’s DFRLab’s investigation into the network, shortly after the first takedown.
The networks used their Instagram and Facebook accounts to spread both uplifting and humorous content with politically charged narratives, DFRLab said, “presumably to garner a wide following before pivoting into regional politics.”
It’s worth noting that this is happening beyond Facebook: As DFRLabs notes, the networks post slightly tweaked memes and other CIB across all the major social media platforms, “using similar and sometimes identical accounts and content across Facebook, Instagram, and Twitter.”
These are the networks that Facebook tore up last month:

1. India: Facebook removed a network of 37 Facebook accounts, 32 Pages, 11 Groups and 42 Instagram accounts whose activity originated in India and which focused on the Gulf region, US, UK and Canada. Facebook says that the people behind the network tried to conceal their identities and coordination, but an investigation found links to aRep Global, a digital marketing firm in India.
2. Egypt: Facebook removed a network of 333 Facebook accounts, 195 Pages, 9 Groups and 1194 Instagram accounts. Its activity originated in Egypt, and it focused on countries across the Middle East and North Africa. Whoever’s running the network also tried to disguise their identities and the fact that they were coordinating their behavior, but Facebook’s investigation found links to two marketing firms in Egypt: New Waves and Flexell. In September, the New York Times reported that New Waves is owned by former Egyptian military officer Amr Hussein: a vocal supporter of Egypt’s authoritarian leader, President Abdel Fattah el-Sisi. The obscure digital marketing company is behind a network of fake Facebook accounts that praised Sudan’s military days after the military massacred pro-democracy demonstrators in Khartoum, according to the Times. Both companies have repeatedly violated Facebook’s Inauthentic Behavior policy and are now banned.
3. Russia: Facebook removed a network of 78 Facebook accounts, 11 Pages, 29 Groups and four Instagram accounts. The network activity originated in Russia and focused primarily on Ukraine and neighboring countries, the company said. Facebook’s investigation found that the network has links to Russian military intelligence services.
4. Iran: Facebook booted a small network of 6 Facebook accounts and 5 Instagram accounts that originated in Iran and focused primarily on the US.
5. Myanmar, Vietnam: It removed 13 Facebook accounts and 10 Pages operated from Myanmar and Vietnam that focused on Myanmar, and found links to two regional telecom providers.

For more information, check out Facebook’s full report.

---

Latest Naked Security podcast