A Facebook drama, act 3: the content

Fake accounts pushed charged political content as a means of gathering a particular audience susceptible to the scam

(Source: @nikaaleksejeva/DFRLab via “Os Nossos Dias” by rtppt is licensed under CC BY-NC-SA 2.0)

This is the third and final piece resulting from a joint investigation between the DFRLab and Der Spiegel.

The content posted by the accounts in the network discussed divisive sociopolitical issues, though the topics were likely a superficial brand to attract an audience that would be susceptible to the network’s scam.

These accounts demonstrated mutual connections, shared political and social stances on divisive sociopolitical issues, but lacked a single, coherent advocacy agenda. Given Facebook’s assessment that the accounts were designed to scam unsuspecting users, the lack of a focused political agenda likely indicated the types of users they intended to scam; not really promoting a unified point of view, the content was likely aiming at an audience that was concentrated, engaged, and considered to be more vulnerable to the scam.

With this in mind, this piece primarily discusses the content on the network’s accounts. The previous two pieces assessed the inauthentic nature and degree of coordination among the accounts.

Support for Kurdish independence movement

A subset of the accounts, many of which identified as special operations forces fighting alongside the Syrian Kurdish militia in northeastern Syria, expressed political stances on the Syrian War and the Kurdish independence movement. The DFRLab identified 14 accounts that were explicitly pro-Kurdish.

One of the most prominent of these was Robert Gautier, a supposed French special forces officer who was also discussed in part 2 of this report, shared an emotionally loaded pro-Kurdish video on October 24, 2019. Another account, “Soraya Mansour Al-Thani,” included the phrase “Kurdistan (heart)” in the “Intro” section of her Facebook profile.

Several accounts stated that they belong to the Kurdish People’s Protection Units, also known as the YPG, the Kurdish militia operating in northern Syria and the dominant group in the U.S.-allied Syrian Democratic Forces (SDF).

Accounts claiming to serve in the YPG. (Source, left to right: Zafiro Sultan/archive; Yedy Aza Al-Athir/archive; Jade Abdulbeyyan/archive; Omar Abdulbeyyan/archive)
Accounts whose Facebook user IDs included the word “Kurd.” (Source: Zarp Backett/archive, left; Amanj Pesmerge/archive, right)

Some accounts did not specify that they were YPG members but nonetheless posted pro-Kurdish independence cover photos.

Cover photos by accounts that did not indicate a specific connection to the YPG. (Source: George Wozniak/archive, left; Elvis Russo/archive, middle; Alfred Louis Carter/archive, right)

Other accounts published posts condemning Turkish for acts of violence against Kurds as well as demonizing — in an oddly literal sense — U.S. President Donald Trump.

Posts condemning Turkish and implying that U.S. President Donald Trump is the devil. (Source: Cristobal Laport/archive, top left; Alfred Louis Carter/archive, top right; Devon Singer/archive, bottom left; Tony Cifelli/archive, bottom right)

The pro-Kurdish posts appeared from May 2017 until October 2019, suggesting that the topic was of ongoing interest to these accounts.

The DFRLab also identified several other accounts that acted as a counterbalance to the pro-Kurdish narrative by presenting the Turkish side of the conflict.

Accounts claiming that they served in Turkish-backed militias operating in Syria. (Source: Tibet Zumrut Guler/archive, left; Doganberk Ozgen/archive, right)

One of the Turkish accounts, Levent Ozkan, expressed support for former Turkish leader Mustafa Kemal Ataturk, a Turkish nationalist icon.

The false account Levent Ozkan expressed support for Turkish nationalist icon and the nation’s founder, Kemal Ataturk. (Source: Levent Ozkan/archive)

In another post, Levent attempted to provoke one of the most explicitly pro-Kurdish accounts in the network, Soraya Mansour Al-Thani, and the two engaged in a public argument in the comments section.

