OCTOBER 2020

DETAILED REPORT

October 2020 Coordinated Inauthentic
Behavior Report

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

We’re constantly working to find and stop coordinated campaigns that seek to manipulate
public debate across our apps.

PURPOSE OF THIS REPORTOver the past three years, we’ve shared our findings about​ ​coordinated inauthentic behavior
we detect and remove from our platforms. As part of our regular CIB reports, we’re sharing
information about all networks we take down over the course of a month to make it easier for
people to see progress we’re making in one place.

WHAT IS CIB?
We view CIB as coordinated efforts to manipulate public debate for a strategic goal where fakeaccounts are central to the operation. There are two tiers of these activities that we work tostop: 1) coordinated inauthentic behavior in the context of domestic, non-government
campaigns and 2) coordinated inauthentic behavior on behalf of a foreign or government actor.

COORDINATED INAUTHENTIC BEHAVIOR (CIB)
When we find domestic, non-government campaigns that include groups of accounts andPages seeking to mislead people about who they are and what they are doing while relying on
fake accounts, we remove both inauthentic and authentic accounts, Pages and Groups directly
involved in this activity.

FOREIGN OR GOVERNMENT INTERFERENCE (FGI)
If we find any instances of CIB conducted on behalf of a government entity or by a foreign
actor, we apply the broadest enforcement measures including the removal of every on-platform
property connected to the operation itself and the people and organizations behind it.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTCONTINUOUS ENFORCEMENT
We monitor for efforts to re-establish a presence on Facebook by networks we previously
removed. Using both automated and manual detection, we continuously remove accounts andPages connected to networks we took down in the past.

SUMMARY OF OCTOBER 2020 FINDINGS
Our teams continue to focus on finding and removing deceptive campaigns around the world— whether they are foreign or domestic. In October, we removed 14 networks of accounts,
Pages and Groups. Eight of them — from Georgia, Myanmar, Ukraine and Azerbaijan —targeted domestic audiences in their own countries, and six networks — from Iran, Egypt, theUS and Mexico — focused on people outside of their countries. We have shared information
about our findings with law enforcement, policymakers and industry partners.
We are making progress rooting out this abuse, but as we’ve said before, it’s an ongoing effort.
We’re committed to continually improving to stay ahead. That means building better
technology, hiring more people and working closely with law enforcement, security experts andother companies.
●

Total number of Facebook accounts removed: 1,196●

Total number of Instagram accounts removed: 994●

Total number of Pages removed: 7,947●

Total number of Groups removed: 110

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTNETWORKS REMOVED IN OCTOBER 2020:
1. NEW​—​Iran: ​We removed 12 Facebook accounts, two Pages and 307 Instagram

accounts linked to individuals associated with EITRC, a Tehran-based IT company. This
activity originated in Iran and targeted primarily Israel, and also Iraq. This network was
early in its audience building when we removed it. We found this activity as part of ourinvestigation into suspected coordinated inauthentic behavior in the region.

2. NEW​—​Iran, Afghanistan: ​We removed 33 Facebook accounts, 11 Pages, six Groups
and 47 Instagram accounts operated by individuals in Iran and Afghanistan. Theytargeted Farsi/Dari-speaking audiences primarily in Afghanistan. We found this network
as part of our internal investigation into suspected coordinated inauthentic behavior in
the region.
3. NEW​—​Egypt, Turkey and Morocco:​ We removed 31 Facebook accounts, 25 Pages
and two Instagram accounts operated by individuals in Egypt, Turkey and Moroccoassociated with the Muslim Brotherhood. They targeted Egypt, Libya, Tunisia, Yemen,
Somalia and Saudi Arabia. We found this network as part of our internal investigation
into suspected coordinated inauthentic behavior in the region.
4. NEW​—​Georgia:​ We removed 50 Facebook accounts, 49 Pages, four Groups, eight

Events and 19 Instagram accounts linked to Alt-Info, a media entity in Georgia. This
activity originated in the country of Georgia and targeted domestic audiences inGeorgia. Alt-Info is now banned from Facebook. We found this network as part of ourinvestigation into suspected coordinated inauthentic behavior in the region. Ourassessment benefited from public reporting by International Society for Fair Elections
and Democracy (ISFED), a non-profit in Georgia.

5. NEW​—​Georgia: ​We removed 54 Facebook accounts, 14 Pages, two Groups and 21

Instagram accounts linked to two political parties in Georgia — Alliance of Patriots andGeorgian Choice. This activity originated in the country of Georgia and targeted
domestic audiences in Georgia. We found this network after reviewing information
about some of its activity publicly reported by International Society for Fair Elections

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

and Democracy (ISFED), a non-profit in Georgia.
6. NEW​—​Myanmar: ​We removed 36 Facebook accounts, six Pages, two Groups and one
Instagram account linked to Openmind, a PR agency in Myanmar. This activity

originated in Myanmar and targeted domestic audiences in Myanmar. We found thisnetwork as part of our proactive investigation into suspected coordinated inauthentic
behavior in the region ahead of the November election in Myanmar.
7. NEW​—​Ukraine: ​We removed 46 Facebook accounts, 44 Pages, one Group and three
Instagram accounts linked to MAS Agency, a PR firm in Ukraine, and individuals

associated with Yulia Timoshenko’s campaign and Batkivshchyna, a political party in
Ukraine. This activity originated in Ukraine and targeted domestic audiences in Ukraine.
We found this network as part of our investigation into suspected coordinatedinauthentic behavior in the region. Our review benefited from public reporting on someof this activity in Ukraine.
8. Mexico, Venezuela:​ We removed 2 Facebook Pages and 22 Instagram accounts
operated by individuals from Mexico and Venezuela. They primarily targeted the US. We
began this investigation based on information about this network’s off-platform activity
from the FBI. Our internal investigation revealed the full scope of this network on
Facebook. ​(Originally​ ​announced​ on October 27, 2020)
9. Iran: ​We also removed 12 Facebook accounts, 6 Pages and 11 Instagram accounts
linked to individuals associated with the Iranian government. This small network

originated in Iran and focused primarily on the US and Israel. It had some limited links
to the CIB network we removed in​ ​April 2020​. We began this investigation based on
information from the FBI about this network’s off-platform​ ​activity​. ​(Originally
announced​ on October 27, 2020)

10. Myanmar: ​We removed 10 Facebook accounts, 8 Pages, 2 Groups and 2 Instagram

accounts operated by individuals in Myanmar. They focused on domestic audiences.
We found this network as part of our proactive investigation into suspected coordinatedinauthentic behavior ahead of the upcoming election in the region. ​(Originally

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

announced​ on October 27, 2020)
11. US: ​We removed 202 Facebook accounts, 54 Pages and 76 Instagram accounts linked
to Rally Forge, a US marketing firm, working on behalf of Turning Point USA and

Inclusive Conservation Group. They focused primarily on domestic US audiences andalso on Kenya and Botswana. Rally Forge is now banned from Facebook. We began
our investigation after public reporting about some elements of this activity by the
Washington Post. We are continuing to review all linked networks, and will take action
as appropriate if we determine they are engaged in deceptive behavior. ​(Originally
announced​ on October 8, 2020)

12. Myanmar: ​We removed 38 Facebook accounts, 15 Pages and 6 Instagram accounts
linked to members of the Myanmar military. This activity originated in Myanmar andtargeted domestic audiences. We began our investigation after reviewing local public
reporting about some elements of this activity as part of our proactive work ahead of
the upcoming election in Myanmar. ​(Originally​ ​announced​ on October 8, 2020)
13. Azerbaijan: ​We removed 589 Facebook accounts, 7,665 Pages and 437 accounts on

Instagram linked to the Youth Union of New Azerbaijani Party. This network originatedin Azerbaijan and focused primarily on domestic audiences. We identified this network
through an internal investigation into suspected fake engagement activity in the region.
(Originally​ ​announced​ on October 8, 2020)

14. Nigeria:​ We removed 78 Facebook accounts, 45 Pages, 93 Groups and 46 Instagram
accounts linked to the Islamic Movement in Nigeria. This network originated primarily in
Nigeria and focused on domestic audiences. We identified this activity through ourinvestigation into suspected coordinated inauthentic behavior in the region with some
limited links to the​ ​network we removed​ in March 2019. ​(Originally​ ​announced​ ​on
October 8, 2020)

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

01
We removed 12 Facebook accounts, two Pages and 307 Instagram accounts forviolating our policy against​ ​foreign interference​ which is​ ​coordinated inauthentic
behavior​ on behalf of a foreign entity​. This activity originated in Iran and targetedprimarily Israel, and also Iraq.
This network was early in its audience building when we removed it. The network used fakeaccounts — most of which were created around the same time — to develop fictitious
personas who purported to be based in Israel and Iraq. These accounts have gone throughsignificant name changes over time. They posted memes, images and other content in Hebrew
and Arabic focusing on news and current events in the countries they targeted including
anti-Prime Minister Netanyahu protests in Israel, criticism of his policies and response to thepandemic.
We found this network as part of our investigation into suspected coordinated inauthentic
behavior in the region. Although the people behind this activity attempted to conceal theiridentities, our investigation found links to individuals associated with EITRC, a Tehran-based IT
company.
●

Presence on Facebook and Instagram: 1​ 2 Facebook accounts, 2 Pages and 307
accounts on Instagram.

