Scripted family dramas betrayed a coordinated and cultivated network

This is the second piece resulting from a joint investigation between the DFRLab and Der Spiegel.

The fake Facebook accounts identified through a DFRLab-Der Spiegel joint investigation demonstrated multiple indicators of coordination. In particular, the accounts mentioned and interacted with one another online, listed each other as family members on their profiles, and may have even engaged with authentic user accounts over private messaging.

These behaviors indicated that the accounts may have been operated by the same person or entity; at the very least, they suggested that the operators behind the accounts were aware of one another.

“Hugs, Robert!”

One of the personas that many of the accounts interacted with was that of “Robert Gautier,” who, since 2012, has played the role of a French special forces officer fighting in Syria. Multiple accounts updated their cover photos with images of stunning landscapes and addressed Robert in the description. Robert’s account then commented on the posts, expressing thanks and awe at the images.

And many “hugs” are exchanged between the original posting account and Robert.

In addition to English, the accounts addressed Robert in French, Russian, German, and Croatian. He responded in kind.

The repetition in language (so many “hugs”) and in punctuation and language errors pointed to like-minded, if not shared, operators.

“Love you, Soraya!”

Another set of accounts interacted with a second persona — “Soraya Mansour Al-Thani” — in a similar manner.

The posts often stirred extensive and stilted conversation. For example, a photo mentioning Soraya posted by “Ian Fairley” was accompanied by a somewhat nonsensical first response from Soraya, in which she responded to the photo as “Thank you very much ! I love that country!”

The awkward turns within the conversation point to either poorly translated text or possibly AI-generated responses. The exact nature of the replies in this circumstance was unclear; some other conversations between accounts in the network appeared less stilted and more authentic.

Of note, the photo Ian Fairley used in the post featured four men sitting on a stoop in period attire (which Soraya referred to as “that country” in her first reply). The photo was a still from the BBC television series “Ripper Street.”

Both Robert and Soraya appeared to be aware of one another: on January 21, 2018, Robert commented on Soraya’s photo.

Family trees

The fake accounts were connected to one another in a complex web of family relationships, all displayed publicly on their profiles.

For instance, Robert’s “family” featured “Armand Gautier” as his father, “Simone Singoret” as his mother, “Marguerite Gautier” as his sister, “Jean Paul Gautier” as his brother, and “Louis Gautier” as his uncle.

The accounts were inconsistent in who they listed as family on their public profiles. Robert’s family, for example, seemed to be at odds with each other. Robert’s uncle, “Louis,” tagged Robert’s father, “Armand,” in his family list at his brother. The feeling, however, was not mutual, as Armand did not list any association with Louis.

After Der Spiegel and the DFRLab started their investigation, and possibly as a result of the former’s outreach, many of the accounts deleted their familial relationships. For example, as of at least January 6, 2020, Robert’s parents only listed that they were married to each other and did not have any other family association — perhaps there was family turmoil, however, as at the start of this analysis in October 2019 they had listed some of “their children.”

Most unusually, Robert’s parents, Armand and Simone, did not mention the same children. Armand did not mention Jean Paul as his son, and Simone did not mention Marguerite as her daughter. All of the family members mentioned only Robert in their public posts, suggesting that his account was central to the network. Robert also identified Robien as his brother, and the two acknowledged one another in a public post.

In one photo that she posted, Robert’s mother, Simone, also appeared to be in a romantic relationship with him (her son) and not his father.

Another prominent family in the network was the Bergmanns. Alice — previously highlighted in part 1 of this report for featuring a reappropriated profile photo — and David Bergmann identified themselves as siblings. They both identified their mother as “Mary Rose Lindmayer.”

Alice and David appeared to have at least three cousins — Caroline Bergmann, Amara Bergmann, and Helena Bergmann, all of whom mentioned an inaccessible account under the name Zafiro Sultan as their uncle.

In the comment section under a post from Alice about Easter, Mary Rose Lindmayer greeted her and Alice’s account replied, “Thanks, Mom.” Then, Zafiro Sultan commented “Alice, I love you!” and soon Alice’s account replied, “Thanks daddy!”

The relationship is inauthentic, as Zafiro’s account identified itself as a Kurdish female with a potential maiden name of “Jane Kobane.”

Developing inter-family relationships

These comments suggested that there was a prior relationship among the accounts.

After Soraya’s account posted an image of a young woman in a bikini, Zafiro’s account commented “Marry me.” Caroline’s account then posted a negative comment, suggesting that the image was an insult to Muslims. Soraya’s account replied that Alice Bergmann had posted the negative comment from Caroline’s account.

Similarly, an account named Majid Najm Al-din posted that he is in love with Soraya, but Soraya’s account rejected Majid in the comment section.

The relationship was inauthentic, as Majid’s account identified himself as a woman and used a female username.

Engaging with real users

Some accounts left public evidence that suggested that they contacted real users over private messaging. For instance, Helen Bergmann’s account received multiple comments from accounts that the DFRLab identified as authentic. The comments referred to private messages these users received from and sent to Helen.

Most recently, on January 2, 2020, some accounts from the network commented under Robert Gautier’s post from October 2019 about “German journalists” that accounts should not talk to, most likely referring to journalists from Der Spiegel.

Der Spiegel journalists, with whom the DFRLab collaborated, confirmed that they reached out to some authentic accounts to ask about the nature of their relationships with the inauthentic accounts. The journalists claimed they did not ask anything about Robert Gautier in particular but that the authentic accounts brought him up anyway. The fact that inauthentic accounts tried to protect Robert once more confirms that “Robert Gautier” was one of the main accounts in the network.

Conclusion

These fake accounts demonstrated a degree of interconnectedness, as they regularly interacted with one another’s profiles. Additionally, comments under some public images suggested that some of the inauthentic accounts may have engaged with real users over private messaging.

The scope of the inauthentic network as well as development of the accounts’ individual personas suggested that the operators expended significant effort to curate it. The fact that some details — such as Armand and Simone’s relationship with their children — changed after Der Spiegel’s outreach also indicated that these accounts were sensitive to scrutiny and modified their content in response.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.