On January 12, 2021, Facebook removed a network of assets connected to the Ukrainian NGO known as Anti-Corruption Block Post. In its announcement, Facebook stated:

Facebook removed a total of 53 assets, including 13 accounts, 31 pages, six groups, and three Instagram profiles. The DFRLab analyzed the public postings of 41 assets before they were removed from the company’s platforms; we also reviewed accounts discovered through public searches of the Facebook Ad Library to determine who sponsored any promotions of the pages in question. Most of the pages presented themselves as focused on political news; others were either dedicated to exposing corruption or social injustice.

There was open-source evidence of both coordination and inauthenticity among the assets. Whereas most pages in the set published primarily political and national news from multiple legitimate outlets, complemented by links to dubious blog posts and websites rife with unsubstantiated claims, they also ran Facebook ads that were paid for by the same user accounts and that attacked specific Ukrainian political figures and state agencies. Within the set, the DFRLab identified multiple accounts that used profile pictures stolen from other sources.

Facebook tied the removed assets to Anti-Corruption Block Post, whose now-defunct Facebook page stated its mission was “to fight corruption and promote the transparency of public authorities and officials.” According to YouControl, an analytics tool for business entities in Ukraine, the organization’s full name is the All-Ukraine Association Anti-Corruption Block Post. The organization has 15 local chapters in various Ukrainian regions. The organization claimed in an activity report submitted to the Irpin city council website that its investigations had helped police to identify and charge multiple civil servants in the Kyiv region with corruption and to initiate investigations into the mishandling of state property.

Despite the widespread network, according to the now-defunct Facebook page, the organization used a Blogspot page that had not been updated since 2016, as well as a YouTube channel with 14 subscribers and four videos, with the last upload on April 20, 2018.

The organization appeared to focus in particular on corruption around natural resources in the country classified as “subsoil.” Subsoil is a catchall term in Ukrainian for minerals, oil, wood, and other natural resources, and illegal extraction and exploitation of natural resources is an ongoing and widespread problem in Ukraine. The NGO, however, appears to have little to no presence in the field, though a Google search revealed that it had sent multiple requests for information to the State Service of Geology and Subsoil of Ukraine. Also, the organization applied to be on the Civil Oversight Board of the National Anti-Corruption Bureau of Ukraine in 2016. The organization also requested permission to send official observers to oversee the local elections in 2015 and parliamentary elections in 2019. Anti-Corruption Block Post has the same registration address as Protect Your Vote, another NGO that applied for observation of parliamentary elections in 2019; their page was also taken down by Facebook.

The DFRLab used the social media listening tool CrowdTangle to collect publication patterns and engagement levels of the removed pages. During their almost two years of operation, these pages received more than 93,000 engagements, including reactions, shares, and comments.

The removed pages published almost 2,600 posts, with 90.5 percent of content being shared between photos and links.

The most shared non-Facebook domain addresses were pravda.com.ua and epravda.com.ua. The former is a reputable Ukraine media outlet, while epravda is its economic division. The other sites, with the exception of Antikor, are national outlets that report on events in Ukraine. Antikor appeared in multiple databases as an unreliable and manipulative website that appears to seek to publish info for financial remuneration. According to Texty, a Ukrainian independent media, Antikor — among others — earned money in part by publishing often fabricated accusations against political figures and would remove them for a fee, essentially blackmailing the subjects of its articles.

Most of the pages published national news and shared political ads targeting specific politicians and public personas.

Pages in the set concealed visible connections by predominantly publishing news from legitimate national media. However, they also sporadically posted blogs and websites with “compromising materials” on politicians, such as the ex-minister of finance, or state agencies, including the state fiscal service and Ukrainian railways. Multiple pages from the set published political ads on Facebook. According to public searches of Facebook’s Ad Library, they were all paid by a user account named “Rubanchuk Oleg.” This account paid for the ads on multiple pages removed as a part of the takedown, including “Corrupted Ukraine,” “Taxpayers,” “UaRelease,” “Political Observer,” and “Reformer.”

It appears that the person behind the Rubanchuk Oleg account likely had more than one Facebook user account to pay for the ads. The image below shows a second Facebook user account — Oleg Rubanchuk (on the left) versus Rubanchuk Oleg (on right, written in Russian). The DFRLab could not determine whether the Rubanchuk accounts were an online persona or of a specific individual with a similar name.

Some ads promoted Corrupted Ukraine, a now-defunct Facebook page from the set, but the majority shared blogposts or negative news articles about Ukrainian officials ranging from fiscal service managers to state ministers. Usually, these pages advertised blogs written by the people who paid for the ads. In the example below, ads paid by a user account named “Valeriy Scherbina” promoted three blogs, in which the author “investigated” the Kyiv fiscal service head’s alleged tax-related corruption.

Some of the outlets linked externally by the assets, including apostrophe.ua and Politeka.net, also appeared in rankings of Ukrainian media outlets regarding adherence to journalistic standards — or the lack thereof — highlighting these websites’ verve for posting manipulative content, publishing misinformation, and using non-verified sources. Politeka.net was in fact subject to an earlier takedown in September 2019. Some of the external website stories in links in the Facebook ads were no longer available, including one advertised post on Politeka. An article with the same headline and presumably the same content appeared on multiple fringe media outlets, which resembled attacks on officials that the DFRLab previously exposed.

The user accounts for Valeriy Scherbina and Oleg Rubanchuk were among the sponsors for Facebook ad content promoting the Political Observer Facebook page.

Interestingly, the names Valeriy Scherbina and Oleg Rubanchuk also appeared in a September 2020 story by OpenNews about Ukrainian bot farms.

The DFRLab had access to 13 user accounts, the majority of which had stolen profile pictures and posted little to no content.

One of the personas, Oleh Rybalchenko, claimed to be an analyst with Anti-Corruption Block Post according to this blog and his biography on a Kyiv local administration website.

Using the online tool “Multiple tools for Facebook,” the DFRLab found that user accounts removed by Facebook were admins of four groups, three of which were removed as well. One of the groups had the same name and visuals as the page Political Observer. Whereas the page published general news, the group demonstrated bias in its posts. Natalia Prokopenko, a now-defunct user account from this takedown set and admin of the Political Observer group, consistently shared posts between pages from the set.

The same admin published multiple posts complimenting various officials while sharing their publications. Out of 13 posts from December 4 to 13, 2020, six shared posts or complimentary coverage of Oleh Urusky, the Ukrainian vice prime minister of strategic industries. The admin also amplified messages of other officials, including the head of the State Fiscal Service of Ukraine.

The set of Facebook user accounts, groups, pages, and Instagram accounts contained elements of inauthenticity, like user images retrieved from the web. The assets showed a certain degree of coordination, such as Facebook ads sponsorship and group administration by the same users. Much of the content being spread by the network was political in nature, much of which was unsubstantiated claims of corruption.

Nika Aleksejeva and Roman Osadchuk, “Facebook removes assets connected to Ukrainian NGO,” Digital Forensic Research Lab (DFRLab), January 12, 2021, https://dfrlab.org/2021/01/12/facebook-removes-assets-connected-to-ukrainian-ngo/.