24 Instagram pages masqueraded as news aggregators in central and western Ukraine

On January 17, Facebook removed 41 Instagram pages targeting Ukraine that it said “shared characteristics” of accounts operated by the Internet Research Agency (IRA) troll factory in Russia. The takedown came shortly before Ukraine’s presidential elections and amidst growing fears that the Kremlin would seek to influence the electoral process.

Facebook shared the account names of 24 Instagram pages with @DFRLab shortly before the takedown. All 24 masqueraded as local news aggregators publishing posts in Ukrainian and appeared to target Ukrainians living in central and western Ukraine. The pages managed to reach an audience of nearly 100,000 users, although there is evidence to suggest not all engagement was organic.

The “Today” Network

The 24 pages masquerading as news aggregators were all a part of the same network sharing news stories about Ukraine in both Ukrainian and Russian. It is likely that the network was managed by the same entity or person, because all the pages had similar usernames and used similar graphics.

All but one of the removed accounts had the word “today” in their usernames and were named after different Ukrainian districts (e.g., kharkivtoday_, kiev_today_, and lvivtoday_.

Nearly all of the “today” network pages used the same graphics and format. All but one of the 24 pages used a small triangle on the bottom left corner of uploaded photos to mark posts with news stories. The triangle contained the text “новини TODAY,” which translated from Ukrainian is “News TODAY.”

Radio Free Impersonator Page

One page that differed from the rest of the network was “Ukrainerealiyi.” The page had Instagram and Facebook accounts, which diverted traffic to a news website under the same name, publishing on www.ukrr.info, which remained active at the time of this report.

The website appears to imitate the U.S. government-funded Radio Free Europe/Radio Liberty’s (RFERL’s) news page; it has a similar logo, color scheme, and website layout. Prague-based RFERL has a substantial audience in Ukraine and an office in Kyiv.

Although Ukraine Realiyi’s reporting was not impartial, different articles exhibited different biases. On the one hand, the site reported on the Belarusian Ministry of Foreign Affairs’ statement saying that Russia was a threat to Ukrainian and European security. On the other hand, it also reported on Russian Ministry of Defense’s claim that the missile that downed Malaysian Airlines flight MH17 over Ukraine in July 2014 was Ukrainian without providing any of the widely available evidence to the contrary.

The website also featured articles on intelligence and local politics that presented bias in the form of skewed facts. For instance, the most engaged-with article, which received most of its traffic via Instagram and Facebook, regarded Vasyl Hrytsak, the Head of Security Service of Ukraine (SBU), and his statement on news about Russia’s bombing of Ukrainian naval vessels, which resulted in an injury of a counterintelligence SBU officer.

Ukrr.info’s piece claimed that Hrytsak handed over a Ukrainian counterintelligence officer to Russia — no reports could verify this claim — and called for his resignation. Hrytsak has been a vocal and transparent critic of the Russian Federation’s annexation of Crimea, making Ukrr.info’s assertion particularly salient, given it portrays the SBU head as cooperating with Russia.

The Today Network’s Limited Impact

The 24 Instagram pages taken down by the platform posted more than 24,000 posts and accumulated nearly 80,000 followers. The campaign indicated a clear, covert attempt at building an audience in central and western Ukraine. @DFRLab’s analysis of the pages’ followers shows that the network did manage to achieve its objective as the vast majority of the pages’ followers did come from central and western Ukraine.

Not all engagement appears to have been organic. A closer investigation of the accounts revealed that some of the users engaging with the Today Network’s content were Turkish, not Ukrainian. It suggests that the engagement may not have been organic and the network used artificial amplification to build up an audience.

Conclusion

Facebook’s takedown shows that the Kremlin-linked IRA continues to target Ukraine and is now expanding its operations to central and western parts of the country. Although this is a concerning development ahead of Ukraine’s presidential elections in March 2019, the fact that the IRA’s operation managed to accumulate less than 100,000 followers across 24 pages in almost a year shows that their tactics are far from effective.

Follow along for more in-depth analysis from our #DigitalSherlocks.