Facebook takes down inauthentic assets targeting multiple Latin American elections

Inauthentic assets posed as independent news

Facebook takes down inauthentic assets targeting multiple Latin American elections

Share this story

Inauthentic assets posed as independent news entities targeting political actors and presidential elections in the region

(Source: @estebanpdl/DFRLab)

On July 8, 2020, Facebook removed a network of assets engaged in coordinated inauthentic behavior focusing on several Latin American countries and influencing political topics in the region. Facebook attributed these assets — including 77 pages, 41 user accounts, and 56 Instagram profiles — to Estraterra, an Ecuadorian public relations firm operated out of Canada, as well as political consultants and former government employees in Ecuador. This is not the first example of a commercial marketing company profiting on political gamesmanship, as other previous DFRLab investigations have reported on similar operations. While for-profit operations that work to influence political outcomes are not new or novel, the exposure of yet another company undertaking such operations demonstrates how widespread the phenomenon has become.

The administrators of the pages involved in this takedown were mainly located in Canada and Ecuador, but the content also targeted other countries, including Argentina, Bolivia, Chile, Uruguay, and Venezuela. Much of the content appeared to be related to elections, with many pages promoting specific left-wing candidates in the lead-up to an election and then falling dormant thereafter. The content reviewed by the DFRLab did not seem to be disinformation or even manipulated, but the assets themselves did appear to be coordinated and feature elements of inauthenticity.

In its announcement of the takedown, Facebook stated:

This network relied on a combination of authentic and inauthentic accounts, some of which had already been detected and disabled by our automated systems. This operation — which was also active on other internet platforms — activated around civic events such as elections, at times posting on both sides of the political debate, and then abandon or pause its activity. They used fake accounts to pose as locals in countries they targeted, post and like their own content, drive people to off-platform sites, and manage Pages posing as independent news in countries they targeted. Some individuals behind this activity created multiple duplicate accounts under their own name. This network posted about domestic news in the countries it targeted, including topics such as politics, activism, praise and criticism of political candidates, elections, the government of Venezuela, both support and criticism of the President of Ecuador, political parties in the region including Farabundo Martí National Liberation Front in El Salvador, Peronist party in Argentina, and the Progressive party in Chile.

We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to political consultants and former government employees in Ecuador and Estraterra, a Canada-based PR firm. Estraterra is now banned from our platforms.

This is also not the first time that a social media platform detected coordinated inauthentic activity linked to Ecuador. In September 2019, Twitter removed 1,019 accounts tied to the Alianza País (AP) political party, a political movement linked to former President Rafael Correa. Facebook’s latest takedown bore a close resemblance to the 2019 Twitter takedown as some of the network’s assets openly acknowledged their support for Correa by creating posts in favor of his political party.

The DFRLab found evidence that one of the removed user accounts was that of a former government employee in Ecuador who had served as an advisor at the National Secretary of Public Administration during Correa’s presidency. The same former employee is also a co-founder of Estraterra.

The investigation also confirmed the connections between the assets on both Facebook and Instagram, as well as those related to the off-platform websites linked to the assets. Some of these websites shared similar content, used the same user account (UA code) for Google Analytics and added the same publisher ID for a Google AdSense account; many were also hosted on the same server.

Overall, this operation followed a pattern the DFRLab has seen many times before: a for-profit company operating a series of Facebook and Instagram assets, as well as affiliated off-platform websites.

Estraterra — Ecuadorian origin, Canadian operation

A search on LinkedIn yielded a profile for a person by the name of Roberto Wohlgemuth, whose profile states that he is located in Vancouver, Canada, and is a co-founder of Estraterra. Wohlgemuth would be a recurring figure throughout this investigation.

Screengrab from LinkedIn profiles for Estraterra and Roberto Wohlgemuth corroborated their connection. (Source: LinkedIn)

Despite Wohlgemuth’s Canadian location, a Google search found his name on official documents showing that the company was founded in Ecuador on July 19, 2017.

Screengrab from Estraterra’s official founding document, which Roberto Wohlgemuth signed as co-founder. (Source: Superintendencia de Compañias, Valores y Seguros)

The document indicated that the company would be operated under the laws of the Republic of Ecuador, suggesting that the firm is based in Ecuador. It also specified that the company can operate subsidiaries overseas, thus accounting for the Canadian connection.

Screengrabs from the firm’s document, which specifies that Estraterra is an Ecuadorian company. The images also show the company’s purpose as being focused on “strategic communications and marketing.” (Source: Superintendencia de Compañias, Valores y Seguros)

According to the document, the company’s purpose is to “provide technical advice on communications and publicity, including consultancy, professional assistance, trainings, and provision of services,” targeting, for example, “strategic communications and marketing.”

According to its website, Estraterra is a strategic political communications company that helps connect “progressive political movements and governments around the world meaningfully with their constituents.”

Screengrab of Estraterra’s website showing its description as a strategic political communications firm. (Source: Estraterra/archive)

In addition to the LinkedIn account, one of the accounts removed by Facebook in the takedown also went by “Roberto Wohlgemuth.” A further Google search revealed an official document indicating that a Roberto Wohlgemuth served as an advisor at the National Secretary of Public Administration in Rafael Correa’s presidential administration as of 2011.

A Google advanced search returned results showing official documents identifying government employees, connecting Wohlgemuth to the Correa administration. (Source: @estebanpdl/DFRLab via Google, left; Ecuador’s presidency office/archive, right)

Wohlgemuth was not the only connection to the Correa administration. Another of the removed Facebook accounts was for a Giovanni López, Jr., for whom a similar Google search found an official document stating that he was serving as a technical assistant for media and public relations in the vice president’s office as of 2014.

Screengrab from a removed account alongside a Google search showing a similarly named person working in the Ecuadorian vice president’s office in 2014. (Source: @estebanpdl/DFRLab via Facebook, left; Google, middle; Vice President’s Office/archive, right)

Target: Latin America

A large proportion of the Facebook pages and Instagram profiles that the DFRLab had access to posed as independent news entities and fact-checking media outlets, with supportive content aimed at leftist leaders in Latin America and negative content aimed at right-wing political figures in the region, including Brazilian President Jair Bolsonaro, Chilean President Sebastian Piñera, former Argentinian President Mauricio Macri, and Juan Guaidó, who is recognized by more than 60 countries as interim president of Venezuela.

Examples of negative posts by the removed Facebook pages targeting right-wing regional leaders. (Source: Facebook)

According to the pages’ creation dates and content, several of the network’s assets operated almost exclusively during presidential campaigns in South America, including in Chile (2017), Ecuador (2017), Venezuela (2018), Argentina (2019), and Uruguay (2019).

Table showing some of the assets involved in the takedown. The pages’ creation dates matched with presidential election campaigns in the target country. (Source: @estebanpdl/DFRLab)

In Ecuador, the pages promoted the candidacy of Lenin Moreno, who at the time the assets were active was nominated as presidential candidate for Correa’s Alianza País’s party. Moreno won the election and is currently serving as president of Ecuador. After Moreno took office, disagreements between him and Correa led to a political rupture. The assets involved in the takedown similarly pivoted from supporting Moreno’s candidacy to attacking him after he fell out with Correa. Other pages attempted to discredit the opposition candidate, Ecuadorian businessman and politician Guillermo Lasso. None of the posts, however, appeared to be anything more than standard political attack advertisements.

Screengrabs from pages showing content targeting former Ecuadorian presidential candidate Guillermo Lasso. GiLasso Enemigo del Pueblo (“GiLasso [Guillermo Lasso] enemy of the people”) was created on January 2016, while El Verdadero Lasso (“The real Lasso”) went online in December 2016. Both were created during the 2017 presidential campaign in Ecuador. (Source: Facebook)

Other assets in the set pushed for the reelection of Venezuela’s Nicolás Maduro in 2018 and Alberto Fernández in Argentina. Fernández was the center-left candidate for the Argentinian presidency while the assets were active in 2019. Other pages targeted the 2019 Argentinian elections with attacks on the incumbent candidate, Mauricio Macri. Fernández won the contest.

Screengrabs showing attacks on Mauricio Macri during the 2019 Argentinian presidential election. (Source: Facebook)

Most of the pages that targeted the different presidential elections around the region operated only during the campaign. They stopped publishing content on the platform immediately following the elections.

Out of the assets the DFRLab had access to, only two paid for promotion using Facebook’s advertising platform under the category “issues, elections, or politics.” One of these pages, El Austral Digital, launched around 32 ads in October 2019. These took aim at an Argentinian audience, sometimes specifically targeting users in the capital Buenos Aires.

Screengrabs from Facebook’s advertising platform showed that the page El Austral Digital launched ads targeting the 2019 Argentinian elections. (Source: Facebook)

Beyond those assets, however, the network also focused more broadly on ongoing domestic politics in both Ecuador and Chile, including content on former presidential candidates, political party leaders, members of national assemblies, and mayors.

