BANNER: (Source: @DFRLab)

On March 7, Facebook removed a network of four Romanian Facebook pages, 26 Facebook accounts, and a public Facebook group. @DFRLab had an exclusive look at the inauthentic Facebook pages and the group, all of which promoted highly biased content in favor of Romania’s ruling Social Democratic Party (PSD) or denigrated politicians of the opposition.

According to Facebook, the removed assets shared “divisive narratives and promoted content hosted by several domains that present themselves as news sites.” Each removed Facebook page linked to an affiliated “news” domain, whose biased articles were predominantly shared among official PSD Facebook pages.

@DFRLab’s analysis suggests a degree of coordination among the Facebook pages, their affiliated news domains, and the Facebook group, as revealed by similarities in post activity, political bias, and domain analytics.

Facebook also removed an inauthentic network of at least 15 pages and two groups with an intended audience in the United Kingdom, on which @DFRLab also reported.

Romania has recently drawn increased attention for its internal politics as well as its strained relations with the broader European Union. The country is currently gearing up for its presidential elections in late 2019, in which current President Klaus Iohannis (former leader of the center-right National Liberty Party, PNL) is eligible for re-election. In terms of EU relations, Romania recently took over the EU’s rotating Presidency of the Council of the European Union, a position it will hold until June 30, 2019.

The EU, however, recently accused the Romanian government of stalling its efforts to combat corruption. An EU communique urged the country to reform its judicial system and appoint a new anti-corruption prosecutor. Romania’s former chief anti-corruption prosecutor, Laura Codruța Kövesi, spearheaded various anti-corruption initiatives that jailed prominent former politicians, including high-ranking PSD members. She was later dismissed from her post.

Within this context, the four removed Facebook pages and the removed group served to spread highly positive articles regarding PSD, its policies, and its politicians, while denigrating politicians from other parties.

Three of the four Romanian Facebook pages were created within a week, on December 26, 2018 (De Stânga, translation from Romanian: “On the left”) and December 20, 2018 (Momentulzero, Pe Rele.ro). The page ANTI FAKE News was created earlier that year, on September 11. In its “About” section, Momentulzero categorized itself as “Media”, whereas De Stânga and ANTI FAKE News categorized themselves as “News & Media Website”. Pe Rele.ro categorized itself as “Just For Fun.”

Each Facebook page provided a link to a “news” website with the same name. None of the pages displayed a blue or grey badge that Facebook uses to mark verified pages.

Besides ANTI FAKE News, Momentulzero also claimed to combat “fake news,” while De Stânga referred to itself as “real news.”

Altogether, the four Facebook pages accumulated 1,550 followers. Momentulzero collected the most likes (806) and followers (817). The remaining three pages amassed lower numbers of likes and followers, with Pe Rele.ro garnering the least likes (182) and followers (182). These numbers suggest that the Facebook pages had limited reach.

The content published on all four Facebook pages displayed a strong bias in favor of Romania’s PSD party. This bias did not escape some of the pages’ Facebook followers.

The Facebook pages predominantly shared articles from their corresponding news outlets, mostly praising PSD politicians such as Viorica Dăncilă, the Prime Minister of Romania, and Liviu Dragnea, the leader of the PSD party and President of the Romanian Chamber of Deputies. At the same time, the pages shared inflammatory, denigrating, or derisive content on opposing party members.

The Facebook pages mostly targeted President Iohannis and Laura Codruța Kövesi. While generally refraining from publishing content openly in favor of the PSD, Pe Rele.ro largely focused on spreading derisive commentary directed at the opposition, particularly the current president and Codruța Kövesi.

The “news” domains affiliated with the Facebook pages (Momentulzero.ro, Destanga.ro, Perele.ro, Antifakenews.ro) further reflected the Facebook pages’ extreme bias in favor of the PSD party and mockery toward non-PSD politicians. Using CrowdTangle, a tool that provides social-media metrics for articles and media outlets, @DFRLab found that articles from the four domains were predominantly referenced in posts of Facebook pages clearly affiliated with the PSD party or Facebook pages targeting the current President. Similar to their affiliated Facebook pages, the domains did not officially state a party affiliation.

@DFRLab used whois.net to determine the domain registrars of the websites. Two of the domains, Antifakenews.ro and Perele.ro, were both registered by TES Euro Media SRL, suggesting a link between the two domains. Analyzing the domains on dnslytics.com, @DFRLab found that three domains (all except Perele.ro) shared the same Google Adserver ID. This implies that all advertisement revenue from the three domains is funneled to a single account, further suggesting a connection between the domains. Facebook confirmed that the pages paid $650 USD in spending for advertisements on Facebook, paid for in U.S. Dollars, Euros, and Romanian Leu.

