Inauthentic Facebook assets supported Mexican governor’s successful election campaign

Network supporting San Luis Potosí Governor-elect

Inauthentic Facebook assets supported Mexican governor’s successful election campaign

Share this story

Network supporting San Luis Potosí Governor-elect Jose Ricardo Gallardo Cardona initially identified by the DFRLab

San Luis Potosí Governor-elect Jose Ricardo Gallardo Cardona during a rally, as seen in a photo promoted by one of the four inauthentic Facebook pages. (Source: San Luis Ya Es Verde)

By Daniel Suárez Pérez

On July 8, 2021, Facebook announced the removal of a network of 59 assets that supported Jose Ricardo Gallardo Cardona, governor-elect for the Mexican state of San Luis Potosí, for engaging in “coordinated inauthentic behavior” during the election campaign. Gallardo ultimately won the election. The inauthentic campaign was first identified by the DFRLab.

Facebook removed 32 user accounts, 23 pages, and four Instagram profiles prior to the election, which took place on June 6, 2021.

In its announcement, Facebook said:

The people behind this activity used fake accounts to post in Groups, react to and share comments in Spanish on posts about the gubernatorial election in San Luis Potosi, including content by the official Pages of some candidates and parties. They also ran Pages posing as local news entities. This network focused primarily on posting about the candidates from the Green [Partido Verde Ecologista de México (PVEM)] and Labor party [Partido del Trabajo (PT)] coalition [Juntos Haremos Historia] and the campaign of Ricardo Gallardo Cardona, while criticizing candidates Octavio Pedroza and Xavier Nava.

We found this activity after reviewing information shared by researchers at the Atlantic Council’s Digital Forensics Research Lab about suspected coordinated inauthentic behavior in the region and removed it ahead of the June election. Although the people behind it attempted to conceal their identities and coordination, our investigation found links to individuals associated with Cardona’s political campaign.

Previously on May 6, 2021, Facebook announced the removal of 180 Facebook and Instagram assets promoting the political campaigns of mayoral candidate Xavier Nava, from the Morena party, and Octavio Pedroza, a member of PAN (Partido Acción Nacional, or National Action Party), both of whom were running for governor of San Luis Potosí state. The operation was also used to attack their political opponents.

While investigating the Nava-Pedroza network, the DFRLab found signs of inauthentic behavior on the other side of the political spectrum. Pages that appeared to be inauthentically boosting the candidacy of Ricardo Gallardo Cardona, a PVEM (Partido Verde Ecologista de México, or “Ecologist Green Party of Mexico”) politician who had also been investigated for corruption. Gallardo won the election, beating his closest opponent by around 5 percent. The DFRLab did not have access to all assets removed by Facebook but can now detail the operation of some of the pages that led to this takedown.

Pages registered by the same organization

The DFRLab found four Facebook pages campaigning for Gallardo that appeared to belong to the same network. These pages all linked to different external websites registered on the blog platform Tumblr. Although the websites customized Tumblr’s default URL in an apparent attempt to appear as legitimate websites that were all independent from each other, they were all registered by the organization Agenda Política on February 12, 2021, all within the same one-second period. This suggests they were purchased simultaneously.

Table showing the websites associated with the Facebook pages supporting Gallardo and their registration data. The domain was registered one second before (highlighted green) than the other three websites. (Source DFRLab via Facebook/RiskIQ)

One of the pages, San Luis Ya Es Verde, described itself as a “media/news company” but stated clearly in its description that it was a community supporting Gallardo’s campaign. This page was not taken down by Facebook.

The three others — El Espectador de México, La Neta de las Netas Si, and Anonymous San Luis Potosí — said they were independent media outlets or news aggregators, despite being registered by the same group that registered the page that clearly campaigned for Gallardo. Facebook took down these three pages.

These pages targeted Nava’s and Pedroza’s campaigns and political allies with negative content, in part by suggesting — without strong evidence, if any — that Nava and Pedroza had been involved in corruption cases during their previous campaigns or during their previous terms in public office.

Screencaps of two of the Facebook pages, La Neta de las Netas Si and El Espectador de México, that undertook inauthentic behavior to attack political opponents. In this case, the pages reposted memes that a third page, Anonymous San Luis Potosí, posted to attack Nava (red box) and Gallardo (blue box), respectively. However, the pages used different texts on their posts. (Source: Facebook)

The Tumblr pages connected to the Facebook pages posted similar content. posed as an independent media outlet but posted only memes with content targeting Pedroza and other politicians.

Another of the websites,, posted images launching Gallardo’s campaign and rallies, while still another,, postured itself to be the media outlet of the San Luis Potosí affiliate of the group Anonymous, publishing negative content about Gallardo’s rivals.

