BANNER: (Source: @DFRLab)

Facebook removed almost 300 pages from its platform for “coordinated inauthentic behavior” across the former-Soviet space on January 17, 2019. The pages masqueraded as groups with special interests — ranging from food to support for authoritarian presidents — and amplified content from the Kremlin’s media agency, Rossiya Segodnya, especially that of its subordinate online news outlet Sputnik.

The pages represented a systematic, covert attempt to improve Rossiya Segodnya’s online audience across more than a dozen countries. Some had little impact, but others racked up tens of thousands of followers. Sputnik was the main beneficiary, as it was often the only source the Facebook pages amplified.

The Editor-in-Chief of Sputnik Latvia, Valentīns Rožencovs, confirmed that Sputnik ran the Latvian-focused pages. Open-source evidence shows that Rossiya Segodnya employees ran some of the other pages and were aware of even more of them.

In addition to a previous, independent investigation by @DFRLab, Facebook shared the names of the accounts before the takedown. Based on internal evidence, not shared with @DFRLab, Facebook concluded:

This post sets out the main findings and patterns, based on the open-source evidence. An accompanying @DFRLab post provides greater detail on the evidence and records the scale, techniques, and impact of the operation.

The pages acted as amplifiers for two main Rossiya Segodnya outlets: Sputnik and the video service TOK. Sputnik is Rossiya Segodnya’s main media brand, operating in 31 languages, from Abkhaz to Vietnamese. Rossiya Segodnya’s founding charter says its mission is to “secure the national interests of the Russian Federation in the information sphere.” Sputnik officials deny that their parent company’s charter applies to them, but the outlet is notable for its close adherence to Kremlin narratives. TOK is less well known, but its website makes clear that it is part of the Rossiya Segodnya conglomerate.

Each page claimed to focus on a special interest, ranging from travel in Latvia to support for the President of Tajikistan. Most posts were apolitical, but some, especially in the Baltic States, were sharply political, anti-Western, and anti-NATO.

Almost all the pages predominantly shared content from Sputnik or TOK. Some shared Sputnik content and nothing else; others interspersed the Rossiya Segodnya content with images, memes, or stories from other sources, often Instagram.

The effect of these activities was promotion of Rossiya Segodnya output to a range of special-interest audiences, without stating their background or affiliation.

The network identified by Facebook included 266 pages dedicated to 13 countries: Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, Armenia, Azerbaijan, Georgia, Moldova, Romania, Belarus, Estonia, Latvia, and Lithuania. Other pages covered the Baltic states as a whole.

The network reached across borders. This page, for example, said it was for “supporters of [Tajikistan President] Emomali Sharipovich Rahmon, the founder of peace and national unity, the leader of the nation. Created by the people of Tajikistan for the people of Tajikistan.” It was managed from Russia.

The network was very large. Some of the pages had only a few followers and rarely posted, while others had tens of thousands of followers and posted every few hours. In aggregate, they had 853,413 followers. This figure does not account for single accounts following multiple pages, nor for the possible presence of artificial or automated followers, but it does give an impression of the sheer scale of the operation.

By comparison, Sputnik’s official pages across the same countries amassed 495,947 followers. The inauthentic network therefore increased Sputnik’s reach by over 170 percent across the countries they covered.

A statistically improbable number of the pages — over one quarter — was created in October 2017. Of those, 32 were created on a single day, October 10, 2017. They covered topics ranging from “famous Georgians” to Chechen leader Ramzan Kadyrov and from sport in Latvia to the Tajik rice-based dish known as “plov,” but all significantly amplified Sputnik’s content, reinforcing the impression that they were all part of a coordinated network.

@DFRLab initially encountered the covert amplifiers in Latvia in November after TV show De Facto tipped @DFRLab about four pages from the network. This was an independent investigation initiated separately from Facebook’s work.

Based on joint research with @DFRLab, Latvian investigative TV show De Facto interviewed Editor-in-Chief of Sputnik Latvia Valentīns Rožencovs, who confirmed that Sputnik itself was running the pages. He further argued that this was “normal content promotion.”

None of the Latvian pages offered any transparency with regard to their Sputnik connection.

In other countries, technical and personal indicators also connected these pages to Rossiya Segodnya and Sputnik, beyond the pattern of sharing Sputnik and TOK content.

One page in Kazakhstan listed the Sputnik Kazakhstan website as its own. Another referred to “my dear Sputnik colleagues.” A page in Belarus boasted of posting an “exclusive” Sputnik video before Sputnik Belarus itself did. In Azerbaijan, one of the pages was managed by an individual who was employed at Sputnik until the end of November 2018.

None of these pages mentioned an affiliation to Rossiya Segodnya itself, although they amplified its content.

Other pages in the network cross-posted Sputnik and/or TOK videos. Cross-posting can only be done if two accounts or pages agree to it, indicating that Sputnik and TOK were aware of all the pages that cross-posted their content.

Most of the pages in the network were covert, in that they did not mention a connection to Rossiya Segodnya and also did not claim any other specific identity.

In one case, a sub-group of nine pages in Georgia was run by an account that appeared to be actively fraudulent, in that it claimed to be a young lady from Tbilisi, but took its profile pictures and “personal” posts from other online sources.

One of the pages run by this apparently false account paid to sponsor a Sputnik article in December 2018. One month earlier, Sputnik embedded two videos from the apparently false account in one of its stories.

Facebook concluded, based on its own data, that this network of pages “used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.”

Facebook did not share that data with @DFRLab.

The open-source evidence indicates that the primary effect of almost all these pages was to promote Rossiya Segodnya outlets without mentioning any connection with the Kremlin agency.

In Latvia, Sputnik confirmed that it was running the pages as a “promotion” technique. Elsewhere, a range of open-source evidence, including cross-posting, user statements, and details of page managers, provided indicative links to Rossiya Segodnya and its employees.

The overall effect of the network was to provide Sputnik, in particular, with an audience significantly bigger than its own organic one. This was a covert promotion operation, and Rossiya Segodnya outlets were the main beneficiaries.

Follow along for more in-depth analysis from our #DigitalSherlocks.