A Facebook drama, act 2: the coordination

Scripted family dramas betrayed a coordinated and cultivated network

@DFRLab
@DFRLab
Jan 24 · 7 min read
(Source: @disinformediain/DFRLab via “Os Nossos Dias” by rtppt is licensed under CC BY-NC-SA 2.0)

This is the second piece resulting from a joint investigation between the DFRLab and Der Spiegel.

The fake Facebook accounts identified through a DFRLab-Der Spiegel joint investigation demonstrated multiple indicators of coordination. In particular, the accounts mentioned and interacted with one another online, listed each other as family members on their profiles, and may have even engaged with authentic user accounts over private messaging.

These behaviors indicated that the accounts may have been operated by the same person or entity; at the very least, they suggested that the operators behind the accounts were aware of one another.

“Hugs, Robert!”

And many “hugs” are exchanged between the original posting account and Robert.

Examples of the inauthentic accounts’ posts directed at Robert Gautier. The comments were made by false accounts too. (Source: Angus Campbell/archive, top left; Kevin Holssing/archive, top right; Hetzel Kozlovski/archive, bottom left; Ramses Sawiris/archive, bottom right)

In addition to English, the accounts addressed Robert in French, Russian, German, and Croatian. He responded in kind.

Examples of posts directed at Robert in French, Russian, German, and Croatian. The comments were made by false accounts too. (Source: Hamlet Batifoulier/archive, top left; Miroslav Kostenkov/archive, top right; Hades Haeger/archive, bottom left; Vincent Cerimagic/archive, bottom right)

The repetition in language (so many “hugs”) and in punctuation and language errors pointed to like-minded, if not shared, operators.

“Love you, Soraya!”

Examples of posts addressed to Soraya. Notice the commonalities of the two top images (multiple men) and the bottom images (window). (Source: Vanessa Ferraro Vecchia/archive, top left; Ian Fairley/archive, top right; Nahid Shamal Al-Thani/archive, bottom left; David Sulkowski/archive, bottom right)

The posts often stirred extensive and stilted conversation. For example, a photo mentioning Soraya posted by “Ian Fairley” was accompanied by a somewhat nonsensical first response from Soraya, in which she responded to the photo as “Thank you very much ! I love that country!”

The somewhat nonsensical conversation under Ian Fairley’s photo that mentioned Soraya in the accompanying text. (Source: Facebook/archive)

The awkward turns within the conversation point to either poorly translated text or possibly AI-generated responses. The exact nature of the replies in this circumstance was unclear; some other conversations between accounts in the network appeared less stilted and more authentic.

Of note, the photo Ian Fairley used in the post featured four men sitting on a stoop in period attire (which Soraya referred to as “that country” in her first reply). The photo was a still from the BBC television series “Ripper Street.”

Ian Fairley’s photo was a still from the TV series “Ripper Street.” (Source: Facebook/archive, left; IMDb/archive, right)

Both Robert and Soraya appeared to be aware of one another: on January 21, 2018, Robert commented on Soraya’s photo.

Family trees

For instance, Robert’s “family” featured “Armand Gautier” as his father, “Simone Singoret” as his mother, “Marguerite Gautier” as his sister, “Jean Paul Gautier” as his brother, and “Louis Gautier” as his uncle.

As of January 6, 2020, Robert Gautier appeared to be on the best terms with the rest of his family, as he listed everybody on his About page, thus he is at the center of the family tree. The arrows represent when a profile mentioned another, in the direction of the mention. Some mentions were not reciprocated — for example, Robert mentioned his “father” Armand, who did not list Robert in return. The yellow boxes are profiles listed as family but which had no associated Facebook account. (Source: @disinformediain/DFRLab via Facebook)

The accounts were inconsistent in who they listed as family on their public profiles. Robert’s family, for example, seemed to be at odds with each other. Robert’s uncle, “Louis,” tagged Robert’s father, “Armand,” in his family list at his brother. The feeling, however, was not mutual, as Armand did not list any association with Louis.

After Der Spiegel and the DFRLab started their investigation, and possibly as a result of the former’s outreach, many of the accounts deleted their familial relationships. For example, as of at least January 6, 2020, Robert’s parents only listed that they were married to each other and did not have any other family association — perhaps there was family turmoil, however, as at the start of this analysis in October 2019 they had listed some of “their children.”

