Inauthentic assets posed as independent news entities targeting political actors and presidential elections in the region

On July 8, 2020, Facebook removed a network of assets engaged in coordinated inauthentic behavior focusing on several Latin American countries and influencing political topics in the region. Facebook attributed these assets — including 77 pages, 41 user accounts, and 56 Instagram profiles — to Estraterra, an Ecuadorian public relations firm operated out of Canada, as well as political consultants and former government employees in Ecuador. This is not the first example of a commercial marketing company profiting on political gamesmanship, as other previous DFRLab investigations have reported on similar operations. While for-profit operations that work to influence political outcomes are not new or novel, the exposure of yet another company undertaking such operations demonstrates how widespread the phenomenon has become.

The administrators of the pages involved in this takedown were mainly located in Canada and Ecuador, but the content also targeted other countries, including Argentina, Bolivia, Chile, Uruguay, and Venezuela. Much of the content appeared to be related to elections, with many pages promoting specific left-wing candidates in the lead-up to an election and then falling dormant thereafter. The content reviewed by the DFRLab did not seem to be disinformation or even manipulated, but the assets themselves did appear to be coordinated and feature elements of inauthenticity.

In its announcement of the takedown, Facebook stated:

This network relied on a combination of authentic and inauthentic accounts, some of which had already been detected and disabled by our automated systems. This operation — which was also active on other internet platforms — activated around civic events such as elections, at times posting on both sides of the political debate, and then abandon or pause its activity. They used fake accounts to pose as locals in countries they targeted, post and like their own content, drive people to off-platform sites, and manage Pages posing as independent news in countries they targeted. Some individuals behind this activity created multiple duplicate accounts under their own name. This network posted about domestic news in the countries it targeted, including topics such as politics, activism, praise and criticism of political candidates, elections, the government of Venezuela, both support and criticism of the President of Ecuador, political parties in the region including Farabundo Martí National Liberation Front in El Salvador, Peronist party in Argentina, and the Progressive party in Chile.

We found this network as part of our internal investigation into suspected coordinated inauthentic behavior in the region. Although the people behind this activity attempted to conceal their identities and coordination, our investigation found links to political consultants and former government employees in Ecuador and Estraterra, a Canada-based PR firm. Estraterra is now banned from our platforms.

This is also not the first time that a social media platform detected coordinated inauthentic activity linked to Ecuador. In September 2019, Twitter removed 1,019 accounts tied to the Alianza País (AP) political party, a political movement linked to former President Rafael Correa. Facebook’s latest takedown bore a close resemblance to the 2019 Twitter takedown as some of the network’s assets openly acknowledged their support for Correa by creating posts in favor of his political party.

The DFRLab found evidence that one of the removed user accounts was that of a former government employee in Ecuador who had served as an advisor at the National Secretary of Public Administration during Correa’s presidency. The same former employee is also a co-founder of Estraterra.

The investigation also confirmed the connections between the assets on both Facebook and Instagram, as well as those related to the off-platform websites linked to the assets. Some of these websites shared similar content, used the same user account (UA code) for Google Analytics and added the same publisher ID for a Google AdSense account; many were also hosted on the same server.

Overall, this operation followed a pattern the DFRLab has seen many times before: a for-profit company operating a series of Facebook and Instagram assets, as well as affiliated off-platform websites.

Estraterra — Ecuadorian origin, Canadian operation

A search on LinkedIn yielded a profile for a person by the name of Roberto Wohlgemuth, whose profile states that he is located in Vancouver, Canada, and is a co-founder of Estraterra. Wohlgemuth would be a recurring figure throughout this investigation.

Despite Wohlgemuth’s Canadian location, a Google search found his name on official documents showing that the company was founded in Ecuador on July 19, 2017.

The document indicated that the company would be operated under the laws of the Republic of Ecuador, suggesting that the firm is based in Ecuador. It also specified that the company can operate subsidiaries overseas, thus accounting for the Canadian connection.

According to the document, the company’s purpose is to “provide technical advice on communications and publicity, including consultancy, professional assistance, trainings, and provision of services,” targeting, for example, “strategic communications and marketing.”

According to its website, Estraterra is a strategic political communications company that helps connect “progressive political movements and governments around the world meaningfully with their constituents.”

In addition to the LinkedIn account, one of the accounts removed by Facebook in the takedown also went by “Roberto Wohlgemuth.” A further Google search revealed an official document indicating that a Roberto Wohlgemuth served as an advisor at the National Secretary of Public Administration in Rafael Correa’s presidential administration as of 2011.

Wohlgemuth was not the only connection to the Correa administration. Another of the removed Facebook accounts was for a Giovanni López, Jr., for whom a similar Google search found an official document stating that he was serving as a technical assistant for media and public relations in the vice president’s office as of 2014.

Target: Latin America

A large proportion of the Facebook pages and Instagram profiles that the DFRLab had access to posed as independent news entities and fact-checking media outlets, with supportive content aimed at leftist leaders in Latin America and negative content aimed at right-wing political figures in the region, including Brazilian President Jair Bolsonaro, Chilean President Sebastian Piñera, former Argentinian President Mauricio Macri, and Juan Guaidó, who is recognized by more than 60 countries as interim president of Venezuela.

