Kosovo Blue Lives Takedown
Kosovo Blue Lives Takedown
In the course of assisting reporter Judd Legum of Popular Information on an investigation into a Ukraine-based network of Facebook Pages (recently taken down), SIO researchers uncovered a similar network that appeared to be operating from Kosovo. This network, consisting of approximately 9 pages with 312,000 followers, focused predominantly on “Blue Lives Matter” content – an American social movement that expresses support for police officers. Popular Information has put up a post with screenshots.
Screenshot of removed "Focal Point" Facebook Page
Seven of the pages were related to supporting the police. The names included “All Lives Matter”, “I Support The Police US Not Criminals”, and “PRO POLICE OFFICER”. The oldest page was created in May 2017, the most recent in January 2019. At least two of the Pages had related Groups.
Like the Ukrainian operation, two of the pages featured charming high-engagement animal-related content, such as “3 Minute Animal Stories”:
They replicated strategies used by the Ukrainian groups, such as turning still memes into videos by slow-panning over them. On several occasions they used identical memes as content.
"Pro Police Officer" (L) is a page run out of Kosovo. "I Love America" (R) was one of the Ukrainian Pages taken down last week.
Motivation
The Kosovo cluster similarly appears to be primarily financially motivated, rather than for political influence purposes on behalf of a state actor. We make this assessment primarily because they were posting extensives links to an ads-enabled sensationalist “news” website, Korrespodenti. (https://korrespodenti.com/). Calls-to-action on the Facebook posts primarily solicited page shares and likes. The network, while not as large as the Ukrainian operation, appears to have leveraged almost exclusively organic marketing tactics – rather than ads – to grow the Pages. Two reached audience sizes above 75,000. The largest, begun in November 2018, reached 170,000 followers.
We detected several occasions in which accounts related to the Kosovo operation posted content from the “Blue Lives Matter” Pages into large or authentic American-run Facebook Groups dedicated to support for the movement, American policing, and U.S. President Donald Trump. It is unclear how authentic these accounts are; the names did not always match the slugs in the URL. However, they claimed to be from Serbia, not from the United States. Regardless, this strategy of disseminating content to draw an audience to an inauthentic page is a threat vector that SIO disinformation experts have warned about. Posting content into aligned Groups is an audience-growth marketing hack that facilitates organic lift, can generate many comments, and can be used to convert politically-aligned individuals to become followers of disinformation pages. It was a predictable tactical evolution to evade the increased scrutiny around paid ads implemented following the discovery of the Internet Research Agency operation.
Screenshot of repost of "Pro Police Officer" Facebook Page content
Screenshot of "Pro Police Officer" post sharing
Examining the audience growth and reach of one of the larger Pages, “Police Lives Matter,” we observe a growth pattern that does not strongly suggest that they were purchasing followers. Actual American users frequently commented on the Page, leaving notes to thank the Page for supporting police.
Audience growth of page “Police Lives Matter”
Impact
One of the questions that we are always trying to assess when new inauthentic content is detected is impact. Beyond the impact engagement metrics, one interesting observation is that the piece of content that outperformed the rest of the posts on the Page over the past month was a recycled Internet Research Agency meme.
In the course of SIO’s investigation into the network, Facebook removed one of the Pages prior to any notification, suggesting they continued to investigate residual connections to the Ukrainian content. The remainder came down upon Popular Information’s inquiry.
The economic motivation is difficult to dissuade, and many of these commercially-motivated networks skirt a line around whether they violate the company’s authenticity policy. Several of these Pages explicitly pretended to be American; they posted a fake American business address and phone number. There is also a risk that what looks like commercially-motivated activity is in fact a contracted operation purchased by state-affiliated actors.
The Stanford Internet Observatory is a cross-disciplinary program of research, teaching and policy engagement for the study of abuse in current information technologies, with a focus on social media. The Observatory was created to learn about the abuse of the internet in real time, and to translate our research discoveries into training and policy innovations for the public good.