Graphika
Research Reports/Echoes of Fake News
GatedJan 12, 2021

Echoes of Fake News

Facebook Downs Assets Linked to Deceptive Websites Run from Separatist-Held Ukraine, First Reported by Die Welt and Netzpolitik

Influence OperationsTrust & Safety
Ben Nimmo, Léa Ronzaud & C. Shawn Eib
Graphika Research
Share
Free Download

Access the Full Report

Get the complete findings from Graphika's latest research, including in-depth network analysis, narrative mapping, and intelligence across platforms.

By submitting this form, you agree to receive communications from Graphika.

On January 12, Facebook announced that it had taken down a cluster of accounts, pages and groups that were tied to a network of fake “news” websites across Europe and Central Asia. The websites were routinely pro-Kremlin, anti-Ukraine and anti-Western, and were linked to individuals in Russian-occupied areas of Ukraine.

As it announced the takedown as part of its monthly update on influence operations, Facebook said, “The people behind this deceptive campaign used fake accounts to manage Pages and Groups, drive people to off-platform domains masquerading as independent news entities in countries they targeted, and comment to make their posts seem more popular than they were. Each Page had an accompanying domain and posted content hosted on these websites. It appears that the network accelerated its activity in 2020 and some of its content was re-printed by media organizations in Germany and Russia, including Sputnik Germany. Although the people behind this activity attempted to conceal their identities, our investigation found links to individuals in the Luhansk region in Ukraine and those associated with Borotba, a political group in Ukraine.”

The operation was based around a network of websites; some of these were exposed by a joint report by German outlets Netzpolitik.org and Die Welt in December. That report linked the network to a Crimea-based pro-Kremlin outlet called News-Front, which has already been banned from Facebook and YouTube, but there is insufficient open-source evidence to confirm this attribution with confidence. Available digital traces led to individuals in separatist-held Ukraine, especially the Luhansk region; the organization behind them remains unknown. Facebook also highlighted individuals with links to Borotba, a Marxist organization that originated in Odessa, Ukraine.

The websites worked in English, German, Russian, French, Spanish and Hungarian. Some of their content was copied from bona fide news outlets, while other articles appear to have been original. The original content praised Russia and its allies and attacked its critics, both foreign and domestic. Many of its claims were false, including the accusation that the United States had released COVID-19 from a secret lab in Ukraine, that Ukraine was exporting radiation-contaminated wheat to Europe, and that Russian opposition leader and poisoning victim Alexei Navalny was a CIA operative.

The network used its assets on Facebook, Instagram and Twitter to promote its content, but its activity does not seem to have borne fruit. Most of the network’s posts gained a handful of engagements, if any. One Facebook page had 7,000 followers, none of the others had over 5,000, and half of them had under 1,000. In the Western countries whose languages it used, the operation seems to have had almost no impact.

Instead, its main amplification came from apparently unaffiliated Russian-language websites that cited the fake articles as if they came from “Western media.” As such, the network of websites appears to have been a disinformation laundromat. Whether by accident or design, its main effect, such as it was, was to insert false stories about Kremlin critics, and defense of Kremlin narratives, into the Russian-language space by pretending that they came from Western outlets. The operation was based in Ukraine, but its main audience appears to have been in Russia.

Written By

Ben Nimmo

Head of Investigations

Ben Nimmo was Head of Investigations at Graphika, where he led an expert team of OSINT investigators in detecting, identifying and analyzing inauthentic behavior and information operations online. He specializes in analyzing patterns of online disinformation and influence operations across varying platforms and geographical regions. He is now the Principal Investigator, Intelligence & Investigations at OpenAI.

Léa Ronzaud

Senior Analyst

Léa Ronzaud leads monitoring and investigations into the detection and tracking of Russian influence operations and violent extremist groups. She also researches nihilistic violent extremism and hacktivism. Léa’s work has helped disrupt efforts by extremists in multiple countries to orchestrate real-world harm and exposed the inner workings of nation-state influence operations from Russia, China, and Iran.

C. Shawn Eib

Analyst

Full Report

Download the complete PDF

The full report includes the complete network graph maps, raw attribution indicators, cross-platform topology analysis, and the full takedown timeline with platform-level data.

  • Full network graph visualizations
  • Attribution indicators with confidence scores
  • Raw behavioral modeling data
  • Takedown coordination timeline
Free Download

Access the Full Report

Get the complete findings from Graphika's latest research, including in-depth network analysis, narrative mapping, and intelligence across platforms.

By submitting this form, you agree to receive communications from Graphika.

Act on This Intelligence

See How Graphika Can Help Your Team Act on This Intelligence

This report is one of 600+ investigations Graphika’s team has published. Our platform gives your analysts continuous access to the same intelligence — plus the tools to apply it to your specific threat environment.

60+ government agencies briefed
Used by NATO and EU Parliament
Contributed to 200+ platform takedowns