Coordinated Inauthentic Behavior

From time to time a press release will come from the Facebook Newsroom about yet another network removed for engaging in coordinated inauthentic behavior. Typically the details are relayed in terms of the country of origin and the numbers of pages, groups and profiles removed.  Sometimes samples of their posts are provided.

We learn about the network only after it is gone. The people who came in contact with the content, who were members of the groups, had liked the pages, friended the profiles and shared their material are never notified directly. There is never a debriefing.  

The closest we came to that type of disclosure was after the debacle with the Russian Internet Research Agency. Facebook offered a tool buried deep in the help center, where a motivated person could log in (only through a desktop computer) and see if they had followed any of the Russian pages.  As far as I know, I am the only person who has publicly admitted to having followed one. I recently tried to find my way back to that tool and it seems to be gone.  

In this video from the Facebook Newsroom, Nathaniel Gleicher talks about Coordinated Inauthentic Behavior. He explains that it pertains to the activity of the network as a whole and not necessarily problems with any of the pieces of content individually.

There is a large network currently operational on Facebook that, like an arcade coin pusher, is simultaneously being added to as other pieces fall off the other side. Here is an opportunity for you to see coordinated inauthentic behavior in the wild.  This network exists to solicit subscriptions for a news app and to disseminate links to TheBL.com. BL stands for the Beauty of Life.  I have my own nickname for TheBL- The Big Lie. The heart of this story has to do with deception. Not just any deception, but deception from a brand who has billed itself as truthful and moral... they even use the word righteous in their website's about section.

This post was my first encounter with the network:

The day I encountered this spam post from the (now deleted) profile "Christopher Donnelly" (with the profile URL: www.facebook.com/tayron.threatts)  I took this screenshot. I also did a reverse image search of the profile picture and discovered the original photo taken from Unsplash was by the Johannesburg photographer, Maatla Seetelo, it has been used as a stock photo all over the web. I composed a tweet about what I assumed to be a Smishing scam- Donnelly's profile also had once sported a cover photo of piles of cash!  

I returned to look at his post one more time- and had difficulty recognizing it because in the hour I'd been away, the profile photo was swapped out to an entirely different person.  This would set the stage for the investigation to come.

In my next article I will discuss specific details of of how this network operates. If you'd like to see it for yourself before then, one easy entry point (I call this a trailhead) is to search on Facebook for the keywords seen here in Christopher Donnelly's post, "Text MAGA 76684"  You will likely have many search results showing network profiles spamming these ads/articles into non-network groups. You will also see network pages putting these into their own groups. Some ads instruct to "Text Trump 76684" you may get some of those too. A word of caution: real people are duped into spamming these ads when they share the articles- the ad caption goes with it, so understand that not all the profiles who come up in a search are automated network spambots, and not all the groups getting the spam treatment are part of this network.

The chart below represents accounts created by TheBL network in the summer of 2019.  There may be accounts I did not find, and still others which were deleted before I started. Many of these accounts counted in this chart have been deleted since I began my research on September 5th (I did not report any accounts to Facebook) Deletions are not noted here, just creation dates.  Each dot represents an account. Yes, they really made that many groups!  In regards to the profiles, it can be difficult to establish a creation date for an account that was hijacked or repurposed.  In those cases the date that the profile's cover photo and most recent profile-photo was added is considered a creation date.

For reference this  timeline lists key media, network and personal events in this story from the summer of 2019- with links:

• June 20- Stephen Gregory, publisher of the Epoch Times publishes an open letter in regards to what he felt was an inapropriate line of questioning from NBC investagative reporters.
• July 12-14 (unbeknownst to me at the time) TheBL creates at least 41 Facebook groups dedicated to supporting President Donald Trump.
• July 15- I notice a spam post from "Christopher Donnelley" on Facebook.
  I tweet about it.
• July 22- Facebook page "Pure American Journalism" is created
• July 23- Facebook page "Honest Paper" is created
• July 26- TheBL creates an additional 15 Facebook groups promoting President Trump.
• July 26- On this day I publish an open letter to Chad Prather (a different problematic situation on Facebook unrelated to TheBL)
• August 20- NBC Tech News publishes a story by Brandy Zadrozny and Ben Collins, "Trump, QAnon and an Impending judgement day: Behind the Facebook-fueled rise of the Epoch Times. "
• August 21- Levi Browde, the Executive Director of the Falun Dafa Information Center, publishes an open letter, "NBC Journalists Distort and Malign Falun Gong to Strengthen Attack on Rival Media" This letter appears on the center's website and in three publications: The Epoch Times, NTD.com, and TheBL.com
• August 22- "Pure American Journalism" (Facebook page) shares two news stories; USA Today on the threat China poses to religious freedom in Hong Kong, and a video from the Washington Examiner of Trump lambasting a NBC News correspondent. These are the last posts made by the page to-date.
• August 22- NBC had an update to this story- "Facebook bans ads from The Epoch Times after huge pro-Trump buy"
• August 23- Stephen Gregory, publisher of The Epoch Times publishes a statement in response to the NBC Story.
• August 25-29- TheBL creates (at least) 33 new Facebook pages and two groups.
• September 5- I begin mapping out TheBL's Facebook activity.
• October 6, I begin to write about TheBL network on Facebook that has curiously avoided the media spotlight.
• October 8- I attempt to contact NBC reporters to share what I have found.
• October 10- I find Adsense code demonstrating an irrefutable connection between The Epoch Times and TheBL.com
• October 9-11- TheBL creates at least 16 new Facebook pages, three of them are titled: "Keep America Great"
• October 11- Snopes publishes "EXCLUSIVE: Expanding Pro-Trump Outlet ‘The BL’ Is Closely Linked to The Epoch Times"