Coordinated and inauthentic Facebook assets amplified content discrediting Russian opposition leaders

In September, Facebook removed 40 user accounts, 17 pages, one group, and six Instagram accounts, all of which originated in Russia, for coordinated inauthentic behavior. The assets were connected to the ruling United Russia party and posted content designed to support the government and discredit the opposition.

With increasing frequency, political actors are undertaking social media campaigns using sockpuppet accounts and various social media manipulation techniques to bolster their candidates and attack opponents. In 2019, the Oxford Internet Institute found that political actors in 26 countries used what it referred to as computational propaganda as a means of suppressing political opponents and undermining dissenting opinions. Such actions are intended to give social media users the impression that whatever is being shared is a widespread belief, when in fact it is being spread by a small number of individual accounts or users. Russia, in particular, uses computational propaganda to influence local and global audiences.

In its statement on October 8, 2020, Facebook said:

The people behind this activity used fake accounts — some of which had already been detected and disabled by our automated systems — to post content and manage Pages posing as independent news entities. Many of these Pages have been dormant for some time. This campaign amplified and commented on other people’s posts about the United Russia party and local politicians in Voronezh. The people behind this activity posted about local and regional elections, various reconstruction projects in Moscow, and criticism of United Russia’s political opponents and local candidates.

The DFRLab had access to a subset of the removed assets and found that a majority of them seemed to be sockpuppets — fake accounts bearing a fictitious identity controlled by an individual or a group of users. In doing so, they attempted to conceal their real-world identities by using photos stolen from elsewhere on the internet. The DFRLab found some evidence indicating that individuals linked to this network worked for a regional branch of United Russia in Voronezh city.

Inauthentic accounts

The Facebook accounts involved in this network have been around for at least five years. Prior to the 2016 parliamentary elections in Russia, for instance, some of the removed accounts posted identical, pro-United Russia party content over a short time period.

On June 27, 2016, Russian President Vladimir Putin spoke at the plenary session of the 15th Congress of the United Russia party, during which the party approved a pre-election platform and the candidates for that year’s State Duma elections. On the same day, some of the removed accounts posted a link to the transcript of Putin’s speech from the party’s website, while others shared the party’s post of the transcript to its official Facebook page.

The removed accounts also engaged in political trolling by spreading inflammatory content about Putin’s political opposition, with a particular verve for attacking high-profile critics Alexei Navalny and Mikhail Khodorkovsky. The accounts pushed a narrative that Mikhail Khodorkovsky is a murderer and the he belongs in jail. In 2016, they amplified Russia’s request to Interpol asking it to search for Mikhail Khodorkovsky and charge him with taking out a contract for the murder of Vladimir Petukhov, who was mayor of Nefteyugansk city at the time of his killing. Interpol refused Russia’s request, however, saying that it “did not correspond with the organization’s rules.”

The Facebook accounts in question also accused Alexei Navalny of serving the West and of receiving money from Western countries in order to pay his personal debts. (On August 20, 2020, Navalny was hospitalized for what has since been determined to be poisoning by the chemical agent Novichok, leading some to conclude the Kremlin to have been behind the incident.) The accounts published similar anti-opposition posts in a similar timeframe, potentially indicating coordination between them.

The inauthentic network also tried to bolster certain points of view and influence discourse around local civil affairs. For example, the removed accounts posted manipulative content about an ongoing large-scale urban demolition project adopted by the Moscow government in 2017. The main objective of this project was to resettle and demolish old buildings comprising up to 10 percent of Moscow’s housing, which would also entail forcibly relocating approximately 1 million people to make way for taller buildings on the same land. This project drew many opponents within Russia, and residents of the apartments designated for demolition organized several mass protests against it. Moscow residents worried that this project served only the interest of the construction lobby and would adversely affect everyday people’s lives.

In an attempt to influence public opinion and create an illusion of consensus, the removed accounts posted an identical video in which a woman expresses her satisfaction with the fact that her old house would be demolished and she would get a new apartment. Posts with this video contain different descriptive texts, all of which pushed a single narrative that living in old Soviet-era houses in Moscow is very difficult for people, and moving to new houses would inevitably improve their living conditions.

As a means of hiding their inauthentic nature, many of the accounts featured profile pictures stolen from elsewhere on the internet, providing camouflage and allowing them to appear as genuine accounts. The DFRLab found numerous instances of these photos using Google Image Search.

Moreover, the DFRLab identified individual accounts within the subset that appeared to belong to real people connected to the United Russia party. One of them, for Victoria Batunina, posted her latest job position — that of social media marketing manager of the United Russia party branch in the city of Voronezh– to the account introduction. Another account, for Polina Strizhachenko, indicated in her Facebook bio that she worked as a press secretary for the United Russia party. Her current job position said that she worked for Kremlin-funded RIA News Agency in Voronezh. A third seemingly real account belonged to Anzhelika Melnikova, whose job information was not included in her Facebook intro section, but the DFRLab found photos of her that nevertheless demonstrated her connection to the United Russia party. Melnikova attended a gathering of party members in 2017, from which she uploaded photos to her Facebook and Instagram accounts. Facebook also removed Instagram accounts for both Melnikova and Strizhachenko.

Inauthentic Facebook pages

One of the pages, Open Reporter, positioned itself as a news agency but posted mostly pro-Kremlin, anti-opposition content. The page had 36,045 followers at the time of removal and focused on sharing content intended to discredit Navalny. It mainly shared articles from its website, Open Reporter. Engagement with the posts shared to the Open Reporter page, however, was close to zero.

The content of the narratives discrediting Navalny focused on three major topics. The first was a claim that Russian opposition parties do not support Navalny’s “Smart Voting” strategy, which is designed to mobilize support for registered candidates in each constituency who are the most competitive, who are not associated with the local mayor’s office, and who have the best chance of defeating the United Russia candidate. The articles also claimed that Navalny’s strategy does not take into account either the experience, electoral rating, or policy platforms, but instead selects people on the basis of their loyalty to him.

Another narrative pushed in the shared articles claimed that Navalny personally profits from elections. In particular, they accused the opposition leader of charging fees from people who want to be the candidates under his Smart Voting project.

The final narrative attempted to discredit Navalny’s inner circle. Articles claimed that Navalny is surrounded by schoolchildren, neo-Nazis, individuals with criminal records, and members of destructive sects, and that, if the opposition leader’s Smart Voting candidates were to win elections, it would raise them to high positions. Writ large, the Open Reporter articles accused Navalny of using Smart Voting as an instrument for undermining Russian statehood.

Another page in the set, also positioning itself as news outlet, was Блок (“Block”), which had a mere 37 followers and no post engagements. The page mainly shared Instagram videos critical of Navalny.

The associated Instagram page with the same name garnered 110 followers and 185 posts by the time of its removal. A majority of its posts were dedicated to criticizing Navalny, though some focused on other Russian opposition leaders. The posts mostly received fewer than 10 engagements per post.

Both the Facebook and Instagram page for Блок were connected to an external website with an identical name, which publishes articles discrediting Navalny and other Russian opposition leaders.

Out over his Zaborovskijs

A WhoIs query showed that Block-ru.com was registered by a person by the name of Valerij Zaborovskij from a Moscow-based IP address.

An analysis of the page source code for Block-ru.com revealed that the site shared a Google Analytics code with Open-reporter.com. In addition, Block-ru.com was hosted on a Russian IP address alongside five other websites, indicative of either a dedicated hosting or dedicated server arrangements, as shared hosting would typically reflect hundred of domains using the same IP address rather than just a handful. Open-reporter.com, Block-ru.com, and antimaidan.ru (and variations with different top-level domains) were all hosted at the IP address 37.140.199.155.

Open-reporter.com, Block-ru.com, and antimaidan.ru are also all registered news media entities in Russia, despite a lack of fact-based reporting and relatively basic design. The websites’ registrations with the Russian government also all showed that “Заборовский В.В.” (“V.V. Zaborovskij”) was the operator of the websites.

Backlink searches for these websites also identified Zaborovskij’s Telegram channel and now-suspended Twitter account, both of which linked to content published on Antimaidan.ru or Block-ru.com. A profile named Zabar1986 posted similar links to Open-reporter.com, Block-ru.com, and Antimaidan.ru on Cont.ws, a Russian blogging platform. The DFRLab has covered Cont.ws on numerous prior occasions, including as a part of its Secondary Infektion report and a prior Facebook takedown.

A Facebook user account by the same name, Valerij Zaborovskij (“Валерий Заборовский”), also included a number of links to antimaidan.ru. At the time of writing, the account remained active.

Zaborovskij appears to be featured on Myrotvorets (“peacemaker”), a Ukrainian platform that investigates national security-related crimes and misbehavior in Ukraine that has also been the subject of a UN High Commissioner for Human Rights investigation. The website has also doxxed a number of journalists, politicians, and other noncombatants, putting their safety at risk. The DFRLab has previously written about the problematic nature of the website.

With that in mind, a phone number on Zaborovskij’s Myrotvorets profile did match one found in the WhoIs search, pointing toward the likelihood that the two are the same.

Using phone contact data, the DFRLab also identified that Zaborovskij held a number of positions with close ties to the ruling United Russia party. For example, he was at one point listed as an assistant to State Duma Deputy Dmitry Vladimovich Sablin, who heads the Patriotic Platform for United Russia. Zaborovskij was also listed as an assistant to Ilias Mercury, a pro-Kremlin blogger and participant of the anti-Maidan movement described by The Insider, Russia in 2015 as “under the control of the [Putin] Administration.”

Zaborovskij also acted as media liaison for the Battle Brotherhood, a Russian military veterans organization, for which Sablin is also first deputy chairperson. Sablin was also credited as one of the founders of the anti-Maidan movement in 2015, alongside the leader of the pro-Putin motorcycle club “The Night Wolves” and Cossack organizations.

The aggregate effect of all these details — with a particular emphasis on his connections to both the Block-ru and Open Report websites, for which pages with the same name were removed as a part of this takedown— indicate that Zaborovskij, at minimum, was possibly associated with the Facebook assets removed during this takedown, though the extent to which he was involved is unclear.

In the end, Facebook removed a network that, among other things, undertook a dedicated political trolling campaign in order to turn public opinion against the leaders of the Russian opposition, with a particular focus on the recently poisoned Alexei Navalny. The United Russia party also used this infrastructure to support government’s social media campaigns and amplify similar messages and narratives in order to make them appear more organic and widespread.

UPDATED (10/9): Added additional context about the problematic content of Myrotvorets.

Givi Gigitashvili is Research Assistant, Caucasus, with the Digital Forensic Research Lab.

Eto Buziashvili is a Research Associate, Caucasus, with the Digital Forensic Research Lab.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab.

Michael Sheldon is a Digital Forensic Research Associate with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.