Facebook’s security team has revealed that it stopped three groups, two from Russia and one from France, from falsely manipulating conversations in Africa. The takedown comprised 358 accounts, 181 pages, and 32 groups from Facebook, as well as 32 Instagram accounts.
In a press conference last night, Facebook’s head of security policy Nathaniel Gleicher confirmed the three separate networks were removed yesterday for violating the platform’s policies against foreign or government interference through “coordinated inauthentic behaviour” (CIB).
“My team leads our work at Facebook to identify and counter influence operations on our platforms,” said Gleicher. “That is any coordinated effort to manipulate or corrupt public debate for a strategic gain. We investigate and remove these manipulation campaigns under our policy against coordinated inauthentic behaviour.
“When we find them, we take them down based on the behaviour we see on our platform, not based on who the actors behind them are or what they say. So far, we’ve taken down over 100 CIB networks globally, including ahead of major democratic elections.”
Facebook’s global threat disruption lead David Agranovich provided an in-depth insight into how the three groups planned their attacks, and what their effects may have caused if they continued.
Agranovich said: “From the first group, we removed 84 Facebook accounts, 6 pages, 9 groups, and 14 Instagram accounts that originated in France and targeted primarily the Central African Republic (CAR) and Mali, and to a lesser extent, Burkina Faso, Algeria, Cote d’Ivoire, and Chad.
“This network used fake accounts, some of which had already been detected and disabled by automated systems. They posed as locals in the countries that they targeted, and they posted and commented on content primarily in French and Arabic. This network’s posts were about news and regional events, including France’s policies across Francophone Africa, and the security situation in a variety of African countries relating to claims of potential Russian interference in the election in the CAR. They also posted supportive commentary about the French military, in criticism of Russia’s involvement in the CAR.
“From the second group, we removed 63 Facebook accounts, 29 pages, 7 groups and 1 Instagram account, all of which originated in Russia. This network focused primarily on the Central African Republic, and to a lesser extent on Madagascar, Cameroon, Equatorial Guinea, Mozambique, South Africa, and the CAR’s diaspora communities in France.
“Our investigation linked this activity to individuals associated with past activity of the Internet Research Agency in Russia and the 2019 operations that were associated with Russian financier Yevgeny Prigozhin, who was indicted by the US Department of Justice in 2018.”
Agranovich explained how the content made by Russians was tailored so well for those in the CAR.
“We found several clusters of connected activity that relied on local nationals from the Central African Republic in South Africa. They used a combination of fake and compromised accounts, some of which had been already detected and disabled by our automated systems. And these accounts were used to comment to amplify their own content, to drive people to off-platform website domains, and to run groups and pages posing as news and civic-focused entities. They also solicited content from local journalists.
“The content focused primarily on news and current events, including COVID-19 and the Russian vaccine against the Coronavirus, the upcoming election in the Central African Republic, terrorism, Russia’s presence in Sub Saharan Africa, supportive commentary about the government in the Central African Republic, criticism of French Foreign Policy, and a fictitious coup d’etat in Equatorial Guinea.”
Read more on the next page about how the CIB groups from France and Russian ended up fighting against each other on the platform.
Gleicher went into detail about one bizarre instance of the groups fighting against one another to assert their messages.
“One of the most interesting things about today’s takedown was this is the first time that we found two foreign campaigns, one from France and one from Russia, actively engage and attempt to counter each other’s accounts. They friended each other, commented on each other’s posts, and criticised the opposing side for being fake.
“We have enforced a number of takedowns of CIB networks targeting Africa over the course of the last years. In October 2019, we announced a removal of a network links to Russia that were targeting several countries within region. The first Russian network we have announced appeared to be an attempt to rebuild their operations after we took down that network in October 2019.
“In addition, our public exposure of that Russian operation coincided with a shift in focus of the French campaign, in which it began to post particularly about Russia’s manipulation campaigns in Africa. This is a good reminder that these actors will continue to attempt to target public debate and taking down a network isn’t enough by itself. Each time we remove one of these networks, we put automated controls in place, so that we are monitoring for if that network tries to come back.”
Agranovich said the last group, and by far the biggest group taken down, targeted Russian and Syrian ties.
“The third group we removed comprised 211 Facebook accounts, 126 pages, 16 groups and 17 Instagram accounts that originated in Russia and focused primarily on Libya, Sudan and Syria. This investigation linked this operation to individuals associated with past activity by Russia’s Internet Research Agency as well.
“This network was found internally as our team was reviewing suspected CIB in the region with limited links to the network’s we removed in October of 2019. This was a network that consisted of several decentralised clusters of connected activity that like the previous Russian network relied on local nationals this time in Libya, Egypt, Sudan, and Syria. They used fake accounts, many of which had been detected and removed by our automated systems at the time of creation or soon thereafter.
“Their accounts were used to post into groups to amplify the off-platform domains posing as news outlets to evade our enforcement and to manage pages masquerading as news entities and military-affiliated entities in Libya. Some of these pages went through significant name changes over time as well. This campaign posted primarily in Arabic about regional news and events, including misinformation, supportive commentary about Khalifa Haftar (head of the Libyan national army), the Libyan army, and Saif al-Islam Gaddafi. The network also criticised Turkey, the Muslim Brotherhood, the Tripoli-based Government of National Accord, and the peace talks at the Libyan Political Dialogue Forum in Tunisia.”
The removal of these groups comes at a key moment in the history of the Central African Republic, as the country holds its democratic elections on 27 December, less than two weeks from now.
Gleicher said: “One reason that we are announcing this today and moving very quickly in this announcement is we want to make sure that everyone is aware of this operation and that it has been removed in advance of that election.”