The network, previously investigated by Bukvy and the DFRLab, worked in favor of the Servant of the People party

By Roman Osadchuk and Givi Gigitashvili

On May 6, 2021, Facebook announced the removal of 105 accounts, 24 pages, and five Instagram profiles connected to Ukrainian President Volodymyr Zelensky’s political party, Sluha Narodu (‘Servant of the People’). The takedown was connected to earlier independent investigations made by the DFRLab and Bukvy on a network of pages that promoted pro-Zelensky and anti-opposition messages and articles.

In their statement, Facebook said:

The people behind this network used a combination of authentic and fake accounts — some of which had already been detected and disabled by our automated systems — to post, manage Pages posing as independent news Pages, and drive people to off-platform websites masquerading as news entities. Some of these accounts went through significant name changes over time. They frequently shared posts from legitimate news organizations in Ukraine, in addition to posting their own content. This network unpublished and deleted many of its Pages and accounts in February 2021 when some of this activity was reported on by Ukrainian journalists. This campaign had limited following when we removed it.

The people behind this activity posted in Ukrainian and Russian about news and other topics like corruption; politics; automotive industry; satiric content about covid-19; supportive commentary about the Sluha Narody party and the current Ukrainian government; and criticism of opposition parties and politicians including former president Poroshenko and the mayor of Kyiv, Vitali Klitschko.

THE DFRLab had access to a subset of 85 of these assets prior to their removal from the platform. We analyzed the public postings of five pages before they were removed from the company’s platforms; we also reviewed accounts discovered through public searches of the Facebook Ad Library to determine who sponsored any promotions of the pages in question. All of the pages presented themselves as focused on political news.

Pages

Among the five pages analyzed, the DFRLab found that they shared political news and memes mocking politicians, except President Zelensky and his Servant of the People party. Four pages had fewer than 1,000 subscribers at the time of removal, but the most popular and oldest page, “Старі політики” (“Old politicians”), had 8,443 followers. We analyzed the content of all five pages from their inception to their removal. According to historical data from the Facebook analysis tool CrowdTangle, the pages predominantly published images and links to external websites.

Political ads

DFRLab assessed five pages, three of which ran political ads. The oldest page in the set, the aforementioned Старі політики, had purchased multiple Facebook ads since 2019. In March 2019, before the first round of the presidential election, the page ran ads that targeted then-President Petro Poroshenko, who would eventually lose to current President Volodymyr Zelensky. The page intensified its mocking of Poroshenko when both he and Zelensky proceeded to the runoff. The page published memes that blamed him for manipulating and violating the law. One of the ads used a snippet from Zelensky’s TV series, “Servant of the people,” which was taken down by Facebook because it went against its political advertising policies.

After the elections, the channel continued attacking the former president and other politicians in opposition to Zelensky and his political party. The page used the same phone number as pages previously taken down by Facebook after investigations by the DFRLab and Bukvy. These removed pages shared materials and identified four websites in the disclaimer information in Facebook’s ad library. According to DNSLytics Reverse Analytics, a Google analytics code search tool, all four websites — newstime.news, newstime.buzz, proukraine.online, and theukrainenews.com — are connected via a unique Google Analytics ID. Moreover, all four websites were registered under the same email address, not associated with websites identified in this set.

The other two pages that ran ads were created in October 2019 but did not start advertising until March 2021, after multiple pages of the previous network were taken down that February. One of the pages, “Новини Країни” (“State News”), promoted political content during parliamentary by-elections. The contentious elections ended with a victory for a Servant of the People party member. State News ran an ad that blaming campaign opponent Oleksandr Shevchenko, founder of the Bukovel ski resort, for COVID-19 deaths. The page launched multiple ads, where Ukraine’s prime minister and the minister of healthcare said that Shevchenko should bear criminal responsibility because the ski resort became a hotbed of COVID cases. The page targeted the ads for the Ivano-Frankivsk region, where the by-election was held.

