Inauthentic assets focused on domestic audiences promoted a Quintana Roo political candidate and attacked opponents
By Esteban Ponce de León
On April 6, 2021, Facebook took down a network of assets engaged in coordinated inauthentic behavior focusing on Quintana Roo, a South Mexican state along the Caribbean Sea. According to the DFRLab’s independent research, the assets showed connections to the MORENA political party in that state, including its general secretary Jorge Parra Moguel and Marybel Villegas Canché, a political candidate running for mayor of Benito Juárez, a local municipality.
The DFRLab had access to 18 pages, 71 Facebook user accounts, and seven Instagram accounts before the removal. Some of the pages in the network presented themselves as independent news outlets and NGOs, while most of the removed Facebook user accounts engaged with the pages’ content.
In its announcement of the takedown, Facebook stated:
The people behind this activity used fake accounts to post, comment and manage Pages. They also commented on content posted by official Pages of various candidates in the legislative election. The people behind this campaign posted in Spanish about news and current events in Quintana Roo, including the MORENA party, senator Marybel Villegas Canché, and criticism of her opponent Mara Lezama. They also posted about public consultation related to the water supply situation in various municipalities, including corruption allegations related to one of the water services providers. This network was early in its audience building when we removed it.
We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region. Although the people behind it attempted to conceal their identities and coordination, our investigation found links to individuals in the state of Quintana Roo in Mexico.
Targeting Quintana Roo’s 2021 elections
On June 6, 2021, Mexico will hold federal and local elections. Citizens from Quintana Roo will elect mayors and members of local administrative boards, including city council members.
In the municipality of Benito Juárez, where the popular tourist city of Cancún is located, Senator Villegas Canché and the current mayor seeking re-election, Mara Lezama, are both seeking the mayoral nomination on behalf of MORENA, Mexican President Andrés Manuel López Obrador’s political party.
Most of the removed pages in the network promoted content supporting political pre-candidate Villegas Canché, as well as the political activities of MORENA’s general secretary in Quintana Roo, Jorge Parra Moguel. The removed pages also posted criticism of incumbent candidate Mara Lezama, highlighting links to corruption activities and illicit enrichment.
Some of these pages were created either on the same day or within a few days of each other. In total, these Facebook pages amassed more than 12,500 likes and around 15,000 followers. The most liked pages were “Unidos FUERA Aguakan” (“Together get out Aguakan”), followed by “Resultados Hoy Quintana Roo” (“Results Today Quintana Roo”). The former posted and amplified content about complaints on Aguakan, a private company that provides services on drinking water, sewerage, and sanitation in some municipalities of the state of Quintana Roo, while the latter focused mostly on Quintana Roo’s upcoming 2021 local elections.
Promotion through political ads
Out of the pages the DFRLab had access to, six paid for promotion using Facebook’s advertising platform under the category “issues, elections, or politics.” In total, these pages run around 70 ads and spent approximately $50,000 Mexican pesos (nearly $2,500 USD), according to open-source analysis using the Facebook’s Ad Library.
The content of these ads focused particularly on promoting pre-candidate Villegas Canché, targeting Mara Lezama, and discussing the water supply situation in various municipalities of Quintana Roo related to the Aguakan company.
Connections to an external website
Out of the pages the DFRLab had access to, only the page “Unidos FUERA Aguakan” included a website in the “About” section. The domain is fueraaguakan.com (“Get out Aguakan”), and the website used WordPress as its content management system.
The content on this website includes a public consultation related to the water supply situation in various municipalities of Quintana Roo, an initiative that aims to expose irregularities by Aguakan, which provides drinking water, sewage, and sanitation in some municipalities of the state of Quintana Roo. This company has received thousands of complaints due to irregularities and undue charges.
The licensed senator and pre-candidate for the Benito Juárez municipality, Villegas Canché, has engaged directly on this issue through Facebook posts and has campaigned on it.
