A Facebook drama, act 3: the content

Fake accounts pushed charged political content as a means of gathering a particular audience susceptible to the scam

@DFRLab
@DFRLab
Jan 24 · 5 min read
(Source: @nikaaleksejeva/DFRLab via “Os Nossos Dias” by rtppt is licensed under CC BY-NC-SA 2.0)

This is the third and final piece resulting from a joint investigation between the DFRLab and Der Spiegel.

The content posted by the accounts in the network discussed divisive sociopolitical issues, though the topics were likely a superficial brand to attract an audience that would be susceptible to the network’s scam.

These accounts demonstrated mutual connections, shared political and social stances on divisive sociopolitical issues, but lacked a single, coherent advocacy agenda. Given Facebook’s assessment that the accounts were designed to scam unsuspecting users, the lack of a focused political agenda likely indicated the types of users they intended to scam; not really promoting a unified point of view, the content was likely aiming at an audience that was concentrated, engaged, and considered to be more vulnerable to the scam.

With this in mind, this piece primarily discusses the content on the network’s accounts. The previous two pieces assessed the inauthentic nature and degree of coordination among the accounts.

Support for Kurdish independence movement

One of the most prominent of these was Robert Gautier, a supposed French special forces officer who was also discussed in part 2 of this report, shared an emotionally loaded pro-Kurdish video on October 24, 2019. Another account, “Soraya Mansour Al-Thani,” included the phrase “Kurdistan (heart)” in the “Intro” section of her Facebook profile.

Several accounts stated that they belong to the Kurdish People’s Protection Units, also known as the YPG, the Kurdish militia operating in northern Syria and the dominant group in the U.S.-allied Syrian Democratic Forces (SDF).

Accounts claiming to serve in the YPG. (Source, left to right: Zafiro Sultan/archive; Yedy Aza Al-Athir/archive; Jade Abdulbeyyan/archive; Omar Abdulbeyyan/archive)
Accounts whose Facebook user IDs included the word “Kurd.” (Source: Zarp Backett/archive, left; Amanj Pesmerge/archive, right)

Some accounts did not specify that they were YPG members but nonetheless posted pro-Kurdish independence cover photos.

Cover photos by accounts that did not indicate a specific connection to the YPG. (Source: George Wozniak/archive, left; Elvis Russo/archive, middle; Alfred Louis Carter/archive, right)

Other accounts published posts condemning Turkish for acts of violence against Kurds as well as demonizing — in an oddly literal sense — U.S. President Donald Trump.

Posts condemning Turkish and implying that U.S. President Donald Trump is the devil. (Source: Cristobal Laport/archive, top left; Alfred Louis Carter/archive, top right; Devon Singer/archive, bottom left; Tony Cifelli/archive, bottom right)

The pro-Kurdish posts appeared from May 2017 until October 2019, suggesting that the topic was of ongoing interest to these accounts.

The DFRLab also identified several other accounts that acted as a counterbalance to the pro-Kurdish narrative by presenting the Turkish side of the conflict.

Accounts claiming that they served in Turkish-backed militias operating in Syria. (Source: Tibet Zumrut Guler/archive, left; Doganberk Ozgen/archive, right)

One of the Turkish accounts, Levent Ozkan, expressed support for former Turkish leader Mustafa Kemal Ataturk, a Turkish nationalist icon.

The false account Levent Ozkan expressed support for Turkish nationalist icon and the nation’s founder, Kemal Ataturk. (Source: Levent Ozkan/archive)

In another post, Levent attempted to provoke one of the most explicitly pro-Kurdish accounts in the network, Soraya Mansour Al-Thani, and the two engaged in a public argument in the comments section.

The false account Levent Ozkan endeavored to provoke a pro-Kurdish account.(Source: Levent Ozkan/archive)

Support for demagogues

The users that identified as Russian expressed sympathy for Putin most often.

Posts supporting Putin by Russian accounts in the network. (Source, left to right, top to bottom: Victoria Chevchenko/archive; Vladimir Chevchenko/archive; Deyn Kadyrov/archive; Victoria Chevchenko (2)/archive; Maxim Kalashnikov/archive; Miroslav Kostenkov/archive)

Two Italian accounts expressed support for Salvini. One explicitly claimed he worked for him, and both stated they were involved in anti-migrant initiatives.

Accounts promoting Salvini also used his name as their own surname. (Source: Gianni Salvini/archive, left; Piero Salvini/archive, right)

Another account — the previously mentioned Levent Okzan — claimed to be a man of Turkish origin living in Berlin, Germany, and blasted Chancellor Merkel, infusing the criticism with anti-immigrant rhetoric.

Account calling German Chancellor Angela Merkel a “murderer” and denouncing her “open house” immigration policy. (Source: Levent Ozkan/archive)

Natural disasters and terror attacks

Many accounts, for example, posted emotional posts about natural disasters and other tragedies, including wildfires in Greece, Hurricanes Harvey and Florence in the United States, and a terrorist attack in Nice, France.

Posts about natural disasters and terrorist attacks in different countries. (Source: Vanessa Ferraro Vecchia/archive, left; Berk Gokalp/archive, center; Ray Wyatt/archive, right)

Animal welfare

Posts about animal cruelty (intentionally obscured) and veganism. (Source: Luciano Boujicic/archive, top left; Mikolaj Koscianek/archive, top right; Fernando Linton Dawkins/archive, bottom left; Caroline Singer King/archive, bottom right)
Accounts promoting a vegan diet. Again, an account clearly supporting a public persona — this time tennis player Novac Djokovic — used the persona’s last name as their own. (Source: Kevin Holssing/archive, top left; Irving Crusoe Cass/archive, top right; Milan Djokovic/archive, bottom left; Tony Cifelli/archive, bottom right)

At least four additional accounts identified themselves as vegan activists in their intro tabs.

Accounts identifying themselves with the vegan movement. (Source, left to right: Catalina Leyton Haddad/archive; German Fritz Goldmark/archive; Amara Bergmann/archive; Daniel Guéroult/archive)

Some accounts were largely apolitical, discussing special interest topics like soccer.

Accounts posting about soccer. (Source: David Bergmann/archive, top; Wilson Dadić-Lovrić/archive, bottom)

Even some of the more apolitical accounts, however, occasionally posted about incendiary topics.

This fake profile mostly posted innocuous content about sports but on occasion posted invectives about terrorism and Islam. (Source: David Bergmann/archive)

Conclusion

While there were some outward indications that this network may have had an ideological objective, the diversity of the personas and the broad array of their opinions suggested moreover that the network was attempting to attract real users from a wide variety of backgrounds using emotionally appealing content.

Put another way, if these accounts were intent to scam real users, the topical focuses were most likely intended to attract those whom the operators’ believed to be most susceptible to their scams.


Nika Aleksejeva is a Research Associate with the Digital Forensic Research Lab and is based in Latvia.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade