#ElectionWatch: Counterfeit News Pages in Bangladesh

Facebook takes down pages masquerading as genuine news outlets ahead of elections in Bangladesh

Profile images used by three of the counterfeit pages, superimposed on a map of Bangladesh. (Source: Facebook / @bbc.bd.official / DFRLab)

On December 20, Facebook suspended nine apparently Bangladeshi pages that were masquerading as news outlets and posting on political themes, just ahead of the Asian nation’s election on December 30, 2018.

The exposure is important for the way it highlights another attempt by unknown actors to activate a network of counterfeit pages just before a general election. Most of the pages were only a few weeks old and had only a few hundred followers. As such, they appear to have been a failed attempt at interference.

Given the relatively low amount of content they posted, there is insufficient open-source evidence to attribute them to a particular actor.

Facebook shared the names of the nine pages with @DFRLab hours before the takedown; three of them had already been suspended. Facebook also concluded that the pages were part of a coordinated network. This post describes the remaining six pages’ visible activity, for posterity, since they have now been taken offline.

@bbc.bd.official

This page masqueraded as the BBC’s Bengali service. It used the BBC’s official logo and color scheme and, in an apparent attempt to look like a verified page, had photoshopped a blue check-mark over it. Its most recent post was on November 14 and described a clash between police and supporters of the opposition BNP party.

Profile page for the counterfeit BBC page. (Source: Facebook / @bbc.bd.official)

This page was demonstrably false, because the BBC Bengali service has a genuine, verified page, @BBCBengaliService, illustrated below. On a genuine verified account, the blue check is under the profile picture, not on it. Moreover, the BBC Bengali account posts regularly, while the counterfeit page had not posted since November.

Official page of the BBC in Bangladesh. (Source: Facebook / @BBCBengaliService)

A side-by-side comparison highlights the differences.

Comparison of the counterfeit (left) and genuine (right) pages, using screenshots taken on December 19, 2018. Note that the genuine page features the check mark under the profile not in it (yellow circle), and that the latest post on the counterfeit page was dated November 14, more than a month earlier (blue circle). (Left, : Facebook / @bbc.bd.official. Right, source: Facebook / @BBCBengaliService.)

This is not the first attempt to impersonate the BBC in Bengali. Another of the pages on Facebook’s list, @bbc-banglacom, also mimicked the BBC and was already suspended. Both false pages were linked to a counterfeit BBC website, bbc-bangla.com, exposed in November. In that exposure, an impersonation of Bangladeshi daily newspaper Prothom Alo was also found.

The counterfeit page @bbc.bd.official is likely to have been created around November 11, the date on which its first profile picture was posted: a simple capital B on a slightly lighter background.

The first profile photo for the @bbc.bd.official Facebook page. (Source: Facebook / @bbc.bd.official)

The counterfeit BBC logo was uploaded later the same day.

Counterfeit BBC logo, uploaded shortly after the original profile photo. (Source: Facebook / @bbc.bd.official)

The page had little impact. At the time of the takedown, it only had just over 600 followers. It is also worth noting that the page did not give any information in the “About” section (bottom right), unlike the genuine BBC page.

The full @bbc.bd.official Facebook page, including a sparse “About” section. (Source: Facebook / @bbc.bd.official)

@Banglatribune.official

The page banglatribune.official was a similar counterfeit, this time portraying itself as the Facebook page of genuine outlet @BanglaTribuneOnline. As with the false BBC page, it inserted the blue check-mark in the profile picture and lacked any significant information in the “About” section.

The counterfeit page. Note the position of the blue check (yellow circle) and the lack of detail on the “About” page (red box). (Source: Facebook / @banglatribune.official)

It only had just over 600 followers, as compared to the genuine outlet, which has over three million.

The genuine BanglaTribune page. Note the location of the blue check mark (yellow circle) and the detailed “About” page (red box). (Source: Facebook / @BanglaTribuneOnline)

This page uploaded its first profile picture, an initial letter on a lighter background, on November 10. It added the pretend “verified” logo the following day, the same day as the false BBC page.

The first profile picture of the counterfeit page, posted on November 10, 2018. (Source: Facebook / @banglatribune.official)
The updated profile picture, November 11, 2018. (Source: Facebook / @banglatribune.official)

This account was barely active. It did not make any posts at all and only posted four photos — three profile images and a banner.

The only three photos posted by the counterfeit page. (Source: Facebook / @banglatribune.official)

@BDSNews24.bd

This page was a close imitation of genuine news page BDNews24, using the same logo, a stylized red letter “b” on a white background. It used almost the same screen name, bdsnews24.com, as the genuine article, bdnews24.com. It linked to a website, bdsnews24.com.

The counterfeit page. Note the logo, the screen name “BDSNews24.com,” and the lack of detail in the “About” box. (Source: Facebook / @bdsnews24.bd)
The genuine page. Note the identical logo, the screen name “bdnews24.com”, and the detailed information on the “About” page. (Source: Facebook / @bdnews24)

With over 6,400 followers and high engagement this page had the most significant community.

Profile page, showing the number of likes and followers on the right. (Source: Facebook / @bdsnews24.bd)

This page also had the highest number of postings and interactions on political content. The number of shares and likes showed that the page had significant reach with its audience. The page, active since 2017, was less active during its inaugural year but accelerated its activity in 2018, as the general elections approached.

Engagement on bdsnews24.com increased around the elections. (Source: NetVizz / Viz: @DFRLab)

The page and associated website posted on political themes. An article on the far-right party Bangladesh Jamaat-e-Islami (JEI), posted in August, had the highest engagement. The article claimed that JEI was considered a militant organization by the U.S. Department of Homeland Security. The article had no source, reports, nor hyperlinks. Nevertheless, the political party was highlighted as a threat to “democracy and the democratic process” in Bangladesh in a bill by U.S. Congressman Jim Banks (R-IN) in November.

Some articles on the website propagated misinformation, stating its information was obtained via “intelligence sources” while providing no actual sourcing. The website was registered on June 3, 2017, the same date as another page, newsdinraat24, which also used its Facebook page for influence operations (see below).

The @bdsnews24.bd Facebook page uploaded its profile picture on June 15, 2017, shortly after the website was registered.

The page’s profile picture, uploaded on June 15, 2017. (Source: Facebook / @bdsnews24.bd)

@Newsdinraat24.com

This was one of the few pages in the network to be more than a few weeks old and to boast more than a few hundred followers — it had just over 2,000. Like the other pages, it gave no information about itself and only posted sporadically, ceasing altogether in September.

Profile page for newsdinraat24.com. Note the lack of identifying detail in the “About” page and the fact that the last post was on September 16, 2018. Screenshot taken on December 19, 2018.(Source: Facebook / @newsdinraat24)

The page appeared associated with the website newsdinraat24.com. As we have seen the website was registered on the same day as bdsnews24.com, examined above. However, the Facebook page’s first profile picture was posted almost two months later, on July 25, 2017.

Original profile photo for the counterfeit page. (Source: Facebook / @newsdinraat24)

@Shamakal

This account appears to have impersonated a Bangladeshi website, samakal.com, which has a functioning Facebook page in English and a broken one in Bengali. It used the same banner and font as the genuine Samakal page but gave no further information, had not posted, and only had 26 followers.

The counterfeit page. Note the misplaced blue check mark and the lack of information on the “About” section, and the fact that it has not posted at all, witness the lack of “posts” on the left-hand side. (Source: Facebook / @Shamakal)

Its first profile picture was also uploaded on November 11 and featured the same pattern of a dark initial on a light background.

The page’s first profile picture, dated to November 11. Note the identical style to that of the counterfeit BanglaTribune page the day before. (Source: Facebook / Shamakal)
The page for Samakal English; note the identical logo, in white on orange, and the detailed “about” page. A version in Bengali was already offline. (Source: Facebook / @Samakal.English)

@BDNewsTime24dotcom

This page had a logo that closely resembled a genuine Bangladesh news outlet, BanglaNews24. Like so many other pages in this network, it had just over 600 followers. It had not posted since June.

Profile page for the counterfeit bdnewstime24.com, top, compared with the genuine profile page of, bottom. Note the high number of followers and the detailed “About” page on the genuine page. (Source, top: Facebook / bdnewstime24dotcom; Source, bottom: Facebook / banglanews24)

This account was another of the early ones in the network, created in November 2017.

Profile page for @bdnewstime24dotcom. Note the date. (Source: Facebook / @bdnewstime24dotcom)

Conclusion

Facebook’s conclusion that these pages were part of an organized network of coordinated inauthentic behavior appears borne out, especially in the case of the three pages that were created in November 2018. They all had the same style and were all set up over two days.

This network was small and inefficient, and some of its pages were only a few weeks old when they were taken offline.

Their content was political and likely targeted at the December 30, 2018, election. Given the small scale of the operation, the low number of followers and likes, and their rapid exposure, this appears to have been a failed operation that is of interest because the attempt was made and not because it succeeded.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Kanishk Karan is a Digital Forensic Research Assistant at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Follow along for more in-depth analysis from our #DigitalSherlocks.