The Coordinated Inauthentic Behavior of TheBL network on Facebook

This week brought many announcements from the Facebook Newsroom; one about protecting the integrity of the US elections, another on takedowns of networks from Iran and Russia and another updating and clarifying specific policies behind the way Facebook combats information operations of those engaged in coordinated inauthentic behavior on the platform, (now called CIB)

Last week, in my first piece for SecJuice, I introduced a complicated tangle involving the publication TheBL.com and provided a timeline with references to articles for further reading.  This week I'll illustrate some specific activity on Facebook.

I documented about 275 profiles in a spreadsheet. These are used for spamming network content and administration of their groups. About 25 of those seem to be connected to real people, both American and Vietnamese staff.  Most notably, Matt Tullar, a political video commentator, and Orysia McCabe, the Editor-in-chief of TheBL. Both of these profiles have roles as administrators in many of the groups.

The Editor-in-Chief of TheBL served as a group administrator with the now deleted page "We Stand with President Donald Trump.Ana" bearing the  profile logo: Trump 2020 Because Fuck You Again.

On the right side of this illustration are two screenshots of the admin team of the group "We Stand with President Donald Trump". The screenshots were taken ten days apart, the first on October 14th, the next on the 24th. There are some big changes in the admin team. The two page admins, they didn't just step down, those pages are gone from Facebook. Also deleted from Facebook is the profile "Smith Inez" which had a Vietnamese name in its Facebook URL thithan.luong.771.  Two new profiles have been added, a seemingly real Vietnamese woman who hasn't posted in English on her personal timeline, and a brand new fake profile "Forman Virginia" that was created on October 22.  
  The *page* "We Stand with President Donald Trump.Ana" was created on August 27th, and the profile image was uploaded the same day.  For about seven weeks, the Editor-in-Chief of TheBL had her name right alongside "Trump 2020 Because Fuck You Again".

I'd like to juxtapose this with some flowery text from TheBL website:

"It is our responsibility to be conscious of the kind of values that we choose to portray to all of society. All citizens strive for TRUTH IN CONTENT.
We wish to gather the force of kindness and transmit righteous energy while promoting mutual understanding and respect. In the face of a complex and problem-filled world, The BL is like a pure mountain spring, moistening the heart of every reader. It aims to plant the seeds of sincerity, goodness, and tolerance deep into the soul, so that it may grow and prosper."

I almost feel bad for Orysia McCabe. I'm exposing this horribly rude and unprofessional occurrence that appears to have gone unnoticed. It would be lost to Facebook's massive data graveyard of deleted secrets were it not for my screenshots. I have to work to beat back my sympathy for this woman by remembering what the company she works for has done and the executive decisions that she surely played a role- regardless if she knew what the overworked page maker and social media manager in the background (likely in Vietnam) had slipped past her.

Somewhere along the way The Epoch Times decided to branch off on a new venture. They made a purposeful strategic decision that all connections between themselves, this new branch, TheBL, and Falun Gong would be hidden. Once the connection was discovered and made public, the connection was denied and further steps taken to hide it. Contrary to their mission statement, TheBL is neither respectful or honest. A paternalistic decision was made that the best way to achieve their goals was to support Donald Trump, and to do that without publicly declaring their motivations or rational. Their support of this one person would carry the full burden of achieving their goal.  Rather than simply being honest with the American people, making their plight known (or openly evangelizing their religious beliefs) and allowing the natural political process to take place.  TheBL has engaged in a full out propaganda campaign to push their agenda through the votes of Americans they seek to influence.

Here is a random sampling of 21 of the pages TheBL put on Facebook... of about 100 I found.

Reasearching this network was a slog. We know if we have discovered something by being able to differentiate it from the things we have already seen.  This network is so repetitive it's hard to recognize what we have already encountered, and the naming conventions are positively maddening. In a very short time you will encounter faces, names, logos, slogans and vistas that you have seen before... you feel like you have circled this block already five or fifty times.  Maintaining a spreadsheet of the account URLS and constantly re-checking was essential. There were several instances when I found what I thought was a new fake profile and discovered that it was one I had already documented, but that it had been renamed and re-faced with a different profile picture. Other times pages were deleted and quickly replaced with a new page identical in every way to the previous one except for the creation date and URL.

Here are an additional six pages I set aside to highlight together for obvious reasons.

Adding to the overwhelming amount of repetition is that almost every group has a mirror page with the same name and cover pictures.  These pages typically serve a role as an administrator of the group.

Most pages acting as group administrators have no posts and only a handful of likes.  They function pretty much like a fake profile without the burden of needing to be a pretend human being- but with the added visual authority of  profile photos of the President and the American Flag accompanying their posts. Because the profile photo is typically the only part of the page that would be viewed by the public, for many of these pages, that's all there is on the page.  This is what that looks like:

When I first started trying to visualize the size of this, I tried to pair the pages and groups. I soon realized that along with the fake profiles who typically each were in more than one group, most groups had several administrator pages as well. The crossover was difficult to chart in a linear fashion.  There was one page in particular, "America First," managed from Vietnam with no branding disclosure. That page was an administrator (by my count) of at least twenty six of TheBL groups on the day that Snopes published their findings.  Snopes had found seventeen of those groups and mentioned the page by name in their article. By 9:00 PM that night "America First" was gone. I do not know if that removal was voluntary or at the hands of Facebook.

There were several "branded" pages with a blue BL logo acting as administrator in most of the groups. These pages are true fan pages which post content for their following (which can number in the millions).  These blue dot "branded admins" have been removed from the groups since the publishing of the Snopes article.

Here is an excerpt from Nathaniel Gleicher's recent news release about CIB:

"The real issue is that the actors behind these campaigns are using deceptive behaviors to conceal the identity of the organization behind a campaign, make the organization or its activity appear more popular or trustworthy than it is, or evade our enforcement efforts."

Let's look at some of the fake profiles used to seed theBL material into the Facebook content stream.  I found 275, here are seventy of them grouped by themes.

Below is a sampling of sixteen of the 77 groups I found. There is no reason for one entity to need that many groups other than the tactical advantage of flooding. It is also not humanly possible to responsibly maintain this many groups with a shadow admin powered by a social media post managment software program. By generating groups names with almost every possible combination of key election words- they have elbowed their way into the search results of almost any query. TheBL is not just promoting President Trump with these tactics- they are competing against legitimate groups where natural human conversations and a human curated collections of organic shares are found. A propaganda network like this is effectively silencing real humans by drowning their voices in the flood of automated static. While other groups host a mix of content brought to the table by real people, TheBL groups use tireless bot administrators to push a stream of branded propaganda, datamining engagement bait memes, and "Text MAGA" spam to guide their audiences away from Facebook and the competition for their attention. Another tier of spamming accounts send the posts from the group out into other non-network groups; reaching even more people, advertising their group and giving the posts the appearance of popularity.  Facebook's algorithm further rewards the spamming by surfacing posts which have more shares.

It is important to note that there is no reciprocity when it comes to their own network groups; they all have the same rules posted:

"Dear members, Thank you for joining our group. Please make sure that you share links from direct websites or the personal account. Links shared from other pages/groups are not ALLOWED."

Last week I wrote about "Christopher Donnelly" who changed his race soon after I encountered a piece of "Text MAGA" spam from him.  "Phillip Parshall" is another fake profile who has had a dramatic change of face. These two handsome guys on the profile (FB: david.l.rice.104) came from two photographers on Unsplash, Nico Marks and Timothy Barlin.

Parshall was spamming heavily into NFL Boycott themed groups when he switched faces in July.  I wonder if anyone even noticed.

Before the name was changed to Nancy Myers- before it became a redhead and then a blond, this profile had a Vietnamese name and posted in that language. Likewise "Cindy Anderson" also had a Vietnamese name.  Of her friends, two stand out with the look of a BL bot... those two, like these others, have changed their names and profile pictures to assume American identities to push this content to an American Audience.  

TheBL is also not shy about using memes heavily laden with Christian iconography while avoiding mention of the religion they actually represent. This is no accident, their target audience is largely Christian. It's beyond the scope of this article to delve into theological analysis. Christians who are concerned should take this question to their pastor.

The photos that gave a face to these fake Christian bots all came from the photo sharing site Unsplash.
"Josephson Magnolia": original photo by Timothy Barlin
"Tom Clayton": original photo by Oliver Ragfelt
"Joseph Shutt": original photo by Joseph Gonzalez

I'll finish with this somber captioning on this post from (now deleted) account John Landrum, once an Admin in the Group "America Needs President Trump"

The American voting process is not about shutting people up, it's about the right of every person to be heard.  (People. Not bots.) I hope all Americans will continue to speak up, to speak to each other, and to vote. I hope that they learn to be more careful and do not allow artificial amplification systems to drown out their voices, drive wedges between us or to undermine our political process with deceptive manipulation. Please be aware of the tactics and signals of CIB. Don't be fooled into thinking that if you happen to agree with some of the content they are pushing that they are on your side- this is not representation! They are silencing conservative voices through flooding. They are collecting data and mailing lists and developing off platform tracking of vulnerable people.  They are cheating American publishers from a fair chance to reach their audience; publishers whose content is not artificially surfaced through an army of bots and a hundred seventy some odd groups and pages, and who don't have a secret agenda and who would never have a couple of million dollars to spend on Facebook advertising.  

I expect that Facebook will be eager to demonstrate that they take this very seriously and look forward to yet another update from the Newsroom in the coming days.