A Facebook drama, act 1: a network of fakes

Accounts cultivated fake personas but left an online trail of inconsistencies

(Source: @nikaaleksejeva/DFRLab via “Os Nossos Dias” by rtppt is licensed under CC BY-NC-SA 2.0)

This is the first piece chronicling a joint investigation between the DFRLab and Der Spiegel.

A joint investigation by the DFRLab and German newspaper Der Spiegel uncovered a network of at least 329 inauthentic accounts that displayed numerous indicators of inauthentic behavior, including stolen profile pictures, biographical inconsistencies, and linguistic errors.

This piece primarily discusses the fake characteristics of the network. In subsequent parts of this report, the DFRLab will assess the nature of coordination among the accounts and the content they posted.

In total, the research team identified six indicators of inauthentic activity among the accounts:

  • Use of Latin American celebrities’ images as profile images;
  • Re-use of the same images for different accounts;
  • Use of unmatching usernames and screen names;
  • Inconsistencies with gender identifiers;
  • Inconsistencies with language use; and
  • Inconsistencies with post publishing times.

Several of these suggested that a part of the network was likely operated from a Spanish-speaking country in Latin America.

Use of other people’s images

The user accounts used pictures of lesser-known Latin American actors and models. For example, an account named “Robert Gautier” used a mirrored and highly saturated image of Brazilian musician Leandro Lebart, who has been impersonated by many Facebook accounts.

Robert Gautier’s profile using Brazilian musician Leandro Lebart’s photo. (Source: Facebook/archive, left; Pinterest/archive, right)

Some of the accounts used screen captures from YouTube videos as their profile pictures. For instance, the user account of “Alice Bergmann” used a screen capture of Chilean actress Josefina Montane from a YouTube video.

Alice Bergmann using frame from a video featuring Chilean actress Josefina Montane. (Source: Facebook/archive, left; YouTube/archive, right)

Similarly, the account “Helena Bergmann” used a screen capture from a video interview with former Chilean beauty queen Candela Carrasco.

Helena Bergmann’s account using Candela Carrasco images. (Source: Helena Bergmann/archive, left; YouTube/archive, right)

Some accounts from the network even used the same profile pictures as one another, as in the case of “Robin Christiansen” and “Aurelio Montes Cooper.”

Accounts using the same profile picture. (Source: Robin Christensen/archive, top; Aurelio Montes Cooper/archive, bottom)

The account “Konrad Kertész Broż” also had a profile picture featuring Brazilian musician Lebart, similar to Robert Gautier. Konrad Kertész Broż’s profile photo featured Lebart with a child, a photo that also appeared in Broż’s timeline showed a man with a similar profile to Lebart but who was not the musician.

Konrad Kertész Broż using Lebart’s image as his profile picture, despite previously using images of another man (bottom left). (Source: Konrad Kertész Broż/archive, left; Robert Gautier/archive, right)

Busy millennials

The accounts also had much in common with one another in terms of the biographical information they disclosed.

Most of the accounts identified themselves as in their late 20s or early 30s.

Age of the users that specified their date of birth. Calculation made on October 31, 2019. (Source: @nikaaleksejeva/DFRLab via Facebook)

Many accounts also listed multiple jobs.

Example of accounts that have many simultaneous jobs. (Source: Meredith Kennedy/archive, left; Miguel Angel Singer/archive, right)

Inconsistent usernames

Almost every tenth account (35 out of 329) that Der Spiegel identified as inauthentic used a screen name that was different from its username. Sometimes, the suggested genders of the names did not match, either. It is possible that the accounts were renamed at some point.

Examples of usernames and screen names that the fake accounts used. Notice the two male accounts using female usernames (pink underline) on the left side of the image. (Source: Mâjid Najm Al-dîn/archive, top left; Marguerite Gautier/archive, top right; Hetzel Kozlowski/archive, bottom left; Zein Afrodakis/archive, bottom right)

In addition, almost every third account (100 out of 329) had one of five permutations of the suffix “vis” in its username: “visir” (13 times); “visir123” (10 times); “vis123” (33 times); “123vis” (9 times); and “vis” (35 times).

Examples of accounts with four permutations of the “vis” suffix added to the username. (Source: Youssef Mansour/archive, top left; Liam Christensen/archive, top right; Magdalena Gärtner/archive, bottom left; Vincent Ćerimagić/archive, bottom right)

The use of suffixes with usernames may indicate a certain degree of coordination, but the DFRLab did not identify any behavior unique to the accounts using the same suffix. The mismatch between these accounts’ screen names and usernames, however, suggested that the profiles may have been renamed, or even repurposed, at some point.

Gender inconsistencies

These accounts may have done more than adopt new names: they may have fully reinvented their identities. Some of the accounts appeared to have started out as one gender but later become another. For example, a user named “Ramses Sawiris” used images of women as previous profile pictures and identified as female, but most recently used a profile picture of a man.

The user Ramses Sawiris used pictures of people of different genders as his profile images. (Source: Ramses Sawiris/archive, left; Ramses Sawiris/archive, right)

Similarly, an account named Thanos Kazimoglu used a profile image of a man but identified as female, and an account named Victoria Chavchenko used an image of a woman but identified as male.

Thanos Kazimoglu and Victoria Chavchenko identifying themselves as the opposite gender. (Source: Thanos Kazimoglu/archive, left; Victoria Chavchenko/archive, right)

Language inconsistencies

The DFRLab found evidence to suggest that the operators of these accounts were native Spanish speakers.

Many of them frequently listed the languages they spoke in Spanish but omitted Spanish itself from their list of spoken languages.

Accounts listing the languages they speak in Spanish but not including Spanish on the list. (Source: Jared Dabrowski/archive, top left; Mark Von Muller-Kolsch/archive, top right; Miroslav Overchenko/archive, bottom left; Mahir Sawiris/archive, bottom right)

Other accounts presented themselves as native English-speakers but posted text with grammatical and syntactical errors characteristic of non-native English speakers.

An example of a post by a Scottish account, with English-language errors underlined. (Source: Angus Campbell/archive)

Other minor clues also pointed to a native Spanish speaker behind these accounts. A supposed Russian account by the name of Oleg Ivanov posted a life event saying he “Got a Pet Named ‘gatito,’” which means “kitten” in Spanish.

Oleg claimed he was Russian but named his cat in Spanish. (Source: Oleg Ivanov/archive)

Evidence pointing to Latin America

In addition to being native Spanish speakers, some of the operators behind these accounts were also likely based in Latin America.

Robert Gautier posted a photo on October 24, 2019, with the timestamp of 1:03 p.m local to the DFRLab researcher. Hovering over the timestamp, however, revealed a different time: 7:03 p.m. local to the uploader.

Robert Gautier posted six hours ahead of the time that the researcher saw when hovering over the timestamp. (Source: Robert Gautier/archive)

The time zone of the researcher who took the screengrab was GMT+2, so Robert’s time zone must have been GMT -4. Most of the countries in GMT-4 time zone are in Latin America.

Countries that use the GMT -4 time zone. (Source: 24timezones.com/archive)

Neither Syria nor France, the locations Robert Gautier mentioned on his account in posts and profile description, respectively, are in GMT-4 time.

Conclusion

These accounts shared numerous inauthentic features. The use of Latin American celebrities’ images, timestamps that matched the time zones of several countries in that regions, and evidence that the operators were native Spanish speakers suggested that the person or group of people operating some of these accounts was based in Latin America.


Nika Aleksejeva is a Research Associate with the Digital Forensic Research Lab and is based in Latvia.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.