BREAKING: @Facebook just took down over 900 accounts, pages and groups associated with @TheBLcom and Epoch Media Group.
Report from @Graphika_NYC and @DFRLab coming shortly.
about.fb.com/news/2019/12/r…
Report from @Graphika_NYC and @DFRLab coming shortly.
about.fb.com/news/2019/12/r…
One of the most interesting aspects was the way this network, which we call #OperationFFS, used AI-generated profile pictures.
Interesting, but remember: the network sent up many signals of fake behaviour. It takes a lot more than a fake profile pic to hide a fake campaign.
Interesting, but remember: the network sent up many signals of fake behaviour. It takes a lot more than a fake profile pic to hide a fake campaign.
There's a lot in this set: assets around the world in English, Spanish, Chinese, Portuguese, Vietnamese; feelgood content, anti-China content, pro-Trump content.
But takedowns are about behaviour not content, so here are a few main points.
But takedowns are about behaviour not content, so here are a few main points.
A ton of groups and pages - over 80 of them - posed as pro-Trump American patriots. They almost exclusively shared content from TheBL.
But page transparency is a great thing. Most of the managers across those pages were in Vietnam.
But page transparency is a great thing. Most of the managers across those pages were in Vietnam.
There were groups and pages focused on Taiwan, Hong Kong and China, too. A lot of them were managed by the same admins, grouped into clusters.
(H/t @realShawnEib for the mapping.)
(H/t @realShawnEib for the mapping.)
And a similar pattern in the US-focused ones. Dense cluster, same admins across lots of different groups.
What's interesting in the US groups, which were all variants on a theme of pro-Trump messaging and TheBL content, was the faces of the admins.
They were AI-generated. How can you tell? Well, human faces tend to asymmetry. Glasses, not so much.
They were AI-generated. How can you tell? Well, human faces tend to asymmetry. Glasses, not so much.
Here's the close-up of the two halves. Spot the difference.
Turns out earrings are difficult, too.
Again, here's the closeup.
There's no rule that says earrings have to match, of course, but the blurriness and general effect are telling.
There's no rule that says earrings have to match, of course, but the blurriness and general effect are telling.
Perhaps counter-intuitively, backgrounds are even harder, because there's more variation in scenery than there is in faces.
Always worth looking at the background on pics like this, in fact.
There were a lot of pics like this. Dozens at least in the accounts we looked at, both admins and members of groups.These are a sample.
Fun trick that works for now, though I guess the AI will evolve pretty fast: see what happens when you make all 40 opaque and superimpose them. Note how the eyeballs line up?
(H/t @conspirator0 and @ZellaQuixote for the idea)
(H/t @conspirator0 and @ZellaQuixote for the idea)
But I'll say again, it takes much more than fake faces to hide a fake operation.
There were other indicators of fakeness too.
These were all admins on the same group. All uploaded their only profile pics in the space of an hour.
There were other indicators of fakeness too.
These were all admins on the same group. All uploaded their only profile pics in the space of an hour.
These were the clustered admins on the China-focused assets. Ten admins, all with profile pics taken off the web - often from Vietnamese sites.
These were another cluster. Note the sources, and...
... note how they all uploaded different profile pics at first, in a batch in September, and then changed in a batch on November 4.
Here's the coordinated bit in action. Same post from TheBL, different admins, different groups, all in just over an hour.
Even with AI-generated profile pics, somebody thought it would be a good idea to reuse them.
It wasn't just activity on Facebook. There were at least some Twitter assets too. Some looked like spam retweeters, amplifying posts from @TheBLcom and @TheBLNews.
They are no longer with us.
They are no longer with us.
And there was this interesting YouTube channel. It posted three videos, two of them advertising TheBL, the third one showing President Trump insulting journalists.
Three videos, 15 responses, 51 subscribers. And 1.8 million views.
Three videos, 15 responses, 51 subscribers. And 1.8 million views.
Oddly, that may not all have been organic.
Some of this activity was demonstrably automated, using Postcron on both Facebook and Twitter.
Note the profile pic for "Davidson Susan", too.
Note the profile pic for "Davidson Susan", too.
Final thought: multiple layers of research went into this. There's a community building around these issues. We need to keep building it, to make sure future operations get exposed early enough. //
Thread ends.
Thread ends.
