Network supporting San Luis Potosí Governor-elect Jose Ricardo Gallardo Cardona initially identified by the DFRLab
By Daniel Suárez Pérez
On July 8, 2021, Facebook announced the removal of a network of 59 assets that supported Jose Ricardo Gallardo Cardona, governor-elect for the Mexican state of San Luis Potosí, for engaging in “coordinated inauthentic behavior” during the election campaign. Gallardo ultimately won the election. The inauthentic campaign was first identified by the DFRLab.
Facebook removed 32 user accounts, 23 pages, and four Instagram profiles prior to the election, which took place on June 6, 2021.
In its announcement, Facebook said:
The people behind this activity used fake accounts to post in Groups, react to and share comments in Spanish on posts about the gubernatorial election in San Luis Potosi, including content by the official Pages of some candidates and parties. They also ran Pages posing as local news entities. This network focused primarily on posting about the candidates from the Green [Partido Verde Ecologista de México (PVEM)] and Labor party [Partido del Trabajo (PT)] coalition [Juntos Haremos Historia] and the campaign of Ricardo Gallardo Cardona, while criticizing candidates Octavio Pedroza and Xavier Nava.
We found this activity after reviewing information shared by researchers at the Atlantic Council’s Digital Forensics Research Lab about suspected coordinated inauthentic behavior in the region and removed it ahead of the June election. Although the people behind it attempted to conceal their identities and coordination, our investigation found links to individuals associated with Cardona’s political campaign.
Previously on May 6, 2021, Facebook announced the removal of 180 Facebook and Instagram assets promoting the political campaigns of mayoral candidate Xavier Nava, from the Morena party, and Octavio Pedroza, a member of PAN (Partido Acción Nacional, or National Action Party), both of whom were running for governor of San Luis Potosí state. The operation was also used to attack their political opponents.
While investigating the Nava-Pedroza network, the DFRLab found signs of inauthentic behavior on the other side of the political spectrum. Pages that appeared to be inauthentically boosting the candidacy of Ricardo Gallardo Cardona, a PVEM (Partido Verde Ecologista de México, or “Ecologist Green Party of Mexico”) politician who had also been investigated for corruption. Gallardo won the election, beating his closest opponent by around 5 percent. The DFRLab did not have access to all assets removed by Facebook but can now detail the operation of some of the pages that led to this takedown.
Pages registered by the same organization
The DFRLab found four Facebook pages campaigning for Gallardo that appeared to belong to the same network. These pages all linked to different external websites registered on the blog platform Tumblr. Although the websites customized Tumblr’s default URL in an apparent attempt to appear as legitimate websites that were all independent from each other, they were all registered by the organization Agenda Política on February 12, 2021, all within the same one-second period. This suggests they were purchased simultaneously.
One of the pages, San Luis Ya Es Verde, described itself as a “media/news company” but stated clearly in its description that it was a community supporting Gallardo’s campaign. This page was not taken down by Facebook.
The three others — El Espectador de México, La Neta de las Netas Si, and Anonymous San Luis Potosí — said they were independent media outlets or news aggregators, despite being registered by the same group that registered the page that clearly campaigned for Gallardo. Facebook took down these three pages.
These pages targeted Nava’s and Pedroza’s campaigns and political allies with negative content, in part by suggesting — without strong evidence, if any — that Nava and Pedroza had been involved in corruption cases during their previous campaigns or during their previous terms in public office.
The Tumblr pages connected to the Facebook pages posted similar content. espectadordemexico.com posed as an independent media outlet but posted only memes with content targeting Pedroza and other politicians.
Another of the websites, sanluisyaesverde.com, posted images launching Gallardo’s campaign and rallies, while still another, anonymousslp.com, postured itself to be the media outlet of the San Luis Potosí affiliate of the group Anonymous, publishing negative content about Gallardo’s rivals.
The DFRLab was not able to find more information about Agenda Política using open-source techniques. However, at the same second that these Tumblr pages were registered, Agenda Política also registered a website belonging to an “advertising agency” named Margen Politico.
Although Margen Politico’s website is currently offline, the DFRLab was able to find an archived version from July 30, 2016, that detailed the services provided by the agency. The firm offered, among other services, the creation of social media accounts for the candidate “to influence potential voters” as well as “negative campaigns” to convince “people NOT to vote for your competitors.”
Among its clients in 2016, Margen Politico mentioned political parties Partido Revolucionario Institucional (PRI), PAN, Partido de la Revolución Democrática (PRD), Partido Nueva Alianza, and PVEM, Gallardo’s party.
Margen Politico also maintained a Facebook page created on January 27, 2016 that described the agency as a “Political Marketing Consulting Firm.” The page was not removed by Facebook, nor did it mention the name of this firm in its announcement, possibly because Facebook generally focuses on evidence that it finds within the platform, while this connection became apparent through the analysis of domain registration records.
More evidence of coordination
The four pages involved in the campaign also purchased ads on Facebook, three of which engaged in negative advertising. For instance, El Espectador de México and Anonymous San Luis Potosí sponsored posts that twisted a campaign initially promoted by Pedroza alongside Enrique Francisco Galindo Ceballos, the elected mayor of San Luis Potosí. More specifically, Pedroza’s official Facebook page shared a video to promote its alliance, or combo (a reference to a fast food “combo meal”) with Galindo. Anonymous San Luis Potosí then advertised the same video but claimed that Pedroza’s and Galindo’s alliance would bring violence and corruption to the state. El Espectador de México and Anonymous San Luis Potosí then advertised a still image based on the latter’s previous rewrite of Pedroza’s and Galindo’s campaign, this time suggesting it was a combo of “rats.”
Another page involved in the operation, San Luis Ya Es Verde, used a different strategy, advertising images of Gallardo’s campaign as well as polls that showed he would be elected as the governor, rather than promoting negative campaigns about his rivals.
According to the Facebook’s Paid For By database that allows a user to identify who paid for a political ad, a person identified as Adriana Ramos Barrios paid for the four pages’ ads between September 27, 2020, and February 22, 2021. The DFRLab could not find any online traces of Barrios to verify whether she was connected to the campaign.
Ramos’s name and phone number also appeared in Anonymous San Luis Potosí’s ads, which seemed unusual, as the real hacker collective is known for keeping the identity of its members hidden.
The four Facebook pages ran 62 ads between September 27, 2020, and April 30, 2021, spending approximately $6,300 Mexican pesos (nearly USD $315), according to open-source analysis using the Facebook’s Ad Library. Moreover, Facebook said in its announcement that the broader network it removed — of which the DFRLab only had access to the four assets covered here — spent in total USD $26,000.
Daniel Suárez Pérez is a Research Assistant, Latin America, with the Digital Forensic Research Lab.
Cite this case study:
Daniel Suárez Pérez, “Inauthentic Facebook assets supported Mexican governor’s successful election campaign,” Digital Forensic Research Lab (DFRLab), August 10, 2021, https://medium.com/dfrlab/inauthentic-facebook-assets-supported-mexican-governors-successful-election-campaign-6213b396266d.
Follow along for more in-depth analysis from our #DigitalSherlocks.
