# Removing Coordinated Inauthentic Behavior **[about.fb.com/news/2020/09/removing-coordinated-inauthentic-behavior-russia/](https://about.fb.com/news/2020/09/removing-coordinated-inauthentic-behavior-russia/)** April 7, 2022 **We removed three separate networks for violating our policy against foreign or** **government interference which is coordinated inauthentic behavior (CIB) on behalf of** **a foreign or government entity. These networks originated in Russia.** In each case, the people behind this activity coordinated with one another and used fake accounts as a central part of their operations to mislead people about who they are and what they are doing, and that was the basis for our action. When we investigate and remove these operations, we focus on behavior rather than content, no matter who’s behind them, what they post, or whether they’re foreign or domestic. Over the past three years, we’ve shared our findings about over 100 networks of coordinated inauthentic behavior we detected and removed from our platforms. Earlier this year, we started publishing monthly CIB reports where we share information about the networks we take down to make it easier for people to see progress we’re making in one place. In some ----- cases, like today, we also share our findings soon after our enforcement. Today s takedowns will also be included in our September report. You can find more information about our [previous CIB enforcement actions here.](https://about.fb.com/news/tag/coordinated-inauthentic-behavior/) The networks we’re announcing today targeted many countries around the world and had very limited following globally at the time of disruption. Much of this activity focused on two things: 1) creating fictitious or seemingly independent media entities and personas to engage unwitting individuals to amplify their content and 2) driving people to other websites that [these operations control. Similarly to the Russia-based network we removed in August, these](https://about.fb.com/news/2020/09/august-2020-cib-report/) operations worked across many internet services and attempted to hire contributors and seed their stories with news organizations. We’ve seen deceptive campaigns target journalists and public figures in the past, including as part of hack-and-leak operations. Hack-and-leak — where a bad actor steals sensitive information, sometimes manipulates it, and then strategically releases it to influence public debate — is one of the threats we’re particularly focused on and concerned about ahead of the November elections in the US. While we have not seen the networks we removed today engage in these efforts, or directly target the US 2020 election, they are linked to actors [associated with election interference in the US in the past, including those involved in “DC](https://about.fb.com/news/2020/03/february-cib-report/) leaks” in 2016. We anticipate that operations like these may attempt to pivot at any time and we will keep vigilant to find and remove them. We will also continue to share our findings publicly to provide context for the adversarial trends we see. These threats are a whole-of-society challenge, and we’re working with partners across industry to tackle them. We have shared information about our findings with law enforcement, policymakers and industry partners. We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort. We’re committed to continually improving to stay ahead. ## What We Found **1. We removed 224 Facebook users, 35 Pages, 18 Groups and 34 Instagram accounts** **for violating our policy against** **[foreign or government interference which is](https://newsroom.fb.com/news/2019/10/inauthentic-behavior-policy-update/)** **[coordinated inauthentic behavior on behalf of a foreign or government entity. This](https://newsroom.fb.com/news/2018/12/inside-feed-coordinated-inauthentic-behavior/)** **activity originated in Russia and focused primarily on Syria and Ukraine, and to a** **lesser extent on Turkey, Japan, Armenia, Georgia, Belarus, and Moldova A small** **portion of this activity focused on the UK and the US. (Updated on October 12, 2020 at** **_6:30PM PT to reflect the latest enforcement numbers.)_** We identified several clusters of connected activity that relied on fake accounts — many of which had been detected and removed by our automated systems. This network appears to have centered around a number of regions including the Far East, Russia’s neighboring countries, and Syria. They used fake accounts to create elaborate fictitious personas across many internet services, posing as journalists to contact news organizations, purporting to be ----- locals in countries they targeted, and managing Groups and Pages, some of which proclaimed to be hacktivist groups. These clusters also focused on driving people to their offplatform sites and other social media platforms where, among other themes, they promoted content related to past alleged leaks of compromising information. The operation had almost no following on our platforms when we removed it. The people behind this campaign posted in many languages including English, Ukrainian, Russian and Arabic as they tailored their activity to each audience. They frequently posted about news and current events, including the Syrian civil war, Turkish domestic politics, geopolitical issues in the Asia-Pacific region, NATO, the war in Ukraine, and politics in the Baltics, Georgia, Armenia, Ukraine, Russia, Belarus, and the US. We identified this activity as part of our investigation into suspected coordinated inauthentic [behavior connected to the networks we had removed in August 2018 and](https://about.fb.com/news/2018/08/more-coordinated-inauthentic-behavior/) [February 2020.](https://about.fb.com/news/2020/03/february-cib-report/) Although the people behind this operation took steps to conceal their identities and coordination, our investigation connected these clusters to the Russian military including military intelligence services. _Presence on Facebook and Instagram: 224 Facebook accounts, 35 Pages, 18 Groups_ and 34 Instagram accounts (Updated on October 12, 2020 at 6:30PM PT to reflect **_the latest enforcement numbers.)