Published in


#ElectionWatch: Facebook Takes Down Network Supporting Indonesian Presidential Candidate Prabowo Subianto

Network of false pages and groups mingled human-interest and religious content with political content, as well as used known false identities

(Source: @KaranKanishk/DFRLab)

On April 12, Facebook removed 234 Indonesian pages, accounts, and groups for spreading polarizing political messaging just a week before the country’s elections.

Indonesia’s 192 million voters go to the polls on Wednesday, April 17, for presidential, parliamentary, and local elections. The presidential race pits incumbent Joko Widodo, or “Jokowi,” against former general Prabowo Subianto, who has been accused of human rights abuses and seeks to bolster the military establishment dramatically. Indonesia reportedly has the fourth highest number of Facebook users in the world, making the platform a prime target for manipulation in the country.

Facebook shared the names of some of the pages and groups with the DFRLab shortly before the takedown. These assets mixed attacks on the incumbent president and praise for his challenger with apolitical content, possibly as an audience-building technique.

In an update to an earlier blog post, Facebook stated that it had removed these assets:

“…for engaging in coordinated inauthentic behavior as part of a domestic network in Indonesia. This activity originated in Indonesia and the people behind it misled others about who they were and what they were doing. They used fake accounts and frequently posted about local and political news including topics like upcoming elections, alleged election fraud, candidate views, and alleged misconduct of political figures. As always, we took action based on the behavior of these actors, not the content they posted.

Their impact was low, as measured by follower numbers and engagements, but their potential reach was higher because of the number of groups they managed.

A Known Fake Name

Three pages were using the identity of a known false persona, Annisa Madaniyah, which had previously spread a hoax about the North Maluku gold mine being given to the Chinese and had also posted comment insulting Jokowi’s mother in 2017.

The accounts administered the same two groups: Annisa Madaniyah Vs Jokowi Dodo and Annisa Madaniyah

Three pages associated with Annisa Madaniyah, a known false persona, administered the same two groups, Annisa Madaniyah Vs Jokowi Dod and Annisa Madaniyah. (Source: Annisa Madaniyah/archive, top; Annisa Madaniyah/archive, middle; Nisa Vs Jokowi Monyet/archive, bottom)

The pages often published the same posts within a tight time-frame, suggesting coordination across the network.

The pages shared the same link accompanied with the same text, an indication of coordinated activity. (Source: Annisa Madaniyah/archive, top left; Annisa Madaniyah/archive, top middle; Nisa Vs Jokowi Monyet/archive, top right; Annisa Madaniyah/archive, bottom left; Annisa Madaniyah/archive, bottom middle; Nisa Vs Jokowi Monyet/archive, bottom right)

Linked by Groups

The DFRLab identified four pages that managed over ten groups each. Most of the managed groups were the same across the three pages.

A list of the groups managed by four pages in the network. Across three of the pages, most of the managed groups were the same. (Source, left to right: Satu Dua Tiga/archive; PS O8 for Indonesian/archive; Sekilas Info/archive; Silvana Andriana/archive)

While the pages Satu Dua Tiga, PS O8 for Indonesian, and Sekilas Info posted political content, the page Silvana Andriana posted cooking recipes.

Recipes from Silvana Andriana. (Source: Silvana Andriana/archive)

The pages Satu Dua Tiga, Sekilas Info, and Berita Sekitar Indonesia posted the same links to Gelora.co, Nusanews.id, and Gelora.news at nearly the same time. This behavior is typical of coordinated networks with shared managers or a shared content strategy whose intent is to amplify a specific outlet, while making the amplification look organic.

The pages Satu Dua Tiga, Sekilas Info, and Berita Sekitar Indonesia posted the same links almost at the same time. The top link title, translated from Indonesian: “Second Day of Campaign, Google Trends: Jokowi 30.63% vs. Prabowo 69.38%;” middle link title, translated from Indonesian: “Apparently Prabowo Has 8,000 Foster Children in Papua;” bottom link title, translated from Indonesian: “Family of National Hero Bung Tomo Supports Prabowo-Sandi.” (Source, left to right, top to bottom: Satu Dua Tiga/archive; Sekilas Info/archive; Berita Sekitar Indonesia/archive; Satu Dua Tiga/archive; Sekilas Info/archive; Berita Sekitar Indonesia/archive; Satu Dua Tiga/archive; Sekilas Info/archive; Berita Sekitar Indonesia/archive)

Islamic Content

One page, RBNS News, posed as a news outlet. In February and March, it shared posts in English, Chinese, and Russian, linking to three Islam-focused Blogspot pages (respectively called islam-news-online, islam-xinwen, and islam-novosti-russia). The posts in each language concerned the same subjects, usually Islamic prayer and scripture, and used the same images.

A page called RBNS News posed as news outlet and linked to Islam-focused Blogspot pages in English, Chinese, and Russian. (Source: RBNS News/archive)
The Russian-language version of same post from RBNS News. (Source: RBNS News/archive)

Prior to these posts, the page had been silent since late November. Earlier, it had primarily shared posts from a website called superbola.win. The page is no longer operational but shared a name with the Facebook page Superbola.com, which also featured in this Facebook takedown.

The RBNS page had previously shared posts primarily from a website called superbola.win, which shared a name with the Facebook page Superbola.com. The Superbola.com Facebook page was also removed in this Facebook takedown. (Source: superbola.com/archive)

The page was ostensibly devoted to sports, but its recent posts were more political or religious in nature and linked to a website called sew0rd.com that described itself as a “portal for Islamic news.”

The Superbola.com page recently posted more political and religious content, including links to a website called sew0rd.com. (Source: superbola.com / archive)


This report presents a snapshot of the pages that Facebook took down for “coordinated inauthentic behavior” ahead of the election.

The pages visibly formed a dense and self-reinforcing network, with clusters of pages sharing links to the same articles and websites at almost the same time. Some of the identities they claimed had already been exposed as false ones.

The pages mingled religious and human-interest content with political content, predominantly attacking incumbent President Joko “Jokowi” Widodo and supporting his main rival, Prabowo Subianto.

Their overall direct follower count was low, at around 17,000 (with probable redundancies between the follower counts for different pages). Typical posts only achieved a handful of engagements, if any. Nevertheless, these pages managed a large number of groups, well over 100, which gave them the chance to achieve significantly more reach.

This does not appear to have been an especially effective operation. Given the proximity of the elections, however, its potential for spreading false or divisive messaging remained significant.

Nika Aleksejeva is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Kanishk Karan is a Digital Forensic Research Associate at the DFRLab.

Ben Nimmo is Senior Fellow for Information Defense at the DFRLab.

Register for the DFRLab’s upcoming 360/OS summit, to be held in London on June 20–21. Join us for two days of interactive sessions and join a growing network of #DigitalSherlocks fighting for facts worldwide!



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store



@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.