Accounts cultivated fake personas but left an online trail of inconsistencies

This is the first piece chronicling a joint investigation between the DFRLab and Der Spiegel.

A joint investigation by the DFRLab and German newspaper Der Spiegel uncovered a network of at least 329 inauthentic accounts that displayed numerous indicators of inauthentic behavior, including stolen profile pictures, biographical inconsistencies, and linguistic errors.

This piece primarily discusses the fake characteristics of the network. In subsequent parts of this report, the DFRLab will assess the nature of coordination among the accounts and the content they posted.

In total, the research team identified six indicators of inauthentic activity among the accounts:

• Use of Latin American celebrities’ images as profile images;
• Re-use of the same images for different accounts;
• Use of unmatching usernames and screen names;
• Inconsistencies with gender identifiers;
• Inconsistencies with language use; and
• Inconsistencies with post publishing times.

Several of these suggested that a part of the network was likely operated from a Spanish-speaking country in Latin America.

Use of other people’s images

The user accounts used pictures of lesser-known Latin American actors and models. For example, an account named “Robert Gautier” used a mirrored and highly saturated image of Brazilian musician Leandro Lebart, who has been impersonated by many Facebook accounts.

Some of the accounts used screen captures from YouTube videos as their profile pictures. For instance, the user account of “Alice Bergmann” used a screen capture of Chilean actress Josefina Montane from a YouTube video.

Similarly, the account “Helena Bergmann” used a screen capture from a video interview with former Chilean beauty queen Candela Carrasco.

Some accounts from the network even used the same profile pictures as one another, as in the case of “Robin Christiansen” and “Aurelio Montes Cooper.”

The account “Konrad Kertész Broż” also had a profile picture featuring Brazilian musician Lebart, similar to Robert Gautier. Konrad Kertész Broż’s profile photo featured Lebart with a child, a photo that also appeared in Broż’s timeline showed a man with a similar profile to Lebart but who was not the musician.

Busy millennials

The accounts also had much in common with one another in terms of the biographical information they disclosed.

Most of the accounts identified themselves as in their late 20s or early 30s.

Many accounts also listed multiple jobs.

Inconsistent usernames

Almost every tenth account (35 out of 329) that Der Spiegel identified as inauthentic used a screen name that was different from its username. Sometimes, the suggested genders of the names did not match, either. It is possible that the accounts were renamed at some point.

In addition, almost every third account (100 out of 329) had one of five permutations of the suffix “vis” in its username: “visir” (13 times); “visir123” (10 times); “vis123” (33 times); “123vis” (9 times); and “vis” (35 times).

The use of suffixes with usernames may indicate a certain degree of coordination, but the DFRLab did not identify any behavior unique to the accounts using the same suffix. The mismatch between these accounts’ screen names and usernames, however, suggested that the profiles may have been renamed, or even repurposed, at some point.

Gender inconsistencies

These accounts may have done more than adopt new names: they may have fully reinvented their identities. Some of the accounts appeared to have started out as one gender but later become another. For example, a user named “Ramses Sawiris” used images of women as previous profile pictures and identified as female, but most recently used a profile picture of a man.

Similarly, an account named Thanos Kazimoglu used a profile image of a man but identified as female, and an account named Victoria Chavchenko used an image of a woman but identified as male.

Language inconsistencies

The DFRLab found evidence to suggest that the operators of these accounts were native Spanish speakers.

Many of them frequently listed the languages they spoke in Spanish but omitted Spanish itself from their list of spoken languages.

Other accounts presented themselves as native English-speakers but posted text with grammatical and syntactical errors characteristic of non-native English speakers.

Other minor clues also pointed to a native Spanish speaker behind these accounts. A supposed Russian account by the name of Oleg Ivanov posted a life event saying he “Got a Pet Named ‘gatito,’” which means “kitten” in Spanish.

Evidence pointing to Latin America

In addition to being native Spanish speakers, some of the operators behind these accounts were also likely based in Latin America.

Robert Gautier posted a photo on October 24, 2019, with the timestamp of 1:03 p.m local to the DFRLab researcher. Hovering over the timestamp, however, revealed a different time: 7:03 p.m. local to the uploader.

The time zone of the researcher who took the screengrab was GMT+2, so Robert’s time zone must have been GMT . Most of the countries in GMT-4 time zone are in Latin America.

Neither Syria nor France, the locations Robert Gautier mentioned on his account in posts and profile description, respectively, are in GMT-4 time.

Conclusion

These accounts shared numerous inauthentic features. The use of Latin American celebrities’ images, timestamps that matched the time zones of several countries in that regions, and evidence that the operators were native Spanish speakers suggested that the person or group of people operating some of these accounts was based in Latin America.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.