Inauthentic assets posted pro-Trump, Christian imagery, and QAnon content

On August 6, 2020, Facebook announced the removal of a network of assets based in Romania engaged in coordinated inauthentic behavior and targeting the United States. Prior to their removal, the DFRLab had access to a subset of assets — two pages, 22 individual Facebook accounts, and 78 Instagram accounts — that largely posted content supporting U.S. President Donald Trump. A few of the assets also referenced QAnon, the sprawling far-right conspiracy theory that has moved from the fringes to the mainstream in recent months. Although the conspiracy was not a significant focus of the network, its inclusion is noteworthy given NewsGuard’s recent report on QAnon’s spread to Europe.

In a statement, Facebook indicated:

The people behind this network used fake accounts — some of which had already been detected and disabled by our automated systems — to pose as Americans, amplify and comment on their own content, and to manage Pages including some posing as President Trump fan Pages. This network posted about US domestic news and events, including the upcoming November election, the Trump campaign, support for the campaign by African Americans, conservative ideology, Christian beliefs, and the QAnon network known to spread fringe conspiracy theories. They also frequently reposted stories by American conservative news networks and the Trump campaign.

The open-source clues this network left behind as to its operators or motivations were sparse — but there was ample evidence that it was misrepresenting itself and engaged in inauthentic amplification of pro-Trump messages and imagery. The overall impact of this effort appears limited, as many of the accounts primarily interacted with one another’s posts. Some user profiles on both Facebook and Instagram, however, had built up several thousand friends or followers. While many of these followers appeared inauthentic, others seemed like real people. Overall, the network appeared to be targeting pro-Trump conservatives in the United States.

The many versions of David Adrian

A persona named “David Adrian” appeared to be central to the network, with several assets bearing variations of the name across Facebook and Instagram. It is against Facebook’s Community Standards to maintain more than one personal account.

On his primary Facebook account, David Adrian primarily posted official Trump campaign content. He also frequently posted memes to a pro-Trump group called “Trump Train,” a group he apparently joined three weeks ago.

David Adrian consistently portrayed himself as a pro-Trump conservative — he even maintained an account on Parler, a “pro-free speech” conservative social network that has recently gained notoriety as a number of high-profile Republicans have allegedly reduced their Twitter use for the supposedly more free-speech environment of Parler. On Twitter, a matching account of David Adrian had been suspended, but the DFRLab found a cached version. He tweeted pro-Trump and Christian content and participated in “Trump Trains,” a social media follower growth hacking strategy that independent researcher Erin Gallagher has previously documented as unique to pro-Trump Twitter. The fact that he had a nearly identical number of followers (8,911) and accounts he was following (8,910) indicated that this growth hacking strategy worked — for nearly every follow, he got a follow-back.

There were other signs of inauthenticity across David Adrian’s accounts. For example, while on Facebook, he indicated he was from and living in Romania, on Twitter, he indicated he was in “Montana, USA.” The DFRLab could not confirm that “David Adrian” was a real person — other than his Parler and suspended Twitter account, there were no corroborating records of him online — either in Romania or in Montana, USA. There was also no evidence, however, that his profile content was stolen from somewhere else. As of publication, Adrian’s Parler account is still active and posting content.

Coordinated behavior

In addition to the multiple David Adrians on Facebook, other Facebook profiles in the network had similar names, such as “David White,” “David Black,” “Dave Black,” “Adrian Adrian,” and “Ady Adrian.” Although some of the profiles did not have public posts, several of the profiles that did largely shared pro-Trump content and a couple shared Christian imagery.

There was some coordinated behavior among many of the accounts, including accounts liking each other’s pictures, identical pro-Trump profile imagery, and friendship ties.

Some of the accounts in the network had posts with numbers of shares that were disproportionate to the other engagement they received. For example, one profile, Fred Davis, had 40 shares on one picture, but the picture only garnered 15 reactions and four comments.

Pro-Trump pages

The Facebook pages posted and amplified pro-Trump content. Two of the pages, @MAGAPOTUS45 and @MAGAPOTUSDJT45, almost exclusively shared posts from Trump’s official page, with occasional shares from the official White House page. Both pages were active through July 2018.

Another page, “We Love Our President,” was created in mid-July on Facebook, but had a matching Instagram with over 3,000 followers.

Pro-Trump content on Instagram

Out of the 77 Instagram accounts the DFRLab analyzed, only 15 accounts had public posts the had content the DFRLab could access. A majority of the Instagram accounts — seventy 70 percent — had no posts; it is unclear if these accounts deleted previously existing posts or if the accounts never posted at all. Despite the lack of posting, many of these accounts indicated they were pro-Trump through their bios, profile pictures, or handles like “4moreyears_trump.”

One Instagram account, “blackpeoplevotefortrump,” had two posts, both of which were allegedly of pro-Trump Black people.

Some of the assets posted content that seemed extraneous to the general pro-Trump nature of the network. For example, one account was devoted solely to the television show 13 Reasons Why; another, “veteransfortrump45,” posted more general content about different national days than about political affairs. These accounts may have been intended for audience-building purposes.

QAnon content

On Instagram, several accounts in the network posted QAnon content or invoked the conspiracy theory in their handles. These accounts all had only a few dozen followers each, but they were tied to rest of the network via their follower-following relationships. Curiously, the QAnon accounts were primarily active in 2018 to early 2019, and largely stopped posting after that time.

This network largely posted pro-Trump memes and amplified Trump campaign pages, adding little, if any, original commentary that would indicate the operators’ objectives. It was primarily active in the early half of 2018, but some profiles on both Facebook and Instagram continued to post actively until their removal. Its consistent and enduring devotion to amplifying official pro-Trump campaign content is curious, given Facebook’s attribution of the network to Romania.

Zarine Kharazian is Assistant Editor with the Digital Forensic Research Lab (@DFRLab).

Alyssa Kann is Research Assistant with @DFRLabthe Digital Forensic Research Lab.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.