Facebook Takes Down the “Voice of Truth” in Ukraine

A small set of Facebook pages amplified divisive content related to the Ukrainian Orthodox Church, the 2014 Ukrainian Revolution, and other pro-Kremlin messaging

(Source: @r_osadchuk/DFRLab via Facebook; flaticon.com; mapsvg.com)

On July 25, 2019, Facebook announced the removal of nine pages that targeted Ukraine with pro-Kremlin messaging and other divisive content, in what the company refers to as “coordinated inauthentic behavior.” The company shared the names of five of the pages with the DFRLab prior to taking them down.

In its announcement, Facebook stated:

The people behind this activity created fictitious personas, impersonated deceased Ukrainian journalists, and engaged in fake engagement tactics. They also operated fake accounts to increase the popularity of their content, deceive people about their location, and to drive people to off-platform websites. The Page administrators and account owners posted content about Ukrainian politics and news, including topics like Russia-Ukraine relations and criticism of the Ukrainian government.

Four of the five pages focused on a range of issues, including promoting conspiracy theories about the 2014 Ukrainian Revolution and exploiting religious tensions at the heart of the 2018 Moscow-Constantinople Schism within the Eastern Orthodox Church. In an indicator that the operators of the individual pages were coordinating with one another, these four pages amplified content from a single news website, golospravdy.com. A fifth page served as an aggregator of philanthropy news, with occasional negative news content dispersed throughout.

The reach of individual pages varied. Two of the pages had fewer than 80 followers or likes, two others had roughly 1,000 followers, and one had nearly 25,000 followers.

The “Voice of Truth”

Four out of the five pages in this set revolved around an external website, golospravdy.com (or “Voice of Truth”), which primarily served as an aggregator of blog, video, and news content produced by anti-Ukrainian government or pro-Kremlin bloggers and journalists. The URL for golospravdy.com now redirects to golospravdy.eu, likely because the Ukrainian government blocked the former.

Comparison of the archived edition of the golospravdy.com homepage from May 12 (left) and the golospravdy.eu (right) homepage from the same period. (Source: golospravdy.com/archive, left; golospravdy.eu/archive, right)

On the bottom of the website, there was a link to the pro-Kremlin hacker operation known as CyberBerkut, named after the Ukrainian riot police forces, which gained notoriety for their brutality during the Revolution of Dignity. CyberBerkut has been tied the GRU hacker group Fancy Bear, which has been implicated in numerous international cyber-espionage operations in recent years, including in the 2016 hack of the Democratic National Committee in the United States.

In the footer of the website, contributing authors identified the major topics they focused on, as well as provided links to people they were supporting, including politicians who fled Ukraine in 2014 and pro-Russian journalists.

The footer of golospravdy.eu. The logo of the “Cyberberkut” is indicated by the orange square. The magenta square identifies a site disclaimer, which reads: “Usage of materials is prohibited without direct link to golospravdy.com.” In the light blue box, there is text indicating that the website provides a platform for allies of ousted former president Victor Yanukovych as well as journalists that support him. (Source: @r_osadchuk/DFRLab via Voice of Truth/archive)

The site broadly focuses on Ukrainian politics, spreading a mix of conspiracy theories and content based on real events. Among other material, the website has published articles framing the 2014 revolution as a “coup de état,” alleging censorship and corruption on the part of the current Ukrainian government, and echoing other pro-Kremlin narratives about the war in Ukraine.

“Coup”

The first page from the set, Переворот (“Coup”), was established on November 23, 2016, and had only 53 followers. It posed as the page of Volodymyr Oliynyk, a former member of the Ukrainian Parliament. Oliynyk is allegedly a close associate of the Kremlin and is currently wanted by the Ukrainian authorities, whom he has avoided by taking up residency in Russia. He routinely claims that a judicial review he conducted of the Euromaidan pro-democracy protests had determined that the protests were a “coup de état.” Various pro-Kremlin actors, including Putin himself, have also shared this conspiracy theory, which has been debunked multiple times.

Initially, the Coup Facebook page promoted Oliynyk’s recent book on the Euromaidan, also named “Coup,” but its focus pivoted to be general promotion of the Voice of Truth page. On average, each post on the Facebook page received only a single user interaction in the form of a like or emoji.