Screengrabs showing a focus on domestic politics in both Ecuador and Chile, including Ecuadorian politician Jimmy Jairala (left); Cynthia Viteri (middle), who currently serves as Mayor of Guayaquil, the second-largest city in Ecuador; and Alejandro Guillier, a 2017 candidate for the Chilean presidency (right). (Source: Facebook)

The Facebook and Instagram assets also featured U.S. President Donald Trump heavily, as many on the left in Latin America see him as a useful foil to galvanize left-wing readers. In particular, they used Trump as a means of attacking Guaidó, who has been challenging Nicolás Maduro for control of Venezuela since January 2019, following the country’s highly contested 2018 presidential election. Other pages posted content based on the January 2020 U.S. military strike that killed Iranian Islamic Revolutionary Guard Corps Major General Qasem Soleimani.

Screengrabs of posts featuring U.S. President Donald Trump. The topics included Ayatollah Khamenei, Major General Qasem Soleimani, and Venezuelan opposition leader Juan Guaidó. (Source: Facebook)

A few of the assets posted COVID-related content, with a focus on the city of Guayaquil, which has been hard hit by the coronavirus outbreak.

Screengrabs from posts showing COVID-19 content. Such posts highlighted the Pacific city of Guayaquil, which has been hit particularly hard by the coronavirus outbreak. (Source: Facebook)

Some of the assets openly acknowledged their support for Ecuador’s Correa and Venezuela’s Maduro. For example, the Instagram account @correistas— a name that itself references supporters of former president Correa — posted photos that put Correa in a sympathetic light.

Screengrabs showing content from network’s assets supporting former Ecuadorian president Rafael Correa and Venezuela’s Nicolás Maduro. (Source: Facebook)

The DFRLab used VGG16 Tensorflow Keras, a machine learning application, to analyze image similarity among the nearly 9,000 photos posted on Instagram by the network, including applying it to pictures of former president Rafael Correa. The analysis concluded that that two assets on Instagram, @correistas and @seguidoresdecorrea, mainly shared pictures of Correa, uncovering many photos similar to the input photo of Correa.

Using VGG16 Tensorflow Keras, the DFRLab looked for image similarity based on a photo of former Ecuadorian president Rafael Correa. The model allowed researchers to identify the volume of photos demonstrating support for Correa. The DFRLab used the VGG16 Tensorflow Keras application to train a machine learning model to identify image similarity in a local database. The model was trained using the Instagram photos posted by the network’s assets provided by Facebook. (Source: @estebanpdl/DFRLab)

Inauthentic activity on Facebook and beyond

The DFRLab was able to corroborate signs of coordinated inauthentic behavior in the network. Many pages, for example, posed as independent news outlets in the region and were created either on the same day or within a few days of each other.

Screengrabs showing two pages that posed as news and fact-checking media outlets. (Source: Facebook)

Many of the assets were created in clusters. For example, some of the assets focusing on the 2017 Ecuadorian presidential election were created around the same time period. Similarly, there was an overlap in page manager locations. Although these pages had mostly Ecuador-based managers, two of them showed Canada as well, according to Facebook page transparency data.

The table shows assets that focused their content on political topics in Ecuador. According to the page transparencies, manager locations were mainly in Ecuador, but two pages also featured managers in Canada. (Source: @estebanpdl/DFRLab via Facebook)

Another group of pages, which targeted mostly Venezuelan politics, were created between February 8 and 9, 2018, before the presidential campaign in Venezuela. The DFRLab identified three main groups of pages. In each subset, pages were created on the same day.

Table showing Facebook pages that posed as independent news entities joining on the same day. The highlighted assets were created on February 8 and 9, 2018, posted a short welcome message after being created. (Source: @danielsuarezper/DFRLab via Facebook)

The investigation also found that some of the assets operated using duplicate and fake accounts. It is unclear, however, if some of the duplicate accounts were created because a previous one had been removed by the platform.

Screengrabs from removed assets that operated using duplicate accounts. (Source: Facebook)

Alongside the duplicate accounts, at least one of the removed accounts had a profile picture generated using a generative adversarial network (GANs). As the DFRLab has previously identified in collaboration with Graphika, AI-generated faces can be recognized by analyzing features on the image, such as background details, hair, lips, and asymmetry between eyes or ears.

