Facebook takes down inauthentic accounts from India, Egypt

Facebook has removed hundreds of accounts, pages, groups and Instagram accounts originating from India and Egypt for violating Facebook’s policy against foreign or government interference.

Accounts emanating from India focused on the Gulf region, U.S., UK, and Canada while the Egyptian activity aimed at countries in the Middle East and North Africa. Facebook said one marketing firm in India, “aRep Global,” and two marketing firms in Egypt, “Waves” and “Flexell,” are responsible for the activity.

The announcement Monday comes as part of Facebook’s efforts to be more transparent about how it roots out inauthentic behavior on its platforms (this is the first in what executives said will be a series of monthly reports). The social media company in recent months has identified separate campaigns associated with a Russian tycoon, the United Arab Emirates, Africa and the Middle East.

But this is not the first time Waves and Flexell, the Egyptian firms, have been caught running questionable campaigns on Facebook.

Facebook removed activity from both firms in August and October of last year. And yet, in this case, they still succeeded in building a following of about 6.2 million users. Many of the accounts behind the Egyptian activity were “continuously detected and disabled by our automated systems,” Facebook said, adding that the operators spent less than $48,500 for ads on Facebook and Instagram.

It’s a possible warning sign that identifying and removing inauthentic behavior may not be enough, researchers at the Atlantic Councils’ Digital Forensic Research Lab say.

“The resurgence of assets linked to NewWaves and Flexell, both subjects of an identical purges performed less than a year ago, is a worrying development,” DFRLab’s Jean le Roux and Max Rizutto wrote in a blog post. “Flexell and NewWaves persisted with conduct that violated Facebook’s terms of service despite both companies losing assets in two separate takedowns in 2019.”

DFRLab warned against the “opaque nature of the business” as a particular concern moving forward.

“Given the companies appear to be paid-for marketing firms, without insight into their client base, it is unlikely that the true source of this activity will become known,” the researchers added. “It is this opaque nature of the business that is of particular concern: without clear insight as to who is paying a private company to undertake such activities, the ulterior motive for the information pollution they inject online will similarly remain a mystery, making it nearly impossible to hold those ultimately responsible accountable.”

What the networks did

It wasn’t clear why the actors behind the Egyptian network brought it back online, DFRLab said. At times, Egyptian account owners masqueraded as local news organizations in the countries they were targeting, sharing information about the Trump administration’s killing of Qassem Soleimani in Baghdad, protests in Iraq, the war in Libya, humanitarian programs in Yemen, and alleged terrorism in Qatar and Turkey.

But the content shared by the Egyptian campaign, which was run through both authentic and fake accounts, wasn’t just political. Some of the accounts were sharing uplifting or humorous content, according to DFRLab, which also analyzed Facebook’s findings.

Many of the administrator accounts were created this year, and the network tweaked and reused content in a likely effort to avoid detection, DFRLab said, saying that was evidence the accounts were inauthentic.

There was also a Twitter account associated with the Egyptian scheme working “in unison” with the Facebook entities, according to DFRLab.

The Indian-associated pages sometimes posed as news sites, as well. They focused on Saudi Arabia’s role in the conflict in Yemen, human rights in the UAE and Saudi Arabia, the murder of Washington Post columnist Jamal Khashoggi, and sporting events in Qatar, with an anti-Saudi, anti-Emirati, pro-Qatar bent, according to Graphika, which also had access to the account data.

Like the Egyptian campaign, the Indian network relied on multiple platforms to amplify its messaging, including Twitter, YouTube, Medium, WordPress, Reddit, Gmail, LinkedIn, according to Graphika.

While Facebook has linked this network with a digital marketing firm, Graphika said, it’s not clear if government dollars also are involved somehow.

Facebook’s attribution “suggests that the operation was a case of online influence for hire, conducted at the behest of a geopolitical actor with concerns in the Gulf,” the researchers write. “Open-source evidence has not yet uncovered the smoking invoice that would prove the identity of the actor, but the pattern of commercial operators running influence operations for political or geopolitical clients has already been observed in the Gulf and elsewhere.”

The India-based scheme garnered nearly 30,000 followers and involved less than $450 in spending on advertisements.