All four Facebook pages predominantly shared links rather than photos, statuses, or Facebook videos. Most of these links referenced articles from the respective corresponding news domains of the Facebook pages. The high proportion of links shared by the Facebook pages may imply that the pages were intended to serve as amplification platforms for the highly biased narratives of their respective affiliated news domains.

Although its page was created in September, ANTI FAKE News displayed a significant increase in post activity starting January 2019 after the other three pages launched.

Comparing the peak post activity for all four Facebook pages, @DFRLab found that De Stânga, Momentulzero, and ANTI FAKE News were similar. Pe Rele.ro was an outlier in terms of post activity and it also yielded the lowest post count (82 total posts) of the domains.

@DFRLab discovered nearly identical peaks in post activity for the De Stânga and Momentulzero pages. The similar pattern suggests that the two pages may have coordinated to share and promote links from their respective news domains.

The Melting Pot

Along with the aforementioned pages, Facebook also took down Stânga Românească (translated, from Romanian, “Left Romania”), a public group. It appears to have served as a melting pot for articles from the highly biased news domains affiliated with the Facebook pages as well as other highly biased messaging in favor of the PSD and against its opposition.

Created on January 2, 2019, the group had amassed a modest 462 members. Of those 462 members, 399 joined within the last 30 days before the takedown, suggesting that the group had started gaining traction only recently.

In the 30 days before the takedown, members of Stânga Românească published 923 posts in the group, with an average rate of 30.7 posts a day, a relatively high rate of content. In the post activity of the three days prior to the analysis (between March 2 and March 5), @DFRLab detected 152 shared links, 89 of which were links to articles of the four news domains affiliated with the pages concurrently removed by Facebook. There was only one reference to a Perele.ro article, while articles from the other three domains were occasionally shared twice. The engagement rates of the shared links in the group were generally low.

The four Facebook pages frequently mentioned posts shared in the Facebook group Stânga Românească. De Stânga, one of the removed pages, pinned a post on its Facebook Timeline that encouraged its followers to join the group for more information, suggesting a connection between the Facebook pages and the group.

Members of the Facebook group posted political advertisements of the PSD party in the group, as well as pictures of PSD politicians against floral and comical backgrounds.

The four removed Facebook pages shared posts from the two administrators of the removed group, Stânga Românească, which further suggests a shared community between the different pages and the groups.

Using inteltechniques.com, an open-source tool to investigate user statistics and behavior on Facebook, @DFRLab analyzed both administrators’ user statistics and found that they had an overlap of 87 mutual friends. In addition, both belonged to the same 18 groups, many of which had a clear bias in favor of the PSD and against politicians of other parties, as indicated by names such as “We support PSD! We support Liviu Dragnea !! Sustinem Tudorel Toader !!” and “LIVIU DRAGNEA THE PRESIDENT! Tudorel Toader EROU! Jos IOHANNIS!!” In their Facebook profile, one administrator referred to himself as a journalist for Destanga.ro, which, coupled with both administrators’ presence in the removed Facebook pages, also further suggests strong affiliation between the different pages and the group.

@DFRLab’s analysis uncovered no affiliation between the PSD itself and the four Facebook pages, the four news domains, and the public Facebook group. Nevertheless, the assets spread highly biased political messaging in support of the PSD party, while posting derisive commentary on opposing party members. This coordinated effort unfurled amid domestic political tensions within Romania, as the country prepares for its upcoming presidential elections.

Furthermore, the posting activity of the Facebook pages and group mainly consisted of publishing links from their corresponding news domains, which suggests an attempt (of limited success) at amplification of biased content from the news domains.

Through open-source investigation, @DFRLab detected notable similarities among the pages, including not just the shared political bias but also similar posting activity, the shared Google Adserver ID of their affiliated domains, and, in two cases, an identical domain registrar. All of these similarities suggest a degree of coordination. @DFRLab’s analysis suggests that Facebook pages masqueraded as supposedly independent news outlets or fact-checking sites. These pages then proceeded to amplify highly biased political messaging, while simultaneously using a public Facebook group to fuse and commingle their biased narratives.

Follow along for more in-depth analysis from our #DigitalSherlocks.