A network of Facebook pages imitating real people shared disinformation about the collapse of shopping mall in Latvia

On July 15, the website Redzams, which translated from Latvian means “Visible”, reported the alleged collapse of the “Alffa” shopping mall in Riga and with hundreds of casualties.

Open source evidence revealed that the mall was not collapsed, and Redzams relied on false social media accounts to drive traffic to the website. This was not the first time Redzams, which is owned in part by Latvian hip-hop artist Niks Endziņš, was accused of spreading disinformation, but this case triggered a response from the Latvian Minister of Interior. The event also reignited a debate on whether the Latvian government should create a joint website that will share debunks of false news.

What happened?

On July 15, the website Redzams reported the alleged collapse of the “Alffa” shopping mall in Riga and with hundreds of casualties.

Factually, Riga does have a shopping mall named “Alfa” with one “f”. While the story from Redzams mispelled the name, it created the impression that the real shopping mall collapsed. It was, in fact, open for business.

Geotagged posts on social media suggest that shopping mall “Alfa” in Riga was safe and sound a day later on July 16.

Despite the proven falsehood and verifiable information, the story was quickly shared by 7,800 Facebook users.

Latvian investigative journalist Inga Springe immediately alerted the Latvian police to the false news on Twitter. She wrote:

@Valsts_policija Tell me, if web pages distribute such news as the shopping mall Alfa having collapsed and that hundreds of people were killed, isn’t there a reason to initiate criminal proceedings? We have gathered several web pages and facts we would love to share.

Two days later, Latvian online news media Skaties.lv published a statement by the Latvian Medical Association (LMA) in response the false news. The statement read:

Any situation in Latvia with more than ten victims is a catastrophe that needs additional resources. We do this well enough, but when such a message is out, for example, the Eastern Hospital should be alert, regardless of whether the message is “fake” or real [..]

There are a lot of people who respond psychologically to such very serious messages. With rising blood pressure or neurological crises. If there was a stroke or an infraction event because of such worries, who would be held accountable? Such jokes cannot be made.

The article by Skaties.lv included a statement by Latvian Minister of Interior Rihards Kozlovskis first published on Latvian news agency LETA. The minister stated his intent to find and arrest the authors of the disinformation website.

He told LETA:

If necessary, international co-operation will be required. Sometimes, portals are registered outside of Latvia. In any case, it is a priority, and a clearly defined mechanism must be created so that the population can quickly get a true message.

As it turned out, the owner of the website Redzams.lv is Latvian hip-hop musician Niks Endziņš, also known as “Neids”.

Latvian mainstream conservative newspaper Latvijas Avize debunked information on the website multiple times in May 2017 and October 2017, and also named Endzins as the outlet’s owner.

According to Skaties.lv, Endzins sold the website to a buyer who kept the original content of the site, but slightly changed the domain name. Endzins received half the profits from the website, so he shared Redzams.net content on his social media accounts to drive traffic. He did not disclose the identities of the new website owners.

The History of Redzams

Open source evidence confirmed Endzins’ statement.

The website Redzams existed since at least April 2017. In December 2017, the portal wrote about its closure due to “comments on social networks by those who envy us.”

The current domain of the website “redzams.net” was acquired on April 16, 2018. The former Latvian domain “redzams.lv” is now available, meaning that it does not redirect traffic to the new domain.

The website changed its branding along with its new domain.

With the domain change, amplification of articles posted also improved. According to Buzzsumo analysis, the shares for the most popular articles doubled after the domain change.

The most shared article on Redzams.lv was shared at least 4,800 times. The most shared article on Redzams.net was shared at least 9,500 times. Most of the shares were on Facebook, where the outlet focuses its content promotion.

The official Facebook page linked to the Redzams.net webpage was named “Zinas Latvija”, which translated from Latvian means “News in Latvia”. The page used a different logo from that of Redzams.net. The logo in question featured the letters “OTV” in the profile image and mentioned Redzams.net in the cover picture. The page creation date was November 21, 2017, which was around the time Redzams.lv announced its shutdown. The first post on the page appeared on April 18, 2018, two days after the new domain was acquired.

At the time of this report, the page had 16,564 likes and 18,041 followers. The history of the page did not indicate any name changes or ad campaigns. The profile and cover photo were similarly unchanged.

This page was different from the one linked with Redzams.lv in 2017. The Facebook page linked to the former website — Redzams.lv — had the username @redzams.lv. Much like the old website, this Facebook page is now defunct, but Google still showed it in search results.

Another page named “Zinas Latvija” used the “OTV” logo and shared Redzams.net posts.

What was different here was the username. It was “@zinaslatvijaa” with one more “a” added at the end. The page linked to a domain OTV.lv, and first appeared on November 23, 2017, two days after the original Zinas Latvija page was created. At the time this report was created, it had 8,877 likes and 8,889 followers.

@DFRLab previously reported about a case when a Latvian political party acquired a large follower base on Facebook by merging pages. This way follower bases of two pages were combined.

It is likely that two “Zinas Latvija” pages will combine their follower bases at some point.

Overall, the open source evidence suggested that Redzams.net had different online information distribution infrastructure than Redzams.lv.

The Amplifiers

An analysis of Redzams.net Facebook page post shares revealed key amplifier accounts.

These were both Facebook pages and Facebook user accounts that constantly shared the same Redzams.net messages.

Some of the pages impersonated people with Latvian names. However, the key detail was the prevalence of Facebook pages, as opposed to Facebook user accounts. Both are similar in appearance, but users can run more than one page. In other words, pages could imitate real people (users) with Latvian photos and names. This was an attempt to camouflage the coordinated network of Facebook pages that shared Redzams.net articles as real people.

Some pages were not based on personalities:

• Oknet Lv (4,612 follows)
• Ziņas tev (449 follows)
• Страница «Ziņas» (2,463 follows)
• Ziņas visiem (3,002 follows)
• Ziņas Lasītājiem (4,433 follows)

Other pages were impersonating people:

• Ēriks Ķesteris (1,585 follows)
• Māra Kalniņa (3,043 follows)
• Madara Vasiļevska (4,425 follows)
• Marika Latvele (446 follows)
• Arina Kisy (2,958 follows)
• Evelīna Sauģe (4,090 follows)

The page follower count varied from hundreds to thousands. The average follower count for impersonal pages was 2,991. The average follower count of the pages that impersonated people was 2,757. The pages that impersonated people, did not garner significantly more followers then impersonal pages.

Facebook shut down the Facebook pages on July 20, 2018.

Conclusion

The false news about the collapse of “Alffa” shopping mall triggered a response from the Latvian Minister of Interior. Open source evidence suggested that the public-facing owner of Redzams.lv Niks Endzins was not the sole owner of the website.

The content sharing infrastructure Redzams.net improved along with its domain change. The key amplifiers of the Redzams.net posts were Facebook pages. Some of them presented themselves as news platforms, others impersonated people living in Latvia by using images and names of people.

Whereas the case in question was debunked, the tactic used to generate traction on Facebook remains emergent. @DFRLab will follow developments of the false news amplification network in Latvia.

Follow along for more in-depth analysis from our #DigitalSherlocks.