The ads were paid for by the page “Новини України” (“Ukraine News”). An organization with the same name but different address and phone number also paid for advertisements on a page that was a part of the network taken down earlier this year.

Websites

None of the five evaluated pages listed a website in its ‘About’ section. However, three pages that ran ads identified websites in a disclaimer. They identified three different websites — uavisti.com, newsuaworld.com, staripolitiki.com.ua. The last website does not currently exist, while the first two are real websites with similar structures and a few political posts. The pages did not use materials from these websites, suggesting the websites might have been developed for future use or were a cover to pass a Facebook check to run ads.

While the Facebook pages concealed their connection, the websites did not. According to WHOIS data, the same person from Kamyanets-Podilsky, Ukraine registered both websites. According to Domain Tools, a website analysis tool, the same person also administered four other websites that also published news/blogs but were not widely shared on the platform. However, one of them contained a link to the now-defunct page, “My Ukraine,” which was not included in the set.

Users

Alongside these pages, Facebook removed 105 user accounts, of which the DFRLab had access to 95 of them. According to open-source data of liked pages discovered using the analysis tool Multiple Tools for Facebook, we collected all likes and identified the number of accounts following the same pages.

Of the five most-liked pages, four are automotive oil and lubricant pages that do not publish politics or news. The second most-liked page is an official but abandoned page for Dolynska, a city in the Kirovohrad region of Ukraine. The sixth most popular is an official page of European Solidarity in Kharkiv, a political party led by former President Poroshenko. The DFRLab could not identify the reasons behind the high like rates for these particular pages.

Some of inauthentic accounts removed by Facebook shared content from Yevheniya Kravchuk, who is a member of Ukrainian parliament and deputy chairwoman of President Zelensky’s Servant of the People party. Yevheniya’s posts contained information about the closure of Ukrainian border check points during COVID-19; multiple fake accounts shared one of her posts on the same day, which could indicate possible coordination between them.

The DFRLab also observed that multiple inauthentic users posted or shared link to articles written by Sergei Lyamets, secretary of the National Union of Journalists. One widely shared articles written by Lyamets argued that three oligarchs brought Ukrainian energy industry to a crisis point as President Zelensky tried to diminish their influence. Upon sharing Lyamet’s article, inauthentic accounts wrote in the posts’ description that Ukraine should do away with its green/alternative energy tariff, because it allows oligarchs to increase their wealth. Other articles written by Lyamets and shared by inauthentic assets were also related to the energy industry, as well as Ukraine’s banking sector. Similar to the amplified Yevheniya Kravchuk post, some of the posts linking Lyamet’s articles were also posted on the same day.

Some of the inauthentic accounts also used stolen photos as profile photos. The DFRLab used the Find Clone photo search engine and found that photos were mainly stolen from VKontakte users. Stealing pictures from other users is a common practice for creating fake identities for inauthentic assets.

Conclusion

In this latest Facebook takedown concerning Ukraine, the DFRLab found numerous indicators of inauthentic activity among the removed assets. Multiple assets used stolen pictures from other social media, followed the same pages, and shared identical posts in favor of the President Zelensky or his party members. Pages ran political ads aimed at party opponents both within and outside election season.

While an open-source investigation could not tie the assets directly to the Servant of the People political party, the narratives posted and ads purchased suggest the network intended to support the President Zelensky, his party and its political goals.

Roman Osadchuk is a Research Assistant, Eurasia, with the Digital Forensic Research Lab.

Givi Gigitashvili is Research Assistant, Caucasus, with the Digital Forensic Research Lab.

Cite this case study:

Roman Osadchuk and Givi Gigitashvili, “Facebook removes Ukrainian pages promoting Zelensky’s political party,” Digital Forensic Research Lab, May 6, 2021, https://medium.com/dfrlab/facebook-removes-ukrainian-pages-promoting-zelenskys-political-party-d5600998cb06.

Follow along for more in-depth analysis from our #DigitalSherlocks.