#BalticBrief: False Story About Collapsed Mall Doesn’t Hold Up

A network of Facebook pages imitating real people shared disinformation about the collapse of shopping mall in Latvia

@DFRLab
@DFRLab
Jul 21, 2018 · 7 min read

On July 15, the website Redzams, which translated from Latvian means “Visible”, reported the alleged collapse of the “Alffa” shopping mall in Riga and with hundreds of casualties.

Open source evidence revealed that the mall was not collapsed, and Redzams relied on false social media accounts to drive traffic to the website. This was not the first time Redzams, which is owned in part by Latvian hip-hop artist Niks Endziņš, was accused of spreading disinformation, but this case triggered a response from the Latvian Minister of Interior. The event also reignited a debate on whether the Latvian government should create a joint website that will share debunks of false news.

What happened?

Factually, Riga does have a shopping mall named “Alfa” with one “f”. While the story from Redzams mispelled the name, it created the impression that the real shopping mall collapsed. It was, in fact, open for business.

Geotagged posts on social media suggest that shopping mall “Alfa” in Riga was safe and sound a day later on July 16.

Left (Source: Google Street View); right (Source: Instagram / josef.tumman)
Translated from Latvian: “PHOTO: Tragedy! The shopping mall “Alffa” just collapsed in Riga. Hundreds are dead.” (Source: Google Webcache)

Despite the proven falsehood and verifiable information, the story was quickly shared by 7,800 Facebook users.

Translated from Latvian: “PHOTO: Tragedy! The shopping mall “Alfa” just collapsed in Riga. Hundreds are dead.” (Source: Buzzsumo)

Latvian investigative journalist Inga Springe immediately alerted the Latvian police to the false news on Twitter. She wrote:

@Valsts_policija Tell me, if web pages distribute such news as the shopping mall Alfa having collapsed and that hundreds of people were killed, isn’t there a reason to initiate criminal proceedings? We have gathered several web pages and facts we would love to share.

Two days later, Latvian online news media Skaties.lv published a statement by the Latvian Medical Association (LMA) in response the false news. The statement read:

Any situation in Latvia with more than ten victims is a catastrophe that needs additional resources. We do this well enough, but when such a message is out, for example, the Eastern Hospital should be alert, regardless of whether the message is “fake” or real [..]

There are a lot of people who respond psychologically to such very serious messages. With rising blood pressure or neurological crises. If there was a stroke or an infraction event because of such worries, who would be held accountable? Such jokes cannot be made.

The article by Skaties.lv included a statement by Latvian Minister of Interior Rihards Kozlovskis first published on Latvian news agency LETA. The minister stated his intent to find and arrest the authors of the disinformation website.

He told LETA:

If necessary, international co-operation will be required. Sometimes, portals are registered outside of Latvia. In any case, it is a priority, and a clearly defined mechanism must be created so that the population can quickly get a true message.

As it turned out, the owner of the website Redzams.lv is Latvian hip-hop musician Niks Endziņš, also known as “Neids”.

Translated from Latvian: “Owner at SIA “Redzams.lv” (Source: Facebook / Niks Endziņš)

Latvian mainstream conservative newspaper Latvijas Avize debunked information on the website multiple times in May 2017 and October 2017, and also named Endzins as the outlet’s owner.

According to Skaties.lv, Endzins sold the website to a buyer who kept the original content of the site, but slightly changed the domain name. Endzins received half the profits from the website, so he shared Redzams.net content on his social media accounts to drive traffic. He did not disclose the identities of the new website owners.

The History of Redzams

The website Redzams existed since at least April 2017. In December 2017, the portal wrote about its closure due to “comments on social networks by those who envy us.”

The current domain of the website “redzams.net” was acquired on April 16, 2018. The former Latvian domain “redzams.lv” is now available, meaning that it does not redirect traffic to the new domain.

The website changed its branding along with its new domain.

Left: Redzams.lv in October 2017 (Source: WayBack Machine); Right: Redzams.net in July 2018 (Source: Redzams.net).

With the domain change, amplification of articles posted also improved. According to Buzzsumo analysis, the shares for the most popular articles doubled after the domain change.

Spike in traffic on Redzams.net traffic compared to Redzams.lv. (Source: Buzzsumo)

The most shared article on Redzams.lv was shared at least 4,800 times. The most shared article on Redzams.net was shared at least 9,500 times. Most of the shares were on Facebook, where the outlet focuses its content promotion.

The official Facebook page linked to the Redzams.net webpage was named “Zinas Latvija”, which translated from Latvian means “News in Latvia”. The page used a different logo from that of Redzams.net. The logo in question featured the letters “OTV” in the profile image and mentioned Redzams.net in the cover picture. The page creation date was November 21, 2017, which was around the time Redzams.lv announced its shutdown. The first post on the page appeared on April 18, 2018, two days after the new domain was acquired.

(Source: Facebook / Ziņas Latvijā)

At the time of this report, the page had 16,564 likes and 18,041 followers. The history of the page did not indicate any name changes or ad campaigns. The profile and cover photo were similarly unchanged.

This page was different from the one linked with Redzams.lv in 2017. The Facebook page linked to the former website — Redzams.lv — had the username @redzams.lv. Much like the old website, this Facebook page is now defunct, but Google still showed it in search results.

Another page named “Zinas Latvija” used the “OTV” logo and shared Redzams.net posts.

Left: (Source: Facebook / Ziņas Latvijā); Right: (Source: Facebook / Ziņas Latvijā)

What was different here was the username. It was “@zinaslatvijaa” with one more “a” added at the end. The page linked to a domain OTV.lv, and first appeared on November 23, 2017, two days after the original Zinas Latvija page was created. At the time this report was created, it had 8,877 likes and 8,889 followers.

@DFRLab previously reported about a case when a Latvian political party acquired a large follower base on Facebook by merging pages. This way follower bases of two pages were combined.

(Source: Facebook)

It is likely that two “Zinas Latvija” pages will combine their follower bases at some point.

Overall, the open source evidence suggested that Redzams.net had different online information distribution infrastructure than Redzams.lv.

The Amplifiers

Translated from Latvian: Left: “VIDEO: A drunk man beats a policemen hard” (Source: Facebook/Ziņas Latvijā); Second on the left: “Intrigue: Scandal — Usiks refuse to participate in the finals” (Source: Facebook/Ziņas Latvijā); Second on the right: “VIDE: You will be shocked! The truth about how cigarettes are made revealed” (Source: Facebook/Ziņas Latvijā); Right: “Don’t be ignorant! All drivers are warned — the issue is serious” (Source: Facebook/Ziņas Latvijā)

These were both Facebook pages and Facebook user accounts that constantly shared the same Redzams.net messages.

(Source: Facebook)

Some of the pages impersonated people with Latvian names. However, the key detail was the prevalence of Facebook pages, as opposed to Facebook user accounts. Both are similar in appearance, but users can run more than one page. In other words, pages could imitate real people (users) with Latvian photos and names. This was an attempt to camouflage the coordinated network of Facebook pages that shared Redzams.net articles as real people.

Some pages were not based on personalities:

Other pages were impersonating people:

The page follower count varied from hundreds to thousands. The average follower count for impersonal pages was 2,991. The average follower count of the pages that impersonated people was 2,757. The pages that impersonated people, did not garner significantly more followers then impersonal pages.

Facebook shut down the Facebook pages on July 20, 2018.

Conclusion

The content sharing infrastructure Redzams.net improved along with its domain change. The key amplifiers of the Redzams.net posts were Facebook pages. Some of them presented themselves as news platforms, others impersonated people living in Latvia by using images and names of people.

Whereas the case in question was debunked, the tactic used to generate traction on Facebook remains emergent. @DFRLab will follow developments of the false news amplification network in Latvia.


Nika Aleksejeva is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade