Social platforms connected the assets to the conservative Partido Popular

Facebook removed a series of Spanish accounts — both genuine and inauthentic — that boosted messaging favorable to a conservative political party in Spain. Facebook took action after being alerted by Twitter, which found 259 inauthentic accounts connected to the party on its own platform.

On September 20, the company took down 65 Facebook and 35 Instagram accounts that it said were connected to Partido Popular (PP, or the People’s Party) for engaging in coordinated inauthentic behavior in violation of the platform’s rules.

Independent analysis conducted by the DFRLab found that some of the individuals who had their accounts removed worked for the PP or for local governments controlled by the party.

Meanwhile, fake accounts used stock pictures stolen from the internet to create the impression that they belonged to real users. While most of the accounts did not share political content, a portion did.

The removal of the accounts occurred amid political instability in Spain. In the country’s April general elections, Prime Minister Pedro Sanchéz and his center-left PSOE (“Socialist Workers’ Party of Spain”) won the most seats but failed to gain an outright majority of votes, which would have allowed it to govern by itself. PSOE then failed to form a coalition, and, as such, Spain is thus headed for a new vote in November.

Real accounts, inauthentic behavior

Some of the accounts in the dataset were overtly connected to the PP.

One user, Lorenzo Perez Red, stated he worked for the party’s communications team and shared a photo of himself at a party event. His Facebook account also noted that he was a councilman in the municipality of Soto del Real in Madrid. His name was not on the municipality’s official website at the time of the takedown, but he was listed as a councilman in documents on the website until the beginning of 2019, which means he will likely finish his term also in 2019.

Another user, Jose Antonio Sanchez Serrano, identified himself as a former PP councilman in the municipality of Morata de Tajuña in Madrid.

Other users who had their accounts removed worked for local government. Beatriz Gutierrez Dominguez, for instance, was a staffer of the municipality of Malagón, which is controlled by the PP.

Finally, one of the removed accounts, PePe Motilla del Palancar, did not belong to an individual but represented the PP in the municipality of Motilla del Palancar. The profile described itself as the official page of the local branch of the party.

These seemingly real accounts usually shared content promoting the PP and its candidates, while sometimes also criticizing rivals.

Fake accounts

In addition to the real user accounts linked to the PP, the takedown also included fake accounts that boosted posts from other accounts. Most of these accounts were created in 2019, which may indicate that they focused on the Spanish elections in April.

Some of these accounts did not even have profile pictures, suggesting that the creators did not expend much effort to make the accounts seem authentic.

Other accounts made more of an effort, using photographs of people stolen from the internet in their profiles. A simple reverse image search showed that these photos were mostly stock images available elsewhere on the internet.

These accounts posted very little content; many of the pages had no apparent activity on their timelines or only updated their profile and cover images.

These findings indicated that the accounts were primarily used to like other pages and posts, not post original content. By amplifying other posts, they helped create the impression that the boosted content was more popular than it really was. Facebook arrived at the same conclusion, stating that “most of this [the network’s] activity was focused on amplifying others’ content.”

Some pages liked and posted content by other political parties, masquerading as supporters of those parties. The DFRLab found fake profiles supporting Vox, Ciudadanos, and PSOE.

There were signs that these accounts belonged to a network. At least three of the fake accounts taken down were friends with one another, indicating that they were acting to boost their number of friends to create the impression that they were authentic profiles.

In addition to the Facebook accounts, associated Instagram accounts were also taken down from the platform. Most of these accounts were private or had no content posted, suggesting they were also being used to boost engagement with and amplify other posts.

Operation on Twitter

On September 20, Twitter also announced that it had released a trove of information on accounts “falsely boosting public sentiment online in Spain.” The platform confirmed that the accounts were operated by the individuals linked to the PP with the intent of increasing engagement with messages favorable to the party.

The DFRLab’s analysis corroborated Twitter’s finding that these accounts were tied to the PP.

The top three hashtags in the Twitter set were official hashtags launched by the PP and intentionally aimed to undermine the PP’s political opponents.

The top hashtag, “PedroSeLoFunde,” was part of an official campaign launched by the PP to highlight the issue of overspending of minister councils. Second most recorded hashtag in the set was “DecretazoSanchez,” which claims that Sanchez’s management has been poor. The third most recorded hashtag was “NiObreroNiEspañol,” which attacked Prime Minister Sanchez for sympathizing with Catalonian independence movement.

An assessment of URLs tweeted by the accounts revealed that the accounts amplified an invitation to an official WhatsApp channel run by the party.

The second most tweeted URL was from a report that questioned Prime Minister Sanchez’s decision to dissolve the parliament. The third most amplified URL was a petition hosted on change.org challenging the Prime Minister to face his opposition in parliament.

Both Twitter’s investigation and the DFRLab’s independent open-source analysis of the content suggested that these accounts engaged in an active campaign to push messaging favorable to the PP.

Conclusion

Facebook and Twitter removed more than 300 accounts that, according to the platforms, were run by the PP, one of Spain’s major political parties.

The DFRLab corroborated the attribution. On Facebook, many of the removed accounts were overtly connected to the PP, and several fake accounts liked PP pages.

On Twitter as well, the PP was the main beneficiary of the operation, which promoted favorable messaging, hashtags, and external URLs.

The takedown happened amid political turmoil in Spain, as the country heads toward another election in November. It remains to be seen whether this online inauthentic activity will influence Spaniards’ voting behavior.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.