Facebook’s Sputnik Takedown — Top Takeaways

Inauthentic pages linked to Sputnik promoted its content

@DFRLab
· 6 min read
(Source: @DFRLab)

Facebook removed almost 300 pages from its platform for “coordinated inauthentic behavior” across the former-Soviet space on January 17, 2019. The pages masqueraded as groups with special interests — ranging from food to support for authoritarian presidents — and amplified content from the Kremlin’s media agency, Rossiya Segodnya, especially that of its subordinate online news outlet Sputnik.

The pages represented a systematic, covert attempt to improve Rossiya Segodnya’s online audience across more than a dozen countries. Some had little impact, but others racked up tens of thousands of followers. Sputnik was the main beneficiary, as it was often the only source the Facebook pages amplified.

The Editor-in-Chief of Sputnik Latvia, Valentīns Rožencovs, confirmed that Sputnik ran the Latvian-focused pages. Open-source evidence shows that Rossiya Segodnya employees ran some of the other pages and were aware of even more of them.

In addition to a previous, independent investigation by @DFRLab, Facebook shared the names of the accounts before the takedown. Based on internal evidence, not shared with @DFRLab, Facebook concluded:

Despite their misrepresentations of their identities, we found that these Pages and accounts were linked to employees of Sputnik, a news agency based in Moscow, and that some of the Pages frequently posted about topics like anti-NATO sentiment, protest movements, and anti-corruption.

This post sets out the main findings and patterns, based on the open-source evidence. An accompanying @DFRLab post provides greater detail on the evidence and records the scale, techniques, and impact of the operation.

Amplifiers

The pages acted as amplifiers for two main Rossiya Segodnya outlets: Sputnik and the video service TOK. Sputnik is Rossiya Segodnya’s main media brand, operating in 31 languages, from Abkhaz to Vietnamese. Rossiya Segodnya’s founding charter says its mission is to “secure the national interests of the Russian Federation in the information sphere.” Sputnik officials deny that their parent company’s charter applies to them, but the outlet is notable for its close adherence to Kremlin narratives. TOK is less well known, but its website makes clear that it is part of the Rossiya Segodnya conglomerate.

Banner from the TOK website, showing the Rossiya Segodnya brand. (Source: TOK/archive)

Each page claimed to focus on a special interest, ranging from travel in Latvia to support for the President of Tajikistan. Most posts were apolitical, but some, especially in the Baltic States, were sharply political, anti-Western, and anti-NATO.

Almost all the pages predominantly shared content from Sputnik or TOK. Some shared Sputnik content and nothing else; others interspersed the Rossiya Segodnya content with images, memes, or stories from other sources, often Instagram.

Videos shared by @TRVLLV, a page ostensibly devoted to tourism in Latvia. Thirteen out of the 16 videos seen in this screenshot came from Sputnik’s weather service. (Source: @TRVLLV/archive)

The effect of these activities was promotion of Rossiya Segodnya output to a range of special-interest audiences, without stating their background or affiliation.

Widespread, Systematic, Cross-Border

The network identified by Facebook included 266 pages dedicated to 13 countries: Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, Armenia, Azerbaijan, Georgia, Moldova, Romania, Belarus, Estonia, Latvia, and Lithuania. Other pages covered the Baltic states as a whole.

The network reached across borders. This page, for example, said it was for “supporters of [Tajikistan President] Emomali Sharipovich Rahmon, the founder of peace and national unity, the leader of the nation. Created by the people of Tajikistan for the people of Tajikistan.” It was managed from Russia.

“Info and ads” section of the page @lidernaciirahmon (translated from Russian, “leader of the nation Rahmon”), showing the location of its managers. (Source: @lidernaciirahmon/archive)

The network was very large. Some of the pages had only a few followers and rarely posted, while others had tens of thousands of followers and posted every few hours. In aggregate, they had 853,413 followers. This figure does not account for single accounts following multiple pages, nor for the possible presence of artificial or automated followers, but it does give an impression of the sheer scale of the operation.

By comparison, Sputnik’s official pages across the same countries amassed 495,947 followers. The inauthentic network therefore increased Sputnik’s reach by over 170 percent across the countries they covered.

A statistically improbable number of the pages — over one quarter — was created in October 2017. Of those, 32 were created on a single day, October 10, 2017. They covered topics ranging from “famous Georgians” to Chechen leader Ramzan Kadyrov and from sport in Latvia to the Tajik rice-based dish known as “plov,” but all significantly amplified Sputnik’s content, reinforcing the impression that they were all part of a coordinated network.

Graph showing the creation dates of the pages that Facebook took down. (Source: DFRLab, based on analysis of Facebook pages)

In Latvia, Run by Sputnik

@DFRLab initially encountered the covert amplifiers in Latvia in November after TV show De Facto tipped @DFRLab about four pages from the network. This was an independent investigation initiated separately from Facebook’s work.

Based on joint research with @DFRLab, Latvian investigative TV show De Facto interviewed Editor-in-Chief of Sputnik Latvia Valentīns Rožencovs, who confirmed that Sputnik itself was running the pages. He further argued that this was “normal content promotion.”

None of the Latvian pages offered any transparency with regard to their Sputnik connection.

Screenshot of the About page for @TRVLLV. Note the lack of attribution of the page. This was one of the pages identified by @DFRLab as a Sputnik amplifier and confirmed as such by the Editor-in-Chief of Sputnik Latvia. (Source: @TRVLLV/archive)

Connected to Rossiya Segodnya

In other countries, technical and personal indicators also connected these pages to Rossiya Segodnya and Sputnik, beyond the pattern of sharing Sputnik and TOK content.

One page in Kazakhstan listed the Sputnik Kazakhstan website as its own. Another referred to “my dear Sputnik colleagues.” A page in Belarus boasted of posting an “exclusive” Sputnik video before Sputnik Belarus itself did. In Azerbaijan, one of the pages was managed by an individual who was employed at Sputnik until the end of November 2018.

None of these pages mentioned an affiliation to Rossiya Segodnya itself, although they amplified its content.

Other pages in the network cross-posted Sputnik and/or TOK videos. Cross-posting can only be done if two accounts or pages agree to it, indicating that Sputnik and TOK were aware of all the pages that cross-posted their content.

Screenshot from the Kazakhstan page @Казах-в-моде-при-любой-погоде. Six of the eight videos here were from Sputnik; five were cross-posted weather reports. The same page posted 34 TOK videos in a single day. (Source: @Казах-в-моде-при-любой-погоде/archive)

From Covert to Fraudulent

Most of the pages in the network were covert, in that they did not mention a connection to Rossiya Segodnya and also did not claim any other specific identity.

In one case, a sub-group of nine pages in Georgia was run by an account that appeared to be actively fraudulent, in that it claimed to be a young lady from Tbilisi, but took its profile pictures and “personal” posts from other online sources.

Top right, profile pictures posted by @diana.dvali.94. Top left and bottom left and right, the original sources of those pictures. (Source: Pinterest/archive, top left; @diana.dvali.94/archive, top right; Elena Kiseleva/archive, bottom left; deavita.fr/archive, bottom right)

One of the pages run by this apparently false account paid to sponsor a Sputnik article in December 2018. One month earlier, Sputnik embedded two videos from the apparently false account in one of its stories.

Conclusion

Facebook concluded, based on its own data, that this network of pages “used similar tactics by creating networks of accounts to mislead others about who they were and what they were doing.”

Facebook did not share that data with @DFRLab.

The open-source evidence indicates that the primary effect of almost all these pages was to promote Rossiya Segodnya outlets without mentioning any connection with the Kremlin agency.

In Latvia, Sputnik confirmed that it was running the pages as a “promotion” technique. Elsewhere, a range of open-source evidence, including cross-posting, user statements, and details of page managers, provided indicative links to Rossiya Segodnya and its employees.

The overall effect of the network was to provide Sputnik, in particular, with an audience significantly bigger than its own organic one. This was a covert promotion operation, and Rossiya Segodnya outlets were the main beneficiaries.


Nika Aleksejeva is a Digital Forensic Research Associate at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

Kanishk Karan is a Digital Forensic Research Assistant at @DFRLab.

Donara Barojan is a Digital Forensic Research Associate at @DFRLab.

Ben Nimmo is Senior Fellow for Information Defense at @DFRLab.

Follow along for more in-depth analysis from our #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade