The social network took down assets connected to News Front and South Front, propaganda websites supportive of Russian security services

On April 30, as part of a larger takedown, Facebook removed 140 assets connected to Russian propaganda outlets News Front and South Front, of which the DFRLab had access to a subset of 69 assets.

Most of the pages and groups the DFRLab had access to had clear connections to News Front and South Front. While the DFRLab found instances of inauthenticity and of coordination but could not connect them, it also found no evidence to contradict Facebook’s findings of coordinated inauthentic behavior (CIB). Facebook designates assets for removal under CIB when accounts, pages, groups, or other assets intentionally mislead users.

In this case, according to its statement, the company removed the assets because:

The individuals behind this activity relied on a combination of authentic, duplicate and fake accounts — many of which had been previously detected and disabled by our automated systems. They used fake accounts to post their content and manage Groups and Pages posing as independent news entities in the regions they targeted. This network posted ​about geopolitical and local news including topics such as the military conflict in Ukraine, the Syrian civil war, the annexation of Crimea, NATO, US elections, and more recently the coronavirus pandemic​. ​Our investigation linked this activity to individuals in Russia and Donbass, and two media organizations in Crimea — NewsFront and SouthFront.

Registered as a private company, News Front Ltd. received a Russian state licenses to operate as an information agency in June 2015 and as a TV channel in February 2017, according to public data. The company was established by Konstantin Knyrik, the head of News Front, and Mikhail Synelin, who has held various positions in the Russian government or in state-affiliated entities from the leadership of the government secretariat to deputy chairman of the state corporation “Bank for Development and Foreign Economic Affairs.” Finally, he is also brother-in-law to Sergey Glazyev, an advisor to Russian President Vladimir Putin from 2012 to 2019.

The flagship News Front outlet has about 12 full-time staff, more than 100 contributors, and a disclosed fiscal budget of 712,000 rubles (around $12,200; for 2017). According to “a former News Front staffer” in an article from German outlet Zeit, the outlet is funded by the FSB, the Russian intelligence services. The outlet started off as a Russian federal agency outlet but, in April 2015, switched to ostensibly being a private news agency, according to data from Russian tax authorities.

The motives of the operation bear close resemblance to what the DFRLab observed in a previous takedown of assets belong to Iranian company IUVM, a messaging laundromat that Facebook de-platformed for pushing pro-Iranian information operations. Like PressTV and Mehr, IUVM’s ownership was a puzzle, but the content showed clarity in its pro-Iranian geopolitical objective. Similar to that, News Front and South Front are thinly disguised propaganda outlets for pro-Russia content.

The DFRLab has covered News Front’s propagation of Russian propaganda previously, from its role in spreading messages against the migration movement in Germany to its projection of false equivalence between the independence movement in Catalonia and the “Republics” movement in the Donbas.

Just like mainstream Russian media outlets such as RT or Sputnik, the website’s content exhibits an anti-Western bias and promotes the Kremlin’s stance on certain issues. The dissemination of the content was made effective through the distortion of facts, projection of false equivalence, use of photoshopped content, and amplification of Kremlin talking points, all in service of Russia’s geopolitical agenda.

News Front: an amplifier and part of the Russian media ecosystem

One of the assets taken down was News Front’s official Facebook page.

Most of the assets that DFRLab had access to did not hide their connection to South Front or News Front. Many of the pages wore their connections on their sleeves, naming themselves as different language versions of the websites.

Others in the set were not named as directly, but nevertheless included links to the News Front website in the “About” section of their main page.

Some of the removed assets also demonstrated a close relationship by liking each other’s pages.

ANNA News Front

The DFRLab also found suspicious links to another Russian propaganda outlet, ANNA News. Some of the administrators of some of the pages previously worked at ANNA News, an Abkhazian news agency that pushes a pro-Kremlin agenda.

Two of the removed pages, “Catherine Nollan” and “Ellen Krasovskaya,” were dedicated to anchors for News-Front.info who were formerly with Anna News.

“Anastasia Shkitina,” an account listed as the creator of one of the removed groups, “NewsFront auf Deutsch,” was also a former ANNA News employee.

An account seemingly belonging to former ANNA News anchor “Catherine Nollan,” as mentioned above, was also listed as an administrator for the same group.

Catherine Nollan had a duplicate account, which seemed inactive at the time of the takedown but may have been intended as a secondary account to post News Front content.

Catherine’s main account also listed itself as “CEO of News Front.”

Both Catherine Nollan accounts, along with the “Anastasia Shkitina” account, were among those removed in the takedown. Although these accounts may have been real identities, other accounts had pilfered profile photos or stolen names, such as an account that used a picture of former British Prime Minister David Cameron as its profile photo and named itself after comedian Yakov Smirnoff (“Яков Смирнов”).

Though the DFRLab did not find that the accounts involved used inauthentic means at scale, there were clear attempts to use sockpuppet accounts to push content, especially in promoting News Front and South Front stories.

Moreover, a few accounts shared verbatim posts across various groups that discuss political issues, often on the same day. This behavior, while not necessarily inauthentic, showed attempts to gain visibility in these groups on political issues.

One of the removed pages, “Front.TV,” sought to raise funds for ANNA News in October 2014, but at the time of its removal had been posting News Front content for several years. Archived copies of the News-front.info website shows that the website’s social media icons linked to the same Front.TV Facebook page between December 21, 2014 and May 15, 2016, when it switched to the Newsfront.info Facebook page.

The links to other pro-Kremlin outlets indicated that News Front may be part of a broader Russian media ecosystem.

Denial of Russia’s role in downing of Flight MH-17

“Ellen Krasovskaya,” one of the removed pages, was dedicated to the eponymous anchor for News Front and ANNA News mentioned above. The page posted links to News Front articles that were outright disinformation. For instance, the page posted a link to a News Front story that denied the culpability of Russian-backed separatists’ involvement in the shoot-down of Malaysia Airlines MH-17 in eastern Ukraine in July 2014.

The Joint Investigative Team, an international coalition assembled to investigate the tragedy, determined separatists to have been behind the MH-17 shootdown; after issuing the determination, the organization pursued criminal proceedings against four individuals. Also, the involvement of the two so-called “republics” (the “Luhansk People’s Republic” and the “Donetsk People’s Republic”) in eastern Ukraine was proven by open-source evidence collected by Bellingcat, a citizen journalist investigations outlet.

The “Ellen Kraskovskaya” page also posted a story blaming the U.S. representative in the Organization for Security and Co-operation in Europe (OSCE) for false accusations and aggressive statements and claiming that the U.S. representative had called for “liquidation” of the “republics’” administration before elections could be held under Ukrainian law in the Donbas region. The piece erroneously translated the word “dismantled” to mean “liquidation,” implying the physical extermination of the governmental personnel of the so-called “republics.”

Another of the removed pages, Front.TV, served as a platform to amplify News Front articles, especially those dedicated to Syria and the MH-17. The page also promoted “Ukraine: Masks of Revolution,” a French documentary that nonprofit fact-checking organization StopFake criticized for “mirroring the ideology traditionally put forth by pro-Russian channels” and “build[ing the] story on factual mistakes.” The page also provided consistent coverage on shelling by the Ukrainian side of the conflict in eastern Ukraine but ignored any similar attacks by Russian-backed separatists. The most recent post on the page was published on February 12, 2016.

False equivalence and distortion

News Front and South Front both used false equivalence and distortion to manipulate the information environment. South Front features similar content to News Front, but the former mostly posts military-related analysis. According to EUvsDisinfo, the outlet shares Russian talking points “verbatim” and is “frequently featured in [its] database of cases of disinformation.” Moreover, EUvsDisinfo has compared South Front’s modus operandi to that of New Eastern Outlook, another English-language, pro-Russian outlet that featured in Facebook takedown of Thai assets on July 2019.

One of the pages posting South Front links, “ZuidFront,” spread anti-EU, anti-U.S., and pro-Kremlin messages in both the Dutch and English languages.

Some of the content from the page targeted Western narratives by pushing a false equivalence, such as comparing the conflict in the Donbas region of Ukraine (a proxy war between Ukraine and Russia) with Brexit (a geopolitical event decided by democratic vote).

Another of the removed pages, “South Front Nederlands,” openly acknowledged its affiliation with South Front and posted consistent pro-Kremlin coverage of the conflict in Syria. Among other things, the page amplified conspiracy theories about the downing of MH-17, putting the blame on the Ukrainian government.

The “About” section of the page stated that it was devoted to translating South Front’s English language articles into Dutch. The page had been active since November 2017.

A penchant for Photoshop and a Russian vocabulary

Another of the pages amplifying News Front articles, “Donbass Back To Russia,” had 6,713 followers and posted pro-Russian, pro-separatist news regarding the conflict in the Donbas region of eastern Ukraine, including posts that were overtly pro-independence for the Donbas “republics.” The “About” section for the page listed a link to a WordPress blog called “Narodni Eurasia.” The blog is now defunct, but a search on archive.is showed a post from May 2015 that included screencaps from a News Front video.

Other posts used photoshopped, fabricated, and defamatory images to target Western politicians, including a photo of Hillary Clinton posted ahead of the 2016 presidential elections that supposedly showed her shaking hands with Osama bin Laden. The Photoshopped image superimposed bin Laden’s head on the body of Indian musician Shubhashish Mukherjee, who can be seen meeting Clinton at a 2004 event in the original photo.

The page also posted several times on a supposed Russian humanitarian aid convoy to the Donbas. The OSCE, however, cast doubt on what the contents of these alleged aid trucks actually were.

The page stopped publishing in June 2017.

Some of the pages in the set promoted terminology and concepts pushed by Russia. One such term, “Novorossiya,” appeared on the Donbass Back To Russia page.

The term gained momentum among Russian media and policy circles after Putin used it in 2014 as a means of implying Russia’s sovereignty over the Donbas. The term has since fallen out of favor.

Pushing an alternative view

Some of the pages taken down focused beyond Ukraine, offering alternative views to Western reporting more generally.

One page, for instance, was dedicated to Bulgaria, and published an article criticizing the European Union’s response to the coronavirus pandemic.

Targeting Latin America and Georgia

Beyond the assets focused on Ukraine and the European Union, other assets — such as the pages “Agencia de Noticias News Front En Español” (“News Front Outlet In Spanish”) and “Novorossia Today En Español” (“Novorossia Today In Spanish”) targeted Latin American audiences with posts linking to News Front articles in Spanish that focused on Brazil, Bolivia, Mexico, and Venezuela. Most of this content aimed to highlight the failings and supposed successes of Latin American leaders, including Brazil’s Jair Bolsonaro, Bolivia’s Evo Morales, Venezuela’s Nicolas Maduro, and Mexico’s Lopez Obrador.

These articles, however, were not original content: they were taken from state-funded media outlets, such as the Russian-funded Sputnik, Tass, Ria, and RT, the Venezuelan-funded TeleSurTV, and the Iranian state-funded HispanTV. News Front used the same content from those outlets and amplified them on its site, linking back to the original content.

The DFRLab collected a sample of news links published in the HTML source-code of the News Front Spanish version’s homepage, es.newsfront.info. In total, the DFRLab extracted 74 URLs from news published between December 2019 to April 2020. The data showed that media outlet Sputnik has been amplified by the website most often, followed by Tass and RT.

According to a search using the social media listening tool CrowdTangle, this sample of news links garnered 440 likes and 145 shares in total. Among those groups sharing News Front Spanish content were accounts supporting Vladimir Putin, Venezuela’s Nicolas Maduro, and groups identifying themselves as “friends of Russia.”

Using the CooRnet R package, the DFRLab also identified accounts that engaged in coordinated link-sharing behavior. Given a set of URLs, the package determines a coordination interval for shared links — a time threshold that identifies which of the same links were shared by different pages within an unusually short period of time, on a repeated basis. Public Facebook entities that repeatedly shared the same links within that threshold are deemed as engaging in coordinated link-sharing behavior with one another. The analysis identified the groups “Apoyo a Vladimir Putin” (“I support Vladimir Putin”), “Todos con Rusia” (“Everybody with Russia”), “Pueblos en resistencia” (“People’s resistance”), and “Pueblos que resisten al imperialismo” (“People’s resistance to imperialism”) as coordinating on posting links.

Facebook also removed News Front assets that operated in the Georgian language and amplified content published by the News Front Georgian edition. Multiple inauthentic fake accounts were posting openly pro-Russian and anti-Western content in Facebook groups, which aimed to antagonize society against the West and portray Russia as a more reliable partner for Georgia.

Conclusion

News Front and South Front are propaganda outlets dedicated to posting pro-Kremlin and anti-Western stories, especially on Ukraine. Both outlets demonstrate similarity in ideology and tactics to their more overtly Russia-backed counterparts, such as Sputnik and RT, and some of its foreign language versions — such as its Spanish-language edition — openly repost content from those same Russian state-backed entities.

When they first surfaced in the Ukrainian media environment, News Front and South Front appeared to be fringe media outlets. The extent to which their ideological messaging cohered with that of the Kremlin, especially on topics like the downing of Flight MH-17, raised suspicion of their links to the Russian security services.

A defining feature of this operation was its scope: the removed assets disseminated pro-Kremlin propaganda in an array of languages, indicating that they were attempting to reach a diverse, international audience beyond Russia.

---

Kanishk Karan is a Digital Forensic Research Associate with the Digital Forensic Research Lab.

Roman Osadchuk is a Research Assistant, Eurasia, with the Digital Forensic Research Lab.

Givi Gigitashvili is Research Assistant, Caucasus, with the Digital Forensic Research Lab.

Esteban Ponce de León is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab.