Network uncovered by DFRLab and removed by Facebook linked to Honoré Mvula and his political youth organization

Cet article est disponible en français.

On August 6, 2020, Facebook announced it had removed a network of 66 user accounts, 63 pages, five groups and 25 Instagram accounts connected to Honoré Mvula and his political organization, the Force des Patriotes (FP), in the Democratic Republic of Congo (DRC).

The network was initially uncovered by the DFRLab while investigating COVID-19 disinformation in Africa. Many of the pages initially impersonated other politicians or political figures, but later rebranded and pivoted to promoting pro-Mvula content. Among the assets removed from the platform was a verified page called “Honore Mvula,” which Facebook identified as belonging directly to him.

The DFRLab uncovered the core pages in the network in April 2020, and Facebook’s investigation identified dozens of additional assets. Prior to their removal, Facebook shared a total of 63 user profiles, 51 pages, 5 groups and 25 Instagram accounts with DFRLab for analysis as part of their ongoing partnership monitoring election interference. The platform concluded that the pages were run by at least six people, some of them closely connected to Mvula.

According to a statement from Facebook:

The people behind this activity used duplicate and fake accounts to create fictitious personas, post in Groups and on Pages, drive people to off-platform sites, and manage Pages posing as independent news and fact checking entities. They also impersonated opposition and political candidates and re-posted their exact content, likely to build an audience. Some of these Pages appear to have been purchased and have gone through significant name changes over time. The Page admins and account owners posted primarily in French about news and current events, including politics, the Union for Democracy and Social Progress, government officials, political candidates, criticism of the opposition and the People’s Party for Reconstruction and Democracy. Most recently, they posted about the coronavirus pandemic, using it to build an audience before switching to political themes.

We identified the full scope of this activity after investigating information shared with us by researchers at the Atlantic Council’s Digital Forensics Research Lab. Our assessment also benefited from public reporting by independent fact-checkers at AFP and France 24. Although the people behind this activity attempted to conceal their identities and coordination, our investigation linked this activity to Force des Patriotes, a political party in DRC.

Mvula entered politics as a member of an opposition party called the Movement for the Liberation of the Congo (MLC), previously a rebel group involved in the Second Congo War. He has never held elected office. In 2019, he founded Force des Patriotes (FP), which describes itself as a “movement of young Congolese intellectuals.” He is also a vocal supporter of DRC President Félix Tshisekedi, having campaigned for him during the 2018 presidential elections.

In addition to promoting Mvula, some of the pages also spread COVID-19 disinformation. Five of the pages in the takedown had previously been included in a May 2020 investigation by France24’s Les Observateurs into COVID-19 disinformation spreading over social media in the DRC. The outlet identified two of the men operating the pages as students at the University of Kinshasa who knew each other, although the investigators opted not to identify them.

In an interview with Les Observateurs, the men said they created the pages “pour le buzz” — to see who could collect the most likes and followers by spreading sensational and false information. The DFRLab discovered that the scope of the network was much larger than what was initially covered by Les Observateurs, however, ultimately linking the assets to Honore Mvula. As the next elections in DRC are not until 2023, it is unclear whether these pages were engaging in inauthentic behavior in order to support a possible future candidacy by Mvula or other individuals supported by the fledgling party.

Impersonating public figures, then rebranding

Of the 51 pages the DFRLab analyzed, the majority had undergone a name change at least once. They started off as dedicated fan pages or pages impersonating celebrities, controversial public figures, or politicians, likely in an attempt to gain large numbers of followers. Later on, many of them rebranded as news outlets, deleted all of their previous content to start fresh, and began posting content primarily promoting Mvula.

The Facebook pages and user profiles appeared to have been the most impactful aspects of the network: the pages, for example, had a combined total of almost 1.5 million likes. In contrast, the Instagram assets appeared to have been created as an afterthought, used to promote the content posted to the network’s Facebook pages. This analysis thus focuses primarily on the Facebook assets.

One of the Facebook pages engaged in this tactic was Mvula’s own verified Facebook page. The page was created on November 25, 2016 under the name of another Congolese politician, Samy Badibanga Ntita. It went through several name changes until settling on the name “Honore Mvula” on March 20, 2019.

The page contained no references to its prior incarnations before it changed to Mvula’s name, nor why it changed its identity. The oldest content on the page was a profile picture uploaded on March 20, 2019, suggesting that its previous content had been deleted.

In a similar manner, a page originally called “Politique.cd” changed its name to “Force des patriotes” — the name of Mvula’s political party — on May 17, 2020.

It is possible that the page was originally created as a fake version of the real news website, Politico.cd, as a means of gaining followers quickly. Between March 2 and May 19, the page racked up 6,178 followers. The account even posted a link to Politico.cd on March 20 and shared posts from other pages included in the DFRLab’s analysis.

After changing its name, the “Force des patriotes” page almost exclusively shared posts from Mvula’s Facebook page, with the occasional original post or shared posts from other assets in the network. The name change did not result in an influx of likes and followers; in fact, since the DFRLab began monitoring the page on April 29, 2020, it had only gained 81 likes. One of those 81 likes was from Mvula’s own user account, which had only liked the page after it had changed names.

Other pages engaged in the network engaged in this tactic as well. “V É R I T É,” a Facebook page with over 67,000 followers, was originally created as “Mireille mukeni” on January 25, 2020, in apparent reference to Mireille Mokeni, a real person who reportedly drugged a woman and forced her to abort her child on behalf of a pastor in early 2020.

On April 3, the page updated its name to reflect the correct spelling of Mokeni’s surname before changing it yet again to “V É R I T É” and removed any traces of Mokeni, other than a few errant references made by community posts. From April 3 onward, the page dedicated itself to posting political and health-related disinformation. A number of the posts garnered tens of thousands of shares, while others were fact-checked by independent fact-checking organizations and labeled as false information.

Passing off disinformation and political propaganda as news

The majority of the pages under analysis posted content masquerading as facts or news in two main structural formats.

The first format was written to look like an urgent statement or press release from a high-profile individual. The fake content would sometimes be preceded by the word “urgent!”

Alternatively, other posts were presented as a “news flash” and included an image with a short paragraph attached. The paragraphs usually started with a flag emoji to indicate the country the news occurred in, as well as a hashtag in reference to the news topic.

The content itself was often similar. In one instance, multiple pages claimed that Congolese Minister of Higher Education Thomas Luhaka had canceled all university classes for the year. Despite the information being debunked by fact-checking organization Congo Check on April 5, the story was nevertheless reposted throughout April. In the interview with Les Observateurs, one of the young men operating the pages said his goal was to publish false information in an attempt to make that information a reality, and claimed he wanted the past school year to be counted as “null” as a result of COVID-19.

There was evidence that the pages were operating from the same bank of templates, at times uploading the same text alongside different images. On April 12 and 13, for example, two pages created posts saying that Martin Fayulu, the main opposition candidate who ran against Tshisekedi in 2018, was calling for Tshisekedi’s impeachment. The main text was a direct copy, grammatical errors included.

In several cases, independent fact-checking organizations such as PesaCheck spearheaded by Code for Africa debunked posts from some of the larger pages included in the removed assets, such as the claim that French President Emmanuel Macron would prevent Africans from travelling to France if they did not take a coronavirus vaccine. (The post had 13,000 shares and 17,000 comments and was shared to prominent groups in other countries, such as Mali, Togo, and Côte d’Ivoire).

Connections to the FP

Eight of the removed assets were directly linked to the Force des Patriotes political party: three pages named after the FP, Mvula’s verified page and his user profile, a user profile called “Force des Patriotes- usa,” and the “Honore Mvula notre choix.” group. Another group called “HONORÉ MVULA MON CHOIX” was also removed, however it only had 1 member.

A search for “Force des Patriotes” on Facebook showed at least six dedicated Facebook pages were not removed as part of the July 31 takedown, but all six pages have less than 1,000 followers in total and rarely posted any content. Four of the pages had been liked by Mvula’s user profile before it was removed.

After investigating the 63 user profiles the DFRLab had access to, it appeared the majority were either FP members, liked FP content, were friends with Mvula’s user profile, or liked Mvula’s page.

Rubbing elbows with Mvula

The DFRLab identified six young men as operators of at least 26 pages and five groups in the network. Two of the young men, who often appeared in photos together, were central: they had several duplicate profiles with different names and operated several of the pages and groups. The first primarily used the surname Emongo, while the second used either Wotsh Wembo or Wotshowadive. The URLs for the user profiles also revealed that some of them were originally likely created with different names, and later appear to have been taken over by members of this network.

Emongo and Wotsh Wembo both appear alongside Honore Mvula on photos and videos posted to Mvula’s Facebook page. On May 13, Mvula hosted a live video on his Facebook page in which he announced the winners of a competition he hosted; Emongo and Wotsh Wembo appeared beside him in the video.

The DFRLab was able to confirm their presence at the event because accounts associated with the two men also posted images from the event. A comparison of the photographs posted by Emongo and Wotsh Wembo to the 75-second video clip posted to Honore Mvula’s Facebook page showed that both men were present during the Mvula’s small prize-giving ceremony.

A selfie of Wotsh Wembo with Mvula also appeared on the Facebook story of the Joël Wotsh Wembo profile on May 14. The same image was also posted to the joelwotshwembo Instagram account on May 24, with Mvula tagged.

Two of the Emongo accounts — Brones and Browns Emongo — were administrators of a group named “Honore Mvula Notre Choix.,” which translates to “Honore Mvula our choice.” They were also among the founders of the group, along with Mvula himself and Joël Wotsh Wembo.

In a similar manner to Emongo, Wotsh Wembo also created a number of user profiles and pages that contained the same photographs of a young man, suggesting that they were potentially operated by the same person.

COVID-19 disinformation

A third profile that primarily went by the name Grass’d Gradon operated at least seven pages and one group in the network. The Grass’d Gradon user profile was the administrator and moderator of “grass’d- verité,” one of the groups removed by Facebook.

Gradon published a significant amount of disinformation related to COVID-19 on the pages he operated. In particular, he amplified debunked conspiracy theories about alleged COVID-19 vaccination programs in Africa. Some of the posts linked back to an Instagram account called grassd_verite, which subsequently changed its account handle to grassd_gradon before it was removed by Facebook.

One of the pages linked to Gradon via an email address created original content about Mvula that was subsequently shared to other pages Gradon likely operated. The page was originally named “Soraya Mpia” after the stepdaughter of Vital Kamerhe, President Tshisekedi’s former chief of staff. The page changed its name to “Afrikinfos” on June 23, and then to “Afrik.cd” before it was removed by Facebook.

Afrikinfo is a Cameroonian website described as an online news organization and has its own associated Facebook page, “Afrikinfo.net.” The “Afrikinfos” Facebook page associated with Gradon, however, was operated out of the DRC and did not appear to be directly affiliated with the Cameroonian news organization.

“Afrikinfos” also regularly quoted a source named Grace Dondji. A closer look at the URL for the Grass’d Gradon user profile showed it was originally named Grace Dondji before changing to Gradon at a later stage.

Although the DFRLab could not find evidence that Gradon had interacted with Mvula face-to-face as Emongo and Wotsh Wembo had, Mvula liked and followed the majority of pages associated with Gradon.

Several other assets were identified as part of the network, but were less strongly linked to either Mvula, the FP, or to Emongo and Wotsh Wembo. There were still some lingering traces linking them to the more central operators of the network, however. A profile named Falyala Wilondja, for example, had six pages associated with it, including one bearing the same name. At some point between May 20, when the DFRLab first started investigating this page, and its removal from Facebook on July 31, it appeared to change hands, removing a cell phone number associated with Wotsh Wembo and replacing the link with an email address associated with Falyala Wilondja.

The Wilondja profile also tagged the user Joël Wotsh Wembo in a number of images posted to its account. These clues suggested that the user profile and its matching page were associated with the operator of the Wotsh Wembo account.

The DFRLab could not find references to Mvula on either the “Falyala Wilondja” or the “Falya’s 01” Facebook pages (another page linked to the account). However, these pages did share content from pages associated with Wotsh Wembo and Emongo through prior research.

Similarly, the DFRLab identified a user that went by the name Mervedi Muanandeke as the operator of a page called “Kinshasa News.” Both user profiles linked to this name included the same images of the same young man in their profiles. Mervedi Muanandeke also posted a “behind-the-scenes” look at the “Kinshasa News” page with a link to the page, revealing him as the operator.

The About section of “Kinshasa News” also lists an email address containing the name Meve, potentially in reference to another user profile named Meve M.T that used the same images as Mervedi Muanandeke. However, the DFRLab was only able to find tangential connections between “Kinshasa News,” Mvula, and the FP, and was not able to corroborate Facebook’s findings.

Two other pages identified in the takedown, “Yedidia lomu B”12 vision de la nature” and “Sauvons LE CONGO,” functioned similarly to the other assets in the network, primarily posting information presented as news flashes.

“Sauvons LE CONGO’ shared one post by Mvula, while also sharing posts that denigrated Tshisekedi. The DFRLab was not able to identify the connections between the groups and the Mvula or the Force des Patriotes; however, one of the profiles associated with Yedidia was tagged in a post by the Falyala Wilondja profile.

Conclusion

This network of pages, groups, and accounts took concerted steps to conceal its connection to Honore Mvula and his political party, the Force des Patriotes. Many of the pages involved engaged in deceptive audience-building tactics: they initially presented themselves as representing other politicians and public figures. Once a sufficient audience was built, they rebranded to post pro-Mvula content.

Several of the pages involved had already attracted attention for spreading COVID-19 disinformation in the DRC, to the extent that a popular French outlet had published an investigation on the pages’ operators. The DFRLab’s research, however, revealed that the network was more expansive than originally thought, and also uncovered its political roots.

Tessa Knight is a Research Assistant, Southern Africa, with the Digital Forensic Research Lab (@DFRLab) and is based in South Africa.

The DFRLab team in Cape Town works in partnership with Code for Africa.

Follow along for more in-depth analysis from our #DigitalSherlocks.