Meta, the parent company of Facebook, has taken down two separate covert influence networks operating out of China and Russia, it announced on Tuesday (27 September).
The two unconnected networks were removed by the platform for violating its policy against Coordinated Inauthentic Behaviour, by targeting other countries’ political spaces online. In both cases, the operations ran across multiple social media platforms and were often focused on Russia’s war against Ukraine.
There has been a heightened focus on tackling disinformation since Russia invaded Ukraine in February, with several platforms rolling out additional measures in the initial days of the war and Brussels introducing unprecedented economic sanctions in March designed to prevent the dissemination of content from Moscow-backed outlets in the EU.
However, research undertaken since the introduction of these measures has found ways to circumvent these measures, meaning such material is still making it through into the EU’s information space.
Chinese network
The network based in China was found to have primarily targeted audiences in the US and the Czech Republic across four clusters between November 2021 and September 2022.
The issues touched upon by the campaign, which was carried out in English, Czech, and Chinese, were more narrowly targeted in the Czech Republic, zooming in on the government’s support of Ukraine and calls to avoid antagonising China.
In the US, however, the focus was broader, covering politics more generally but targeting a domestic audience. This, Meta said, diverged from previous Chinese influence operations which had taken aim at the US image in the eyes of an international audience.
The network in China was small in scale but spread across a number of platforms including Facebook, Instagram and Twitter, and its followership was small-scale, with just 20 accounts following one or more of the network’s pages across the former two platforms.
While the US-focused efforts saw little engagement, more interaction was seen with the content targeting Czech audiences, which also appeared on Czech petition websites. The posts were found to be sporadic and were mainly uploaded during Chinese working hours.
There were also instances uncovered of material from Russian state-affiliated entities being reposted by this network, including a link originally posted by Russia’s Ministry of Defence purporting to show documents detailing US-run bioweapons labs in Ukraine and articles from Kremlin-backed outlet Russia Today.
Russian network
The second network was the much broader of the two, covering a wider swath of countries and platforms, with around 4,000 followers of its pages and an estimated $105,000 spent on advertising on Facebook and Instagram.
Originating in Russia, this operation mainly targeted Germany, but also hit France, Italy, Ukraine, and the UK, and was run in German, English, Russian, French, Ukrainian, Spanish, and Italian. Meta was first alerted to its existence by German investigative journalists reporting on its activity.
This network functioned by mimicking legitimate news sites, including Der Spiegel, The Guardian, ANSA and Bild, but posting pro-Russian content and criticising Ukraine and Western sanctions.
This material was promoted across a wide range of platforms including social media sites such as Facebook, Twitter, Instagram and Telegram, as well as the sites of civil society and petition organisations such as Avaaz and Change.org. The content was also found to have, in a number of cases, been amplified by Russian embassies across Europe and Asia.
As Meta investigated and removed the impersonations, attempts were made to set up replacement sites “suggesting persistence and continuous investment in this activity”, the tech giant said.
This network, which began in May 2022, “is the largest and most complex Russian-origin operation that we’ve disrupted since the beginning of the war in Ukraine”, Meta said, adding that its combination of careful replication of news websites and crude social media amplification “presented an unusual combination of sophistication and brute force.”
The operation was also investigated by non-profit EU DisinfoLab, which titled it “Doppelganger” for its cloning of existing media outlets.
DisinfoLab’s examination found that content was appearing in different audio-visual formats, and many of the leading narratives promoted Kremlin lines, such as denying massacres in Ukraine or depicting it as a corrupt state.
The fact that concrete identification of those behind the campaign could not be made means that it remains “a continuing threat”, DisinfoLab said, noting that the operation was still ongoing.
“The publicly available data raises doubts about the success of Doppelganger,” said Alexandre Alaphilippe, executive director of EU DisinfoLab.
“But the very fact that the operation is still ongoing after months of breaching European trademark laws, GDPR, using EU-based servers and software, likely without consequences for its authors, is troubling.”