_** _Followers: About 8,500 accounts followed one or more of these Pages, about 9,500_ accounts joined one or more of these Groups, and around 7,500 people followed one or more of these Instagram accounts _Advertising: About $60 in spending for ads on Facebook paid for in US dollars and_ rubles. Below is a sample of the content posted by some of these Pages and accounts: ----- Translation: Image title: Disputed Kuril Islands Caption: #Russia #Japan #Kuril islands #Shinzō_Abe #SecondWorldWar #islands #claims Bad historical memory ----- ----- ----- **2. We also removed one Page, five Facebook accounts, one Group and three** **Instagram accounts for** **[foreign or government interference which is](https://newsroom.fb.com/news/2019/10/inauthentic-behavior-policy-update/)** **coordinated** **inauthentic behavior on behalf of a foreign or government entity. This small network** **originated in Russia and focused primarily on Turkey and Europe, and also on the** **United States.** ----- This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it. The people behind this activity posted off-platform articles primarily in English and Turkish about global news and current events relevant to the countries they targeted, including local elections; geopolitical conspiracies; presidential and parliamentary elections in Hong Kong, Spain, the UK, and the US; social and racial injustice; police brutality; the coronavirus pandemic; criticism of US sanctions in the Middle East, US foreign policy, and US allies including Israel; and politics in Venezuela. We began this investigation based on information from the FBI about this network’s offplatform activity. Our internal investigation enabled us to find the full scope of this network on Facebook. Although the people behind this activity attempted to conceal their identity and coordination, our investigation found links to individuals associated with past activity by the Russian Internet Research Agency (IRA). _Presence on Facebook and Instagram: 5 Facebook accounts, 1 Pages, 1 Group and 3_ Instagram accounts _Followers: About 4,900 accounts followed this Page, 1 account joined this Group and_ about 5,600 people followed one of more of these Instagram accounts. _Advertising: Around $4,800 in spending for ads on Facebook paid for in euros and_ rubles. Below is a sample of the content posted by some of these Pages and accounts: ----- Translation: Travel limit brought in #China’s #Hubey state due to #coronavirus has been removed. #Sinciang #Uyghur Autonomous Region schools are open again as no more cases are seen. #COVID19 #Qingfeipaidutang ----- ----- **3. We also removed 23 Facebook accounts, 7 Pages, and 3 Instagram accounts for** **[foreign or government interference which is](https://newsroom.fb.com/news/2019/10/inauthentic-behavior-policy-update/)** **[coordinated inauthentic behavior on](https://newsroom.fb.com/news/2018/12/inside-feed-coordinated-inauthentic-behavior/)** **behalf of a foreign or government entity. This network originated in Russia and** **focused on global audiences, Russia’s neighboring countries including Belarus.** **_(Updated on October 12, 2020 at 6:30PM PT to reflect the latest enforcement_** **_numbers.)_** We identified several clusters of connected activity that used a combination of authentic and fake accounts — some of which had been already disabled by our automated detection systems — to create fictitious personas, post and comment on content, manage Pages, amplify their content, and drive people to off-platform sites posing as independent journals. These fake personas posed as editors and researchers to solicit articles for these websites. ----- This network posted primarily in Russian and English about news and current events, including protests and elections in Belarus, Russian and Ukrainian politics, geopolitical conspiracies, Russia-NATO relations, Russia’s relations with neighboring countries, and criticism of US foreign policy, socio-economic issues in the US, and US political candidates on both sides of the political spectrum. We found this activity as a result of our investigation into the suspected coordinated [inauthentic behavior linked to our previous enforcement in July 2019. Although the people](https://about.fb.com/news/2019/07/removing-cib-thailand-russia-ukraine-honduras/) behind this activity attempted to conceal their identities and coordination, our investigation found links to individuals in Russia, including those associated with Russian intelligence services. _Presence on Facebook and Instagram: 23 Facebook accounts, 7 Pages, and 3_ Instagram accounts. (Updated on October 12, 2020 at 6:30PM PT to reflect the **_latest enforcement numbers.)_** _Followers: About 60,000 accounts followed one or more of these Pages and around_ 2,000 people followed one or more of these Instagram accounts. (Updated on **_October 12, 2020 at 6:30PM PT to reflect the latest numbers.)_** _Advertising: About $13,000 in spending for ads on Facebook and Instagram paid for_ primarily in rubles. (Updated on October 12, 2020 at 6:30PM PT to reflect the latest **_numbers.)_** Below is a sample of the content posted by some of these Pages and accounts: ----- ----- Translation: Page title: Strategic Culture foundation Caption: The indigenous population of European countries is aging and extinct, and Muslim families are common, and this is fueled by the continuous influx of immigrants from the East ----- countries. Translation: Page title: Strategic Culture foundation Caption: The West is trying to drag Belarus, probably not perfect, but overall stable, on the same path that Ukraine, Syria, Libya and the former Yugoslavia are walking. ----- -----