Screencaps from three of the associated external websites. Two of the websites, and, targeted Gallardo’s opponents, Nava and Rangel (red boxes) and Pedroza (green box). The third,, promoted Gallardo’s campaign (orange boxes). (Source:, top;, middle;, bottom)

The DFRLab was not able to find more information about Agenda Política using open-source techniques. However, at the same second that these Tumblr pages were registered, Agenda Política also registered a website belonging to an “advertising agency” named Margen Politico.

Table showing that Agenda Política also registered Margen Politico’s domain (highlighted red) at the same date and time — down to the second — of the four Tumblr pages’ domains. (Source DFRLab via Facebook/RiskIQ)

Although Margen Politico’s website is currently offline, the DFRLab was able to find an archived version from July 30, 2016, that detailed the services provided by the agency. The firm offered, among other services, the creation of social media accounts for the candidate “to influence potential voters” as well as “negative campaigns” to convince “people NOT to vote for your competitors.”

Among its clients in 2016, Margen Politico mentioned political parties Partido Revolucionario Institucional (PRI), PAN, Partido de la Revolución Democrática (PRD), Partido Nueva Alianza, and PVEM, Gallardo’s party.

Screencaps of Margen Politico’s Facebook page (top), in which it describes itself (red box) as a “Political Marketing Consulting Firm” working with candidates and political parties in Mexico and other Latin American countries, and of an archived version of its website from July 30, 2016, which showed that Gallardo’s political party PVEM (orange box) was among the company’s clients. (Source: Facebook, top; Wayback Machine, bottom)

Margen Politico also maintained a Facebook page created on January 27, 2016 that described the agency as a “Political Marketing Consulting Firm.” The page was not removed by Facebook, nor did it mention the name of this firm in its announcement, possibly because Facebook generally focuses on evidence that it finds within the platform, while this connection became apparent through the analysis of domain registration records.

More evidence of coordination

The four pages involved in the campaign also purchased ads on Facebook, three of which engaged in negative advertising. For instance, El Espectador de México and Anonymous San Luis Potosí sponsored posts that twisted a campaign initially promoted by Pedroza alongside Enrique Francisco Galindo Ceballos, the elected mayor of San Luis Potosí. More specifically, Pedroza’s official Facebook page shared a video to promote its alliance, or combo (a reference to a fast food “combo meal”) with Galindo. Anonymous San Luis Potosí then advertised the same video but claimed that Pedroza’s and Galindo’s alliance would bring violence and corruption to the state. El Espectador de México and Anonymous San Luis Potosí then advertised a still image based on the latter’s previous rewrite of Pedroza’s and Galindo’s campaign, this time suggesting it was a combo of “rats.”

Graphic showing the flow of the “combo” narrative: the original post to Pedroza’s Facebook page (top left) shared a video to promote the Pedroza-Galindo “combo;” Anonymous San Luis Potosí then repurposed the same video (top right) by claiming that the “combo” brought violence and corruption; and, finally, El Espectador de México and Anonymous San Luis Potosí (green boxes at bottom) used the same narrative by posting an image suggesting it was a combo of “rats.” (Source: Facebook)

Another page involved in the operation, San Luis Ya Es Verde, used a different strategy, advertising images of Gallardo’s campaign as well as polls that showed he would be elected as the governor, rather than promoting negative campaigns about his rivals.

According to the Facebook’s Paid For By database that allows a user to identify who paid for a political ad, a person identified as Adriana Ramos Barrios paid for the four pages’ ads between September 27, 2020, and February 22, 2021. The DFRLab could not find any online traces of Barrios to verify whether she was connected to the campaign.

Ramos’s name and phone number also appeared in Anonymous San Luis Potosí’s ads, which seemed unusual, as the real hacker collective is known for keeping the identity of its members hidden.

Screencaps of a query of Facebook’s Ad Library showed Adriana Ramos Barrios (red boxes) had paid for some of the ads of four Facebook pages supporting Gallardo. Some ads showed the phone number (green box) registered by Ramos. (Source: Facebook’s Ad Library)

The four Facebook pages ran 62 ads between September 27, 2020, and April 30, 2021, spending approximately $6,300 Mexican pesos (nearly USD $315), according to open-source analysis using the Facebook’s Ad Library. Moreover, Facebook said in its announcement that the broader network it removed — of which the DFRLab only had access to the four assets covered here — spent in total USD $26,000.

Daniel Suárez Pérez is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Cite this case study:

Daniel Suárez Pérez, “Inauthentic Facebook assets supported Mexican governor’s successful election campaign,” Digital Forensic Research Lab (DFRLab), August 10, 2021,

Follow along for more in-depth analysis from our #DigitalSherlocks.