Coordinated and inauthentic subsets of Facebook pages amplified content published by different North Macedonian news sites

The DFRLab found dozens of Facebook pages linked to various North Macedonian news outlets that demonstrate several characteristics pointing to coordinated activity, including the near simultaneous publication of identical content. The assets also demonstrated signs of inauthenticity, as they were created as various interest pages, but ultimately promoted content from news sites to which they disclosed no connection.

In total, four separate networks of coordinated assets amplified content published by 10 Macedonian news websites. Some of the Facebook pages seem to be connected to Adinamic Media, a company that runs news sites supporting the Internal Macedonian Revolutionary Organization — Democratic Party for Macedonian National Unity (VMRO-DPMNE), an opposition party in North Macedonia. Adinamic Media has links with the Hungarian pro-Fidesz public television network Magyar Televízió (MTV). The rest of the assets are connected with other North Macedonian news outlets that generally provide more balanced reporting mainly on domestic affairs.

The North Macedonian media landscape is plagued by a lack of financial transparency, obscure ownership structures, and deep political polarization. The latter is reflected in the fact that many outlets in the country maintain explicitly pro-government or pro-opposition editorial stances, prompting concerns regarding the lack of objective and independent reporting in the country. Political advertisements in local media are funded from the state budget, and policy is intended to limit money in the nation’s political discourse and add a degree of transparency to paid political advertising. The policy, however, does not account for the information environment beyond local media, making social media and larger independent media more vulnerable to manipulation or influence.

This dynamic becomes particularly salient in light of recent political developments in the country, which point toward near-term elections. In early March 2020, European Union leaders failed to agree on starting EU membership talks with North Macedonia. North Macedonia Prime Minister Zoran Zaev called for snap parliamentary elections that were supposed to take place on April 12, 2020, but it was postponed due to the COVID-19 outbreak.

Most of the assets were divided into four subsets, based on the common news outlets they were amplifying.

Subset 1: Amplifiers of pro-VMRO-DPMNE opposition party outlets

The first subset consisted of seven Facebook pages ostensibly dedicated to different topics, all of which amplified articles published by four Macedonian outlets: Republika Online, Kurir, Denesen and Vistina. Republika Online, Denesen and Kurir mainly report on political news, but their content is anti-government, as they prominently feature pro-VMRO-DPMNE views. The fourth outlet, Vistina, does not cover political topics and positions itself as a tabloid magazine. Nevertheless, all these outlets are owned by the same media holding connected to MTV.

According to the Organized Crime and Corruption Reporting Project (OCCRP), Agnes Adamik, a former senior executive at MTV, established the North Macedonian company Adinamic Media in 2017. The firm then purchased a majority of shares in three North Macedonian media companies — Prva Republika, EM Media, and LD Press Media. As of 2018, these companies owned seven news sites supporting the VMRO-DPMNE party. The Prva Republika company owns the news websites Republika Online and Lider (the latter was subsequently transferred from EM Media to Prva Republika). The second company, EM Media, publishes the online news sites Kurir, Denesen, Ekonomski, and Vistina. The third media company, LD Press Media, runs the conservative news site NetPress. According to Mertek Media Center, these acquisitions helped Hungary’s Prime Minister Viktor Orban expand the country’s influence in the Balkan region and also support his ally Nikola Gruevski and his the VMRO-DPMNE party, in North Macedonia. Gruevski is a former Prime Minister of North Macedonia, who fled the country in 2018 and obtained asylum in Hungary.

Facebook pages in this subset post mostly identical articles published by outlets owned by Adinamic Media simultaneously and at the same frequency.

The total number of followers of the seven amplifying pages within this subset amounted to over 690,000 users, whereas the Kurir, Republika Online, Denesen and Vistina official Facebook pages garnered fewer than 300,000 followers. This may indicate that since these outlets had not been successful in growing audiences for their official Facebook pages, they decided to create coordinated networks to amplify their content. The amplifying assets were created at different points between 2009 and 2013 and were managed from North Macedonia. Nothing in the seven amplifying assets’ descriptions indicated they were connected to the outlets they promoted.

One of the official Facebook pages — Економски, for the online news site Ekonomski.mk — did not post any content from its own site and instead exclusively amplified Kurir’s content. Considering that both outlets belong to EM Media, they seem to be using each other’s social media assets to promote their content.

All of these pages were managed from North Macedonia, and the majority of their names include the word “Macedonia,” as well as the flag of North Macedonia in a profile picture.

The “Republika Makedonija (Република Македонија)” and “Ова е Македонија” Facebook pages both included similar email addresses (ovaemakedonija@gmail.com and info@ovaemakedonija.mk) as contact information in their “About” section. The “I ❤ Macedonia” and “Smeenje do solzi” pages also had associated Twitter accounts, and the latter had a channel on YouTube. This specific YouTube channel has the same name and profile picture as another of the Facebook pages, “Насмеј се” in the next subset, indicating a tentative connection between assets in subgroup 1 and 2, even though they promote content published by different sites.

Subset 2: Amplifiers of Markukule, News 24, and Signal

The 17 Facebook pages that comprise the second subset amplified content from three news outlets: Markukule, News 24, and Signal. While these outlets also reported on politics, their content was not as explicitly anti-government as the content published by outlets in the previous subset. These outlets do not provide company information on their websites and publish articles without bylines. Markukule and News24 frequently published supportive articles about Russian President Vladimir Putin, portraying him as an influential leader who respects traditional values and never forgets his friends in times of trouble. News24 also sometimes amplified RT and Sputnik videos.

