Facebook assets impersonating CNN en Español and NTN24 promoted content created by two external websites

Two recently created websites that routinely publish anti-Maduro content — Alexsnews.com and Sharesocial.app — appeared to have used inauthentic assets on Facebook to amplify their material. These assets (one fan page and two groups) impersonated well-known Spanish-language news outlets, such as CNN en Español.

By DFRLab’s count, at least 18 of assets, including the fake groups and page as well as associated accounts, have now been removed from the platform in response to the DFRLab’s investigation. A Facebook spokesperson told the DFRLab:

We routinely take action when we find violations of our Community Standards, including financially motivated activities like spreading clickbait content. In this case, we removed a number of Pages and accounts that used deceptive and spammy tactics to drive people to websites to generate ad impressions.

The DFRLab has previously identified similar behavior in which Facebook groups and fan pages took advantage of authentic media outlets’ credibility to reach a wider audience, such as during the Bangladesh 2018 elections. This behavior serves two functions: first, it uses high-profile names to draw in a larger audience more quickly; and, second, by doing so, it undermines audience trust in the media outlets being impersonated.

The use of inauthentic assets posting about politics is particularly worrisome in Venezuela, a country that is in the middle of a political, economic, and humanitarian crisis that has forced 4.5 million people to leave the country. Most recently, amidst a growing fear of a coronavirus outbreak, this dynamic has contributed to fears that the disease might lead to increased migration and, as a consequence, spread beyond the country’s borders.

The content published by these websites was related to political events in Venezuela. While the websites published political content with an anti-Maduro slant, they appeared to be primarily profit-driven, as the DFRLab found that the content had been monetized.

Part one: Impersonating CNN and NTN24

The DFRLab found a Facebook group and a page that impersonated CNN en Español (“CNN in Spanish”) and a Facebook group that pretended to be the Colombian right-wing television channel NTN24 in Venezuela.

NTN24 is a private Colombian broadcaster that focuses on international news and is available on cable in many Latin American countries. While it was banned from broadcasting in Venezuela by the Maduro regime on February 12, 2014, following its coverage of anti-government protests around that time, the channel is still available for Venezuelans to view online.

The official CNN en Español and NTN24 services both have Facebook pages but do not maintain groups on Facebook. Out of this lack, the fake groups were more easily able to position themselves as authentic, as they used the exact same name as the real outlets.

An analysis using social media listening tool CrowdTangle showed that, between March 1, 2019, and March 12, 2020, the majority of posts in these groups contained links. This behavior would not be surprising as the content of many pages and groups comprises links: in this case, however, over the last three months, most of these posts linked to articles from two specific websites — Alexsnews[.]com and Sharesocial[.]app.

Part 2: the fringe websites

Alexsnews[.]com and ShareSocial[.]app are both fringe outlets mostly covering Venezuelan affairs and publishing anti-Maduro content. Both use the same template and publish sensationalist and misleading content: in early February 2020, for instance, Alexsnews[.]com used a video manipulated and taken out of context to claim that U.S. President Donald Trump had ordered a military intervention in Venezuela. Since the beginning of the year, the DFRLab has noticed that these websites were routinely garnering more engagement than traditional outlets when covering political events in Venezuela.

The websites do not have an “About” section and do not provide any contact information for their operators. While articles published by ShareSocial[.]app do not have byline, most of the articles on AlexNews[.]com were written by Alex Paz, who authored over 1,200 publications between December 10, 2019, and March 10, 2020.

Both websites were created by a person named Facundo Delonuas: Alexsnews[.]com on December 6, 2019, and Sharesocial[.]app on September 26, 2019, according to website registration records.

According to his Facebook profile, Delonuas lives in Plottier, Argentina, and works for the Concejo Deliberante (local legislative institution) of the city. A publication by the Argentinian website Poder Local indicated that Delonuas is a real person that has written for the website of Plottier’s legislative house. Delonuas’s Facebook account was also listed as an administrator for the fake NTN24 Noticias Venezuela group.

Alexsnews[.]com and Sharesocial[.]app monetize their websites using the advertising monetization tools Google Adsense and Taboola. They share the same Google Analytics code, meaning that the money they receive from ads goes to the same person.

They also use similar Taboola account names, “yosoyvenezolano” and “yosoyvenezolano-avance24,” both of which translate to “I am Venezuelan.”

Part 3: the connection

These fringe websites and Facebook pages were connected not only through their behavior (sharing links to the sites) but also through the identities of their Facebook administrators and moderators.

Both fake Facebook groups — CNN en Español and NTN24 Noticias Venezuela — shared moderators or administrators. As of March 13, 2020, they had six common Facebook accounts as either moderators or admins. However, the groups changed their admins constantly.

The most obvious connection discovered by the DFRLab was between the websites and the fake NTN24 group. This group was created by Delonuas, the same person who registered AlexNews[.]com and ShareSocial[.]app. Additionally, a Facebook page called Noticias Yuanflix Venezuela Informa, connected to another website registered by Delonuas, was listed as an administrator of the fake NTN24 Noticias Venezuela.

AlexNews[.]com, however, was also connected to these groups. One of the common admins of both fake groups was Alex Paz, who shares a name with the individual that authored much of the content on the Alexsnews[.]com website. Alex Paz also posted several links to the CNN en Español and NTN24 Noticias Venezuela groups.

Another aspect of Facebook is that, besides individual accounts, pages can also be administrators for groups on the platform. In this case, the fake CNN en Español Latinoamerica page was also one of the admins of the fake CNN en Español group, suggesting that the two assets were connected. Moreover, the admins of the page were located in Argentina and Venezuela, where Delonuas and Alex Paz indicated they are based, respectively.

Finally, the Facebook page Yo apoyo a Juan Guaidó (“I support Juan Guaidó”) linked to the website in its About section and was one of the admins of the CNN en Español page. There was, however, no indication that Guaidó’s team was involved with the page. Moreover, AlexsNews[.]com has previously published content critical of Guaidó’s public statements; in one example, Alex Paz published an article encouraging military intervention in Venezuela after Guaidó claimed that intervention was not his preferred course to remove Maduro from power.

Conclusion

Three apparently inauthentic Facebook assets were used to amplify content published by two external websites. While the websites published anti-Maduro content, they did not necessarily have a political motivation: because the websites were monetized, it is likely that the primary motivation for these assets was financial rather than political influence.

For monetized websites, more clicks translate to more money. As such, in an attempt to garner more page views, the websites’ owners appeared to have created Facebook pages and groups masquerading as real news outlets, literally capitalizing on a seeming affiliation with a reputable outlet.

The secondary effect of coopting the identities of established media outlets is a possible reduction in public confidence in the outlets being impersonated. A reader may understand that a story posted by the fake assets is untrue but be unable to distinguish that the assets themselves are fake (i.e., that it is not from the reputable news outlet). Conversely, a less careful reader might assume the information to be true because it appears to be from a reputable outlet, even when it is not. This dynamic is particularly concerning in Venezuela, where the government controls most of the information flow and citizens depend on independent outlets to receive trustworthy information.

Follow along for more in-depth analysis from our #DigitalSherlocks.