Some family listings for the Gautier family in October 2019, prior to Der Spiegel’s outreach. The pink solid line boxes mark family members that mutually listed each other on their respective profiles. The pink dotted-line boxes mark family members that lacked a mutual mention with any other family member. The green box marks Robert’s brother, “Robien,” who no other family member mentioned. (Source: Armand Gautier/archive, top left; Simone Singoret/archive, top middle; Robert Gautier/archive, top right; Louis Gautier/archive, bottom left; Marguerite Gautier/archive, bottom middle)

Most unusually, Robert’s parents, Armand and Simone, did not mention the same children. Armand did not mention Jean Paul as his son, and Simone did not mention Marguerite as her daughter. All of the family members mentioned only Robert in their public posts, suggesting that his account was central to the network. Robert also identified Robien as his brother, and the two acknowledged one another in a public post.

In one photo that she posted, Robert’s mother, Simone, also appeared to be in a romantic relationship with him (her son) and not his father.

A photo posted by Robert’s mother implied a romantic relationship between the two of them. (Source: Simone Signoret/archive)

Another prominent family in the network was the Bergmanns. Alice — previously highlighted in part 1 of this report for featuring a reappropriated profile photo — and David Bergmann identified themselves as siblings. They both identified their mother as “Mary Rose Lindmayer.”

The Bergmann family. Pink boxes mark their relations as specified on Facebook. (Source: David Bergmann/archive, left; Mary Rose Lindmayer/archive, middle; Alice Bergmann/archive, right)

Alice and David appeared to have at least three cousins — Caroline Bergmann, Amara Bergmann, and Helena Bergmann, all of whom mentioned an inaccessible account under the name Zafiro Sultan as their uncle.

Alice and David’s cousins identified “Zafiro Sultan” as their uncle (pink boxes). (Source: Caroline Bergmann/archive, left; Amara Bergmann/archive, middle; Helena Bergmann/archive, right)

In the comment section under a post from Alice about Easter, Mary Rose Lindmayer greeted her and Alice’s account replied, “Thanks, Mom.” Then, Zafiro Sultan commented “Alice, I love you!” and soon Alice’s account replied, “Thanks daddy!”

Alice referred to Zafiro Sultan her dad. (Source: Facebook/archive)

The relationship is inauthentic, as Zafiro’s account identified itself as a Kurdish female with a potential maiden name of “Jane Kobane.”

Zafiro Sultan’s account identified itself as Kurdish female. (Source: Zafiro Sultan/archive)

Developing inter-family relationships

The accounts for Zafiro Sultan, Caroline Bergmann, and Robert Gautier all commented on a photo posted by Soraya Mansour Al-Thani. (Source: Soraya Mansour Al-Thani/archive)

After Soraya’s account posted an image of a young woman in a bikini, Zafiro’s account commented “Marry me.” Caroline’s account then posted a negative comment, suggesting that the image was an insult to Muslims. Soraya’s account replied that Alice Bergmann had posted the negative comment from Caroline’s account.

Similarly, an account named Majid Najm Al-din posted that he is in love with Soraya, but Soraya’s account rejected Majid in the comment section.

Relationships between Majid Najm Al-din’s and Soraya Mansour Al-Thani’s accounts. (Source: Majid Najm Al-din/archive)

The relationship was inauthentic, as Majid’s account identified himself as a woman and used a female username.

Majid Najm Al-din’s account identified him as female. (Source: Majid Najm Al-din/archive)

Engaging with real users

Authentic users commented on Helena Bergmann’s posts, referring to private messages with her. (pink boxes) (Source: Helen Bergmann/archive, left; Helen Bergmann/archive, right)

Most recently, on January 2, 2020, some accounts from the network commented under Robert Gautier’s post from October 2019 about “German journalists” that accounts should not talk to, most likely referring to journalists from Der Spiegel.

Accounts from the network talking about “German journalists” that they need to ignore. (Source: Robert Gautier/archive)

Der Spiegel journalists, with whom the DFRLab collaborated, confirmed that they reached out to some authentic accounts to ask about the nature of their relationships with the inauthentic accounts. The journalists claimed they did not ask anything about Robert Gautier in particular but that the authentic accounts brought him up anyway. The fact that inauthentic accounts tried to protect Robert once more confirms that “Robert Gautier” was one of the main accounts in the network.

Conclusion

The scope of the inauthentic network as well as development of the accounts’ individual personas suggested that the operators expended significant effort to curate it. The fact that some details — such as Armand and Simone’s relationship with their children — changed after Der Spiegel’s outreach also indicated that these accounts were sensitive to scrutiny and modified their content in response.


Nika Aleksejeva is a Research Associate with the Digital Forensic Research Lab (@DFRLab) and is based in Latvia.

Iain Robertson is Deputy Managing Editor with @DFRLab and is based in Washington, DC.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade