Ben Nimmo Profile picture
Jan 20 11 tweets 3 min read
JUST OUT: Report on coordinated inauthentic behaviour takedowns in December, and a look back over the past year & more.

Interesting: 2/3 of all ops we removed since 2017 were wholly or partially focused on domestic audiences.

about.fb.com/news/2022/01/d… Image
We took down three operations last month:

* Iran, targeting the UK, focusing on Scottish independence;
* Mexico, a PR firm targeting audiences across LATAM;
* Turkey, targeting Libya, and linked to the Libyan Justice and Construction Party (affiliated w/Muslim Brotherhood).
It’s not the first time for an Iranian op to pose as supporters of Scottish independence.
In the past, FB found a page that copied and posted political cartoons about independence as far back as 2013.
@Graphika_NYC writeup here (pages 26-27)
graphika.com/reports/irans-…
This time again, this activity didn’t get much traction: the most successful IG account had just over 4K followers, and only about half of those were in the UK.

What’s remarkable is how hand-crafted the operation was.
Many of the accounts claimed to have specific jobs or hobbies, like an architect or a soccer fan. Then a lot of their posts were about that side interest to build credibility. Image
One account even stole its profile picture from a media personality in Iraq. Every couple of days, it would upload a new photo, to try and make it look authentic.
This was artisan work, not mass production: a small number of accounts active at any time (with auto detection disabling others).

Each tried to stay under the radar to avoid enforcement - which made it hard to be effective.
They posted about a mixture of things. Some personal, identity-building content. Some Scottish scenery. Some UK politics, especially Scottish independence.

Occasionally they posted about Saudi Arabia, Israel or the USA.

Iranian operations seem unable to resist these.
They copied the scenery photos and videos from real people.

That didn’t go down too well.

On at least one occasion, the real author called out the operation for using their images without asking.
Some of the people running it had a background in teaching English as a foreign language.

This didn’t stop them misspelling some of their hashtags, and some of the memes they appear to have created.
This was more like an old-fashioned IO: creating detailed personas, and trying not to be noticed. That’s a trend we called out last year.

It’s a recipe for staying under the radar, but it often means staying ineffective.
about.fb.com/news/2021/05/i…

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Ben Nimmo

Ben Nimmo Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @benimmo

Dec 1, 2021
JUST OUT: Adversarial threat report on brigading, mass reporting and coordinated inauthentic behaviour.

With a deep dive into the Chinese operation that created a fake “Swiss biologist” back in July.

I think of that one as Operation Swiss Rôle.

about.fb.com/news/2021/12/m…
There’s a lot here:

* Expanding Crowdtangle IO archive to more researchers
* First public takedowns of brigading & mass reporting networks
* CIB takedown from Palestine (Hamas)
* Two CIB ops focused on Poland / Belarus migrant crisis (one from Belarus KGB)
* Op Swiss Rôle
First, deep dive: in July, a fake “Swiss biologist” persona on FB and Twitter accused the US of bullying the WHO over COVID origins, and was picked up by Chinese state media with amazing speed.

H/t @mradamtaylor and @BBCTrending for their reports.

washingtonpost.com/world/2021/08/…
Read 11 tweets
Nov 20, 2021
I appreciate this discussion bc it helps shine a light on the complexity of these problems. Two things to note as we all work to tackle inauthentic behavior & deception. 🧵

1. There’s a big behavioral difference between spammy amplification and complex IO;

2. Platforms traditionally approach each differently for a reason — each represents different behaviours and has different incentive structure.
Boosting shares and likes is a numbers game to make content look more popular than it is. It can be used on political content or fake sunglasses (or both).

Either way, it’s on the simpler end of the spectrum.
@markhansontoo discussed it last year about.fb.com/wp-content/upl…
Read 9 tweets
Nov 1, 2021
🚨 JUST OUT: We took down a troll farm in Nicaragua, run by the Nicaraguan government and the FSLN party.
Our team’s research here:
about.fb.com/news/2021/11/o…
Important terminology point: over the years, I’ve seen some confusion over what constitutes a “troll farm”, as opposed to clickbait/content farms.

Here’s how we understand it.
Two things to note on this operation:

1) This was the closest thing to a “whole-of-government” operation we’ve seen.

2) The troll farm lived across the internet: own media websites built on wordpress, blogspot, amplified on FB, IG, TikTok, Twitter, Telegram, YouTube, etc.
Read 8 tweets
Aug 10, 2021
JUST OUT: In-depth report on the #Fazze case — a campaign from Russia targeting primarily India and LATAM, and to a lesser extent the US.
It was focused on the Pfizer and AstraZeneca COVID-19 vaccines, but got close to zero traction across the internet.
about.fb.com/news/2021/08/j…
There’s already been reporting on the Pfizer phase, in May (h/t @daniellaufer, @toniodaoust, @FloraCarmichael, @charliehtweets, @arawnsley).

Our investigation uncovered that in December, the same op targeted AstraZeneca.
We attributed this operation to Fazze, a marketing firm primarily operating from Russia.
Read 11 tweets
Jul 8, 2021
JUST OUT: Our monthly report on Coordinated Inauthentic Behaviour takedowns - June 2021 edition.

Eight networks, seven countries.

about.fb.com/news/2021/07/j…
Full details in the report, but a couple of thoughts here.

All but one of the networks focused on domestic targets. That’s not unusual: influence operations so often start at home — remember our recent IO Threat Report?
Historically, even some operations that became (in)famous for foreign interference started domestically.

E.g. the early Russian IRA posted critical commentary about Navalny back in 2013, often on LiveJournal (h/t @soshnikoff)

mr-7.ru/articles/90769/
Read 11 tweets
May 6, 2021
JUST OUT: 9 takedowns in our April CIB report. Primarily domestic ops:

👉Palestine, linked to Fatah;
👉Azerbaijan, linked to individuals associated with defence ministry;
👉Central African Republic, linked to local NGO;

(More in next tweet...)

about.fb.com/news/2021/05/a…
👉Mexico, 1 network linked to local election campaigns, 1 linked to a local politician and a PR firm;
👉Peru, 1 linked to a local party and an advertising firm, 1 linked to a marketing entity;
👉Ukraine, 1 linked to people associated with the Sluha Narodu party,

And...
👉Ukraine, 1 network linked to individuals and entities sanctioned by the US Treasury — Andrii Derkach, Petro Zhuravel, and Begemot-linked media + political consultants associated with Volodymyr Groysman and Oleg Kulinich.

Deep dive in the report. about.fb.com/news/2021/05/a…
Read 10 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(