●

Followers: A​ bout 1,100 accounts followed one or more of these Pages, and around
9,500 people followed one or more of these Instagram accounts.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Caption: Burning down state institutions andparty headquarters, you leader of corruption#Leader_of_Corruption #Kurdistan #Iraq#Iraq #Iraqi #Erbil #Mosul #Dohuk#Suleimaniyah #Kirkuk #Soran #Tal_Afar#Hawija #Tikrit #Samarra #iraq #duhok#irbil_city #mosul #saudiarabia #kuwait #uae

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Caption: #blackflags #theblackflags#bibinetaniyahuIn image: Hope is up to us(on the flag)

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

02
We removed 33 Facebook accounts, 11 Pages, six Groups and 47 Instagram
accounts for violating our policy against​ ​foreign interference​ ​which iscoordinated inauthentic behavior​ on behalf of a foreign entity. This network was
operated by individuals in Iran and Afghanistan and targeted Farsi/Dari-speaking
audiences primarily in Afghanistan.
This network used a combination of authentic and fake accounts to post content, direct people
to their channels on other internet services and manage Pages. Some of these Pages
impersonated media organizations such as TOLONews and Etilaatroz. Some of these accounts
posed as young women in Afghanistan and used fake profile photos and names.
This network posted about news and current events in the region, including politics; sports;
victims of Taliban violence; supportive commentary about Afghan security forces; and criticism
of US foreign policy in Afghanistan, Taliban’s record on women’s rights, US military actions in
Afghanistan, negotiations with Taliban, and Afghan president Ashraf Ghani, the Pashtun
politician Gulbuddin Hekmatyar. They also posted nature photos and photos of women, andnews about the coronavirus pandemic from different regions of Afghanistan. We found thisnetwork as part of our internal investigation into suspected coordinated inauthentic behavior in
the region.
●

Presence on Facebook and Instagram: 3​ 3 Facebook accounts, 11 Pages, 6 Groups and47 accounts on Instagram.

●

Followers: A​ bout 25,000 accounts followed one or more of these Pages, about 15,000

accounts joined at least one of these Groups and around 539,000 people followed one
or more of these Instagram accounts.
●

Advertising: L​ ess than $30 in spending for ads on Facebook and Instagram paid for in
US dollars.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Caption: Yaftal city is the end of Badakhshan
province!

Translation:
Iranian Foreign Minister in a meeting with
Abdullah: We support efforts to make peacein Afghanistan. The Supreme Council of
National Reconciliation has said in a
newspaper in this meeting that took place
after today's brunch (Sunday, 27 Mizan),both sides have talked about Afghanistan's
peace process. According to the newspaper,
Mr. Zarif in this meeting called Afghanistan
peace as one of the main needs of the regionand said that Iran supports efforts to achieve
permanent peace in Afghanistan. He addedthat Iran knows Afghanistan's success inpeace and success.
Translation:
Taliban in the official announcement: Afterlong negotiations between the Islamic
Emirates and the United States, both sides
agreed that on the 5th month of Rajab
Al-Marjab, 1441, 10, 2020, 1398, and 29
February 2020 M, the final agreement will besigned in the presence of the world between
both sides.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

03
We removed 31 Facebook accounts, 25 Pages and two Instagram accounts forviolating our policy against​ ​foreign interference​ which is​ ​coordinated inauthentic
behavior​ on behalf of a foreign entity.​ This network was operated by individuals in
Egypt, Turkey and Morocco and targeted ​Egypt, Libya, Tunisia, Yemen, Somalia
and Saudi Arabia​.
The people behind this activity used fake accounts to comment on content and manage Pages
pretending to be local to countries they targeted. Some of these accounts were automaticallydisabled for various violations including posting terrorism-related content. They posted
primarily in Arabic about news and current events in countries they targeted including politics
in Egypt, tensions in Libya and Somalia, supportive commentary about Qatar and Turkey andcriticism of Saudi Arabia, the UAE, the Egyptian government, Saudi and Emirati activity in
Yemen, and Emirati actions in Tunisia.
We found this network as part of our internal investigation into suspected coordinatedinauthentic behavior in the region. Although the people behind this activity attempted toconceal their identities, our investigation found links to individuals associated with the Muslim
Brotherhood.
●Presence on Facebook and Instagram: 3​ 1 Facebook accounts, 25 Pages and 2
accounts on Instagram.

●

Followers: A​ bout 1.57 million accounts followed one or more of these Pages andaround 1,000 people followed one or more of these Instagram accounts.

●

Advertising: L​ ess than $219,000 in spending for ads on Facebook and Instagram paid
for in Turkish lira, US dollars, Egyptian pound and Qatari rial.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Page title: Tunisia Against Emirati
Intervention
Caption: The president of the Ennahda
parliamentary bloc accused Abir Moussi, thepresident of the Free Destourian Party, of
paving the way for foreign powers, namely
the UAE and Egypt, to overthrow "theelected Tunisian government"

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Page name: Somali & Proud
Caption: Qatar, represented by the Qatar
Development Fund, continued its efforts to
support development projects in Somalia. As
part of the "Somali Roads" project, theMogadishu-Afgooye road has begun to be
paved.
Image overlay: "Qatar Development"
continues its support for infrastructure
projects in Somalia

Translation:
Page name: Youth Against the Coup
Caption: The police are at the service of thedog

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

04
We removed 50 Facebook accounts, 49 Pages, four Groups, eight Events and 19
Instagram accounts for violating our policy against​ ​coordinated inauthentic
behavior​. This activity originated in the country of Georgia and targeted domestic
audiences in Georgia.
This network used fake accounts to post and comment on their own content to make it appear
more popular than it was, and manage Pages, some of which posed as independent from one
another. Some of these Pages went through significant admin changes and appeared to havebeen purchased. This network focused primarily on amplifying and engaging with Alt-Info’s
Page and its content, and commenting on local news media Pages. This network posted
primarily in Georgian about news and current events in the country including EU and Russianpolitics, Georgian parliamentary election in 2020, political figures, criticism of local media andliberal politicians such as representatives of European Georgia party, immigrants, minorities
and LGBTQ communities. Some of this activity included posting hate speech and information
rated false by independent fact-checkers in Georgia.
We found this network as part of our investigation into suspected coordinated inauthentic
behavior in the region. Our assessment benefited from public reporting by International Society
for Fair Elections and Democracy (ISFED), a non-profit in Georgia. Although the people behind
this activity attempted to conceal their identities, our investigation found links to Alt-Info, a
media entity in Georgia. Alt-Info is now banned from Facebook.
●Presence on Facebook and Instagram: 5​ 0 Facebook accounts, 49 Pages, 4 Groups, 8
Events and 19 accounts on Instagram.

●

Followers: A​ bout 328,000 accounts followed one or more of these Pages, about 13,000
accounts joined at least one of these Groups and around 1,600 people followed one ormore of these Instagram accounts.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT●Advertising: L​ ess than $5,000 in spending for ads on Facebook and Instagram paid for
in US dollars.

●

Events: ​8 events were hosted by these Pages, some of which were removed forviolating our policies. The first was scheduled for April 2017 and the most recent wasscheduled for April 2020. Up to 530 accounts expressed interest in at least one of these
events – among these accounts, our automated systems detected and disabled somefake accounts. We cannot confirm whether any of these events actually occurred.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Caption: LIVE Anti-Georgian hysteria ofliberals about David Gareji, Georgia’s
geopolitical chances

Translation:
Caption: Iago Khvitchia live on Alt-info +information on how to become a donor for
GirchiComment: All in all, there were two main
topics and on both Iago said that he had noanswer...

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Caption: News about Georgian famous
dancer saying "there are no gays in Georgianballet".
Comment: that's right <3

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

05
We removed 54 Facebook accounts, 14 Pages, two Groups and 21 Instagram
accounts for violating our policy against​ ​coordinated inauthentic behavior​. This
activity originated in the country of Georgia and targeted domestic audiences inGeorgia.
This network was still early in its audience building when we removed it. The people behind it
used fake accounts — some of which have gone through significant name changes — tocreate fictitious personas, comment on other people’s content, post in Groups and manage
Pages. Some of these Pages posed as news entities. This network posted primarily inGeorgian about news and politics in Georgia, including the parliamentary elections in October
2020, memes and other content about Russia-Georgia relations, supportive commentary about
Alliance of Patriots and Georgian Choice parties, and criticism of their political opponents andGeorgia-NATO relations. The network also posted content that was rated false by local
fact-checkers. The inauthentic engagement activity appeared to begin in December 2019focusing on one party (Alliance of Patriots), and then in May 2020 shifted to focus on another(Georgian Choice).
We found this network after reviewing information about some of its activity publicly reported
by International Society for Fair Elections and Democracy (ISFED), a non-profit in Georgia.
Although the people behind this activity attempted to conceal their identities, our investigation
found links to two political parties in Georgia — Alliance of Patriots and Georgian Choice.
●

Presence on Facebook and Instagram: 5​ 4 accounts, 14 Pages, 2 Groups and 21
accounts on Instagram.

●

Followers: A​ bout 15,600 accounts followed one or more of these Pages, about 21,500

accounts joined at least one of these Groups and around 5,500 people followed one ormore of these Instagram accounts.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT●Advertising: A​ round $4,600 in spending for ads on Facebook and Instagram paid for in
US dollars.

Below is a sample of the content posted by some of these Pages.

Translation:
Caption: “Georgia will never be a NATOmember, says opposition”
Comment: “I do not think NATO membershipis realistic, there are only talks”

Translation:
Title: “Today in Politics”
Caption: “New power, new hope” OR “Newpower, new business”

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Caption: ​“Alliance of Patriots of Georgia” Irma Inashvili: It’s up to the Government todecide what to offer to the political spectrum.
Comments:
1. “Good Luck to Ms. Irma!”
2. “Good Luck to Ms. Irma!”
3. “You do everything for the the country’s
well being”

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

06
We removed 36 Facebook accounts, six Pages, two Groups and one Instagram
account for violating our policy against​ ​coordinated inauthentic behavior​. This
activity originated in Myanmar and targeted domestic audiences in Myanmar.
This network was caught early in its operation, before it was able to build its audience. The
people behind this activity offered to pay others in return for engaging with their posts. They
used fake accounts — some of which had already been detected and disabled by our
automated systems — to create fictitious personas, post in Groups and manage Pages. Someof these Pages focused on promoting the Union Solidarity and Development Party, whileothers criticized the National League for Democracy. They posted primarily in Burmese aboutnews and current events including this week’s general elections in Myanmar.
We found this network as part of our investigation into suspected coordinated inauthentic
behavior in the region ahead of the November election in Myanmar. Although the people
behind this activity attempted to conceal their identities, our investigation found links toOpenmind, a PR agency in Myanmar.
●

Presence on Facebook and Instagram: 3​ 6 Facebook accounts, 6 Pages, 2 Groups andone account on Instagram.

●

Followers: A​ bout 12,000 accounts followed one or more of these Pages, about 270
accounts joined at least one of these Groups and around 15 people followed thisInstagram account.

●

Advertising: L​ ess than $76,000 in spending for ads on Facebook and Instagram paid for
in US dollars and also in Indonesian rupiah.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Caption: “You will receive 1000 Kyats foryour phone bill just from Liking and Sharing.
Don't miss out on such an opportunity."

Translation:
Image Overlay: “Election is more important
than the COVID-19 virus. Listen to me! I AM
YOUR MOTHER”

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:

🙂🙃🔴

Caption: "Who are you going to choose?
or ?
Left: For temporary happiness. Right: Forlong term protection solution

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

07
We removed 46 Facebook accounts, 44 Pages, one Group and three Instagram
accounts for violating our policy against​ ​coordinated inauthentic behavior​. This
activity originated in Ukraine and targeted domestic audiences in Ukraine.
This network used fake accounts — some of which had already been detected and disabled by
our automated systems. They created fictitious personas, commented on other people’scontent, posted in Groups and managed Pages, some of which posed as local news entities.
This network posted primarily in Ukrainian about news and current events in Ukraine likepolitics and elections, including supportive commentary about Yulia Timoshenko andBatkyvshyna party and criticism of its political opponents, President Zelensky and former
President Poroshenko. This activity primarily centered around recent elections, includingpresidential and parliamentary elections in 2019 and local elections in 2020.
We found this network as part of our investigation into suspected coordinated inauthentic
behavior in the region. Our review benefited from public reporting on some of this activity in
Ukraine. Although the people behind it attempted to conceal their identities, our investigation
found links to MAS Agency, a PR firm in Ukraine, and individuals associated with Yulia
Timoshenko’s campaign and Batkivshchyna, a political party in Ukraine.
●

Presence on Facebook and Instagram: 4​ 6 Facebook accounts, 44 Pages, 1 Group and3 accounts on Instagram.

●

Followers: A​ bout 889,000 accounts followed one or more of these Pages, about 20

accounts joined this Group and around 1,500 people followed one or more of these
Instagram accounts.
●

Advertising: A​ round $2.1 million in spending for ads on Facebook and Instagram paid
for in US dollars.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Page name: “Political Ukraine”

🙂

Caption: A decent place for a candidate ...

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Translation: “Medvedchuk and I are thefuture of Ukraine”

Translation:
Caption: “Touché!”Image overlay: "loser - that's you!"OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

08
We removed 2 Facebook Pages and 22 Instagram accounts for violating ourpolicy against​ ​foreign interference​ which is​ ​coordinated inauthentic behavior​ onbehalf of a foreign entity. This small network was in the early stages of building
an audience and was operated by individuals — some wittingly and some
unwittingly — from Mexico and Venezuela. It primarily targeted the US.
This network began creating accounts in April 2020. The individuals behind this activity took
steps to conceal their coordination and who is behind this network. Some of the people
managing these accounts and Pages claimed to work for a Poland-linked firm Social CMS,
which doesn’t appear to exist. They used fake accounts to create fictitious personas and postcontent. ​Some of these accounts posed as Americans supporting various social and politicalcauses and tried to contact other people to amplify this operation’s content. ​These accounts

followed, liked and occasionally commented on others’ posts to increase engagement on theirown content.
The people behind this activity posted in Spanish and English about news and current eventsin the US including memes and other content about humor, race relations and racial injustice,
feminism and gender relations, environmental issues and religion. ​A small portion of thiscontent included memes posted by the Russian Internet Research Agency (IRA) in the past.
They reused content shared across internet services by others, including screenshots of social
media posts by public figures.
We began this investigation based on information about this network’s off-platform activity
from the FBI. Our internal investigation revealed the full scope of this network on Facebook.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT●●

Presence on Facebook and Instagram:​ 2 Facebook Pages and 22 Instagram accounts.
Followers: 1​ account followed one or more of these Pages and around 54,500 people
followed one or more of these Instagram accounts (about 50% of which were in theUS). The account with the highest following had under 15,000 followers.

Below is a sample of the content posted by some of these Pages.

Translation:
Image overlay: “A French bulldog goes viral
on TikTok when it introduces its owner to its
new pup.”Caption: “Comment below on your favorite
breed of dog. Share this post with a dog
owner! Via TikTok”

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

09
We also removed ​12 Facebook accounts, 6 Pages and 11 Instagram accounts ​forgovernment interference​ which is​ ​coordinated inauthentic behavior​ on behalf of agovernment entity. This small network originated in Iran and focused primarily on
the US and Israel.
We began this investigation based on information from the FBI about this network’s
off-platform​ ​activity​. As a result, last week, we removed a single fake account created in

October 2020 that attempted to seed false claims and unsubstantiated election-related threatsas part of an influence operation carried out primarily via email. Our teams continued toinvestigate and found additional dormant accounts and Pages that had been largely inactive
since May 2019 and focused primarily on Israel. This operation used fake accounts — some ofwhich had been already detected and removed by our automated system. Some of theseaccounts tried to contact others, including an Afghanistan-focused media outlet, to spreadtheir information. They focused on Saudi Arabia’s activities in the Middle East and claims about
an alleged massacre at Eurovision, an international song contest, hosted by Israel in 2019.
Although the people behind this activity attempted to conceal their identity and coordination,
our investigation found limited links to the CIB network we removed in​ ​April 2020​ andconnections to individuals associated with the Iranian government.
●

Presence on Facebook and Instagram: 1​ 2 Facebook accounts, 6 Pages and 11
Instagram accounts.

●

Followers: A​ bout 120 accounts followed one or more of these Pages and about 700
people followed one of more of these Instagram accounts.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Caption: "The series of operations by the
Yemen Army and popular committees
against the Saudi aggressors continues. The
Yemen Army's artillery unit targeted theSaudi aggressor's positions in the border cityof Najran in southern Saudi Arabia. This iswhile a Yemen army missile unit fired on the
Saudi aggressor's positions in Najran."

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

10
We also removed 10 Facebook accounts, 8 Pages, 2 Groups and 2 Instagram
accounts for​ ​coordinated inauthentic behavior​. This network originated in
Myanmar and focused on domestic audiences.
The people behind this activity used fake accounts to create fictitious personas, post content
and manage Pages and Groups, some of which had already been detected and disabled by
our automated systems for violating our spam, terrorism and hate speech policies. Some ofthese Pages impersonated others, including an official Tatmadaw Page. This network posted
primarily in Burmese about current events in Rakhine state in Myanmar, including posts insupport of the Arakan Army and criticism of Tatmadaw, Myanmar’s Armed forces. This activity
did not appear to be directly focused on the November elections in Myanmar.
We found this network as part of our proactive investigation into suspected coordinatedinauthentic behavior ahead of the upcoming election in the region.
●

Presence on Facebook and Instagram:​ 10 Facebook accounts, 8 Pages, 2 Groups and 2
Instagram accounts.

●

Followers: A​ bout 16,500 accounts followed one or more of these Pages, around 50
accounts joined one of more of these Groups and around 25 people followed one ormore of these Instagram accounts.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Page Title: "Homeland of Arakans"
Caption: Houses in Kyaut Taw Townshipwere destroyed and burnt as a result of the
Myanmar military using gunship helicoptersand violently shooting at the village

Translation:“Rakhine Nation called Arakan was once avery wealthy country many years ago. Itturned into a poor region after Myanmar
ruled the region for about two hundred years.
Not going to mention the Hereditary
monarchy system. There was no war at
Rakhine 70 years after getting independence.
Why did Rakhine turn into a poor region?
Those who claim that war could bring a
consequence of poverty should answer thequestion. Why did Rakhine become
extremely poor in these 70 years?”

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:“Rakhine's history is not going to repeat
twice. Rakhine revolution began because 70
years after Myanmar got independence
Rakhine suffered a loss in resources causing
Rakhine people to be living in the second
poorest region. This suffering has turned into
fumes which is to severely revenge. Today's
Rakhine revolution is never going to end. No
matter how the Myanmar government is
describing Rakhine and how they will strike
Rakhine, the suffering of Rakhine people will
never be cured. Peace is just a word for
those defeated ones to offer. For those withvictory, peace is always in their hands. It canbe noted that the Myanmar military and
Myanmar government have felt very proud of
their project in eliminating all resources of
Rakhine and this stimulates Arakan to strike.
Myanmar military will only win when all
Rakhine people die and also, if all Rakhine
are not able to be eliminated, Myanmar
military will have to go back to their original
route. Rakhine people today have hatredtowards the Myanmar military andgovernment. Since Rakhine from all walks oflife accept that there is nothing better thanrevolution, Rakhine history is not going torepeat twice. All the governors andnationalists need to understand these.
Daughter of Saw Devi Ar Rakha”

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT11
We removed 202 Facebook accounts, 54 Pages and 76 Instagram accounts forviolating our policy against​ ​coordinated inauthentic behavior​. This activity
originated in the US and focused primarily on domestic US audiences and also on
Kenya and Botswana.
The people behind this activity used fake accounts — a large portion of which had been
automatically removed by our systems — to comment on other people’s content. Many ofthese accounts used stock profile photos and posed as right-leaning individuals from acrossthe US. In 2018, some of these accounts posed as left-leaning individuals to comment on
content as well. This activity was centered primarily around commenting on news articles
posted by news organizations and public figures, rather than posting their own content. These
comments included topics like trophy or sport hunting in the US and Kenya, the midterm
elections in 2018, the 2020 presidential election, COVID-19, criticism of the Democratic party
and presidential candidate Joe Biden and praise of President Trump and the Republican party.
Most recently, the people behind this activity commented most frequently on Pages of the
Washington Post, Fox News, MSNBC, CNN and The New York Times. This network showedsome links to on-platform activity by Turning Point USA.
This network appears to have started its operations in 2018 and continued through 2020. Its
election-focused behavior began in 2018 in the run-up to the midterms, it then went largely
dormant until June 2020. The most recent activity included creating what we call “thinly veiled
personas” whose names were slight variations of the names of the people behind them andwhose sole activity on our platform was associated with this deceptive campaign. We assess
this shift in tactics is likely due to the majority of this network’s fake accounts getting caught by
our automated detection systems.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTWe began our investigation after public reporting about some elements of this activity by the
Washington Post. Although the people behind this network attempted to conceal theiridentities and coordination, our investigation linked this activity to Rally Forge, a US marketing
firm, working on behalf of Turning Point USA and Inclusive Conservation Group. Rally Forge is
now banned from Facebook. We are continuing to investigate all linked networks, and will takeaction as appropriate if we determine they are engaged in deceptive behavior.
We found this network as part of our proactive investigation into suspected coordinatedinauthentic behavior ahead of the upcoming election in the region.

●

Presence on Facebook and Instagram:​ 202 Facebook accounts, 54​ ​Pages and 76
Instagram accounts.

●

Followers: A​ bout 372,500 accounts followed one or more of these Pages and around
20,500 people followed one or more of these Instagram accounts.

●

Advertising:​ Around $1.15 million in spending for ads on Facebook and Instagram paid
for in US dollars. This includes the entirety of advertising activity by both inauthentic andauthentic accounts removed as part of this network.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTOCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT12
We removed 38 Facebook accounts, 15 Pages, and 6 Instagram accounts forviolating our policy against​ ​coordinated inauthentic behavior​. This
domestic-focused activity originated in Myanmar.
We identified clusters of connected activity that relied on a combination of fake, duplicate andauthentic accounts to p​ost content, evade enforcement and removal, manage Pages and drive
people to off-platform websites including military-controlled media domains. These accounts
often used stock female profile photos and photos of celebrities and social media influencers.
The individuals behind this network posted ​primarily in Burmese about local news and current

events including topics like military activities, t​he Union Solidarity and Development Party, local
COVID-19 response, ​criticism of the t​he National League for Democracy, a political party in
Myanmar, and ​Aung San Suu Kyi, as well as a small number of anti-Rohingya posts.

We began our investigation after reviewing local public reporting about some elements of thisactivity as part of our proactive work ahead of the upcoming election in Myanmar. Although thepeople behind this activity attempted to conceal their identities and coordination, ourinvestigation found links to members of the Myanmar military.
●●

Presence on Facebook:​ 38 Facebook accounts, 15 Pages and 6 accounts on Instagram.
Followers: A​ bout 480,000 accounts followed one or more of these Pages and around
800 accounts followed one or more of these Instagram accounts.

●

Advertising:​ Around $1,750 in spending for ads on Facebook paid for in US dollars.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT

Below is a sample of the content posted by some of these Pages.

Translation:
Page Name: People's Voice
Caption: Daw Aung San Suu Kyi is sosmart....1) She grasped love from people byblaming illegal Bangali problem originatedfrom Military government and U Thien Seingovernment and by participating in 2015
general elections without a single Muslim
candidate. But after the election, she
appointed Muslim lawyer U Ko Ni as
chairman of Constitutional amendment
Committee - an important position - under
the pretext of constitution amendment. (Yes!
Daw Aung San Suu Kyi is so smart....) 2) She
grasped love from people by proclaiming to
upgrade the outdated education system
while blaming the failure of the system at thetime of U Thien Sein government. But rumors
came out that Daw Su has improved theeducation system by allowing matriculationpassing rate to 50 percent with 'Moderation
System'. (Yes! Daw Aung San Suu Kyi is sosmart....) ....

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Page Title: “Our Army”
Caption: “Nothing special. Just because thecountry next door is boasting (about theirmilitary power)The parade is not about
intimidating others. It is a partial
demonstration to show how strong thecountry's defense capabilities are, how highthe country's defense morale is and how thesoldiers of the country are patriotic andpossess a defense mindset. (Excerpt from aninterview between the Office of the
Commander-in-Chief of the Defence
Services and Russia Today News Agency,2020) #crd-Phoe Si”

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTTranslation:
Page title: Public Outcry
Caption: Don't ask what the government hasdone in the last five years.Just look at theeconomic situation in Myanmar from 2016 to2019

Translation:
Caption: Local farmers' heartfelt voices on
the support of rice, oil, salt, beans and foodsupplies from military families for families
affected by the drought

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT13
We removed 589 Facebook accounts, 7,665 Pages and 437 accounts on
Instagram that were involved in​ ​coordinated inauthentic behavior​. This network
originated in Azerbaijan and focused primarily on domestic audiences.
While the individuals behind this activity used fake accounts — some of which had been
already detected and disabled by our automated systems, they primarily relied on authentic
accounts to create Pages designed to look like user profiles — using false names and stock
images — to comment and artificially boost the popularity of particular pro-government
content. This network appeared to engage individuals in Azerbaijan to manage Pages with thesole purpose of leaving supportive and critical commentary on Pages of international and local
media, public figures including opposition, and the ruling party of Azerbaijan, to create aperception of wide-spread criticism of some views and wide-spread support of others. From
what we’ve seen, it appears that most of the engagement these comments received were fromwithin this network of Pages themselves. Our analysis shows that these comments wereposted in what appears to be regular shifts during working hours in Azerbaijan on weekdays.
This network posted primarily in Azerbaijani, and also in Russian and English. Their comments
frequently touched on local and regional news and events, politics, government policies,
tensions between Armenia and Azerbaijan, Armenia’s actions during past escalations in
Nagorno-Karabakh, praise of president Ilham Aliev and the New Azerbaijani Party, criticism of
the opposition party and leaders accusing them of treason, and denials of human rights abuse
allegations in Azerbaijan.
We identified this network through an internal investigation into suspected fake engagement
activity in the region. Our investigation linked this activity to the Youth Union of New
Azerbaijani Party.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT●

Presence on Facebook:​ 589 Facebook accounts, 7,665 Pages and 437 accounts on
Instagram.

●

Followers: A​ bout 33,000 accounts followed one or more of these Pages and around
241,000 accounts followed one or more of these Instagram accounts.

●

Advertising:​ Around $6,600 spent on Facebook ads paid for primarily in US dollars.

Below is a sample of the content posted by some of these Pages.
Translation:
Page name: Radio Liberty Azerbaijan about
Post: "Regarding the ADB's forecast figures,
I believe that with this trend, GDP will decline
by 4.8-5 percent. If there is a 2.8 percent
decline in the first seven months of 2020, it
may continue until the end of the year. The
consequences of any crisis over time aregoing to be felt even more."
Comment 1: Despite the negative impact ofthe pandemic on the country and the world
economy and falling oil prices, as noted byPresident Ilham Aliyev, no social project will
be postponed.
Comment 2: It should be noted that during
the pandemic, our country saw a decline in
the economy of only 2.8% in 7 months.
However, this result is very good for many
countries.
Comment 3: Azerbaijan has a strong
economy, and the virus has had little effecton growing economic development. This
took us an average of 2 years ago, but incountries like Germany, this figure is muchhigher.
Comment 4: Important reforms are underway
in Azerbaijan to double the economy. The
state uses all opportunities to resolve thisissue. We have passed many such tests and

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTwe will continue to do so.

Translation:
Automated Translation:
Page name: New Azerbaijani Party YouthUnion
Post: PRESIDENT ORDERS ON "DIGLAS":ENTREPRENEURS WILL BE
COMPENSATED [Link to video]
Comment: Once again, the leader showed
who the people should trust and who canprovide the solution to their problems.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT14
We removed 78 Facebook accounts, 45 Pages, 93 Groups and 46 Instagram
accounts engaged in​ ​coordinated inauthentic behavior​. This activity originatedprimarily in Nigeria and focused on domestic audiences.
The people behind this activity used fake and duplicate accounts to manage Groups andPages posing as independent news entities, and to drive people to their off-platform sites.
Many of these accounts used stock images and photos of Ibrahim Zakzaky, the head of
Nigeria's Islamic Movement (IMN), Ayatollah Khomeini and Qasem Soleimani. This network
amplified particular hashtags including #FreeZakzaky after the arrest of IMN's founder. The
Page admins and account owners posted primarily in Hausa, and also in English and Arabic
about local news and events including IMN being a peaceful movement, protests acrossNigeria, and criticism of the Nigerian armed forces, police, President Buhari and the ban ofIMN.
We identified this activity through our investigation into suspected coordinated inauthentic
behavior in the region with some limited links to the​ ​network we removed​ in March 2019.
Although the people behind this operation attempted to conceal their identities andcoordination, our investigation linked this activity to the Islamic Movement in Nigeria.
●

Presence on Facebook and Instagram:​ 78 Facebook accounts, 45 Pages, 93 Groups
and 46 Instagram accounts.

●

Followers: A​ round 82,000 accounts followed one or more of these Pages, about 130,000
accounts joined at least one of these Groups, and around 25,000 people followed one ormore of these Instagram accounts.

●

Advertising:​ Less than $50 spent on Facebook and Instagram ads paid for primarily in
US dollars.

Below is a sample of the content posted by some of these Pages.

OCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTOCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORTOCTOBER 2020 COORDINATED INAUTHENTIC BEHAVIOR REPORT