The false account Levent Ozkan endeavored to provoke a pro-Kurdish account.(Source: Levent Ozkan/archive)

Support for demagogues

Some of the accounts praised certain politicians, such as U.S. President Trump, Russian President Vladimir Putin, and Italian Deputy Prime Minister Mateo Salvini, while denouncing others, such as French President Emanuel Macron and German Chancellor Angela Merkel.

The users that identified as Russian expressed sympathy for Putin most often.

Posts supporting Putin by Russian accounts in the network. (Source, left to right, top to bottom: Victoria Chevchenko/archive; Vladimir Chevchenko/archive; Deyn Kadyrov/archive; Victoria Chevchenko (2)/archive; Maxim Kalashnikov/archive; Miroslav Kostenkov/archive)

Two Italian accounts expressed support for Salvini. One explicitly claimed he worked for him, and both stated they were involved in anti-migrant initiatives.

Accounts promoting Salvini also used his name as their own surname. (Source: Gianni Salvini/archive, left; Piero Salvini/archive, right)

Another account — the previously mentioned Levent Okzan — claimed to be a man of Turkish origin living in Berlin, Germany, and blasted Chancellor Merkel, infusing the criticism with anti-immigrant rhetoric.

Account calling German Chancellor Angela Merkel a “murderer” and denouncing her “open house” immigration policy. (Source: Levent Ozkan/archive)

Natural disasters and terror attacks

While some of the personas in the network expressed outward and incendiary political stances, others focused on presenting content that evoked strong emotions but did not have an explicit political leaning.

Many accounts, for example, posted emotional posts about natural disasters and other tragedies, including wildfires in Greece, Hurricanes Harvey and Florence in the United States, and a terrorist attack in Nice, France.

Posts about natural disasters and terrorist attacks in different countries. (Source: Vanessa Ferraro Vecchia/archive, left; Berk Gokalp/archive, center; Ray Wyatt/archive, right)

Animal welfare

Another common theme among the accounts was advocacy for animal welfare and a vegan lifestyle.

Posts about animal cruelty (intentionally obscured) and veganism. (Source: Luciano Boujicic/archive, top left; Mikolaj Koscianek/archive, top right; Fernando Linton Dawkins/archive, bottom left; Caroline Singer King/archive, bottom right)
Accounts promoting a vegan diet. Again, an account clearly supporting a public persona — this time tennis player Novac Djokovic — used the persona’s last name as their own. (Source: Kevin Holssing/archive, top left; Irving Crusoe Cass/archive, top right; Milan Djokovic/archive, bottom left; Tony Cifelli/archive, bottom right)

At least four additional accounts identified themselves as vegan activists in their intro tabs.

Accounts identifying themselves with the vegan movement. (Source, left to right: Catalina Leyton Haddad/archive; German Fritz Goldmark/archive; Amara Bergmann/archive; Daniel Guéroult/archive)

Some accounts were largely apolitical, discussing special interest topics like soccer.

Accounts posting about soccer. (Source: David Bergmann/archive, top; Wilson Dadić-Lovrić/archive, bottom)

Even some of the more apolitical accounts, however, occasionally posted about incendiary topics.

This fake profile mostly posted innocuous content about sports but on occasion posted invectives about terrorism and Islam. (Source: David Bergmann/archive)

Conclusion

The content of this network was diverse: many of the accounts posted both political and apolitical content, representing a variety of perspectives. Among the political content, there were identifiable topics of interest, the most prominent of which was the war in Syria and the quest for Kurdish autonomy.

While there were some outward indications that this network may have had an ideological objective, the diversity of the personas and the broad array of their opinions suggested moreover that the network was attempting to attract real users from a wide variety of backgrounds using emotionally appealing content.

Put another way, if these accounts were intent to scam real users, the topical focuses were most likely intended to attract those whom the operators’ believed to be most susceptible to their scams.


Nika Aleksejeva is a Research Associate with the Digital Forensic Research Lab and is based in Latvia.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.