According to a DFRLab’s search using the WordPress security scanner WPScan, the website fueraaguakan.com seems to be a multisite, a feature of WordPress that allows multiple virtual sites to share a single WordPress installation. Per WordPress, “when the multisite feature is activated, the original WordPress site can be converted to support a network of sites.” Although, multisites on WordPress can also be listed as either subdomains or subdirectories.
The DFRLab monitored the website fueraaguakan.com using DNSdumpster, an open-source domain research tool that allows researchers to discover hosts related to a domain. According to the results, the website hosts different subdomains, including maralezamaoficial.fueraaguakan.com. The subdomain maralezamaoficial (“Mara Lezama official”) refers to current mayor of Benito Juárez municipality in Quintana Roo, Mara Lezama, who seeks re-election, and who is the opponent of the pre-candidate Villegas Canché.
The subdomain maralezamaoficial.fueraaguakan.com redirects to the website maralezamaoficial.com. Although the site does not provide too much content, it seems that it aims to target Mara Lezama, in part by using a pejorative spelling of her name. The website changed “Mara Lezama” to “Mala Lezama,” in which the term “Mala” could be translated into different contexts, including bad, naughty, evil, or villain.
The subdomain maralezamaoficial.fueraaguakan.com shows open-source evidence that the people behind the website fueraaguakan.com also created the site maralezamaoficial.com. Some of the removed pages were enlisted as well in the site maralezamaoficial.com, suggesting that this site is also connected to the people behind the network.
Although the DFRLab was not able to corroborate who specifically was behind this operation, the research found some patterns behind these two sites: fueraaguakan.com and maralezamaoficial.com. Both sites share the same DNS provider ns1-moluk.hosting-mexico.net. DNS servers allow online users to connect to the domain names on the internet. According to the domain research tool DNSlytics, more than 370 domains use the same name server (ns1-moluk.hosting-mexico.net).
Most of the 370 domains are related to small businesses in Mexico focused on different services. About 10 domains out of those sites are connected to MORENA’s political party, some of them belonging to a few congresspersons. The research, however, did not find links to any other political party among these domains, only to MORENA’s party.
Asset engagement on Facebook
Approximately 15,000 Facebook accounts followed one or more of the removed pages involved in the takedown.
According to a DFRLab’s search query using the Facebook analytics tool CrowdTangle, the removed Facebook pages published on average 146 posts per month between April 2019 and March 2021, and garnered roughly 84,000 interactions in total, including likes, comments, shares, and reactions.
The following graph shows the number of posts since April 2019, when the first page in the network was created. The volume of posts increased after September 2020, when most of the removed pages were created.
Between April 2019 and March 2021, the removed pages shared 3,500 posts, and nearly 90 percent of these posts included either photos or links. More recently, in March 2021, the posts that gathered more engagement on Facebook focused on corruption allegations related to one of the water services providers in Quintana Roo and targeted Mara Lezama, the current mayor of the municipality of Benito Juárez.
Facebook user accounts’ connections to the removed pages
The removed Facebook user accounts did not include too much content in their timelines. Some accounts only uploaded a profile picture and the image for the banner section, while another subset of accounts posted personal content. Using available open-source tools to monitor Facebook pages, the DFRLab was not able to connect which of the user accounts were used to manage the removed pages. However, the research found that most of the user accounts liked some of the assets and pages linked to pre-candidate Villegas Canché and MORENA’s political party.
The following image shows the most-liked pages among the removed Facebook user accounts.
Esteban Ponce de León is a Research Assistant, Latin America, with the Digital Forensic Research Lab.
Cite this case study:
Esteban Ponce de León, “Facebook removes inauthentic network targeting Mexican state elections in Quintana Roo,” Digital Forensic Research Lab (DFRLab), April 14, 2021, https://medium.com/dfrlab/facebook-removes-inauthentic-network-targeting-mexican-state-elections-in-quintana-roo-e2c2990db0a.
Follow along for more in-depth analysis from our #DigitalSherlocks.
