Stoking Conflict by Keystroke

Today Facebook announced the takedown of three separate networks that targeted communities across Africa. Facebook shared the assets with the Stanford Internet Observatory (SIO) and Graphika before they were suspended. SIO collaborated with colleagues at Graphika on two reports analyzing these networks, both of which we published today. 

The first network consisted of 126 Pages, 16 Groups, 211 profiles, and 17 Instagram accounts affiliated with individuals with links to the past activity of the Internet Research Agency (IRA), an entity linked to Russian businessman Yevgeny Prigozhin. According to Facebook, the network involved operators in Russia, Libya, Egypt, Sudan, and Syria and targeted individuals in Libya, Sudan, and Syria. The operation also had a Twitter presence of approximately 30 accounts actively participating in the information operation. These accounts had several thousand followers — at least one had almost 12,000 followers — but the Twitter presence was much smaller than that on Facebook. 

The second network is also linked to Prigozhin, but was a distinct operation that primarily targeted the Central Africa Republic. The third is linked to the French military and targeted the Central African Republic and Mali. In a joint report on these two operations, Graphika and SIO found that each campaign tried to expose the other. 

This is not the first time Facebook has suspended Africa-based networks linked to Prigozhin. In addition to his ties to the IRA, which in March 2020 was found to be leveraging locals based in Ghana to target the US, Prigozhin has ties to the Wagner Group, a private military mercenary organization involved in security and combat operations in areas of strategic interest to Russia. These have included the Central African Republic, Madagascar, Libya, and numerous other countries in Africa. Prigozhin’s information operations have taken the form of grey propaganda operations, such as funding and taking a majority ownership in local news stations that subsequently began to air pro-Russian content, and fully covert operations involving fake social media accounts and front media properties. In October 2019, SIO and Facebook jointly investigated a network linked to Prigozhin that had been operating in Libya, Sudan, the Central African Republic, Madagascar, Mozambique, and the Democratic Republic of the Congo. Some of the tactics observed in that operation — franchising Page ownership to locals, creating front media organizations — were replicated in this most recent attempt.  

Key takeaways from the Russian operation that targeted Libya, Sudan, and Syria:

• This was a large operation: in aggregate, the Pages had 5.7 million followers, though some may have followed more than one Page, and there are indications that fake engagement may have been used to boost follower counts on several Pages. By our estimate, about 1.6 million people followed Pages that actively participated in the information operation. Others may have only followed Pages that were primarily entertainment Pages and that may have been in their audience-building phase. 

• This operation involved participation by Syrians, and possibly Libyan and Sudanese individuals, who were living in Russia. This is similar to our findings from assets Facebook suspended in 2019 linked to Prigozhin; that operation appeared to have involved — wittingly or unwittingly — Sudanese individuals who had studied in Russia. 

• Libya: 

  • Overall, Libya-focused assets mobilized in support of the eastern Libyan National Army (LNA). This Libya operation was more ambitious and sophisticated than the Prigozhin-Libya operation that Facebook suspended in 2019. 

  • The Libya operation appears to have franchised some activities out to the LNA and its Moral Guidance Department media staff.  

  • Several suspended assets were linked to the Stop Terror media brand, which ran a daily podcast. At least one person linked to this media brand received training from international media NGOs. 

  • The network pushed for the release of Russian sociologist Maksim Shugalei and his translator Samir Seifan from a Libyan prison. One Page existed to promote a film describing their experiences — from Russia’s perspective. 

  • Twitter activity was narratively identical to the Libyan Facebook operation. Tactically, the accounts also revealed links to LNA media operatives and Libyan media professionals. Notably, tweets from several sockpuppet accounts were embedded in articles on domains linked to the Facebook operation, such as arabitoday.com. 

  •  Both the pro-Gaddafi and pro-LNA parts of the network aggressively attempted to disrupt the Libyan Political Dialogue Forum (LPDF) in November 2020 with distinct content that stood out from organic activity. 

• Sudan: 

  • Like the 2019 Prigozhin-Sudan operation, the Pages targeting Sudan in this takedown heavily leveraged “news” websites. Narratively, these Pages and linked sites discussed Sudan’s economic crisis and positively framed a Russian-Sudanese deal for a Russian naval base in Sudan, and positively framed ongoing Russian activities in Sudan’s mining sector.

• Syria: 

  • Overall, Syria-focused assets mobilized in support of the Bashar al-Assad regime.

  • The Syrian Facebook Pages told negative stories about the lives of Syrian refugees, perhaps as part of push and pull strategies to promote refugee resettlement.

  • Pages shared a hostility toward military operations conducted by opponents of the Assad regime, particularly the United States and Turkey.

One of the suspended Facebook Pages hyped a film telling the story of Russian prisoners in Libya, from the Russian perspective.