According to the pages’ creation dates and content, several of the network’s assets operated almost exclusively during presidential campaigns in South America, including in Chile (2017), Ecuador (2017), Venezuela (2018), Argentina (2019), and Uruguay (2019).

In Ecuador, the pages promoted the candidacy of Lenin Moreno, who at the time the assets were active was nominated as presidential candidate for Correa’s Alianza País’s party. Moreno won the election and is currently serving as president of Ecuador. After Moreno took office, disagreements between him and Correa led to a political rupture. The assets involved in the takedown similarly pivoted from supporting Moreno’s candidacy to attacking him after he fell out with Correa. Other pages attempted to discredit the opposition candidate, Ecuadorian businessman and politician Guillermo Lasso. None of the posts, however, appeared to be anything more than standard political attack advertisements.

Other assets in the set pushed for the reelection of Venezuela’s Nicolás Maduro in 2018 and Alberto Fernández in Argentina. Fernández was the center-left candidate for the Argentinian presidency while the assets were active in 2019. Other pages targeted the 2019 Argentinian elections with attacks on the incumbent candidate, Mauricio Macri. Fernández won the contest.

Most of the pages that targeted the different presidential elections around the region operated only during the campaign. They stopped publishing content on the platform immediately following the elections.

Out of the assets the DFRLab had access to, only two paid for promotion using Facebook’s advertising platform under the category “issues, elections, or politics.” One of these pages, El Austral Digital, launched around 32 ads in October 2019. These took aim at an Argentinian audience, sometimes specifically targeting users in the capital Buenos Aires.

Beyond those assets, however, the network also focused more broadly on ongoing domestic politics in both Ecuador and Chile, including content on former presidential candidates, political party leaders, members of national assemblies, and mayors.

The Facebook and Instagram assets also featured U.S. President Donald Trump heavily, as many on the left in Latin America see him as a useful foil to galvanize left-wing readers. In particular, they used Trump as a means of attacking Guaidó, who has been challenging Nicolás Maduro for control of Venezuela since January 2019, following the country’s highly contested 2018 presidential election. Other pages posted content based on the January 2020 U.S. military strike that killed Iranian Islamic Revolutionary Guard Corps Major General Qasem Soleimani.

A few of the assets posted COVID-related content, with a focus on the city of Guayaquil, which has been hard hit by the coronavirus outbreak.

Some of the assets openly acknowledged their support for Ecuador’s Correa and Venezuela’s Maduro. For example, the Instagram account @correistas — a name that itself references supporters of former president Correa — posted photos that put Correa in a sympathetic light.

The DFRLab used VGG16 Tensorflow Keras, a machine learning application, to analyze image similarity among the nearly 9,000 photos posted on Instagram by the network, including applying it to pictures of former president Rafael Correa. The analysis concluded that that two assets on Instagram, @correistas and @seguidoresdecorrea, mainly shared pictures of Correa, uncovering many photos similar to the input photo of Correa.

Inauthentic activity on Facebook and beyond

The DFRLab was able to corroborate signs of coordinated inauthentic behavior in the network. Many pages, for example, posed as independent news outlets in the region and were created either on the same day or within a few days of each other.

Many of the assets were created in clusters. For example, some of the assets focusing on the 2017 Ecuadorian presidential election were created around the same time period. Similarly, there was an overlap in page manager locations. Although these pages had mostly Ecuador-based managers, two of them showed Canada as well, according to Facebook page transparency data.

Another group of pages, which targeted mostly Venezuelan politics, were created between February 8 and 9, 2018, before the presidential campaign in Venezuela. The DFRLab identified three main groups of pages. In each subset, pages were created on the same day.

The investigation also found that some of the assets operated using duplicate and fake accounts. It is unclear, however, if some of the duplicate accounts were created because a previous one had been removed by the platform.

Alongside the duplicate accounts, at least one of the removed accounts had a profile picture generated using a generative adversarial network (GANs). As the DFRLab has previously identified in collaboration with Graphika, AI-generated faces can be recognized by analyzing features on the image, such as background details, hair, lips, and asymmetry between eyes or ears.

Another group of accounts appropriated images from elsewhere online, including from football players or actresses. Using Google’s reverse image search, the investigation was able to identify some of the profile pictures used by the user accounts. Additionally, two assets used profile pictures of Argentine football star Lionel Messi.

In addition to the activity on Facebook, there was also evidence of inauthentic activity on Twitter being directed by the aforementioned @correistas Instagram account.

The same tactic was deployed via a dedicated Telegram channel, also named Correistas, invited members to join a hashtag campaign on Twitter by posting a message and using the hashtag.

After these calls to action, some of these hashtags reached the trending topics on Twitter while showing signs of traffic manipulation.

For instance, according to Twitter listening tool Trendinalia, the hashtag #NoSeMetanConCorrea (“Do not mess with Correa”) — which was promoted on Instagram by @correistas on June 11, 2018 — reached the trending topics on the same day. The hashtag garnered 38,483 mentions, and the top 10 percent of the most active accounts generated nearly 70 percent of the publishing volume, indicating that a small group of accounts coordinated in an effort to push this hashtag to trend.

Connections between assets

To analyze the relationship between the user accounts on Facebook, the DFRLab created a social network graph based on friendship connections. This process only took into consideration connections between 29 of the 35 user accounts removed as a part of the takedown to which the DFRLab had access; the remaining six restricted access to their friends lists.

The resulting graph revealed Estraterra co-founder Roberto Wohlgemuth’s user account to be the most connected node in the Facebook network, suggesting that many of the analyzed accounts were “friends” connected with him. Other relevant profiles in the network were Santiago Silva, Pepito Redes, and Giova López.

The links indicated that the user accounts did not operate in isolation. On the contrary, these connections may suggest signs of coordination. In Wohlgemuth’s case, at least, it is likely that his personal user account was removed because he appeared to be the central personality for Estraterra’s coordinated inauthentic behavior activities on the platform.

The DFRLab created a second social network graph to analyze Instagram assets based on the profiles followed by the removed accounts. The resulting graph revealed that some of the assets that posed as independent news entities had followed each other.

External websites with identical content

Beyond Facebook and Instagram, the DFRLab identified at least 33 external websites linked to assets on either platform. Although some of the websites are no longer available, old versions for some of the websites were still available on the Internet Archive’s Wayback Machine.

All the active off-platform websites linked to the assets used WordPress as their content management system. Additionally, some of the websites appeared to be connected with a shared user account (UA code) for Google Analytics and a shared publisher ID for a Google AdSense account, pointing to coordination beyond Facebook and Instagram.

Some of the websites appeared to use the AdSense account as a means of generating revenue by hosting advertisements.

According to WHOIS search results, a tool that allow researchers to find information on any domain name or website, many of the sites in question were registered on the same day, sometimes within only a few seconds. In all cases, the registrant name was not available.

A search using WPScan also showed links between the websites. While the usernames used to access the backend of the WordPress site did not match with the removed accounts, including Wohlgemuth, the scan revealed identical username patterns across websites, such as “editor,” “editor1,” “colab_1,” “colab_2,” etc.

Identical content on and off Facebook

The interchange between the off-platform websites and on-platform assets demonstrated the comprehensive case for CIB: different but similar assets on Facebook and Instagram linked to “copypasta” articles on different external websites, many of which shared the same background details such as Google AdSense or Analytics IDs.

Posts published at the same time across the Facebook and Instagram network also included links to the external websites. Instagram profiles connected to Semanario La Region and Latam Post, for example, published similar images to each and links to articles with verbatim content between the respective websites.

The content of the off-platform articles was not the only identical language found between the assets. On May 6, 2019, for example, the same Instagram profiles as above used an identical caption for two different images. One of them, however, featured a caption that did not align with the context of the accompanying photo. Despite this, the posts were published within seven minutes apart from each other.

Accounts supporting Rafael Correa also shared similar photos on Instagram. Although these profiles published on different dates, both accounts @correistas and @seguidoresdecorrea (“Correa followers”) shared identical content in their timelines.

On Facebook, the pages “¿Y Tu? ¿No Quisieras?” (“and you? Wouldn’t you like to?”) and “Las Cosas No Son Lo Que Parecen” (“Things are not what they seem”) published identical posts within the same hour. The pages were created on July 5 and 7, 2019, respectively.

Asset engagement on Facebook and Instagram

Approximately 400,000 Facebook and Instagram accounts followed one or more of the assets provided to the DFRLab by Facebook.

According to a query search on the social media listening tool CrowdTangle, the removed Facebook pages published 10 posts per month between January 2017 and July 2020, and garnered nearly 3,400 interactions monthly, including likes, and reactions.

In the first quarter of 2019, there was a peak in the number of published posts. This activity can be explained by the number of assets, at least 16 pages, created on the same year. Nevertheless, small peaks in the number of posts match with presidential campaigns, including the Ecuadorian and Chilean elections (January 2017), Venezuela’s January 2018 presidential campaign, and the 2019 Argentinian elections.

In total, these Facebook assets amassed 3.1 million interactions. Between December 2017 and January 2018, the page “Diles No a los Traidores” (“Say no to the traitors”) garnered one-third of all interactions. Despite the number of assets increasing after 2019, the volume of interactions remained low compared to previous years.

In its independent analysis of the Estraterra–affiliated assets removed as a part of Facebook’s latest takedown, the DFRLab was able to corroborate many of the connections between the assets involved. Moreover, the assets were clearly linked to former government employees in Ecuador with ties to the administration of former president Rafael Correa.

While many of the assets posed as independent news entities with associated fringe websites, the content did not appear to be doctored, nor was it evidently disinformation in the strictest sense of the term. It seems, however, that this set of Facebook assets engaged in coordinated inauthentic behavior while aiming to push narratives based on progressive political movements in conjunction with numerous South America presidential elections.

---

Esteban Ponce de León is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Daniel Suárez Pérez is a Research Assistant, Latin America, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.