Posts by the “Coup” Facebook page. The first post (left) shared the link to a movie by film director Oliver Stone, the second one (middle) focused on an interview with a film director who had worked with Stone on the movie, and the third post (right) claimed to be a journalist’s pejorative description of the outcome of the Maidan protests. (Source: Coup/Facebook)

Additionally, Oliynyk’s personal website, which shares its name with his book, is located under the “Special Projects” section of the Voice of Truth website.

The “Voice of Truth” website with the link to Oliynyk’s website, “Coup” (in orange box) (Source: Voice of Truth/archive)

“Media Truth and Faith”

Another of the Facebook pages, Издание Правда и вера (“Media Truth and Faith”), had 24,495 followers, the most of any page in the set. In its About description, the page claimed to have been created on February 21, 2014, but its Page Transparency section revealed that it was actually created on April 17, 2012 with an original title of “Newspaper ‘Truth and Faith.’”

Media Truth and Faith solely focused on amplifying the Voice of Truth Facebook page’s content or linking directly to the Voice of Truth website, mostly to articles on the fallout of the schism within the Eastern Orthodox Church and the ensuing creation of the Orthodox Church of Ukraine, which formally separated from the Russian Orthodox Church on January 6, 2019.

Prior to that, the page’s focus shifted from one religion-related topic to another many times. In 2017, for example, the page primarily shared content alleging that the government of Ukraine and “far-right radicals” had abused the Orthodox Church of Moscow Patriarchy. For example, the page shared an article titled “Radicals Are Terrorizing an Orthodox Priest in Zhytomyr,” which used a picture of men wearing paper signs on their backs that read “I was forced to come here instead of class.”

The article titled, “Radicals Are Terrorizing an Orthodox Priest in Zhytomyr,” published by Voice of Truth and posted to Facebook by Media Truth and Faith (left), and the article on the Ukrainian 24 channel (right), titled “Students at the Largest Pedagogical University Were Sent To Prayer Instead of Class.” The Voice of Truth article recycled the image from the latter article. (Source: Media Truth and Faith/Facebook, left; 24 Channel, right)

Later, in 2018, the page shifted focus to discrediting the different churches and denominations in Ukraine, the LGBT movement, as well as the government of Ukraine’s, alleging that it “attempt[ed] to take churches away from” the Moscow Patriarchate’s property. When the Ecumenical Patriarchate of Constantinople began the process of recognizing the independent Orthodox Church of Ukraine, Media Truth and Faith started attacking the higher synod — or governing council — of Constantinople, as well as the Ukrainian priests of Kyiv Patriarchy, tying them to Nazis or implicating them in bribery allegations involving church officials. The page also highlighted the Ukrainian government’s “persecution of the church,” as well as the readiness of regular people to “defend churches until the end.”

The caption reads “The Nazi roots of the Ukrainian Orthodox Church of Constantinople.” (Source: Media Truth and Faith/Facebook)

Overall, despite the high follower count of the page, its posts achieved little engagement, with a vast majority receiving one like or share and no comments.

“Immortal Regiment Ukraine”

Бессмертный Полк Украина (“Immortal Regiment Ukraine”), the third page of the set, had 1,043 likes and 1,041 followers, promoted the annual Immortal Regiment procession in Ukraine, and shared content related to World War II as well as veterans’ affairs.

Since 2015, top Russian officials, including President Vladimir Putin, have participated in the procession on Victory Day (May 9), a day celebrated in some former Soviet countries in commemoration of the 1945 surrender of Nazi Germany to the Allied Forces. The procession is part of the Kremlin’s broader effort to distract from the mass murder, deportations, and arrests committed by Joseph Stalin during his rule. The Immortal Regiment procession has been met with protests in Ukraine as well as Georgia.

The page “Immortal Regiment Ukraine” promoted the Immortal Regiment march in Ukraine. (Source: Immortal Regiment Ukraine/Facebook)

Similar to the other removed Facebook pages, Immortal Regiment Ukraine also shared content related to World War II from the Voice of Truth website and its associated Facebook page.

The page Immortal Regiment Ukraine shared content from the Voice of Truth Facebook page. (Source: Immortal Regiment Ukraine/Facebook)

Engagement with the posts shared by Immortal Regiment Ukraine was very low, with a majority of the posts receiving close to zero.

The “Sweets-challenge” Page

The fourth page in the set, Цукерки-челендж. (“Sweets-challenge”), got its start by posting an online contest. The “challenge” was an oblique critique of then-President of Ukraine Petro Poroshenko and his alleged corruption, which had inspired the “Roshen protests.” The protests got their name from a candy shop he owned.

According to the “challenge” rules, as described on its Facebook page, participants were called on to film themselves eating a piece of candy at Roshen, Poroshenko’s shop, while chanting the phrase “The sweets challenge has been completed.” The page promised that participants who completed the challenge by uploading a video to the website tsukerky.net would receive an unspecified financial reward.

The tsukerky.net website, where participants in the “sweets challenge” were supposed to upload their video proof of them having completed the challenge. (Source: tsukerky.net/archive)

The DFRLab could not find any videos of somebody completing the challenge.

A WhoIs search showed that the Tsukerky.net domain was registered on April 1, 2017.

Outside of the so-called “challenge,” the Facebook page also spent considerable effort focusing on the then-president. The page also posted videos of the anti-Poroshenko protests. In total, three videos shot at three different locations were uploaded within the first two days of the page’s creation.

The videos seemed to have first appeared on the Sweets-challenge Facebook page, which may indicate that this page was run by the organizers of the protest or by someone close to them. Moreover, these events resembled staged protests involving paid participants, which are not uncommon in Ukraine and the post-Soviet space.

Three videos showing protests against Poroshenko in front of Roshen stores were uploaded by the “Sweets-challenge” Facebook page. (Source: Sweets-challenge/Facebook)

The earliest posted video (from April 5, 2017) on the page also appeared to have been uploaded to the “Tsukerky Challenge” YouTube channel a day later. According to InVid, an online video verification platform, the YouTube channel was created on April 3, 2017.

Information on the sweets-challenge YouTube channel provided by InVid. (Source: @Michael1Sheldon/DFRLab via InVid)

The DFRLab was unable to view the video on Facebook before it was taken down. The two videos appear to be the same, though the one on YouTube was one second shorter than the video on the Facebook page. The last frame of the YouTube video, however, was highly similar to the thumbnail for the Facebook video.

Comparison of the final frame of YouTube video and the thumbnail of Facebook video. (Source: YouTube, left; Sweets-challenge/Facebook, right)

Between the nearly identical run-time and the similarity between the images, the DFRLab determined that they were likely to be the same video.

Although there was a two-day window between the creation of the tsukerky.net website and the sweets challenge’s content, the DFRLab found no direct ties between the Facebook page, the external website, and the YouTube channel.

Connecting the Sweets-challenge page to the broader takedown set, the Voice of Truth website posted videos from Sweets-challenge, including embedding them in two separate articles: one contained the April 5 video and the other comprised the two videos posted on April 6. Voice of Truth posted the articles on the same day as the respective video, suggesting close cooperation.

On April 12, 2017, a blogger on Ukrainian news website censor.net reported on the ties between the Voice of Truth website and the Sweets-challenge Facebook page. After the Voice of Truth website wrote about the first protest, Sweets-challenge shared the article and, referencing the website, claimed that “mass media” wrote about their protest.

Facebook post by the “Sweets-challenge” page redirecting users to a Voice of Truth website article on the protest. (Source: Censor.net/archive)

The Sweets-challenge Facebook page did not post exclusively anti-Poroshenko content. Alongside a post critiquing Poroshenko’s growing financial wealth, it was easy to find tangential political or even outrightly nonsensical content posted by individual user accounts. For example, over the period of a week in April 2017, users posted both a link to a Russian blog post stating that the Ukrainian government had allegedly “confirmed the independence” of the self-proclaimed Luhansk and Donetsk People’s Republics — Ukraine does not currently recognize the two conflict-heavy regions as independent — as well as a far out-of-context meme.

Initially, the content on the Facebook page “Sweets-challenge” was contributed by independent Facebook user accounts, not the page itself. The caption for the meme (right) reads: “I’m astonished by your cockroaches.” (Source: Sweets-challenge/Facebook)

It is worth noting that no other pages in the takedown set featured posts from individual user accounts.

Ultimately, the page would pivot away from Poroshenko completely, with the most recent posts on the page consisting mostly of links to the Voice of Truth website or reposts from its accompanying Facebook page. In contrast with previously removed pages, this page did not limit itself to a particular topic.

The page “Sweets-challenge” shared content from the “Voice of Truth” website and Facebook page. (Source: Sweets-challenge/Facebook)

Among other content, the page also shared online broadcasts of pro-Kremlin commentators or groups sympathetic to the government of former president Viktor Yanukovych, who was ousted in the 2014 Euromaidan protests.

The page “Sweets-challenge” shared live broadcasts from pro-Kremlin political commentators. (Source: Sweets-challenge/Facebook)

Much like for the other pages in the set, engagement with the Sweets-challenge page was very low and virtually zero for most posts. A series of videos uploaded soon after the page’s creation, however, did receive some engagement. One video, uploaded on April 6, 2017, received 67 reactions, two comments, and one share against 203 views, which was an unusually high engagement-to-views ratio.

“RuNews.org”

The final page of the set, “RuNews.org,” was an outlier in terms of the content it posted. Rather than serving as a content amplification platform for the Voice of Truth website, it focused on sharing news about philanthropy and charitable activities. Much of this content highlighted charitable giving coming from within Russia.

In many of its posts, the page linked to an external website called RuNews.org. This website, however, does not exist. When the DFRLab tried to access it, the site redirected to a list of related links that include Yandex results and some unidentified news pages.

The “RuNews.org” Facebook page posted roughly 12–13 articles per day. In addition to covering charitable donations by Angelina Jolie, Zinedine Zidane, and Madonna, among others, the page heavily focused on Russia. On average, every third article concerned charitable activities being organized in or by Russia or its citizens. The page has been promoting Russian charitable activities likely in an effort to influence a broader Russian-speaking audience’s attitudes toward Russia.

On average, every third article shared by the “RuNews.org” Facebook page was about charitable activities carried out in or by Russia. (Source: RuNews.org/Facebook)

The page had only 65 likes and 70 followers and, as a result, garnered virtually no engagement.

In its “About” section, RuNews.org claimed that it was a different kind of online news outlet: one that posted only positive news happening in Russia and beyond — news “that is making the world better”– and avoiding divisive political, social, and economic issues.

Despite this claim, however, in March 2013, the page shared an article accusing the Ukrainian “Aerosvit Airlines” of owing its employees more than 84 million Ukrainian Hryvnia (roughly $10.3 million at the time).

The headline of the article read. “Areal Travel Agency: ‘Aerosvit’ owes its employees more than 84 million Hryvnia.” (Source: RuNews.org/Facebook)

Sharing this particular article, which casts Aerosvit in an overwhelmingly negative light, may have been an attempt to discredit the Ukrainian airline.

A common tactic for disinformation campaigns is to start with banal content, such as celebrities’ charitable giving in this case, before slowly but surely pivoting to more political content. The DFRLab cannot make a confident assessment that this is the case for RuNews.org, but it nevertheless shows signs of a possible pivot, given the earlier negative content.

Conclusion

The pages removed by Facebook covered a relatively wide swath of topics related to Ukraine. Some focused on religious conflict, with a strong interest in discrediting the new Ukrainian Orthodox Church, while others amplified pro-Kremlin narratives regarding World War II or the 2014 Ukrainian Revolution.

Despite their varied focuses, four out of five pages shared content from a fifth Facebook page and a website of the same name, Voice of Truth. The amplification of a single external website, also called “Voice of Truth,” suggested that the operators of these pages coordinated with one another to some extent.

Overall, this network largely promoted pro-Kremlin, or at least pro-Russia, content and only had a modest impact, given the low level of engagement on a majority of its content.


Roman Osadchuk is a Research Assistant with the Digital Forensic Research Lab (@DFRLab) and is based in Ukraine.

Eto Buziashvili is a Research Assistant with @DFRLab and is based in Georgia.

Michael Sheldon is a Research Assistant with @DFRLab and is based in Washington, DC.

Follow along for more in-depth analysis from our #DigitalSherlocks.