Facebook has taken down disinformation networks linked to Brazilian President Jair Bolsonaro and disgraced former Trump adviser Roger Stone, the company announced yesterday.
The network connected to Bolsonaro was “involved in coordinated inauthentic behavior in Brazil” that sought to influence elections and denigrate opponents of the government, according to Facebook. Most recently, the accounts have echoed Bolsonaro’s claims that the coronavirus pandemic has been exaggerated — which even a positive test for COVID-19 has failed to curb.
Their network used duplicate and fake accounts to “create fictitious personas posing as reporters, post content, and manage Pages masquerading as news outlets,” according to Facebook.
An investigation by the Atlantic Council’s Digital Forensic Research Lab (DFRLab) found that several pages were linked to staffers of pro-Bolsonaro politicians. Some of the operators were linked to employees of the offices of Bolsonaro’s sons Eduardo and Flávio. One was directly employed by the president: Tersio Arnaud Tomaz, an adviser in his office.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!
[Read: Democrats counter Trump’s fake coronavirus news with AI that fought ISIS propaganda]
“Notably, the staffers’ involvement in the operation may indicate a potential misuse of public funds, as many of the posts were published during working hours,” the DFRLab said in its report.
The Roger Stone network
The network tied to Roger Stone was discovered through Facebook’s investigation into the right-wing group Proud Boys, which has tried to return to the platform since its 2018 ban. Facebook said the network used fake accounts to pose as residents of Stone’s home state of Florida. They would then post and comment on their posts to boost their popularity, evade enforcement, and manage Pages.
According to social media analytics firm Graphika, the accounts praised Stone’s political acumen, promoted his books, and defended him against the criminal charges set to send him to prison this month.
Most of the activity was around and immediately after the 2016 US presidential election, although a few accounts remained active into 2020. The majority of the pages had low followings, with the notable exception of “Roger Stone – Stone Cold Truth” which had over 140,000 followers. Stone was the only person the page identified as its administrator. Many of the accounts used profile pictures taken from other sources, including one of Walking Dead actress Christian Serratos. There were also “a handful” of authentic accounts in the network — including Roger Stone’s.
The network also ran petitions, according to Graphika. The profile picture and user name of one of the Facebook accounts appeared on two petitions on change.org. The first demanded that CNN fire political commentator Ana Navarro who’s been repeatedly attacked by Stone. The poll threatened “civil disobedience at various CNN bureaus and orchestrated verbal confrontation with CNN on-air talent” if the network refused.
Graphika said the poll used an all-too-familiar strategy:
The use of an ostensibly female persona to launch attacks against a prominent and influential woman commentator is unfortunately common in online harassment campaigns directed at women around the world.
A second petition called for MSNBC to fire host Chris Matthews for “prostituting” his program Hardball by “selling appearances to politicians and other newsmakers ever since his wife, Kathleen, announced last year that she was running for Congress.” The change.org profile is linked to a Super PAC reportedly founded by Stone.
Stone denied any involvement in the fake accounts. “This extraordinary active censorship for which Facebook and Instagram give entirely fabricated reasons is part of a larger effort to censor supporters of the president, Republicans, and conservatives on social media platforms,” he said in a statement.
Domestic disinformation
Facebook also identified disinformation networks focused on Ukraine and Latin America.
The Ukraine network was particularly active during the country’s 2019 presidential and parliamentary elections. According to Graphika, it attacked former president Petro Poroshenko’s electoral rivals Volodymyr Zelensky — now the country’s sitting president — and Yulia Tymoshenko. It also urged Ukrainians to boycott Russian companies and products.
Graphika linked the activity to Postmen DA, an advertising agency in Ukraine. The firm said some of the network’s activity was “clearly coordinated,” noting that a number of pages used the same cover image and motto. At times, they amplified each other’s content through direct reposting or posting “different memes with the same overall message on the same day.”
The Latin America network was linked to Estraterra, a Canada-based public relations firm, and political consultants and former government employees in Ecuador. As well as Ecuador, the network targeted people in Venezuela, El Salvador, Argentina, and Chile.
The DFRLab said that many of the pages had promoted left-wing candidates in the lead-up to an election. Notably, the content did not appear to be disinformation of manipulated, although it did seem to be coordinated and “feature elements of inauthenticity,” according to the researchers.
Overall, this operation followed a pattern the DFRLab has seen many times before: a for-profit company operating a series of Facebook and Instagram assets, as well as affiliated off-platform websites.
Much of the content was circulated via hashtag campaigns. According to Twitter listening tool Trendinali, the hashtag #NoSeMetanConCorrea (“Do not mess with [Former Ecuadoran president] Correa”) became a trending topic on the same day it was first posted.
“The hashtag garnered 38,483 mentions, and the top 10 percent of the most active accounts generated nearly 70 percent of the publishing volume, indicating that a small group of accounts coordinated in an effort to push this hashtag to trend,” said DFRLab.
The researchers say at least one of the removed Facebook accounts had a profile picture created with a generative adversarial network (GANs). Using Google’s reverse image search, they also found a group of accounts had used stolen profile pictures — including two of Argentine football star Lionel Messi.
Graham Brookie, the DFRLab’s director and a former Obama White House staffer, noted that all four networks focused on domestic audiences. “It shows, again, that the scale and scope of domestic disinformation is far greater than what most countries could do to one another,” he said on Twitter.
Despite the fears around foreign interference through online disinformation, it seems the biggest threats are far closer to home.
Get the TNW newsletter
Get the most important tech news in your inbox each week.