BANNER: (Source: @r_osadchuk/DFRLab via Facebook; flaticon.com; mapsvg.com)

On July 25, 2019, Facebook announced the removal of nine pages that targeted Ukraine with pro-Kremlin messaging and other divisive content, in what the company refers to as “coordinated inauthentic behavior.” The company shared the names of five of the pages with the DFRLab prior to taking them down.

In its announcement, Facebook stated:

Four of the five pages focused on a range of issues, including promoting conspiracy theories about the 2014 Ukrainian Revolution and exploiting religious tensions at the heart of the 2018 Moscow-Constantinople Schism within the Eastern Orthodox Church. In an indicator that the operators of the individual pages were coordinating with one another, these four pages amplified content from a single news website, golospravdy.com. A fifth page served as an aggregator of philanthropy news, with occasional negative news content dispersed throughout.

The reach of individual pages varied. Two of the pages had fewer than 80 followers or likes, two others had roughly 1,000 followers, and one had nearly 25,000 followers.

Four out of the five pages in this set revolved around an external website, golospravdy.com (or “Voice of Truth”), which primarily served as an aggregator of blog, video, and news content produced by anti-Ukrainian government or pro-Kremlin bloggers and journalists. The URL for golospravdy.com now redirects to golospravdy.eu, likely because the Ukrainian government blocked the former.

On the bottom of the website, there was a link to the pro-Kremlin hacker operation known as CyberBerkut, named after the Ukrainian riot police forces, which gained notoriety for their brutality during the Revolution of Dignity. CyberBerkut has been tied the GRU hacker group Fancy Bear, which has been implicated in numerous international cyber-espionage operations in recent years, including in the 2016 hack of the Democratic National Committee in the United States.

In the footer of the website, contributing authors identified the major topics they focused on, as well as provided links to people they were supporting, including politicians who fled Ukraine in 2014 and pro-Russian journalists.

The site broadly focuses on Ukrainian politics, spreading a mix of conspiracy theories and content based on real events. Among other material, the website has published articles framing the 2014 revolution as a “coup de état,” alleging censorship and corruption on the part of the current Ukrainian government, and echoing other pro-Kremlin narratives about the war in Ukraine.

The first page from the set, Переворот (“Coup”), was established on November 23, 2016, and had only 53 followers. It posed as the page of Volodymyr Oliynyk, a former member of the Ukrainian Parliament. Oliynyk is allegedly a close associate of the Kremlin and is currently wanted by the Ukrainian authorities, whom he has avoided by taking up residency in Russia. He routinely claims that a judicial review he conducted of the Euromaidan pro-democracy protests had determined that the protests were a “coup de état.” Various pro-Kremlin actors, including Putin himself, have also shared this conspiracy theory, which has been debunked multiple times.

Initially, the Coup Facebook page promoted Oliynyk’s recent book on the Euromaidan, also named “Coup,” but its focus pivoted to be general promotion of the Voice of Truth page. On average, each post on the Facebook page received only a single user interaction in the form of a like or emoji.

Additionally, Oliynyk’s personal website, which shares its name with his book, is located under the “Special Projects” section of the Voice of Truth website.

Another of the Facebook pages, Издание Правда и вера (“Media Truth and Faith”), had 24,495 followers, the most of any page in the set. In its About description, the page claimed to have been created on February 21, 2014, but its Page Transparency section revealed that it was actually created on April 17, 2012 with an original title of “Newspaper ‘Truth and Faith.’”

Media Truth and Faith solely focused on amplifying the Voice of Truth Facebook page’s content or linking directly to the Voice of Truth website, mostly to articles on the fallout of the schism within the Eastern Orthodox Church and the ensuing creation of the Orthodox Church of Ukraine, which formally separated from the Russian Orthodox Church on January 6, 2019.

Prior to that, the page’s focus shifted from one religion-related topic to another many times. In 2017, for example, the page primarily shared content alleging that the government of Ukraine and “far-right radicals” had abused the Orthodox Church of Moscow Patriarchy. For example, the page shared an article titled “Radicals Are Terrorizing an Orthodox Priest in Zhytomyr,” which used a picture of men wearing paper signs on their backs that read “I was forced to come here instead of class.”

Later, in 2018, the page shifted focus to discrediting the different churches and denominations in Ukraine, the LGBT movement, as well as the government of Ukraine’s, alleging that it “attempt[ed] to take churches away from” the Moscow Patriarchate’s property. When the Ecumenical Patriarchate of Constantinople began the process of recognizing the independent Orthodox Church of Ukraine, Media Truth and Faith started attacking the higher synod — or governing council — of Constantinople, as well as the Ukrainian priests of Kyiv Patriarchy, tying them to Nazis or implicating them in bribery allegations involving church officials. The page also highlighted the Ukrainian government’s “persecution of the church,” as well as the readiness of regular people to “defend churches until the end.”

Overall, despite the high follower count of the page, its posts achieved little engagement, with a vast majority receiving one like or share and no comments.

Бессмертный Полк Украина (“Immortal Regiment Ukraine”), the third page of the set, had 1,043 likes and 1,041 followers, promoted the annual Immortal Regiment procession in Ukraine, and shared content related to World War II as well as veterans’ affairs.

Since 2015, top Russian officials, including President Vladimir Putin, have participated in the procession on Victory Day (May 9), a day celebrated in some former Soviet countries in commemoration of the 1945 surrender of Nazi Germany to the Allied Forces. The procession is part of the Kremlin’s broader effort to distract from the mass murder, deportations, and arrests committed by Joseph Stalin during his rule. The Immortal Regiment procession has been met with protests in Ukraine as well as Georgia.

Similar to the other removed Facebook pages, Immortal Regiment Ukraine also shared content related to World War II from the Voice of Truth website and its associated Facebook page.

Engagement with the posts shared by Immortal Regiment Ukraine was very low, with a majority of the posts receiving close to zero.

The fourth page in the set, Цукерки-челендж. (“Sweets-challenge”), got its start by posting an online contest. The “challenge” was an oblique critique of then-President of Ukraine Petro Poroshenko and his alleged corruption, which had inspired the “Roshen protests.” The protests got their name from a candy shop he owned.

According to the “challenge” rules, as described on its Facebook page, participants were called on to film themselves eating a piece of candy at Roshen, Poroshenko’s shop, while chanting the phrase “The sweets challenge has been completed.” The page promised that participants who completed the challenge by uploading a video to the website tsukerky.net would receive an unspecified financial reward.

The DFRLab could not find any videos of somebody completing the challenge.

A WhoIs search showed that the Tsukerky.net domain was registered on April 1, 2017.

Outside of the so-called “challenge,” the Facebook page also spent considerable effort focusing on the then-president. The page also posted videos of the anti-Poroshenko protests. In total, three videos shot at three different locations were uploaded within the first two days of the page’s creation.

The videos seemed to have first appeared on the Sweets-challenge Facebook page, which may indicate that this page was run by the organizers of the protest or by someone close to them. Moreover, these events resembled staged protests involving paid participants, which are not uncommon in Ukraine and the post-Soviet space.

The earliest posted video (from April 5, 2017) on the page also appeared to have been uploaded to the “Tsukerky Challenge” YouTube channel a day later. According to InVid, an online video verification platform, the YouTube channel was created on April 3, 2017.

The DFRLab was unable to view the video on Facebook before it was taken down. The two videos appear to be the same, though the one on YouTube was one second shorter than the video on the Facebook page. The last frame of the YouTube video, however, was highly similar to the thumbnail for the Facebook video.

Between the nearly identical run-time and the similarity between the images, the DFRLab determined that they were likely to be the same video.

Although there was a two-day window between the creation of the tsukerky.net website and the sweets challenge’s content, the DFRLab found no direct ties between the Facebook page, the external website, and the YouTube channel.

Connecting the Sweets-challenge page to the broader takedown set, the Voice of Truth website posted videos from Sweets-challenge, including embedding them in two separate articles: one contained the April 5 video and the other comprised the two videos posted on April 6. Voice of Truth posted the articles on the same day as the respective video, suggesting close cooperation.

