Lights, Camera, Coordinated Action!

On June 3, Facebook said it had removed a network of accounts and pages in May that originated in Pakistan and engaged in “coordinated inauthentic behavior” to target domestic audiences, as well as English, Pashto, and Arabic speakers internationally. The network consisted of 40 Facebook profiles, 25 pages, six groups and 28 Instagram accounts, many of which used fake personas or posed as independent media outlets to post about news and current events with a clear political agenda. “Although the people behind it attempted to conceal their identities and coordination, our investigation found links to individuals associated with AlphaPro, a Pakistan-based PR firm,” Facebook said.

Facebook said it found some links between the new network and a separate set of accounts removed in 2019 that was attributed to employees of the Pakistani military’s Inter Services Public Relations (ISPR) department. Graphika found no direct connections between the two sets of activity but did identify multiple open-source links between AlphaPro and the ISPR. We also note that many of the key narratives advanced by both networks - including praise for Pakistan’s armed forces and attacks against India - are the same, suggesting the two operations may have been parallel efforts with a shared strategic goal.

The newly identified network provides yet another example of the role commercial marketing firms play in online influence campaigns, highlighting their ability to conduct hands-on-keyboard operations while providing plausible deniability to clients who wish to remain one step removed. The accounts in this campaign also posed as independent media outlets and created original video content featuring paid actors and freelance journalists, demonstrating how political interests can trade on the values of a free press to covertly advance their own agendas.

Facebook shared the full set of accounts, pages, and profiles with Graphika for further analysis before removing them from its platforms, building on earlier investigations we conducted into a suspected influence operation in Pakistan. Below is a summary of our key findings:

• The network centered around a group of 25 Facebook pages, most of which presented themselves as independent news outlets and media brands. These pages were then promoted by profiles in the set that liked and reshared their content.
• Multiple accounts engaged in further deceptive behavior, such as using fake identities and stolen profile pictures, some of which had been altered to obscure the original source.
• Most of the pages posted what appeared to be originally-created video content, often featuring professional script readers and freelance journalists acting as presenters and news anchors. It was not clear to what extent, if any, the individuals were aware of their role in the identified influence operation.
• We found multiple connections between accounts in the set and AlphaPro, a digital marketing firm based in Islamabad, Pakistan. These included now-suspended accounts that belonged to AlphaPro employees, pages promoting content produced by AlphaPro, and elements of the political influence operation which overlapped with marketing efforts supporting the company’s commercial clients.
• Key narratives advanced by the network included: praise for Pakistan and its armed forces; efforts to denigrate India and highlight attacks by Hindu nationalists targeting religious minorities; support for Pakistani Prime Minister Imran Khan; and promotion of the government-backed China Pakistan Economic Corridor (CPEC) investment project.