BANNER: Documents showing vote counts received at a polling station are seen in Warsaw, Poland, on October 19, 2023. (Source: Jaap Arriens/NurPhoto via Reuters)

This report was produced as part of the international election-monitoring project of the Polish Election Watch network, as implemented by Alliance4Europe, OKO.press, and the Atlantic Council’s DFRLab.

The DFRLab identified a network of twenty-nine Facebook pages acting in support of the opposition political party Civic Platform and seemingly engaged in what Meta refers to as “inauthentic sharing” of content.

This activity came ahead of Poland’s parliamentary election on October 15 and amid accusations that the ruling Polish Law and Justice (PiS in Polish) party was eroding democratic institutions within the country. Since being voted into office in 2015, among other things, PiS has been “widely accused of politicizing the judiciary, turning public media into a party mouthpiece, using state assets to extend its grip on power, and fanning homophobia.” Meanwhile, Russia has been found meddling in Poland’s internal affairs via influence campaigns, attempting to destabilize its neighbor because of its support for Ukraine.

As a result of the latest parliamentary elections, PiS won the largest share of the vote – 35.38 percent – but lost its overall majority in the parliament. The opposition parties – the centrist Civic Coalition (30.70 percent), center-right Third Way (14.40), and The Left (8.61) – obtained a combined majority, giving them the right to form a governing coalition. In the aftermath of the vote, however, Polish President – and PiS ally – Andrzej Duda, who has a duty to call for and empower the formation of a new government, has not yet done so. Instead, on November 6, Duda empowered PiS to try to form a government, even though all other parties have so far refused to form a coalition with PiS. Without an overall majority, PiS will likely fail to form a government.

While the pages identified as a part of this investigation, at minimum, appeared to be deliberate in their support for Civic Platform and antagonism for PiS, coordinated networks on social media have also previously promoted Poland’s ruling party and attacked its opponents. In May 2019, for instance, Facebook deleted a network that engaged in coordinted inauthentic behavior and widely disseminated pro-PiS and anti-opposition content. In August 2019, PiS-appointed Deputy Justice Minister Łukasz Piebiak had to resign after it was revealed that he led a coordinated online harassment campaign to blackmail judges who were critical of PiS.

With regard to the pages comprising this investigation, the content was not particularly notable, consisting mostly of relatively average political attacks or boosterism, but the transparency as to where they were coming from was seemingly intentionally obscured at times. Meta’s crossposting functionality allows Facebook users to share videos across multiple pages simultaneously, which greatly improves a user’s ability to push those videos to a wider audience at scale. That said, it was uncertain the extent to which the uncovered behavior violated Meta’s crossposting principles, inauthentic sharing of content guidelines, or inauthentic behavior guidelines.

The DFRLab’s investigation found that this network, active ahead of the October 15 elections, acted in support of the main opposition party Civic Platform; some of the pages in the network appeared to be more directly affiliated with the party at local levels while others were merely boosters. Given that the political and media landscapes in Poland remain highly polarized, political actors may be tempted to use deceptive tactics and techniques on social media in order to manipulate public opinion in an attempt to improve their electoral chances pre-election or, post-election, generate instability or distrust of the outcome.

The DFRLab identified a network of at least twenty-nine pages all pushing the same political content, and they tended to fall into one of three categories based on their names. The pages in the first category clearly conveyed their political affinity and often anti-PiS and anti state-controlled media sentiments in their names and descriptions. The pages in the second category had names that were not obviously political on their face but that could be interpreted as political when considered alongside the content. The third category featured pages with apolitical names, despite the fact that they mostly posted the same political content as the pages in the first two groups. The third category presented the least transparent case, as the unrelated names obscured political motivations. Regardless of their names, all these pages crossposted identical political content, hinting that they are most likely managed by the same person or people.

Just before the election in mid-October, but well after the DFRLab’s initial research, the vast majority of pages in this network – twenty-five of twenty-nine, as evident in image above – changed their profile photos to that of the Civic Coalition’s heart-shaped logo, which is directly tied to the Civic Platform’s 2023 election campaign. Before changing profile images, as of September 2023, none of them had featured the same profile image.

The central page in this network appeared to be “Beet Juice” (“SokzBuraka”). In a majority of cases reviewed by the DFRLab, this page was the owner of the video being crossposted by the other twenty-eight pages. Created in 2014, SokzBuraka had over 1.3 million followers as of August 30, 2023.