Screengrab from a removed account that used a profile picture generated by artificial intelligence. (Source: @estebanpdl/DFRLab)

Another group of accounts appropriated images from elsewhere online, including from football players or actresses. Using Google’s reverse image search, the investigation was able to identify some of the profile pictures used by the user accounts. Additionally, two assets used profile pictures of Argentine football star Lionel Messi.

Screengrabs from removed accounts that used stolen profile pictures (Source: @estebanpdl/DFRLab via Facebook and Google reverse image search)

In addition to the activity on Facebook, there was also evidence of inauthentic activity on Twitter being directed by the aforementioned @correistas Instagram account.

Screengrabs from Instagram posts with calls to action to promote hashtags. The @correistas account invited its audience to participate in such campaigns, some of which targeted Ecuador’s current president, Lenín Moreno. (Source: Instagram)

The same tactic was deployed via a dedicated Telegram channel, also named Correistas, invited members to join a hashtag campaign on Twitter by posting a message and using the hashtag.

Screengrab from Telegram group “Correistas.” The search results showed messages that promoted Twitter campaigns. (Source: Telegram)

After these calls to action, some of these hashtags reached the trending topics on Twitter while showing signs of traffic manipulation.

For instance, according to Twitter listening tool Trendinalia, the hashtag #NoSeMetanConCorrea (“Do not mess with Correa”) — which was promoted on Instagram by @correistas on June 11, 2018 — reached the trending topics on the same day. The hashtag garnered 38,483 mentions, and the top 10 percent of the most active accounts generated nearly 70 percent of the publishing volume, indicating that a small group of accounts coordinated in an effort to push this hashtag to trend.

Screengrab from Instagram profile @correistas. The image promoted a hashtag in favor­­ of Rafael Correa. According to the volume of mention, the hashtag reached the t­rending topics around the intended time. (Source: Instagram, top; DFRLab using Brandwatch, bottom)

Connections between assets

To analyze the relationship between the user accounts on Facebook, the DFRLab created a social network graph based on friendship connections. This process only took into consideration connections between 29 of the 35 user accounts removed as a part of the takedown to which the DFRLab had access; the remaining six restricted access to their friends lists.

The resulting graph revealed Estraterra co-founder Roberto Wohlgemuth’s user account to be the most connected node in the Facebook network, suggesting that many of the analyzed accounts were “friends” connected with him. Other relevant profiles in the network were Santiago Silva, Pepito Redes, and Giova López.

The graph shows the friendship connections from the user accounts provided by Facebook. The account “Roberto Wohlgemuth” was the most connected among the analyzed assets. (Source: @estebanpdl/DFRLab)

The links indicated that the user accounts did not operate in isolation. On the contrary, these connections may suggest signs of coordination. In Wohlgemuth’s case, at least, it is likely that his personal user account was removed because he appeared to be the central personality for Estraterra’s coordinated inauthentic behavior activities on the platform.

The DFRLab created a second social network graph to analyze Instagram assets based on the profiles followed by the removed accounts. The resulting graph revealed that some of the assets that posed as independent news entities had followed each other.

Graph showing the most-followed Instagram accounts among the set, including assets involved in the takedown (yellow boxes). Among the most-followed Instagram accounts were the Maduro-backed outlet TelesurTV and the Russian-backed outlet in Spanish ActualidadRT. (Source @estebanpdl/DFRLab)

External websites with identical content

Beyond Facebook and Instagram, the DFRLab identified at least 33 external websites linked to assets on either platform. Although some of the websites are no longer available, old versions for some of the websites were still available on the Internet Archive’s Wayback Machine.

All the active off-platform websites linked to the assets used WordPress as their content management system. Additionally, some of the websites appeared to be connected with a shared user account (UA code) for Google Analytics and a shared publisher ID for a Google AdSense account, pointing to coordination beyond Facebook and Instagram.

Screengrabs showing one example of websites sharing the same user account (UA code) for a Google Analytics account (Source: @estebanpdl/DFRLab via La Voz/archive, top left; Facebook, top right; DNSlytics, bottom)

Some of the websites appeared to use the AdSense account as a means of generating revenue by hosting advertisements.

A screengrab from Semanario La Región’s website using advertisements. The URLs connected to the advertisements point to Latin American sites for the respective companies. (Source: Semanario la Región/archive)

According to WHOIS search results, a tool that allow researchers to find information on any domain name or website, many of the sites in question were registered on the same day, sometimes within only a few seconds. In all cases, the registrant name was not available.