Similar to the previous subset, the Facebook pages in this subset posted articles at the same time and at the same frequency. The DFRLab observed that 14 of the 17 Facebook pages in this subset amplified Markukule and News 24 articles only, whereas two assets also amplified content from Signal and one asset amplified only Markukule content.

The total number of followers of the 17 inauthentic Facebook pages in this subset amounted to over 900,000, roughly nine times that of the official Facebook pages for News 24 and Markukule.

The News 24 official Facebook page underwent a name change from “Freedom to Dedo Lube” to “News24.mk за Македонија” in 2016. “Freedom to Dedo Lube” was a North Macedonian movement created with the goal of supporting Ljubomir Mitev, a 79-year-old North Macedonian who fatally shot one of many robbers who attacked him and his wife in their home in 2013. Mitev was charged with murder in 2015, but citizens launched the initiative “Freedom to Dedo Lube” to free him from prosecution. Although their attempts were unsuccessful, Mitev was later found not guilty in 2019. It remains unclear how the Facebook page transitioned from a Mitev support page into the official Facebook page of News 24.

Similarly, other pages in the subset also previously had different names not related to their existing names, indicating that the pages might have taken advantage of a preexisting audience to amplify their reach.

Subset 3: Amplifiers of Puls 24 and Bulevar

Assets on Facebook in this subset amplified content from two outlets, Puls 24 and Bulevar. According to the Puls 24 website, the outlet belongs to New Media Enterprise, a company registered in Skopje, North Macedonia. The website also provides contact information for the editor-in-chief. Bulevar displays a North Macedonian phone number, email address, and the name of the holding to which it belongs, Stratton Media.

The DFRLab found that amplifier pages in this subset may be connected to Filip Petrovski, a right-wing presidential candidate in the 2019 North Macedonia presidential elections and a former member of VRMO-DPMNE opposition party.

Petrovski opposed the country’s name change, from Macedonia to North Macedonia, undertaken as a means of removing Greece’s blockage of the country’s accession talks to NATO membership. Petrovski has also advocated for the cancellation of the Prespa Agreement, which mandated the name change, signed by Greece and North Macedonia in 2018. Petrovski frequently amplifies News 24 articles on his personal Facebook account; posts containing links to News 24 articles on his individual account later appeared, in several instances, on amplifier pages with identical text.

Moreover, two pages within this subset had names related to Petrovski. The “Филип ЗА Македонија” (“Filip for Macedonia”) and “FILIP PETROVSKI” pages used a photo of Petrovski as their profile pictures. Moreover, the “About” sections of both pages contain details from his biography and political views. The DFRLab could not confirm whether Petrovski himself managed these pages; however, these pages also published Puls 24 articles with the same text as he posted on his personal account.

Combined, the seven amplifying pages in this subset had over 335,000 followers, whereas the official Puls 24 and Bulevar pages garnered just over 275,000. The amplifier pages were created at different points between 2009 and 2019, and their names were not associated with the outlets they amplified. These pages were managed from North Macedonia, and most of them had never changed their name.

Subset 4: Amplifiers of Net Medical Diet and Galama Club

A fourth coordinated network of Facebook assets amplified content published by two outlets — Net Medical Diet, a health news site, and the Galama news outlet.

Net Medical Diet is owned by a company called DPTU Diapazon registered in Skopje, Macedonia. According to its website, the editorial board is comprised of members of the Media Ethics Committee of Macedonia.

Galama disclosed no information about its ownership or editorial board, but both of these media outlets seemed connected to one another, as their official Facebook accounts amplified content from both.

Combined, the eight amplifier pages within this subset had over 770,000 users; the Net Medical Diet and Galama Club official Facebook pages had just over 175,000 followers. The amplifier pages were created between 2010 and 2018, and their names did not refer to the outlets they amplified. These pages were managed from North Macedonia and the United States, and some of them had changed their name at various points.

The DFRLab also found five Facebook pages that amplified content from outlets owned by EM Media. Although the DFRLab was not able to identify coordination between them, there is a likelihood that EM Media was using these assets for content promotion.

Conclusion

The DFRLab analysis showed that subsets of Facebook assets amplified political as well as non-political content published by at least 10 North Macedonian media outlets. While some of the assets acknowledged their connection to the outlets they amplified, others were inauthentic, as they were originally created as unrelated special interest pages but ultimately served to amplify the outlets. This strategy seems to have been efficient, as the assets in each subset have many more followers than the official Facebook pages of the outlets, likely because the former benefited from a built-in audience.

While there was coordination within the subsets of assets, there was no indication of coordination across subsets. In addition, there was no sign that the outlets themselves managed the inauthentic networks.

The presence of these assets online and their success in cultivating a follower base are both fostering political polarization in the North Macedonian public in the run-up to an election. Early parliamentary elections were planned to be held on April 12, 2020, however, the government postponed them due to coronavirus pandemic. According to International Republican Institute’s latest survey, the ruling party and the right-wing opposition VMRO DPMNE party are almost neck-to-neck ahead of the elections. The use of an inauthentic network on social media may enable political forces to mislead people and spread manipulated content to garner voter support, raising a concern on the integrity of the electoral process in the country.

Givi Gigitashvili is a Digital Forensic Research Assistant, Caucasus at the DFRLab.

Kanishk Karan is a Digital Forensic Research Associate at the DFRLab.