Inauthentic accounts posted on soccer, fashion hijabs, dad jokes, and Emmanuel Macron

A network of inauthentic Facebook and Instagram accounts impersonated French-speaking users whose posts ranged from soccer and fashion tips for Muslim women to attacks on French President Emmanuel Macron, in a manner similar to the Russian troll operation which targeted the United States from 2014 through 2018, according to traces of their activity left online.

Facebook removed the accounts from its platform for “coordinated inauthentic behavior,” meaning these pages, which posed as organizations and individuals from different parts of the political spectrum or focused on opposite sides of a debate, were centrally operated. Most of the accounts were focused on building their audiences among French users, suggesting that this was an operation in its early stages.

Facebook took these accounts offline on November 5, 2018, after a tip from U.S. law enforcement.

A week later, Facebook updated its announcement, enumerating the accounts taken down: 99 Instagram accounts, 36 Facebook accounts, and six Facebook pages. The majority of the accounts posted in English (analyzed here); however, a dozen Instagram accounts and all six Facebook pages posted in French.

The French-language accounts appeared focused on audience building, but they also posted political content, especially attacking President Emmanuel Macron. This resembles the behavior of earlier Russian troll operations, which used existing social concerns and tensions to promote division and attack specific politicians in various countries, especially the U.S.

The traces these accounts left online provide a snapshot of an operation. As in any open source investigation based on reconstituting closed accounts, questions remain over how large the full operation was, how long it had been operating, what other content the accounts in question posted, and if they were active on other platforms. This article provides an initial description of the traces left by the known accounts.

By using the online traces to approximate the number of these accounts’ followers, we estimate that they reached 135,000 users at a very minimum.

The Accounts

Before the November 13 announcement, Facebook shared the names of 11 French-language Instagram accounts, which the company identified as “inauthentic” with @DFRLab.

Three of the accounts posed as African women: @une_camerounaise_fiere, @femme_combattante, and @moonlight_en_france. One, @football_et_france, posed as a football fan group focused on encouraging the “Ultras” across all clubs. A more political account, @france__rouge, posed as a Trotskyist, while another, @espoir_de_france, posed as a nationalist.

Of the rest, @action_verte focused on environmental issues, @les_femmes_musulmanes on Muslim women and fashion, and @contre_guerre on conflict, especially in Africa. @la_voix_etranger and @france_pour_tous engaged on immigration issues.

In its November 13 update, Facebook provided screenshots from two Facebook pages, named “fée-ministr” and “la France libre.” Those screenshots showed posts promoting feminist messages.

A Google search revealed two more posts by “fée-ministr,” one a feminist quote from author Colette, the other mocking Catholics for their opposition to in-vitro fertilization (IVF) rights for gay couples.

Facebook also shared the name of a twelfth Instagram account, @lafemme.libre (“the free woman”). The only traces left of this account online were uncached references to two posts it made on the hashtags #feminism and #feminismforeveryone.

Facebook blocked all the accounts as part of its pre-midterms takedown before @DFRLab could review them. This analysis is based on residual posts, either from online caches or from shares. It therefore provides a snapshot of the accounts’ behavior, not a full catalog of their output.

This was not the first set of inauthentic accounts known to have targeted French speakers. The operation run by the Russian Internet Research Agency from 2014 through 2018 ran at least 11 dedicated French-language Twitter accounts, as made evident in the data shared by Twitter last month.

A word cloud of the content of these accounts’ posts highlights the core themes they most engaged on, with “migrant” being the most-used word, and “Brexit” a close second.

Scale and Impact

The impact of the 11 Instagram accounts is best measured by their followings. Only one, @les_femmes_musulmanes, counted more than 10,000 followers, according to caches of the various accounts’ profiles (figures vary from cache to cache, depending on when the snapshot was taken).

More than half of them followed substantially more accounts than they had followers, a strong indication that they were not having great impact yet, and were actively building their audience. Many of these accounts routinely used “audience building” hashtags such as #follow4follow or #like4like, encouraging French users to engage with their content.

In total, the French-language Instagram accounts had a little under 70,000 followers, half of that number being driven by the most-followed account in this network, @les_femmes_musulmanes. According to Facebook’s update, around 65,000 users followed at least one of the Facebook pages. This does not appear to have been a massively effective operation: nonetheless, the set is of interest as it illustrates the latest themes and techniques used by actors to target French users with coordinated inauthentic behavior online.

Anti-Macron

The most overtly political aspect of these accounts, which cut across their claimed identities, was hostility towards French President Emmanuel Macron, and his party, La République En Marche. Five of the 11 Instagram accounts left anti-Macron posts behind, even in the snapshot represented by cached posts. These accounts posted using hashtags such as #macrondegage (“Macron, get out”), or memes targeting the French President.

Right-wing account @espoir_de_france (literally “hope of France”) regularly posted anti-Macron memes, especially on the topic of migration, but also on more general economic and political topics.

Some of its memes were taken from other online resources, such as this play on words, dated October 13, 2018, which replicated a meme circulated online in the summer.

Another account, @femme_combattante (“fighting woman”), claimed to be a French woman of African descent and mostly focused on positive posts about African women. Nevertheless, it also posted a meme showing Macron as a slave-driver whipping African slaves, in the curious context of a post about France’s victory in the soccer World Cup.

A third account, @france__rouge (“red France,” written with a double underscore, and not to be confused with the unrelated @france_rouge), claimed to be a Trotskyist, an international revolutionary Communist follower of assassinated Soviet leader Leon Trotsky.

It, too, posted attacks on Macron, including a claim that both the Left and the Right called him a hypocrite, a post on anti-government demonstrations in Paris, and a post on migration. Some of its posts included the hashtag #Benalla, referring to a scandal around the behavior of one of Macron’s security officers, Alexandre Benalla, which seriously weakened Macron’s prestige.

Benalla related posts, such as posts that contained the hashtag #benallagate, were also found in online traces of @france_pour_tous and @espoir_de_france Instagram posts.

Another account, @france_pour_tous (“France for everyone”), posed as a progressive account and focused on issues of poverty and migration. Its posts suggested that Macron, a former banker, was a distant and elitist ruler who feared that “the people” would wake up.

A fifth account, @action_verte (“green action”), also going by the name “Martina Leflerc”, largely focused on environmental and landscape posts. Nevertheless, it posted at least one hostile comment on Macron regarding the resignation of Interior Minister Gérard Collomb on October 2, 2018. These posts appeared between images of French landmarks, such the Calanques of Cassis, or animal pictures used to comment on biodiversity.

No other French politician was mentioned by so many of the residual posts left by the accounts in this cluster in a tone so systematically negative. Taking into account Facebook’s conclusion that these accounts were connected and engaged in coordinated inauthentic behavior, it suggests that one key purpose of the group was to post negative comment about Macron.

Audience Building

Far more of the group’s activity appeared innocuous and aimed at building an audience among specific target demographics, especially ethnic and religious minorities. This resembled the operation conducted by Russian trolls against the United States from 2014, which paid particular attention to divisive issues of race.

@moonlight_en_france (screen name “Banu Tadun”), @femme_combattante (“Malika Shakur”), and @une_camerounaise_fiere (literally “a proud Cameroonian woman,” screen name “Léa Camerounaise”), all posted positive and empowering images of black women. @moonlight_en_france focused on their beauty.

Many of its posts consisted of pictures with no comment other than hashtags. Some of the more common hashtags translated as #beauty and #blackbeauty (#beauté, #beauténoire); some also used the more political hashtags #stopracisme and #stopdiscrimination.

@femme_combattante focused more on feminist content and women’s strengths.

The account regularly used the hashtags #Follow4follow and #Like4like, offering to follow and like other users who reciprocated. This is a classic technique for building an account’s follower stats and audience.

@une_camerounaise_fiere ( “Léa Camerounaise”) behaved similarly, posting pictures of African women in celebratory poses. Again, it used the hashtags #like4like and #follow4follow among others to build its audience.

Most of its posts were innocuous, but at least one strayed into more political territory, focusing on racial discrimination and reposting content from an article published in leading French newspaper Le Monde.

The account @contre_guerre (“against war”) posed as a pacifist account, focused on Africa, and criticized perceived Western exploitation. It spoke of a war against imperialism.

The account @les_femmes_musulmanes took a similar approach to the accounts which focused on African women, but this time focusing on Muslim women. Its specialty was posting glamorous images of Muslim women in headscarves and a variety of fashionable outfits, together with uplifting mottos. Again, it invited viewers to follow the account, showing its desire to build audience.

Hijabs were its specialty, as this image shows, with numerous hijab-related hashtags, including #hijablicious, #hijabchic and #turbanista.

These tactics clearly had some effect; by September 30, it had over 20,000 followers.

Posing As Political

Some of the accounts were more overtly political or activist. The most obvious was @france__rouge, whose bio proclaimed it to be a Trotskyist. As we have seen above, its surviving posts took an outspoken view of politics, from a far-left stance. It quoted revolutionary Marxist leaders including Fidel Castro and Hugo Chavez.

@action_verte posed as an environmentalist account. Its bio called for “green activism” and carried the motto, “Preserve our future, save our planet!”

Most of its posts fit with that bio, sharing pictures of wildlife and hashtags such as #RecYcle and #greenpeace.

On one occasion, it shared a picture of a spider’s web covered in dew, with a caption which called it simply “perfect.”

The image included, at the top left, a Russian-language caption, “паутина,” “spider’s web.” This could be wholly innocuous, but appears noteworthy, in the context of suspicions that this network of inauthentic accounts was run from Russia.

Another apparently activist account was @france_pour_tous, which mainly posted on issues of migration, and sometimes used the screen name “Elisabeth Duval.”

One account which was politically opinionated was @la_voix_etranger, whose profile picture showed author Albert Camus and whose name was a take on his famous novel L’Étranger (“The Stranger”).

Many of its posts consisted only of hashtags; a few were written in a more informal French. The hashtags included #rebeu and #renoi, which are words in “verlan”, a form of French argot, referring to North African and black ethnic groups. It appears to have been an account in the early stages of audience building, with over 2,500 followers, but it followed over 7,000.

The final account was a purely soccer-focused, audience-building one. Called @football_et_france, it promised “everything about French football and fans. ‘Ultras’ [extreme fans] of all clubs, unite!” Many of its posts focused on the World Cup, not surprisingly, given that France won.

Other posts dealt with club matches, and supported both sides. The screenshot below shows this account’s comments on a match between Olympique Marseille (OM) and Toulouse, described as the “first day of the season.” The two teams did indeed play the season opener on August 10, 2018; Marseille won 4–0.

Conclusions

Facebook determined that this network was one of “coordinated inauthentic activity.” There is insufficient evidence to provide a firm attribution to the Russian Internet Research Agency; the accounts certainly behaved like troll factory accounts, but such behavior is not confined to Russian information operations.

The accounts did not appear to have particular impact. Other than @les_femmes_musulmanes, none achieved a significant following. Their audience-building strategies suggest that the operation was in its early stages; their followings suggest that it still had some way to go.

While the content was largely innocuous, and even positive in some cases (quotes of famous French poets, empowering images), the fact that it was posted by a coordinated inauthentic network, and included strongly political messages, suggests that this was an attempt to gain influence and, potentially, push divisive and inflammatory messages to these audiences at a later stage.

---

Follow along for more in-depth analysis from our #DigitalSherlocks.