Table showing the websites’ creation dates and two examples of Whois results. The rows in color show sets of websites created on the same day. (Source: @estebanpdl/DFRLab via DNSlytics)

A search using WPScan also showed links between the websites. While the usernames used to access the backend of the WordPress site did not match with the removed accounts, including Wohlgemuth, the scan revealed identical username patterns across websites, such as “editor,” “editor1,” “colab_1,” “colab_2,” etc.

Screengrabs from WordPress scans. The websites shared patterns of usernames to access to the WordPress backend. Results show scans from eight websites linked to the removed assets (Source: @estebanpdl/DFRLab via WPScan)

Identical content on and off Facebook

The interchange between the off-platform websites and on-platform assets demonstrated the comprehensive case for CIB: different but similar assets on Facebook and Instagram linked to “copypasta” articles on different external websites, many of which shared the same background details such as Google AdSense or Analytics IDs.

Posts published at the same time across the Facebook and Instagram network also included links to the external websites. Instagram profiles connected to Semanario La Region and Latam Post, for example, published similar images to each and links to articles with verbatim content between the respective websites.

Screengrabs from two Instagram assets showing the same photo on July 11, 2019. The link in the photo’s caption redirects to articles using identical content. (Source: Instagram, top; El Semanario/archive, bottom left; Latam Post/archive, bottom right)

The content of the off-platform articles was not the only identical language found between the assets. On May 6, 2019, for example, the same Instagram profiles as above used an identical caption for two different images. One of them, however, featured a caption that did not align with the context of the accompanying photo. Despite this, the posts were published within seven minutes apart from each other.

Screengrabs from Instagram posts that used the same caption. On the right, the account elsemanarioreg paired an image that did not match with the caption’s context. (Source: Instagram)

Accounts supporting Rafael Correa also shared similar photos on Instagram. Although these profiles published on different dates, both accounts @correistas and @seguidoresdecorrea (“Correa followers”) shared identical content in their timelines.

Screengrabs from two Instagram accounts involved in the takedown. These profiles shared the same photo of Rafael Correa. Both accounts, @correistas and @seguidoresdecorrea, had many similarities in their timeline. (Source: Instagram)

On Facebook, the pages “¿Y Tu? ¿No Quisieras?” (“and you? Wouldn’t you like to?”) and “Las Cosas No Son Lo Que Parecen” (“Things are not what they seem”) published identical posts within the same hour. The pages were created on July 5 and 7, 2019, respectively.

Screengrabs from Facebook pages posting identical content. Both pages were created in July 2019. (Source: Facebook)

Asset engagement on Facebook and Instagram

Approximately 400,000 Facebook and Instagram accounts followed one or more of the assets provided to the DFRLab by Facebook.

According to a query search on the social media listening tool CrowdTangle, the removed Facebook pages published 10 posts per month between January 2017 and July 2020, and garnered nearly 3,400 interactions monthly, including likes, and reactions.

Number of posts between January 2017 and July 2020 by the top 20 most active removed pages (Source: CrowdTangle)

In the first quarter of 2019, there was a peak in the number of published posts. This activity can be explained by the number of assets, at least 16 pages, created on the same year. Nevertheless, small peaks in the number of posts match with presidential campaigns, including the Ecuadorian and Chilean elections (January 2017), Venezuela’s January 2018 presidential campaign, and the 2019 Argentinian elections.

In total, these Facebook assets amassed 3.1 million interactions. Between December 2017 and January 2018, the page “Diles No a los Traidores” (“Say no to the traitors”) garnered one-third of all interactions. Despite the number of assets increasing after 2019, the volume of interactions remained low compared to previous years.

Number of interactions between January 2017 and July 2020 by the top 20 most engaged-with removed pages (Source: CrowdTangle)

In its independent analysis of the Estraterraaffiliated assets removed as a part of Facebook’s latest takedown, the DFRLab was able to corroborate many of the connections between the assets involved. Moreover, the assets were clearly linked to former government employees in Ecuador with ties to the administration of former president Rafael Correa.

While many of the assets posed as independent news entities with associated fringe websites, the content did not appear to be doctored, nor was it evidently disinformation in the strictest sense of the term. It seems, however, that this set of Facebook assets engaged in coordinated inauthentic behavior while aiming to push narratives based on progressive political movements in conjunction with numerous South America presidential elections.

Esteban Ponce de León is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Daniel Suárez Pérez is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.