The social network took down assets connected to Ukraine’s Motherland party

On November 5, 2020, Facebook removed 94 assets connected to the Ukrainian political party Batkyvschyna (“Motherland”) for engaging in coordinated inauthentic behavior.

The DFRLab independently identified 10 pages that ultimately appeared in this takedown. Overall, the DFRLab had access to a subset of 54 assets, including user accounts, pages, groups, and Instagram accounts. Some of the pages primarily presented themselves as focused on hyperlocal news; others were either supportive of Ukrainian President Volodymyr Zelensky or dedicated to mocking a specific politician.

In its announcement, Facebook stated the following:

This network posted primarily in Ukrainian about news and current events in Ukraine like politics and elections, including supportive commentary about Yulia Timoshenko and Batkyvshyna party and criticism of its political opponents, President Zelensky and former President Poroshenko. This activity primarily centered around recent elections, including presidential and parliamentary elections in 2019 and local elections in 2020.

[…]

Although the people behind this network attempted to conceal their identities, our investigation found links to MAS Agency, a PR firm in Ukraine, and individuals associated with Yulia Timoshenko’s campaign and Batkivshchyna, a political party in Ukraine.

There was open-source evidence of both coordination and inauthenticity among the assets. Some pages in the set coordinated to push a specific agenda, often using the same content, sharing connected webpages, and boosting particular political figures. Within the set, DFRLab identified multiple fake accounts that used profile pictures stolen from other sources, alongside the real accounts of people connected to a digital advertising agency, Modern Advertisement Solutions Ltd, as well as the Motherland party.

Ukraine had local elections on October 25. The Motherland party has consistently secured seats in Ukraine’s parliament since 2002. The party identifies as a pro-European populist party and is currently in opposition to Zelensky’s majority. Over the years, Motherland has tried to reinvent itself by merging with other parties’ platforms, but one thing has remained constant: its charismatic leader Yulia Tymoshenko, the party’s main public face.

The party’s base is dispersed across the country, with the most significant support in western and central Ukraine. In the last local elections in 2015, Motherland was the second popular political party and received 12 percent of the vote. In this election, Motherland nominated the most candidates among all of the parties, and it has done so for all regional councils. According to one survey, Motherland is projected to secure 4th place in the elections for regional councils and the Kyiv city council.

“Typical district” pages

The DFRLab categorized the assets it received under four categories. Twelve of the assets followed the same naming convention, titled after one of the Kyiv city districts or other cities preceded by the word Типовий (“Typical” in Ukrainian). Twelve additional pages had unique names, but each focused on mocking a specific politician by publishing memes or articles that put the discussed politician in a negative light. An additional five pages mocked more than one politician, again posting primarily memes and negative stories. Finally, a trio of pages focused on providing positive coverage of President Zelensky and amplifying his official statements.

Out of the 12 that followed the “Typical” naming convention, 10 were named after Kyiv city districts, and nine of these pages were registered over a period of three days in June 2020. The pages characterize themselves as “resident communities” for each corresponding district. Each page published district news on local topics such as water purification or park reconstruction. While they published links, the pages did not amplify any single outlet disproportionally. They also ran ads paid by what appeared to be the same company, “MAS Agency,” but with variations in the registered company name, including “mas-agency” and “Modern Advertisement Solutions Ltd.”

All 10 pages had the same logo with variations of the color scheme and the page’s name. They also used a photo from the appropriate district with the slogan, “Your district page!”

All 10 pages published identical posts that criticized Kyiv city services or promoted meetings with Oleksiy Kucherenko, the Kyiv mayoral candidate from the Motherland party. Each page used the same template to publish a picture with an invitation to a forum/public event with Kucherenko, and one page promoted the forum through Facebook Ads. In addition to posting about district news, the pages mocked Kucherenko’s political opponents.

An agency with multiple faces

As noted earlier, a single agency paid for the ads that invited district Facebook users to the meetings with Kucherenko. The company, Modern Advertisement Solutions Ltd, paid for the ads under separate names: “mas-agency,” “MAS Agency,” and “ТОВ ‘Сучасні рекламні рішення’” (Modern Advertisement Solutions Ltd in Ukrainian).The search for “mas-agency” in Facebook’s Ad Library returned only the results for “MAS Agency,” which may suggest there may be other ads the company ran under different names that were not immediately returned in the search results. This search revealed that this agency also runs ads for Vitaliy Nestor, the head of the Motherland party in Kyiv, as well as for another candidate in the Kyiv region and for the party in areas outside of Kyiv.

In the above image, the advertiser on the left is “Modern Advertisement Solutions Ltd in Ukrainian.” In contrast, the middle advertiser is “mas-agency,” which is the abbreviation for the company’s name, and the advertiser on the right is “MAS Agency.” All of the ads link to the same website, mas-agency.com.ua, share the same domain email address, and the same registered street address (with a slight variation in how the address is written).

A Google search for the phone number listed under Modern Advertisement Solutions Ltd revealed that this number was used to register a company of the same name in the Ukrainian registry of companies. According to YouControl, an analytics tool for business entities in Ukraine, the sole owner of this company is Oleksiy Zakharchenko, who is also the head of the Kyiv branch of Motherland Young, the youth wing of the Motherland party. Zakharchenko also filed a declaration as a political candidate in which he disclosed his company’s email on the same domain, mas-agency.com.ua.

