Facebook removes assets connected to Ukrainian NGO

Assets linked to Anti-Corruption Block Post, an NGO that accused various public officials of corruption

@DFRLab
@DFRLab
Jan 12 · 8 min read
Image for post
Image for post

On January 12, 2021, Facebook removed a network of assets connected to the Ukrainian NGO known as Anti-Corruption Block Post. In its announcement, Facebook stated:

The people behind this network used fake accounts to post and comment on their own content to make it appear more popular than it was, manage Groups and Pages, some of which posed as news entities. Some of this network’s accounts and Pages had already been detected and disabled for spam and inauthenticity. Some of their content appeared on legitimate news sites in Ukraine under fictitious bylines. The people behind this operation posted primarily in Ukrainian and also in Russian about economic and political news, corruption in Ukraine, supportive commentary about some politicians like the former head of the State Tax Service in Ukraine, governor of the Odessa region, one of the local politicians in Odessa, and the UA Railway. They also posted content critical of some politicians, including Aleksandr Dubinskiy, Evgeniy Plinskiy, Luydmila Demchecnko, Igor Umanskiy, and Sergey Marchenko.

We found this campaign after reviewing public reporting in Ukraine about some of this activity. The vast majority of this network was inactive at the time we removed it. Although the people behind it attempted to conceal their identities, our investigation found links to individuals associated with the non-governmental organization Anti-Corruption Blockpost.

Facebook removed a total of 53 assets, including 13 accounts, 31 pages, six groups and three Instagram profiles. The DFRLab analyzed the public postings of 41 assets before they were removed from the company’s platforms; we also reviewed accounts discovered through public searches of the Facebook Ad Library to determine who sponsored any promotions of the pages in question. Most of the pages presented themselves as focused on political news; others were either dedicated to exposing corruption or social injustice.

There was open source evidence of both coordination and inauthenticity among the assets. Whereas most pages in the set published primarily political and national news from multiple legitimate outlets, complemented by links to dubious blog posts and websites rife with unsubstantiated claims, they also ran Facebook ads that were paid for by the same user accounts and that attacked specific Ukrainian political figures and state agencies. Within the set, the DFRLab identified multiple accounts that used profile pictures stolen from other sources.

Facebook tied the removed assets to Anti-Corruption Block Post, whose now-defunct Facebook page stated its mission was “to fight corruption and promote the transparency of public authorities and officials.” According to YouControl, an analytics tool for business entities in Ukraine, the organization’s full name is the All-Ukraine Association Anti-Corruption Block Post. The organization has 15 local chapters in various Ukrainian regions. The organization claimed in an activity report submitted to the Irpin city council website that its investigations had helped police to identify and charge multiple civil servants in the Kyiv region with corruption and to initiate investigations into the mishandling of state property.

Despite the widespread network, according to the now-defunct Facebook page, the organization used a blogspot page that had not been updated since 2016, as well as a YouTube channel with 14 subscribers and four videos, with the last upload on April 20, 2018.

The organization appeared to focus in particular on corruption around natural resources in the country classified as “subsoil.” Subsoil is a catchall term in Ukrainian for minerals, oil, wood, and other natural resources, and illegal extraction and exploitation of natural resources is an ongoing and widespread problem in Ukraine. The NGO, however, appears to have little to no presence in the field, though a Google search revealed that it had sent multiple requests for information to the State Service of Geology and Subsoil of Ukraine. Also, the organization applied to be on the Civil Oversight Board of the National Anti-Corruption Bureau of Ukraine in 2016. The organization also requested permission to send official observers to oversee the local elections in 2015 and parliamentary elections in 2019. Anti-Corruption Block Post has the same registration address as Protect Your Vote, another NGO that applied for observation of parliamentary elections in 2019; their page was also taken down by Facebook.

The DFRLab used the social media listening tool CrowdTangle to collect publication patterns and engagement levels of the removed pages. During their almost two years of operation, these pages received more than 93,000 engagements, including reactions, shares, and comments.

Image for post
Image for post
Total interactions (reactions, comments, and shares) from removed Facebook pages between December 2017 and December 2020. During the spike on April 3, 2020, the pages wrote about Ihor Umansky, ex-minister of finance of Ukraine, accusing him in being drunk on live TV and “uncovering” the truth behind his departure from the office. (Source: @r_osadchuk/DFRLab via CrowdTangle)

The removed pages published almost 2,600 posts, with 90.5 percent of content being shared between photos and links.

Image for post
Image for post
Post types of the pages from December 2017 and December 2020. (Source: @r_osadchuk/DFRLab via CrowdTangle)

The most shared non-Facebook domain addresses were pravda.com.ua and epravda.com.ua. The former is a reputable Ukraine media outlet, while epravda is its economic division. The other sites, with the exception of Antikor, are national outlets that report on events in Ukraine. Antikor appeared in multiple databases as an unreliable and manipulative website that appears to seek to publish info for financial remuneration. According to Texty, a Ukrainian independent media, Antikor — among others — earned money in part by publishing often fabricated accusations against political figures and would remove them for a fee, essentially blackmailing the subjects of its articles.

Image for post
Image for post
Graph of most shared websites on removed pages from December 2017 and December 2020. (Source: @r_osadchuk/DFRLab via CrowdTangle)

Most of the pages published national news and shared political ads targeting specific politicians and public personas.

Pages in the set concealed visible connections by predominantly publishing news from legitimate national media. However, they also sporadically posted blogs and websites with “compromising materials” on politicians, such as the ex-minister of finance, or state agencies, including the state fiscal service and Ukrainian railways. Multiple pages from the set published political ads on Facebook. According to public searches of Facebook’s Ad Library, they were all paid by a user account named “Rubanchuk Oleg.” This account paid for the ads on multiple pages removed as a part of the takedown, including “Corrupted Ukraine,” “Taxpayers,” “UaRelease,” “Political Observer,” and “Reformer.”

Image for post
Image for post
Snapshot of Ad Library search for the name “Rubanchuk Oleg” (in green boxes), who paid for the ads on Political observer (on the left) and Corrupted Ukraine (center and right) (Sources: Facebook Ad Library/archive)

It appears that the person behind the Rubanchuk Oleg account likely had more than one Facebook user account to pay for the ads. The image below shows a second Facebook user account — Oleg Rubanchuk (on the left) versus Rubanchuk Oleg (on right, written in Russian). The DFRLab could not determine whether the Rubanchuk accounts were an online persona or of a specific individual with a similar name.

Image for post
Image for post
Snapshot of Ad Library information for ads on InfoKor (on the left) paid by “Oleg Rubanchuk” and UaRelease (on the right) paid by “Rubanchuk Oleg” (translated from Russian). The green boxes highlight the name of Rubanchuk. (Sources: @nikaaleksejeva/DFRLab via Facebook Ad Library)

Some ads promoted Corrupted Ukraine, a now-defunct Facebook page from the set, but the majority shared blogposts or negative news articles about Ukrainian officials ranging from fiscal service managers to state ministers. Usually, these pages advertised blogs written by the people who paid for the ads. In the example below, ads paid by a user account named “Valeriy Scherbina” promoted three blogs, in which the author “investigated” the Kyiv fiscal service head’s alleged tax-related corruption.

Image for post
Image for post
Three ads on Corrupted Ukraine (on the top left, middle, and right) with subsequent advertised blogs (bottom left and center) with the name of the author and purchaser Valeriy Scherbina highlighted in blue boxes. (Sources: Ad library, top; Apostrophe/archive, bottom left; kievvlast/archive, bottom middle)

Some of the outlets linked externally by the assets, including apostrophe.ua and Politeka.net, also appeared in rankings of Ukrainian media outlets regarding adherence to journalistic standards — or the lack thereof — highlighting these websites’ verve for posting manipulative content, publishing misinformation, and using non-verified sources. Politeka.net was in fact subject to an earlier takedown in September 2019. Some of the external website stories in links in the Facebook ads were no longer available, including one advertised post on Politeka. An article with the same headline and presumably the same content appeared on multiple fringe media outlets, which resembled attacks on officials that the DFRLab previously exposed.

The user accounts for Valeriy Scherbina and Oleg Rubanchuk were among sponsors for Facebook ad content promoting the Political Observer Facebook page.

Image for post
Image for post
Snapshot of Ad Library ads on Politytchny Oglyadach paid for by” Valeriy Scherbina” (left) and “Rubanchuk Oleg” (right). The green boxes highlight Scherbina’s and Rubanchuk’s names. (Sources: @nikaaleksejeva/DFRLab via Facebook Ad Library)

Interestingly, the names Valeriy Scherbina and Oleg Rubanchuk also appeared in a September 2020 story by OpenNews about Ukrainian bot farms.

Image for post
Image for post
(Source: OpenNews/archive)

The DFRLab had access to 13 user accounts, the majority of which had stolen profile pictures and posted little to no content.

Image for post
Image for post
Stolen profile pictures. (Source, left to right, top to bottom: Andriy Klimenko/Facebook; vk.com; Igor Tuholaz/Facebook; face-base; Oksana Monasturska/Facebook; vkclan.ru)

One of the personas, Oleh Rybalchenko, claimed to be an analyst with Anti-Corruption Block Post according to this blog and his biography on a Kyiv local administration website.

Using the online tool “Multiple tools for Facebook,” the DFRLab found that user accounts removed by Facebook were admins of four groups, three of which were removed as well. One of the groups had the same name and visuals as the page Political Observer. Whereas the page published general news, the group demonstrated bias in its posts. Natalia Prokopenko, a now-defunct user account from this takedown set and admin of the Political Observer group, consistently shared posts between pages from the set.

Image for post
Image for post
Natalia Prokopenko shared content originally posted to the Anticorruption Block Post (top) and Reformator (bottom) pages in the “Political Observer” Facebook group. Both pages and the group were removed as a part of this takedown. (Source: Facebook)

The same admin published multiple posts complimenting various officials while sharing their publications. Out of 13 posts from December 4 to 13, 2020, six shared posts or complimentary coverage of Oleh Urusky, the Ukrainian vice prime minister of strategic industries. The admin also amplified messages of other officials, including the head of the State Fiscal Service of Ukraine.

Image for post
Image for post
Natalia Prokopenko sharing posts of Serhii Verlanov, head of State Fiscal Service (blue box), and Oleh Urusky, vice prime minister of Strategic Industries (green box), to the Political Observer Facebook group. (Source: Facebook)

The set of Facebook user accounts, groups, pages, and Instagram accounts contained elements of inauthenticity, like user images retrieved from the web. The assets showed a certain degree of coordination, such as Facebook ads sponsorship and group administration by the same users. Much of the content being spread by the network was political in nature, much of which was unsubstantiated claims of corruption.

Nika Aleksejeva is a Research Associate, Baltics, with the Digital Forensic Research Lab.

Roman Osadchuk is a Research Assistant, Eurasia, with the Digital Forensic Research Lab.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Medium is an open platform where 170 million readers come to find insightful and dynamic thinking. Here, expert and undiscovered voices alike dive into the heart of any topic and bring new ideas to the surface. Learn more

Follow the writers, publications, and topics that matter to you, and you’ll see them on your homepage and in your inbox. Explore

If you have a story to tell, knowledge to share, or a perspective to offer — welcome home. It’s easy and free to post your thinking on any topic. Write on Medium

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store