The social network took down assets connected to the European Solidarity party and NGO Sprava Gromad

On January 12, 2021, Facebook announced that it had removed a network of assets connected to the Ukrainian political party European Solidarity, as well as the NGO Sprava Gromad. Most of the pages presented themselves as focused on regional news; others were either patriotic or satiric pages that mocked the Ukrainian President Zelensky.

In its announcement, Facebook stated:

The people behind this activity used fake accounts to create fictitious personas, evade our enforcement, manage Pages, and post in Groups named after cities in Ukraine. They also shared content from official Pages of political parties and politicians and liked and commented on other people’s posts to make them appear more popular than they were. This network posted in Ukrainian and Russian about news and politics in Ukraine, including supportive commentary about European Solidarity and its candidates, NGO Sprava Gromad, former President Poroshenko and criticism of President Zelensky. Some of this content was rated false by local fact-checkers.

We found this activity as a result of our internal investigation into suspected coordinated inauthentic behavior in the region. Although the people behind this network attempted to conceal their identities, our investigation found links to individuals associated with both the European Solidarity party and Sprava Gromad, an NGO in Ukraine.

There was open source evidence of both coordination and inauthenticity among the assets. Whereas the majority of pages in the set published primarily local news from multiple regional outlets, most of them also managed associated groups where pro-European Solidarity content was published. Within the set, the DFRLab identified multiple accounts that used profile pictures stolen from other sources, accounts using the same person’s pictures, alongside the real accounts of people connected to the NGO Sprava Gromad, as well as the youth wing of the European Solidarity party.

Ukraine conducted local elections on October 25, 2020. The European Solidarity party won 10.73 percent of all seats in local councils. The party identifies as liberal conservative and is in opposition to Zelensky’s majority. The party is organized around ex-President Petro Poroshenko, who lost re-election to Zelensky in a landslide.

Sprava Gromad and bloggers amplification

The DFRLab analyzed the public content of 34 pages, from which all except one, were created after December 2019. They actively promoted content from each other, amplifying patriotic bloggers from and outside the set, as well as Sprava Gromad posts, activities, and events. A few pages called for supporting the NGO.

Sprava Gromad (Громадська Організація “Солідарна Справа Громад”) is an active Ukrainian NGO with an anti-Zelensky political stance. For example, they have released a satirical calendar for 2021 with Zelensky’s pictures that can be bought on their website. Their Facebook page has over 25,000 likes and posts information daily.

Some of the pages that did not have a specific region in its name shared general patriotic news, memes, or bloggers posts. Some pages shared patterns of posting time and content with other pages, as in the example below.

Asset engagements on Facebook

The DFRLab used the social media listening tool CrowdTangle to query publication patterns and statistics of the set’s pages. In 13 months of operation, the removed pages amassed almost 1.5 million interactions, including reactions (likes, hearts, etc), comments, and shares.

The removed pages published around 9,500 posts since 2019, with 83 precent of posts split between links to external publications and photos.

The most shared non-Facebook domain addresses were prm.ua and suspilne.media. The former is a TV channel with positive sentiment towards ex-President Poroshenko, and suspilne.media is an Ukrainian public broadcaster that has relatively neutral coverage. The other sites, apart from the BBC, are local media that report on events in different parts of Ukraine.

Most pages aimed for local audiences and created groups for community discussion; this sharing pattern confirms the regional focus of the pages taken down, suggesting these pages aimed to provide local news with some national coverage as well.

Removed Facebook accounts

The DFRLab assessed the public content of 25 user accounts removed in the takedown. We identified several pages of active Sprava Gromad members or supporters, and multiple inauthentic pages. Many of the taken down pages were friends with each other.

Among the real accounts were Mykhailo Palamarchuk, member of European Solidarity party, who ran for Ternopil city council, and Yulia Kravchenko, member and candidate of the same party for Mykolaiv city council. According to the Multiple Tools for Facebook Chrome extension, Mykhailo was an admin of four Sprava Gromad groups in Ternopil region, and Yulia was an admin of NGO’s Mykolaiv group.

Many accounts appeared to be fake. They posted little to no content, used stolen profile pictures, featured other people from the list as friends, and were members of multiple groups. The profile photos were stolen from various websites, most of them non-Ukrainian.

Three accounts with different names — Valeria Naumenko, Maria Naumenko, and Natasha Lozinskaya — had visually similar persona on their profile pictures. The Instagram account of user with the name Valeria Naumenko was also in the set and now defunct.

Another account, Bogdan Sterneychuk, used the same cover photo as Valeria Naumenko. According to a reverse image search, the photo was not previously posted anywhere else, suggesting it was a personal photo and possibly showing these two accounts were linked.

Groups and pages

According to the Chrome extension Multiple tools for Facebook, Valeria Naumenko was an admin of the still operating group They Can’t Break Us, which currently has only a moderator with a frame of Sprava Gromad on a profile picture. Natasha Lozinskaya administered the now-defunct group Charming Rivne, a local group that posted local and patriotic content. The third person, Valeria Naumenko, was an admin of six now-defunct groups Ternopil Gatherings, Uman ❤️ Sofiya, Poltava City / Martial dumplings!, Crazy Melitopol, Kharkiv Chaotic Rhythm, and Kramatorsk Rules. Each group gathered several hundreds of followers, with Ternopil Gatherings having more than 1,300 followers. The groups focused on local news and chatter and covered cities from all parts of Ukraine. Two other accounts were members of the groups administered by Valeria.

Overall, most accounts like same or similar pages with few exceptions, where users joined 150+ groups. DFRLab aggregated the data from now-defunct accounts and found that among the most popular within this set groups at least one of admins was among deleted pages. Moreover, some of the groups are still running with fewer or no admins.

Most groups shared political and anti-Zelensky content, usually sharing bloggers’ posts and videos to the groups’ feed. Regional groups from the set were a tool of the pages that aimed to gather and engage local audiences, with accounts taken down being both members and moderators of these groups.

The overall content populated in the removed pages showed several trends. As most of the groups were created with a specific city or a region in mind, they primarily shared neutral information regarding those cities, such as local advertisements or news, yet three specific topics were also prominent: patriotic content, anti-Zelensky content and limited pro-Poroshenko content. The last category was not as prominent, yet Poroshenko was usually shown as a patriotic figure, supporting the Ukrainian military. The DFRLab already reported in November 2020 on the use of locally-oriented Facebook groups to spread specific narratives in Ukraine, which was a part of another Facebook takedown.

Conclusion

In the latest Facebook takedown concerning Ukraine, the DFRLab found numerous indicators of inauthentic activity among the assets that were removed. A number of accounts had stolen photos used as their profile images, were highly interlinked together and a number of them were administrators or members of the taken down groups and pages. Pages and groups were created around specific towns and regions, spreading both local news, but also patriotic, anti-Zelensky content, with some pro-Poroshenko content as well. Such tendencies have been seen in previous Facebook takedowns, where Ukrainian Facebook groups were created to share local information or two bring together local communities are used for specific narrative dissemination.

Analysis also shows links to the Ukrainian NGO Sprava Gromad and European Solidarity political party. Signs of both coordination and inauthenticity among the assets were found, with some running more than one group or page actively disseminating specific narratives, often times targeting President Zelensky.

Roman Osadchuk is a Research Assistant, Eurasia, with the DFRLab.

Lukas Andriukaitis is an Associate Director with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.