Network of Facebook pages amplified Polish right-wing and tabloid media outlets

Pages published the same links with identical text, often within a matter of seconds of each other

Network of Facebook pages amplified Polish right-wing and tabloid media outlets

Share this story
THE FOCUS

BANNER: Protesters holding anti-government banners and “Hands Off TVN” posters in Gdansk, Poland on August 10, 2021. TVN, the largest independent media outlet in the country, has been under threat from a proposed law that would clamp down on foreign ownership. (Source: Reuters/Michal Fludra/NurPhoto)

The DFRLab has identified a network of 130 Facebook pages linked to right-wing Polish news outlets engaging in inauthentic distribution, a practice in violation of Facebook’s inauthentic behavior guidelines. The network artificially boosted the outlets’ presence on Facebook through the use of inauthentic pages; these would publish identical content, often within seconds of each other, while failing to disclose their links to these outlets.

Actors across Poland’s political spectrum have increasingly turned to social media as a means of broadcasting preferred narratives and steering online harassment campaigns to bully political opponents. In 2019, Deputy Minister of Justice Łukasz Piebiak was forced to resign after it became known that he had coordinated an online harassment campaign against judges who were critical of changes initiated by the ruling party, Prawo i Sprawiedliwość (“Law and Justice” or PiS). Similar efforts have also utilized inauthentic means of boosting their messages’ reach in Poland. In 2019, for example, Facebook removed an inauthentic network of 27 pages spreading divisive content, including anti-immigrant, anti-LBGT, and antisemitic rhetoric. In a similar vein, the pages uncovered by the DFRLab supported PiS, attacked its opponents, and amplified right-wing messages. Other pages amplified sensational content from Polish tabloid media outlets.

While engaging in inauthentic distribution is not necessarily grounds for immediate expulsion, it can lead to severe consequences for the pages involved, including temporary suspension from public distribution until they change their practices, and permanent suspension from the platform if they do not.

Poland’s media ecosystem

The Polish media landscape is pluralistic but highly polarized along political and ideological lines. Most media outlets in Poland fall into one of four categories: liberal or left-wing (e.g., Gazeta Wyborcza, Okopress); conservative or right-wing (e.g., TVP, wPolityce.pl); business-oriented (e.g., Dziennik Gazeta Prawna, Puls Biznesu); or tabloids (e.g., Fakt, Super Express).

The media landscape is politicized in part because the PiS government has a history of interfering in it. More specifically, PiS has come under growing scrutiny for politicizing publicly-funded media outlets, which the European Commission has declared undermine the European Union’s terms of membership. After the party came to power in Poland in 2015, it replaced the leadership of the public broadcaster TVP, turning it into a propaganda entity for the ruling party. Later, in August 2020, Polish state-run oil company PKN Orlen purchased Polska Press media group from its German owners. This group includes 20 leading regional newspapers in Poland, 120 weekly magazines, and 500 online portals. This move raised concerns about the government’s takeover of independent media that could endanger media freedom in the country. Indeed, reports have emerged of journalists being fired for not following the official government line after the takeover.

Most recently, in August 2021, the Polish Parliament passed a media ownership law that threatened to leave TVN — the largest independent TV station in Poland — without a broadcasting license. After heated debate and multiple protests, the license was granted, though the issue is far from being permanently resolved: Poland’s Senate voted against it, sending it back to the lower house for another vote, while President Andrzej Duda has threatened to veto the bill if it ever reaches his desk, on the grounds that it violates media freedoms and free market principles.

Inauthentic pages

Using the Facebook social media listening tool CrowdTangle, the DFRLab collected more than 1.1 million posts published to inauthentic pages between January 2015 and October 2021. In total, these posts garnered more than 18 million interactions, including likes, comments, shares, and reactions. The number of shared links increased significantly starting in 2019, with nearly 90 percent of all the analyzed posts published in 2020 and 2021.

Graph showing number of posts published between January 2015 and October 2021 by the pages under investigation. (Source: @estebanpdl/DFRLab via CrowdTangle)

Likely as a result of the increasing number of shared links after 2019, the average number of interactions per post decreased significantly, with low individual post interactions diluting the overall average.

Graph showing the average number of interactions per post between January 2015 and October 2021. (Source: @estebanpdl/DFRLab via CrowdTangle)

There are at least three different types of pages in this network. The majority of them seem to have right-wing nationalistic names, while other pages had names that conveyed an anti-opposition stance. A handful of pages clearly conveyed support for the ruling PiS party while targeting leftist ideology. When reviewing the 15 most active pages in terms of post activity, the DFRLab found that seven of them had names critical of or mocking the opposition, sometimes misspelling names intentionally; seven had nationalistic names; and one in support of PiS.

Bar chart showing the number of posts published by the 15 most active pages in the set. Red boxes indicate those with names critical of the opposition or mocking it, blue boxes mark those with nationalistic names, and green boxes show the page with pro-PiS slant. (Source: @estebanpdl/DFRLab via CrowdTangle)

The DFRLab also examined the creation dates of these pages and found that a majority of them were created in 2014.

Bar chart showing the distribution of pages by the year they were created. (Source: @estebanpdl/DFRLab via CrowdTangle)

The DFRLab also checked the 15 most frequently shared domains since 2015. Wlocie.pl appeared as the most actively amplified external website, followed by Tysol.pl and Propolski.pl. The DFRLab investigated whether this could potentially be a collection of separate networks behaving similarly but found overlap in most of the pages: for example, 123 of the 130 all posted a link to Tysol.pl at some point, while a mere seven did not. There was also a subset that in recent times linked almost exclusively to Propolski.pl, but historically had amplified links from Tysol.pl.

The most shared domains by number of posts. (Source: @estebanpdl/DFRLab via CrowdTangle)

The four tabloids

The pages under investigation shared more than 228,000 links to the tabloid Wlocie.pl since 2015. A contact phone number on Wlocie.pl matched the phone number listed on the websites for the tabloids Onpress.pl, Presson.pl, and Allpress.pl, all of which were regularly promoted by pages in this set.

A search using open-source tool WPScan also showed links between the four tabloids. The publicly identifiable usernames used to publish these sites, all of which use WordPress as their content management system, match with each other.

Screengrabs from WordPress scans. The websites shared usernames to access to the WordPress backend. Each color box shows matching usernames between the websites wlocie.pl, onpresss.pl, presson.pl, and allpress.pl (Source: @estebanpdl/DFRLab via WPScan)

The DFRLab checked the source code for the four websites and found that the Google AdSense ID for Onpress.pl (pub-3555295649837252) was also used by Allpress.plPresson.pl, and Wlocie.pl. These four websites sometimes republished materials from other prominent Polish media outlets, with original sources usually indicated at the bottom of the text. They also recommend links to articles published by each other; for instance, articles published on Onpress.pl often feature links leading to suggested articles published by Wlocie.plPresson.pl or Allpress.pl.

The four tabloids mainly publish articles with sensational clickbait-like headlines. While their content is not entirely identical, they often publish similar articles. In some cases, they use identical text with identical banners for articles, posted either by the same person or different authors.

Some websites published identical articles on their websites, utilized the same headlines or the same authors. (Sources: Allpress/archive, top left; Onpress/archive, top right; Allpress/archive, bottom left; Onpress/archive, bottom right).

The vast majority of articles on OnpressAllpress and Presson were published under the same names: Magdalena Derucka, Dariusz Derucki, Bartosz Palędzki, Daniel Wyrzykowski and Agata Kupiecka. The DFRLab found a LinkedIn profile of Magdalena Derucka, which says that she is self-employed and works as a publisher of WlocieOnpress and Allpress. Additionally, a LinkedIn profile for Dariusz Derucki says that he participated in the creation and development of Onpress, where he managed a team of editors and was responsible for “buzz marketing and viral marketing.”

Left: Screencap of the LinkedIn profile of Magdalena Derucka says that she is a publisher of Wlocie.pl, Onpress and Allpress. Right: Screencap of Dariusz Derucki’s profile shows that he managed the editorial team of Onpress and also was responsible for content marketing. (Sources: LinkedIn, left; LinkedIn, right)

Moreover, the DFRLab found a publicly available photo on Facebook suggesting that Magdalena Derucka and Dariusz Derucki are a couple, as it shows them with a child and a description in Polish: “Proud parents.”

Dariusz Derucki and Magdalena Derucka have a common photo featuring a child and the text, “Proud parents.” (Source: Facebook)

The DFRLab also tried to verify the other authors and could not find any additional information about them. Moreover, photos of Bartosz Palędzki, Daniel Wyrzykowski and Agata Kupiecka bear hallmarks of AI-generated faces. More specifically, Daniel Wyrzykowski’s hair at the top of his head is redundant, his ears have different shapes, and his left earlobe is longer than right earlobe. Along similar lines, the ears of Bartosz Palędzki have different shapes, with his left ear appearing distorted or cut. Lastly, Agata Kupiecka’s photo shows that her left ear is much smaller than her right ear. AI-generated faces often feature ear distortions such as these, so it is possible that the owners of the websites employed synthetic portraits to create an impression that additional people worked for these outlets.

Images of Daniel Wyrzykowski, Bartosz Palędzki and Agata Kupiecka published on the websites of Onpress.pl and Allpress.pl contain artifacts commonly seen within AI-generated faces. (Sources: Onpress.pl/archive, top; Onpress.pl/archive, middle; Allpress.pl/archive)

Nationalism, coordination and e-commerce

As previously mentioned, a majority of the Facebook pages in this network had nationalistic names, including “Polish hero,” “Vilnius is Poland,” “Lviv is Poland,” and “Honor and courage.” While many of them would post the same content simultaneously, not all 130 of the pages identified in this investigation would do so at the same time. For example, a given link would appear simultaneously on a subset of pages, while other links would then be posted by another subset of the network.