The “mas-agency” company’s cell number search led to the “About” section of a Facebook page selling Ukrainian national symbols that stopped posting in November 2019. The cell number of “MAS Agency” is owned by a curator of a project under Kyiv’s branch of Motherland Young.

Derisive pages targeting politicians

The set also had 17 pages dedicated to mocking or otherwise targeting Ukrainian politicians, primarily with memes and critical news. While most of these pages targeted specific politicians, one page was not as directed, criticizing the Ukrainian parliament as a whole.

Three pages provided positive coverage, however, supporting Ukrainian President Zelensky. Another page, “Zelensky for President, Tymoshenko for Prime-Minister,” also promoted Tymoshenko, leader of the Motherland Party. The assets were not overall pro-Zelensky, however, as there were also anti-Zelensky and anti-Servant of the People party pages among them.

All the pages relied on materials from outside sources, posting screenshots of headlines, sharing articles that criticized their specific targets, or posting memes that mocked them.

Asset engagement on Facebook

According to a DFRLab search query using the social media listening tool CrowdTangle, the removed Facebook pages started to post content in June 2016 and had since amassed more than 10 million interactions, including likes, comments, shares, and other reactions.

In total, the removed pages had shared around 11,400 posts since 2016, of which more than 70 percent were photos. Nearly 15 percent of these posts included links to external domains. By February 2020, the pages increased the number of posts, reaching more than 1,000 in September.

The most shared off-platform domain by the Facebook pages was pvisti.km.ua, followed by podillyanews.com.

The first domain, pvisti.km.ua, had an accompanying Facebook page that ran multiple ads promoting Motherland Party in regional council elections.

The other website, podillyanews.com, is a local media site that focuses on the Khmelnytsky region of Ukraine and related news. On its website, pvisti.km.ua states that it is owned by private entrepreneur Volodymyr Romynyshyn, who is also a Motherland party member who ran for parliament in 2019.

The website’s accompanying Facebook page listed only a cell number and an email. A Google search of the number revealed that it was the number of the advertising department of Ukrainian public broadcaster UA: First’s Khmelnytskyi branch (UA:Podillya) and to private entrepreneur Olena Lyamzina.

Lyamzina is not affiliated with a political party, and is instead a private entrepreneur. Someone with the name did donate money to the Motherland party three times in 2018–2019, however, according to YouControl, an analytics tool for business entities that draws from National Agency on Corruption Prevention data.

Removed Facebook accounts

As part of the takedown, Facebook removed 44 Facebook accounts, 25 of which were already inactive before the DFRLab could access them. Among the assets the DFRLab could access, there appeared to be staunch supporters of the Motherland party, as well as a large number of inauthentic accounts. Many of the taken down accounts were friends with one another on Facebook.

Among the supporters, accounts such as the before mentioned Mykola Ivanov, the manager of the MAS Agency, and Oleksiy Zakharchenko, the head of the Kyiv branch of Motherland Young, were taken down. These accounts posted a high volume of posts promoting the Motherland party, with a specific focus on Motherland Kyiv mayoral candidate Oleksiy Kucherenko. An account with the name Vita Lazorenko (Віта Лазоренко), another Motherland candidate for Kyiv city council who appeared in a promotional video together with Kucherenko, was also taken down.

These three individuals had photos or videos together with Kucherenko on their accounts, showing that they had a personal relationship with the politician.

Some other accounts with no clear affiliation to the party were also hyperactive in supporting the party and Kucherenko in particular. Mishka Blynov, whose identity could not be verified, was one of the accounts that posted nothing else but content related to Kucherenko and the party. Karina Lysenko, whose identity could also not be verified, had a promotional image of Yulia Tymoshenko as a profile background, together with a few of Tymoshenko’s other pictures on her feed.

A large number of the taken down accounts also appeared to be fake. Most of them did not post any content related to the Motherland party but had the accounts of real supporters and members of the party among their friends.

Most of these accounts fit the basic description of a fake account: stolen profile pictures, very little content, little to no original content, and minimal personal descriptions, among other indicators. They also had very few friends — usually only a couple dozen. It was unclear what purpose they served in the operation.

Other fake accounts had shown some activity, such as Влас Сташис (Vlas Stashis), who garnered 182 friends. His profile, nonetheless, was a stock image of a man from Morocco riding a bike. Денис Поліщук (Denis Polischuk), however, was a fake account that constructed its identity by systematically stealing information from a Mikhail Dubover VK account. The account did not post content related to the Motherland party, but a large number of the account’s friends were party supporters.

Conclusion

The DFRLab found numerous indicators of inauthentic activity among the assets in this takedown set, including close page creation dates, identical posts, and attempts to mislead users about the purpose of the pages, as well as of their connections to one another. The network also made use of inauthentic accounts, as the DFRLab identified multiple user accounts that concealed their identities by stealing pictures from other people.

The pages primarily posted local and hyperlocal Ukrainian news content and memes, which they either lifted from other Ukrainian news outlets or shared from party-aligned websites. But the most interesting element of this network was that it appeared to mix its ultimate political objectives — promoting candidates associated with the Motherland party, and disparaging others — with a financial motivation, by involving a digital advertising agency owned by the head of head of the Kyiv chapter of Motherland’s youth branch.

Roman Osadchuk is a Research Assistant, Eurasia, with the DFRLab.

Lukas Andriukaitis is an Associate Director with the DFRLab.

Esteban Ponce de León is a Research Assistant, Latin America, with the DFRLab.

Follow along for more in-depth analysis from our #DigitalSherlocks.