Mexico: Coordinated inauthentic behavior on Facebook & Twitter

Erin Gallagher
Jan 24 · 12 min read

Coordinated inauthentic behavior on Facebook and Twitter in relation to Mexican news and politics is permitted and goes unreported in English language news while the same activity is taken down by Facebook and amplified in US media — as long as it’s linked to Russia.

Recently, Facebook announced it had taken down 289 Pages and 75 Facebook accounts that were linked to coordinated inauthentic behavior “for engaging in coordinated inauthentic behavior as part of a network that originated in Russia and operated in the Baltics, Central Asia, the Caucasus, and Central and Eastern European countries.”

The pages were linked to Sputnik, a news website established by the Russian government-owned news agency Rossiya Segodnya.

“The Page administrators and account owners primarily represented themselves as independent news Pages or general interest Pages on topics like weather, travel, sports, economics, or politicians in Romania, Latvia, Estonia, Lithuania, Armenia, Azerbaijan, Georgia, Tajikistan, Uzbekistan, Kazakhstan, Moldova, Russia, and Kyrgyzstan.” — Facebook

This kind of operation is not unique. Below are details of three similar operations that have been documented in Mexico, two of the three did not warrant coverage in US media. Pages and profiles linked to these operations are still online and still posting political content.

1. Fake Facebook pages, profiles & Twitter accounts received funding from Mexican government

A similar, although far less transparent, operation was exposed in Mexico by news outlet Sin Embargo, who published a blockbuster report in July 2017 exposing a long list of fake news outlets that had received funding from the Mexican government during 2016 and 2017, some of which were connected to Facebook pages and profiles and Twitter accounts.

Several of the Facebook pages and profiles that were exposed in Mexican social media remain online and the news about this coordinated inauthentic behavior in Mexico was never translated or published in English language media.

“During 15 months, the social communications office of the Governor of the State of Mexico, Eruviel Ávila Villegas, made 44 payments to fake media and advertising agencies. For some there are traces, such as Facebook pages or Twitter accounts that, after the election of June 4, look somewhat abandoned.

In a review of information provided to Sin Embargo by SAIMEX (web portal to request publicly available information relating to the government of the State of Mexico) that lists the media agencies that were paid for advertising during 2016 and the first three months of 2017, a total of $143,798,175 pesos (about $7,542,214 USD) were paid, of which, 44 payments equivalent to $11,647,068 pesos (about $610,888 USD), went to these types of media agencies and companies.” — via Sin Embargo, translated by me

Here are some examples of the fake news Facebook pages that were linked to payments made by the government of Mexico State and are still online:

Lo Perspicaz de la Noticia:

Here is how “Lo Perspicaz de la Noticia” looked at the time of the 2017 report in Sin Embargo:

Source: Sin Embargo
Source: Erin Gallagher

As of February 6, 2019, this Facebook page is still online and posting political content. Despite the newly available “info & ads” sections on Facebook pages, no admins or admin locations are listed on this page. The only information available is the date the page was created: June 27, 2015.

Here’s what “Lo Perspicaz de la Noticia” looks like now:

Recent posts on Lo Perspicaz de la Noticia contain photos of Alfredo del Mazo Maza, a Mexican politician affiliated with the PRI party and the current Governor of the State of Mexico. Del Mazo is also a cousin of the former president of Mexico, Enrique Peña Nieto. The profile photo of this Facebook page (above) shows Alfredo del Mazo Maza walking with Enrique Peña Nieto holding his arm.

According to information reported by Sin Embargo, Lo Perspicaz de la Noticia received $290,000 pesos in 2016 and $58,000 in 2017 despite having no web page, no address, no phone number and no registered media related business associated with the Facebook page.

Screenshots January 17, 2019: Facebook

Es Opinión Mexiquense

A Facebook profile mentioned in the Sin Embargo report, Es Opinión Mexiquense, is also still online and actively posting political content.

It has recently posted breaking news including posts about the recent gasoline shortage in Mexico and posts shared from verified pages associated with the government of the State of Mexico.

Screenshot January 17, 2019: Facebook

Es Opinión Mexiquense has also recently shared a post directly from Alfredo del Mazo Maza’s verified Facebook page and a video from the verified Facebook page for the government of the State of Mexico that featured a tour of a technology school given to Alfredo del Mazo Maza.

Screenshots: January 17, 2019 via Facebook

According to documents seen by Sin Embargo, the Facebook profile Es Opinión Mexiquense was paid $58,000 pesos in 2016 despite it having no website and no such media agency existing in Mexico. At the time of Sin Embargo’s reporting in 2017 they found a connected Twitter account that had tweeted 65 tweets. The most recent Twitter activity on that account as of July 2017 was a retweet of Eruviel Ávila Villegas from June 17, 2013, suggesting that this inauthentic coordinated, government-funded social media activity had been going on for several years.

Source: ES Opinión Mexiquense February 6, 2017

The original report by Sin Embargo titled Eruviel le da millones a “sitios digitales”, “agencias”, muros de Facebook y “revistas” fantasma by Daniela Barragán dated July 28, 2017 contains a long list of all the fake media agencies that received funding from the Mexican government in 2016 and 2017.

These were not state media outlets like Sputnik using fake pages and profiles to spread their own content. These fake pages and profiles were entirely fabricated media outlets being funded directly by the government of the State of Mexico.

I have no idea if Facebook has any way to track if some foreign government is opening or funding fake pages on their platform, but the news of these particular fake pages was published in 2017. The fake pages and accounts in Mexican Facebook are still online as opposed to fake Russian pages which get taken down, prompting official reports to be issued by Facebook & Twitter explaining what actions they took which in turn influence at least one news cycle in US media reporting on another round of Russian social media fakery.

2. Mexican media botnet study

In January 2017, I documented a network of social media accounts that tweeted in a coordinated manner during the gasolinazo protests. I found 20 obviously fake Twitter accounts, 2 dubious media accounts on Twitter and 2 Facebook pages that were clearly working together. A series of tweets and 2 Facebook posts were posted during the same timeframe starting with a now deactivated Twitter account called Noticias Mexicanas (@combomexicanas) at 1:10am on January 4, 2017. Javier Paredes then tweeted the first of a series of automated tweets at 1:31am which continued every minute or so until 1:49am. Two Facebook pages also posted in this timeframe. Most of the accounts were linking to Excélsior, a Mexican news paper.

Source: me

The Facebook page Noticias al Día is now deleted but at the time was posting only links to Excélsior. The El ojo cibernético Facebook page is still online but has been dormant since March 2017.

Many of these Twitter accounts are now suspended but I found one still online and it also went dormant in March 2017. It’s pretty obvious this account and the network it was associated with was spreading Excélsior links in a similar manner to the recently 86'ed fake Sputnik network.

When I documented this network, El ojo cibernético was posting links to it’s own website which, at the time, was laundering Excélsior articles, among others. Its website has undergone a redesign since 2017. On the left is how the page looked then (via the Wayback Machine), and on the right is how it looks now, posting sports content with a new logo.

You can read the full documentation of this network below. It went viral in Mexico when I published it and is my most viewed Medium post to date with 109,000 views; 82,342 of those views happened on January 5, 2017. It was featured in the news in Mexico and mentioned in Buzzfeed.

I also received a nasty death threat for this post (warning, it’s very graphic). At the time that surprised me because it seemed like a fairly innocuous post. Coordinated accounts tweeting links to Mexican media via services like dlvr.it or IFTTT is common and I only documented this network as a quick example because it was relatively small, obviously fake and easy to organize. However this kind of cross-platform coordination is very common in Mexican social media yet I have never heard of Facebook taking down inauthentic coordinated activity like this in Mexico.

Suspicious accounts spreading a link using bit.ly link shortener
Suspicious accounts spreading an El Universal article about a Mexican teachers union

This kind of coordinated behavior used to spread news has been happening for years in Mexico (and many other countries) and is probably the most obvious inauthentic activity. I generally label these kinds of accounts “media bots” although there is no way to prove they are linked to any specific media outlet or even that their activity is politically motivated. It could be used as a way to drive traffic to a website but depending on the context and content of the tweet/media… (does it include a hashtag? is it targeting a person or group of people? is the content defamatory or sensational?) … could be used for political purposes too.

3. Victory Lab

June 28, 2018, Deputy Global News Director, Ryan Broderick of BuzzFeed News published a report days before the 2018 Mexican presidential elections about a Mexican digital news agency called Victory Lab. Victory Lab‘s owner, 29 year old Carlos Merlo told BuzzFeed News, “the only real obstacle to pushing fake news, dark ads, and inflated trending topics for Mexico’s politicians has been getting government employees to pay him on time. Getting paid is difficult. Making a million tweets is easy; getting the money is not.”

Merlo said Victory Lab operated 17 small offices in Mexico, each with 15 to 20 young people. They made memes, operated bots, made topics trend on Twitter and published fake news on a vast network of 4,000 fake Facebook pages.

Merlo also told Buzzfeed that his team controlled 4 million Twitter accounts which were often bought from Russian bot agencies and renamed Mexican-sounding names.

Merlo’s team operates a network of 4,000 fake Facebook pages that look like local newspapers, he said. They register names that sound like real local newspapers — for example, “Wake Up Campeche.” Then they build small but loyal audiences with these fake local news pages. — BuzzFeed News June 2018

Carlos Merlo’s name was not unknown in Mexico prior to the BuzzFeed News investigation. Several articles have been published about him in Spanish language media. Univision published an article in April 2017 titled “The million dollar business behind fake news websites in Mexico.”

“Carlos Merlo owns Victory Lab, one of the companies that offers comprehensive social media services, whose products include bot management , containment, cyber attacks, creation of sites for ‘fake news’, crisis management, among others.

One of the most robust services that Merlo offers costs more than one million pesos ($ 55,000) a month, and includes bots that seem real, crises containment, attacks and pushing information to various sites for purposes of news, disinformation, manipulation, parody, among others.” — Univision April 2017

The news website and print magazine Expansión, which is owned by Time Inc and affiliated with CNN, also published an article in November 2017 about Carlos Merlo’s fake news business titled “The Business Behind Fake News

“In 2012, for the presidential election, we were asked to provide some external support for the PRI and Green Party coalition, to get the media to publish certain news.’ Merlo recalls that, at that time, getting a recognized media to publish his messages was expensive. He decided to open up his own media agency.

We opened a site with the intention of making it grow so that it was a real media company, but one that had a kind of tint,’ explains the young entrepreneur.

‘From 2015 forward, we began to publish false news or falsified information. For example, between candidate A and candidate B, many things are public knowledge, so then something would be published about one candidate that was a secret. From when a website is created, the campaign has a start and end date, and we would publish things to see who picked them up. If you publish an article with guidelines, not much happens, but when larger media pick up the news item, then things happen”, he warns. — Expansión November 2017

Carlos Merlo was a well-known purveyor of political disinformation campaigns in Mexico and ran a fake news business on an industrial scale.

After the first report about Victory Lab in BuzzFeed News, Ryan Broderick published a second article titled Facebook Appears To Have Allowed A Fake News Operation To Publish For Months Before Mexico’s Election which detailed how Facebook knew about Victory Lab’s activities but allowed the digital marketing agency to continue publishing fake news until Facebook’s partner, DFRLab, published their own report.

BuzzFeed News contacted Facebook for comment about why they allowed a massive network of fake Facebook pages to remain online throughout the Mexican presidential elections, and minutes later, a member of DFRLab contacted BuzzFeed News to discuss their story which had not yet been published.

Source: Twitter

DFRLab’s blog was published on June 28, 2018, within hours of BuzzFeed News’s investigation. The analysis presented in the DFRLab blog about Carlos Merlo was superficial and dismissive. I don’t understand why they analyzed the Victory Lab Facebook page and Twitter account instead of pages Victory Lab would have presumably made for its clients. A large portion of DFRLab’s blog cites articles that had been previously published about Carlos Merlo, with several mistranslations and errors.

DFRLab partnered with Facebook in May 2018 to counter disinformation and had exclusive access to Internet Research Agency Facebook data before it was taken down so I assumed they have privileged access to Facebook data that no one else does. So either they don’t have access to the 4,000 fake Facebook pages created and maintained by Victory Lab’s staff or they don’t know which pages those were and never mentioned that they didn’t have that information. Instead DFRLab focused on Victory Lab’s own brand accounts, assuming the activity found on those accounts would be the same as whatever services they provide to their clients.

Based on the previous fake Facebook pages I cited above which are still online and the apparent failure on the part of DFRLab to find and analyze any fake Facebook pages definitively connected to Victory Lab, I assume the fake news Facebook pages that were created by Victory Lab for their clients were never taken down.

In the 2017 book Attacks on the Press: The New Face of Censorship from Committee to Protect Journalists, Sam Woolley, former Director of Research of the Computational Propaganda project at the Oxford Internet Institute, said “Mexico is the benchmark for the worst and most manipulative use of bots.”

Manipulation of Mexican social media is a well-documented phenomenon. Yet the same activity that receives widespread press coverage and condemnation in the US, is ignored and dismissed when it occurs in Latin America.

Erin Gallagher

Written by

Multimedia artist, writer and translator. Digital news junkie, agitprop collector.