Screencaps of inauthentic pages publishing identical posts at the same time. (Source: DFRLab via CrowdTangle)

Some of the Facebook pages also sold clothes online, while others ran online shop sections on Facebook, selling clothes from Extremelifeshop.pl.

Screengrabs from posts to four of the inauthentic pages in which the operators linked to Extremelifeshop.pl, an external website selling clothes. (Source: Facebook)

Apart from posting links from the above-mentioned media portals, pages also regularly uploaded nationalistic photos usually unrelated to any of the publications, including some aimed at discrediting Polish opposition figures or praising PiS. These photos often received more engagement than links to articles on the external websites.

Screencaps of pro-PiS, anti-opposition and nationalistic photos posted by the Facebook pages in this network. (Source: Facebook)

Propolski.pl

Of the 130 pages within the network, the DFRLab identified a subset of 24 pages that mostly amplified articles for Propolski.pl, a right-wing news website. These posts included links to Propolski.pl articles alongside identical descriptive texts, sometimes posted simultaneously across multiple pages in the subset.

Red rectangles mark pages with pro-ruling party names, green marks anti-opposition pages, blue marks anti EU pages, and pink marks nationalistic, right-wing pages. (Source: DFRLab via CrowdTangle)

Timestamps within the subset showed that many of the identical posts across multiple pages were very often published on the hour or half-hour, indicating that page administrators coordinated their posting strategy by scheduling them ahead of time.

Table of the timestamps — either on the hour or on the half-hour — of four different identical posts across multiple pages demonstrating that the page administrator(s) most likely scheduled when the posts would go live. (Source: DFRLab via CrowdTangle)

In addition to those timestamps within the Propolski.pl subset, the DFRLab found that 63 percent of the analyzed posts in the overall set were published within two seconds of additional copies appearing elsewhere in the network, while nearly 80 percent of all posts had copies of themselves published within 25 seconds of each other.

Chart showing the difference in seconds between posts of the overall 130-page set. (Source: @estebanpdl/DFRLab)

Not all of the Propolski.pl subset pages were equally active, however; a CrowdTangle search showed that some of them published more than 40 posts daily, while others published fewer than 20.

The pages in this subset also republished the exact same posts several times over a period of several days or weeks, indicating that they amplified new Propolski.pl articles and later re-upped them.

Screengrab of a CrowdTangle query showing identical posts published by inauthentic pages in Proposki.pl subset, with the same color boxes identifying identical posts. (Source: DFRLab via CrowdTangle)

Under the veneer of being a news outlet, Propolski.pl publishes articles frequently used to attack Polish opposition parties and their leaders, or to boast about PiS’s achievements. Additionally, the vast majority of of these articles were written by one of four authors. However, the DFRLab found no information about these individuals elsewhere on the internet, so it was not possible to verify whether they they are journalists or, for that matter, real people.

Screengrabs of the headlines for Propolski.pl articles targeting Polish opposition figures, all of which attempt to discredit them. (Source: Propolski/archive, top left; Propolski/archive, top right; Propolski/archive, bottom left; Propolski/archive, bottom right)

According to Propolski’s privacy policy, the website is owned by OTUA MEDIA and is registered in Lublin, Poland, with Jakub Zgierski as the company’s board chairperson. The Google Analytics code for Propolski.pl was also used for another website, mlotnamarksizm.pl (“Hammer for Marxism”), which appears to be Zgierski’s personal blog. Entries on the blog demonstrate Zgierski’s hostility toward the left, the LGBT community, and gender issues more broadly, among other topics. Zgierski has two Facebook pages and a YouTube channel on which he publishes podcast interviews with different individuals aimed at discrediting left-wing politics and values. He also writes articles the right-wing media outlet National Mediaaccording to Propolski, Zgierski is National Media’s editor-in-chief.

Another website, zwiazkimilosci.pl, uses the same Google AdSense ID as Propolski. The former seems to be a personal blog about mental health, psychology, and spiritual inspiration. The About section for the website identifies Anna Zgierska as its primary author. Identical ads appear on both websites. Taking into consideration that the admins of both websites have the same surnames, it is possible that they are related in some way.

Readout from analysis tool DNSLytics showing that the Google Analytics (left) and AdSense ID (right) codes of Propolski website are being used by other websites as well. (Source: DFRLab via DNSLytics)

Elsewhere, a Facebook account with the name Anna Zgierska regularly posts links to Propolski.pl articles in various pro-PiS groups on Facebook.

Screencaps of a Facebook account for Anna Zgierska posting Propolski.pl articles to various Facebook groups. (Source: Facebook)

Cite this case study:

Givi Gigitashvili and Esteban Ponce de León, “Network of Facebook pages amplified Polish right-wing and tabloid media outlets,” Digital Forensic Research Lab (DFRLab), November 4, 2021, https://medium.com/dfrlab/network-of-facebook-pages-amplified-polish-right-wing-and-tabloid-media-outlets-ccaa218128ab.