December 20, 2019 — Graphika and the Atlantic Council’s Digital Forensic Research Lab (DFRLab) are together at the forefront of the study of disinformation and foreign influence operations. Both have independently reported on Facebook’s takedown activities. Today marks the first time that the two organizations have worked together to issue a single report, a combined and collaborative effort that accounted for hundreds of hours across both their teams.

Facebook removed a number of assets related to The Beauty of Life (TheBL), an organization that Facebook and open-source researchers have linked to the Epoch Media Group. Researchers at Graphika and the DFRLab had prior access to a subset of these assets. The assets that were a part of this network, dubbed “Operation Fake Face Swarm,” all had features of what Facebook refers to as “Coordinated Inauthentic Behavior,” which the researchers were able to corroborate.

Together, we found that this network highlighted a number of trends:

• Facebook groups in this set were heavily populated by fake accounts. In some cases, every administrator of a group was a fake account.
• Dozens of these fake accounts had profile pictures generated by artificial intelligence (AI), in the first large-scale deployment of fake faces known to the authors of this report.
• Other fake accounts used profile pictures taken from elsewhere online, sometimes with little regard to the apparent sex of the persona they were adopting.
• Some of these fake accounts were created in batches just a few minutes apart.
• Automation was also used for posting: some of the fake accounts used an automation tool called Postcron, allowing them to maintain their rates of posting with no human intervention.
• Many of the fake accounts almost exclusively shared posts from the TheBL, with a small mixture of content from the Epoch Times, pointing real users toward its website and Facebook Page.
• Many of the groups focused on US politics but were partly or primarily managed from Vietnam.
• The campaign extended beyond Facebook. Notably, TheBL Twitter accounts, @TheBLNews and @TheBLcom, showed signs of inauthentic amplification. Both accounts were significantly retweeted by accounts that have since been suspended. A YouTube channel branded to TheBL also showed a pattern of viewing that suggests inauthentic boosting.

The joint Graphika-DFRLab report, found here, details in depth the results of the analysis. For follow-up inquiries, please reach out to dfrlab@atlanticcouncil.org and info@graphika.com.