The social network removed content connected to Strategic Culture Foundation, a disinfo network amplifying anti-Western sentiment

On September 24, 2020, Facebook removed a small network of Russian propaganda assets engaged in coordinated inauthentic behavior. Facebook attributed these assets — including six pages, 23 user accounts, and eight Instagram profiles — individuals in Russia, including those associated with Russian intelligence services. The network included and amplified the Strategic Culture Foundation, which often highlights Western conspiracy theorists and obscure fringe thinkers.

The DFRLab was able to corroborate the connections between the assets and among some of the off-platform websites. As reported by the DFRLab in previous takedowns, Russian-linked disinformation campaigns have focused on a range of topics, including the military conflict in Ukraine, the Syrian civil war, NATO, U.S. elections, and more recently, the COVID-19 pandemic.

The content disseminated by these assets followed the same pattern. Pages mostly amplified anti-Western sentiment in both English and Russian, targeting mainly the United States and NATO countries. Some of these assets date back to 2010 and 2011, although the most recent page was created in 2014. The pages primarily shared links, amplifying news from websites of Russian fringe outlets.

In its announcement of the takedown, Facebook stated:

This network originated in Russia and focused on global audiences, Russia’s neighboring countries including Belarus. We identified several clusters of connected activity that used a combination of authentic and fake accounts — some of which had been already disabled by our automated detection systems — to create fictitious personas, post and comment on content, manage Pages, amplify their content, and drive people to off-platform sites posing as independent journals. These fake personas posed as editors and researchers to solicit articles for these websites. This network posted primarily in Russian and English about news and current events, including protests and elections in Belarus, Russian and Ukrainian politics, geopolitical conspiracies, Russia-NATO relations, Russia’s relations with neighboring countries, and criticism of US foreign policy, socio-economic issues in the US, and US political candidates on both sides of the political spectrum.

We found this activity as a result of our investigation into the suspected coordinated inauthentic behavior linked to our previous enforcement in July 2019. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to individuals in Russia, including those associated with Russian intelligence services.

What is the Strategic Culture Foundation?

According to its website, the Strategic Culture Foundation aims to provide “a platform for exclusive analysis, research, and policy comment on Euroasian and global affairs.” In August 2020, the U.S. Department of State published a report linking the outlet to Russia’s Foreign Intelligence Service (SVR), stating that it “plays a central role among a group of linked websites that proliferate Russian disinformation and propaganda,” including conspiracy theories in both English and Russian. The journal’s emphasis on amplifying Western fringe voices allows the journal to obscure its affiliations with Russian intelligence services while continuing to disseminate pro-Kremlin narratives to a Western audience.

The report highlights that the foundation originally published content only in Russian, adding English-language content in September 2010. The removed Facebook assets linked to the Strategic Culture Foundation was created earlier that year on May 28, 2010, according to page transparency data. The Facebook page of Strategic Culture Foundation had the most followers of the taken down assets, totaling up to 28,807 people.

A search using the domain analytics tool SimilarWeb shows the role of the foundation’s Facebook page to draw website traffic. Around 12 percent of the traffic originated from social networks, and more than 60 percent of this traffic came from Facebook.

The SimilarWeb results also indicate that the main audience for the site is from the United States, Canada, and Germany.

The network

Together with the Strategic Culture Foundation, a number of other smaller pro-Kremlin online media outlets were taken down. Followers of the pages ranged from a couple hundred to several thousand: Route Magazine (537 followers), Pravda Today (3,310 followers), and Научное общество кавказоведов (“Scientific Society of Caucasian Studies”) (1,474 followers). Two pages had larger following, including ОДНА РОДИНА — Россия и Украина (“One nation — Russia and Ukraine”) (9,036 followers) and Фонд стратегической культуры (“Strategic Culture Foundation”) (13,267 followers).

These outlets varied slightly on the topics they focused on, yet all of them amplified pro-Kremlin narratives, including supporting Belarusian President Lukashenka, calling Ukraine’s government illegal and fascist, and blaming Ukraine for war in Donbass. Among the most prominent was the page ОДНА РОДИНА — Россия и Украина (“One nation — Russia and Ukraine”), which primarily dealt with anti-Ukrainian propaganda. This page was quite active, posting at least a few original posts per day. Engagement was limited, though, usually receiving up to a dozen likes, with a few exceptions that received over a hundred.

Another page, Фонд стратегической культуры (“Strategic Culture Foundation”), was even more active, posting an original post every couple of hours. This page offered opinion pieces and articles on various countries, adhering to common pro-Kremlin narratives, claiming that Latvia’s economy “shot itself in the foot” because of its geopolitical choices, and that Lithuania is leading the charge in the EU to sanction Belarus. The page also promoted the idea that the United States is going to face massive public unrest during the presidential election.

A few of the assets posted COVID-related content, amplifying conspiracy theories that falsely alleged the virus was produced in a laboratory as a biological warfare agent, or more recently, narratives that alleged vaccines may contain “surveillance technology.” Some posts also claimed that Bill Gates is at the vanguard of these efforts — a common trope found in COVID-19 conspiracy theories around the world.

Other coronavirus-related posts included narratives on U.S. sanctions on Iran and how these measures have worsened the pandemic in the country.

Connections among Facebook assets

To explore the relationship between the Facebook user accounts, the DFRLab conducted a social network analysis on friendship connections. This analysis only took into consideration connections between the 23 profiles analyzed by the DFRlab prior to the takedown.

The resulting graph showed clear connections between the removed user accounts. The account “Vladimir Maximenko” had nearly 4,200 friends, seven of which were users included in the removed assets. This account was the most connected user among the analyzed profiles, followed by “Арина Цуканова,” (“Arina Tsunkanova”) and “Ira Bubnova,” whose Instagram profile also appeared in the removed assets.

The research was not able to identify the precise user accounts that created the removed pages. However, the DFRLab analyzed in a second graph which of the removed pages received likes by the user accounts involved in the takedown. This process found that only 14 out of the 21 profiles liked at least one of the removed assets. Although this does not suggest they necessarily created the pages, it could indicate a degree of connection between the Facebook assets and user accounts.

Of all the analyzed users, the account “Andrey Areshev” liked the most removed pages, followed by “Dmitry Smirnov.” Both accounts liked five and four out of the seven assets, respectively. These accounts appear as the most connected assets in the friendship network as well.

This network of user accounts operated using a combination of duplicate accounts and authentic profiles, which more likely were used also for personal purposes. Most of these users amplified content from off-platform sites linked to the Facebook pages, including strategic-culture.org, fondsk.ru, and orientalreview.org.

For instance, the account “Irina Rezinkina” shared the same profile picture as the account “Арина Цуканова” (“Arina Tsukanova”). The latter, however, shared content from another removed user that shares similar images posted by the former.

This person appeared to be running additional accounts from the set that Facebook took down. All of them had various locations as their addresses, varying from Kyiv to Yaroslavl. These accounts had varying numbers of friends and followers as well. For example, “Арина Цуканова” had 1,116 friends and 168 followers, while “Irina Rezinkina” had only 20 friends.

“Eva Merkurieva” was identified as another account most likely run by the same person. “Eva Merkurieva” had the profile picture of the same person as “Арина Цуканова.” Merkurieva posted the same post about Sviatlana Tsikhanouskaya and tagged Арина Цуканова in it.

The profile of “Фиона Армани” (“Fiona Armani”) also appeared to be connected. In her photo, Фиона used a photo of a Newfoundland dog wearing the same collar as the dog in “Eva Merkurieva’s” and “Irina Rezinkina’s” photos.

“Фиона Армани” had 340 friends, while “Eva Merkurieva” had 13,625 followers — the most of any in the network — and also received significant engagement on her posts.

While the “Фиона Армани” and “Irina Rezinkina” accounts had barely any posts, “Eva Merkurieva” and “Арина Цуканова” were highly active, tagging each other in most of their posts. Most of their recent posts were targeting Belarusian protesters and supporting President Lukashenka. Some of the posts called the events “Belomaidan,” alluding that the events in Belarus are similar to what happened in Ukraine under the influence of the West, a common pro-Kremlin narrative.

Most of the removed assets had few followers or friends and few likes on their posts, with a few exceptions. One exception was “Andrey Fomin,” who is the Founder and Editor of Oriental News, a pro-Kremlin media outlet that was taken down by Facebook. Fomin’s account wrote short posts, but primarily was used to amplify articles by Oriental News and other pro-Kremlin outlets, such as Sputnik News and RT. The last post on this account was made in March 2018, suggesting that the account was not recently active, even though the Oriental News page continued posting on a frequent basis and had 7,869 followers.

Additionally, most of the accounts were used primarily for amplification purposes. These accounts shared articles from the outlets, often adding a quotation or a comment to go along with the post. In most cases, these posts received no more than a dozen engagements.

Off-platforms connections

The removed pages mostly posted content in the form of links, sharing news and articles from the Russian off-platform outlets linked to the assets, including strategic-culture.org, fondsk.ru, orientalreview.org, odnarodyna.org, and pravdatoday.info. These pages, however, also included links from other external websites, some of which have been previously analyzed by the DFRLab for pushing narratives linked to conspiracy theories and disinformation.

Among these websites was globalresearch.ca — the Centre for Research on Globalization — a pro-Kremlin and anti-NATO site, and infowars.com, a site run by conspiracy theorist Alex Jones, who has been banned by multiple social network platforms, including Facebook, Twitter, Instagram, and YouTube, for violating community standards.

The following graph shows the top 15 most shared domains across the removed pages.

The active off-platform sites — strategic-culture.org and orientalreview.org — used WordPress as their content management system. The DFRLab used the WordPress security scanner WPScan to explore the users behind these platforms.

The results show that one of the assets involved in the takedown, a user account called “Andrey Areshev,” is also one of the usernames behind the website strategic-culture.org. This finding shows evidence of the connections between users and Strategic Culture Foundation. According to Strategic Culture Foundation website, Andrey Areshev is a research fellow at the Centre for the Central Asia and Caucasus Studies, Institute for Oriental Studies.

A second scan of on orientalreview.org did not show results that match the analyzed accounts. However, it identified usernames connected to the removed profiles. The names Andrew Korybko and Leonid Savin appeared as WordPress users for Oriental Review. These individuals are also friends on Facebook with four of the removed user accounts.

Asset engagement on Facebook

Approximately 65,000 Facebook accounts followed one or more of the assets involved in the research.

According to a DFRLab’s search query using the social media listening tool CrowdTangle, the removed Facebook pages published 172 posts per month between January 2011 and September 2020, and garnered roughly 4,500 interactions monthly, including likes, comments, shares, and reactions. In total, these Facebook assets amassed around 523,000 interactions on the platform.

Between January 2011 and September 2020, the removed pages shared more than 20,000 posts. Around 97 percent of these posts included links to external domains. According to the CrowdTangle, the assets increased their posting volume significantly after January 2018.

More recently, in September 2020, the posts that gathered more engagement on Facebook linked mostly to the fondsk.ru and strategic-culture.org websites. As of September 22, these posts garnered 2,717 interactions and 3,728, respectively. Some of the content targeted British politician Tony Blair, as well as Israel and Germany.

Esteban Ponce de León is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Lukas Andriukaitis is an Associate Director with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.