The page description says that SokzBuraka is the “largest political satire community with a slight political flavor.” A 2019 investigation by Polish media outlet Tygodnik “Sieci” reported that Mariusz Kozak-Zagozda, reportedly a Civic Platform employee and Warsaw City Hall worker, managed the SokzBuraka page. Rafał Trzaskowski, Mayor of Warsaw and a Civic Platform leader, subsequently confirmed that Kozak-Zagozda was indeed working at Warsaw City Hall but did not clarify details regarding his involvement with the Facebook page. Trzaskowski argued that it was nonsense to suggest that Warsaw City Hall had any influence on “what this person [Kozak-Zagozda] did during his free time.”

In March 2021, Polish Foundation Otwarty Dialog (“Open Dialogue”) announced that it took over the management of the SokzBuraka Facebook page in order to support civic initiatives as well as “defending democracy, the rule of law, broadly understood freedom and human rights.” Otwarty Dialog’s statement pledged that SokzBuraka would never be a political project and would remain civic in nature.

Nine months later in November 2021, however, Otwarty Dialog announced that it was resigning from managing the SokzBuraka page, because the founders of SokzBuraka continued to use the page to “promote opposition politicians, including those associated with the Civic Platform.” The resignation statement declared that the page’s founders seemed to have different goals and, since the foundation “could not deprive them of their editorial rights,” it was compelled to resign from running the page. Otwarty Dialog also confirmed that SokzBuraka would remain under the control of Crowd Media. In September 2019, however, media outlet Dziennik Gazeta Prawna reported that Crowd Media belonged to a company managed by Kinga Górska, the wife of Michał Górski, who was at the time a Civic Platform candidate in Wroclaw. However, before Otwarty Dialog confirmed it, Kinga Górska denied that she knew anyone who ran the SokzBuraka Facebook page.

The DFRLab investigation revealed that many of the pages in this network regularly distributed content from Crowd Media. Moreover, it seemed that the people behind this network used post scheduling for distribution of Crowd Media content across multiple pages in this network. For example, Crowd Media and at least ten pages in the network posted the same text published at exactly the same time and with verbatim text. Moreover, Crowd Media’s official Facebook page published the same link at the exact same time and with the same message as other pages in the network, indicating a connection between the network and Crowd Media or, at least, between the manager of its Facebook page and those who manage this network.

The operators behind SokzBuraka also managed the namesake website SokzBuraka.pl in the past, but it seems that the website is no longer under their control. As of September 6, the minimalist landing page of SokzBuraka.pl website reads (in Polish, machine translation):

“dear lovers of hate and fake news, over the years, this address has been associated with a lack of any objectivity, a wave of hate and hatred, which is hard to find elsewhere nowadays. But this is the end, it’s time to seal with adhesive tape what was and appreciate real beet juice, which has many properties such as relieving depression, neuroses and emotional tension that many people will probably appreciate.”

The website then provides a recipe for beet juice. That appears to be the only content on the website beyond a simple contact email address and a button for Facebook that, when pushed, prompts the person to post a link to the website to their Facebook feed. The DFRLab used Wayback Machine internet archiving tool and found an archived version of a landing page of the SokzBuraka.pl website from April 2017. Moreover, an archived version of the website from Archive.Today captured in June 2016 showed that visitors of SokzBuraka.pl were automatically redirected to the SokzBuraka Facebook page.

A WhoIs query for SokzBuraka.pl showed that the website changed its hosting server seven times over the last nine years, the last time in 2020, but it did not contain information about the owner of SokzBuraka.pl or when the owners may have changed. The copyright notice for the website dated back to 2020.

As of November 3, 2023, the domain name SokzBurka.pl appeared to be available for purchase.

The Facebook pages in the network, as identified by the DFRLab, regularly crosspost videos mostly from the SokzBuraka page but without declaring an affiliation or ownership between the content and crossposting page, as required by Meta’s crossposting principles. According to Meta, pages have to establish a crossposting relationship or have administrators or managers in common, and it is only under these circumstances that crossposting between pages is allowed. Crossposted videos are visible on a crossposting page the same as if they are posted by the original page.

As visible below, crossposted videos from the network appeared as if they were posted directly to a page without any sign of their provenance, and the same pages did not inform their followers that they crosspost content from other pages.

Moreover, the DFRLab found that a video, owned by the SokzBuraka page, was crossposted on pages created for Civic Platform supporters in different Polish territorial administrations: Platforma Obywatelska Błonie (Civic Platform Blonie), Platforma Obywatelska Łomianki (Civic Platform Lomianki), and Platforma Obywatelska Nowy Dwór Mazowiecki (Civic Platform Nowy Dwor Masovian). More specifically, descriptions for the first two pages stated that they had been created for supporters of Civic Platform.

The third page, Platforma Obywatelska Nowy Dwór Mazowiecki, stated in its description: “Welcome to the profile of the Civic Platform of Poland #NowyDwórMazowiecki #PowiatNowodworski;” unlike the first two pages, it did not say that page had been created for supporters. Moreover, the Platforma Obywatelska Nowy Dwór Mazowiecki page said that it is a political organization and linked to the official website of Civic Platform in its description. It also provided a party email address in its contact details. One post about the meeting of Civic Platform members with Polish electorate published to this page says: “the Civic Coalition team works every day! Daily conversations with you only convince us that their [current government] time is over. Help us win this election and share this post with your friends,” indicating that the administrator (or administrators) of the Obywatelska Nowy Dwór Mazowiecki page were connected directly with the party. This could mean that the people behind SokzBuraka and its associated pages were also potentially affiliated with the party at a local level, at minimum, and could even manage its Facebook pages.

Besides crossposted videos and scheduled posts, pages in the network manually shared identical posts from other users and pages in a seemingly coordinated fashion, as evident by the posts’ timestamps. Given the longer period of time between posts across the network of the same content, it is likely that the relevant posts were manually reposted instead of automated, as would likely be the case when the posts are merely seconds apart.

Again, the content of these videos was relatively standard political attacks, and that the pages did not hide any connection to Civic Platform was not problematic in itself, instead it was the degree to which the pages obscured their relationship.

Several pages in this network also exhibited signs of inauthentic behavior. More specifically, they used page descriptions and names discordant with the type of content they post. The posting history for these pages indicated that the vast majority of them have been amplifying similar or identical political content from the beginning and therefore these pages were most likely created by people behind the network. As such, in some cases, they may have selected names for the pages explicitly to obscure their connections with pages that displayed their political affinity more explicitly. This type of misdirection – using a topical name that does not match the topic of the posts – is often undertaken to attract a wider audience, including to draw in those who are less politically inclined.

For example, the page Warszawa się śmieje (“Warsaw is laughing”) seemed to be positioning itself as an entertainment page – though that does not discount the possibility of political satire – for which its description reads: “every day we will show you what makes Warsaw laugh.” However, this page posted content promoting Civic Platform and discrediting the ruling party. The page, created in October 2018, first crossposted a video from SokzBuraka in March 2019, though it was posting anti-PiS political messaging from the outset. The page name – when put side by side with the content it posted – could be interpreted as a reference to the political class in the Polish capital, Warsaw; as such, this led the DFRLab to categorize it as subset two, consisting of those pages with names that fell somewhere between political and apolitical before looking at their contents.

Another page in the network, Coronavirus alert, based on name alone, portrayed itself as focused on the COVID-19 pandemic. Created on March 12, 2020, it initially posted COVID-19-related, apolitical memes, but the page shortly pivoted and started posting anti-ruling party and pro-Civic Platform political memes. Audience building using apolitical topics before pivoting to political content is a common tactic for actors who ultimately wish to influence viewers toward their political views or candidates. It crossposted first video from SokzBuraka on March 27, 2020.  

memnews.pl, another of the suspicious pages and one of the oldest in the network, described itself saying that it covers “politics and humor in infographics,” but it published almost identical political content – not infographics – as other pages in this network. The page’s transparency information indicated that it was created in June 2015, when it mostly seemed to post Polish industrial business news in a relatively optimistic or neutral tone and did not post political content.

At the time of analysis, its intro section included a link to an external website, memnews.pl. A CrowdTangle query showed, however, that the Facebook page had never shared any links to that external website. Instead, within the pages in the network, the page to most frequently amplify the memnews.pl website was Nie lubię PiS (“I don’t like PiS”), while the SokzBuraka page was the second most active distributor of external links to memnews.pl.

The DFRLab found a Google Analytics code for memnews.pl website, which it shared with another website, zakazanememy.pl. The latter website posts memes and screenshots of tweets carrying anti-PiS messages. The Nie lubię PiS Facebook page – which, as above, shared the most links to the memnes.pl website – was also the most prolific in sharing links to zakazanememy.pl. Given the extent to which both memnews.pl and zakazanememy.pl links were shared across the network, it is possible that the websites are also run by the same people as the Facebook pages.

Another of the oldest pages in the network, Wolne Miasto Wołomin (“Free City of Wolomin”), positioned itself as dedicated to the Polish city of Wolomin. Created in June 2015, the page description reads: “Wołomin – a city in the Mazowieckie Voivodeship, the seat of the Wołomin County and the urban-rural commune.” From its outset, it posted political content, often criticizing PiS or supporting Civic Platform. More recently, the page published the same or similar anti-PiS content and crossposted videos as the other pages in the network.

Another of the Facebook pages, Emeryci, Renciści i Pacjenci (“old age pensioners, disability pension recipients and patients”), claimed that it aimed to fight for “higher pensions without taxes, cheap medicines and doctors without queues.” Indeed, it started its life in December 2018 posting attacks on PiS, but specifically on the topics of the state of the country’s pension and healthcare systems, which were overseen by PiS officials. Similar to other pages in this network, however, more recently this page published broader, less specific anti-PiS and pro-Civic Platform content that was frequently identical to that of other pages in the network.

The introduction to another suspicious page, Dramat w LOT (“Drama in LOT,” a reference to the Polish airline), reads “we are LOT employees, and we want Poles online to know what is really going on in the planes;” created on October 18, 2018, the same day as the start of a strike at the airline, the page initially focused on messages of solidarity with the strikers and labor conditions at the airline, but it later shifted to amplifying political content. The page crossposted its first video from SokzBuraka in April 2019.

The network also contained two targeted pages that seem to be misleading their likely niche audiences – e.g., fans of the named entity – with their names. The first, Solidarni z WOŚP (“Solidarity with WOŚP” [the Polish acronym for the Great Orchestra of Christmas Charity”), featured an Intro description that the people behind the page are administrators of opposition pages. They state that, together with followers of their pages, they create “a community of defenders.” It also links the Great Orchestra of Christmas Charity’s website, though the link is not reciprocated on the website, suggesting that the page is indeed simply a fan page and not actually affiliated with the WOŚP.

The page started life in November 2018 only posting content about WOŚP, including sharing posts from the organization’s official Facebook page. It later started to mix in political content critical of PiS or boosting Civic Platform, and nowadays it posts exclusively political content – often similar or identical to that of the other pages – with no WOŚP-focused content whatsoever.

Similar to Solidari z WOŚP, the page Solidarni z TVN – fan club obywatelski (“Solidarity with with TVN- civic fan club”) initially acted as a fan club for the largest privately owned TV station in Poland, TVN. In December 2017, TVN was subject to a substantial fine from the Polish media regulator for its coverage of protests held outside of Poland’s parliament building; the government labeled the channel’s coverage as “propagat[ing] illegal activities and encourag[ing] behavior threatening security.” The clampdown caused further concern about the ruling PiS government’s continued punitive approach to the free press, and TVN subsequently became a symbol of resistance because of its more neutral and practical coverage of the PiS government. As such, the appearance of the fan page almost a year later, in November 2018, was likely the result of this symbolic position.

As with the Solidarni z WOŚP page, Solidarni z TVN’s early posts were mostly about TVN, but it later mixed in political content and eventually only such content.

Overall, this network appeared intent on boosting support Civic Platform either through statements of support or by attacking the ruling PiS party. While that was the clear intent, with the exception of a single page seemingly directly connected to a local branch of Civic Platform, it remains unknown whether the operators behind the remainder of the pages were directly affiliated with the broader Civic Platform party or whether they were acting independently.

Givi Gigitashvili, “Nontransparent network of pro-opposition Polish Facebook pages coordinates its attacks,” Digital Forensic Research Lab (DFRLab), November 20, 2023, https://dfrlab.org/2023/11/20/nontransparent-network-of-pro-opposition-polish-facebook-pages-coordinates-its-attacks/.