On April 12, 2017, a blogger on Ukrainian news website censor.net reported on the ties between the Voice of Truth website and the Sweets-challenge Facebook page. After the Voice of Truth website wrote about the first protest, Sweets-challenge shared the article and, referencing the website, claimed that “mass media” wrote about their protest.

The Sweets-challenge Facebook page did not post exclusively anti-Poroshenko content. Alongside a post critiquing Poroshenko’s growing financial wealth, it was easy to find tangential political or even outrightly nonsensical content posted by individual user accounts. For example, over the period of a week in April 2017, users posted both a link to a Russian blog post stating that the Ukrainian government had allegedly “confirmed the independence” of the self-proclaimed Luhansk and Donetsk People’s Republics — Ukraine does not currently recognize the two conflict-heavy regions as independent — as well as a far out-of-context meme.

It is worth noting that no other pages in the takedown set featured posts from individual user accounts.

Ultimately, the page would pivot away from Poroshenko completely, with the most recent posts on the page consisting mostly of links to the Voice of Truth website or reposts from its accompanying Facebook page. In contrast with previously removed pages, this page did not limit itself to a particular topic.

Among other content, the page also shared online broadcasts of pro-Kremlin commentators or groups sympathetic to the government of former president Viktor Yanukovych, who was ousted in the 2014 Euromaidan protests.

Much like for the other pages in the set, engagement with the Sweets-challenge page was very low and virtually zero for most posts. A series of videos uploaded soon after the page’s creation, however, did receive some engagement. One video, uploaded on April 6, 2017, received 67 reactions, two comments, and one share against 203 views, which was an unusually high engagement-to-views ratio.

The final page of the set, “RuNews.org,” was an outlier in terms of the content it posted. Rather than serving as a content amplification platform for the Voice of Truth website, it focused on sharing news about philanthropy and charitable activities. Much of this content highlighted charitable giving coming from within Russia.

In many of its posts, the page linked to an external website called RuNews.org. This website, however, does not exist. When the DFRLab tried to access it, the site redirected to a list of related links that include Yandex results and some unidentified news pages.

The “RuNews.org” Facebook page posted roughly 12–13 articles per day. In addition to covering charitable donations by Angelina Jolie, Zinedine Zidane, and Madonna, among others, the page heavily focused on Russia. On average, every third article concerned charitable activities being organized in or by Russia or its citizens. The page has been promoting Russian charitable activities likely in an effort to influence a broader Russian-speaking audience’s attitudes toward Russia.

The page had only 65 likes and 70 followers and, as a result, garnered virtually no engagement.

In its “About” section, RuNews.org claimed that it was a different kind of online news outlet: one that posted only positive news happening in Russia and beyond — news “that is making the world better”– and avoiding divisive political, social, and economic issues.

Despite this claim, however, in March 2013, the page shared an article accusing the Ukrainian “Aerosvit Airlines” of owing its employees more than 84 million Ukrainian Hryvnia (roughly $10.3 million at the time).

Sharing this particular article, which casts Aerosvit in an overwhelmingly negative light, may have been an attempt to discredit the Ukrainian airline.

A common tactic for disinformation campaigns is to start with banal content, such as celebrities’ charitable giving in this case, before slowly but surely pivoting to more political content. The DFRLab cannot make a confident assessment that this is the case for RuNews.org, but it nevertheless shows signs of a possible pivot, given the earlier negative content.

The pages removed by Facebook covered a relatively wide swath of topics related to Ukraine. Some focused on religious conflict, with a strong interest in discrediting the new Ukrainian Orthodox Church, while others amplified pro-Kremlin narratives regarding World War II or the 2014 Ukrainian Revolution.

Despite their varied focuses, four out of five pages shared content from a fifth Facebook page and a website of the same name, Voice of Truth. The amplification of a single external website, also called “Voice of Truth,” suggested that the operators of these pages coordinated with one another to some extent.

Overall, this network largely promoted pro-Kremlin, or at least pro-Russia, content and only had a modest impact, given the low level of engagement on a majority of its content.

Follow along for more in-depth analysis from our #DigitalSherlocks.