Accounts removed in July 2020 were connected to employees of Bolsonaro and his family
By Luiza Bandeira
A recent Brazilian Federal Police investigation has revealed connections between an advisor to Flávio Bolsonaro, a son of Brazilian President Jair Bolsonaro and a senator, and an inauthentic network targeting Brazilian audiences that Facebook removed in July 2020. According to the Federal Police, the staffer, Fernando Nascimento Pessoa, was linked to at least two inauthentic assets that were part of the operation.
On July 7, 2020, Facebook took down a network promoting President Jair Bolsonaro and his allies and attributed the operation to individuals linked to several members of Bolsonaro’s inner circle, including an employee of the office of Flavio Bolsonaro. At that time, the DFRLab had access to a subset of accounts that did not include this employee’s account, so it was not able to corroborate the attribution.
Now, the Federal Police has released a report that, based on Facebook data, shows that among the assets removed, some used IP addresses linked to Fernando Nascimento Pessoa. According to the Federal Police, at best, the managers of inauthentic accounts gathered at Pessoa’s address; at worst, he was the owner of between two and five inauthentic assets.
The information sheds more light on the connections between President Bolsonaro and his allies and influence operations on social networks targeting domestic audiences in Brazil. Apart from Flavio Bolsonaro, one advisor for Jair Bolsonaro himself, as well as two employees of Congressman Eduardo Bolsonaro — also a son of Bolsonaro — were also involved in running the network. One of the involved staffers had previously worked with President Bolsonaro’s third son, Carlos Bolsonaro, a councilman in the city of Rio de Janeiro, which means that employees of President Bolsonaro and all three of his sons were directly connected to this network.
The investigation
The DFRLab had access to a subset of profiles that were removed by Facebook due to a partnership between the two organizations. While Facebook has access to back-end data, such as IP addresses and registration information, the DFRLab looks at the front-end information, as it appears to the public browsing Facebook.
The network used fake and duplicate profiles, as well as pages masquerading as independent journalistic outlets, to spread content promoting Jair Bolsonaro and attacking his opponents. In total, Facebook removed 33 profiles, 14 pages, one group, and 37 Instagram profiles — not all of them were analyzed by the DFRLab.
Among those whose profiles were removed were Tercio Arnaud Tomaz, President Jair Bolsonaro’s advisor who used to work for Carlos Bolsonaro, and Paulo Eduardo “Chuchu” Lopes and Eduardo Guimarães, who worked with Eduardo Bolsonaro. Employees of other politicians from the PSL, Bolsonaro’s former political party, also had their accounts removed.
The removal happened when authorities in Brazil, including Congress and the Federal Police, were already conducting investigations into the use of disinformation and inauthentic behavior for political purposes. Some of these authorities included the information published by the DFRLab in their investigations.
Ever since the 2018 campaign that elected Bolsonaro, disinformation and influence operations have been the subject of intense debate in the country. The situation escalated in the first half of 2020, when protests calling for the closure of Congress and the Supreme Court were held and extremists launched fireworks at the Supreme Court building.
On June 4, 2021, O Estado de S. Paulo newspaper revealed that Brazil’s Prosecutor Office asked the Supreme Court for the closure of the inquiry that investigated who was financing these anti-democratic protests. The organ claimed that the police could not establish the connection between the congressmembers under investigation and the crimes. The Federal Police, however, had pointed to other avenues for the investigation to move forward and asked for it to be continued. The final decision will eventually be made by Supreme Court Minister Alexandre de Moraes.
With this development in the process, details of the Federal Police investigation became public, revealing the connections between Flávio Bolsonaro’s employee and the inauthentic network.
The Flávio connection
After being contacted, Facebook sent information about the removed assets to the Brazilian Federal Police. The police discovered that on at least 1,045 occasions, access to the assets taken down by Facebook came from public buildings, such as the offices of the Presidency, Congress, the Army, and Rio de Janeiro’s City Council. Accounts belonging to Tercio Arnaud Tomaz were also accessed through the internet connection of Michelle Bolsonaro, Brazil’s first lady — probably, according to the police, from President Bolsonaro’s house in Rio de Janeiro.
The police also identified the connection between Fernando Nascimento Pessoa and the network. Pessoa worked directly with President Bolsonaro between 2009 and 2014. He is currently an employee of Flávio Bolsonaro, receiving some R$ 22,944 per month (pre-taxes).
Using data about internet subscriptions and IP addresses, the Federal Police discovered that the Instagram accounts “SnapNaro” and “Trump we Trust” used a single IP address connected to Pessoa’s internet subscription on different occasions. The Federal Police also captured the account DiDireita using the same internet connection.
According to the police, two hypotheses can be considered: either Pessoa was the operator of the accounts SnapNaro, DiDireita, and Trump We Trust, or the operators have been to his house on different occasions. The Federal Police added that, if the former is correct, it is likely that Pessoa was also the operator of the accounts “Tudo é Bolsonaro” and “Porque o Bolsonaro?”, as both were registered under the same email. Another account, “Snapressoras,” was also accessed with an IP connected to Pessoa.
In its statement included in the investigation, Facebook stated that the accounts were all removed because the “infrastructure signal shows that this Complex Object was managed or created by violating account (s) to mislead users.”
The DFRLab had access to four accounts mentioned as possibly belonging to Pessoa. At the time they were removed, they had little to no visible activity and a total of only 381 followers.
Some of these accounts can be connected to the broader network by follower-following relations, albeit this alone does not necessarily imply coordination. The account Tudo É Bolsonaro, for instance, followed pages on the network such as Bolsoneas and Bolsonaro News. It also followed other pages related to the Bolsonaro family, such as the page of Bolsonaro’s ex-wife, Rogeria Bolsonaro, and other pages of influencers accused of leading acts against democracy, such as Sara Winter.
The connection of a staffer of Flávio Bolsonaro to this operation was somewhat surprising, as investigations about influence operations in Brazil usually mention Carlos Bolsonaro and sometimes Eduardo, but not Flávio.
Flávio, however, is currently being investigated for an unrelated matter: he is suspected of heading a corruption scheme known as “rachadinha.” Under this scheme, employees would be hired under the assumption that they had to give back part of their salaries to their employer. In the context of this investigation, in May 2019 the Public Ministry requested the breach of bank secrecy of some of Flávio’s advisors, including Pessoa. This investigation is ongoing; all the actors mentioned deny the accusations.
Luiza Bandeira is an Associate Editor with the DFRLab.
Cite this case study:
Luiza Bandeira, “Investigation reveals link between Flávio Bolsonaro advisor and 2020 Facebook takedown,” Digital Forensic Research Lab (DFRLab), June 11, 2021, https://medium.com/dfrlab/investigation-reveals-link-between-fl%C3%A1vio-bolsonaro-advisor-and-2020-facebook-takedown-573d3ef4120a.
