ARTICLES

4 Million Followers for $1.6 Million. Why Facebook Blocked Ukrainian Pages for Inflating Audiences

17 September 2019, 19:45

Znaj, Politeka and several other news sites came under scrutiny.

Popular Ukrainian news aggregators inflated their audiences using fake Facebook pages. This was reported by DFRLab.

The social network blocked 149 pages linked to Znaj Media Holdings for "coordinated inauthentic behavior." When 121 pages were examined, it turned out that 64 of them were connected to the holding. It includes Znaj, Politeka, Akcenty, Hyser and Clutch.

Facebook officially commented on the situation:

"Page administrators and account owners typically post information about celebrities, show business, sports, local and international news, political and economic issues, including elections in Ukraine, political candidates and criticism of various public figures. Although the people behind this activity tried to conceal their identity, we were able to link it to the Ukrainian PR company Pragmatico."

Pages with thousands, and in some cases millions, of followers published news with links to the aggregators. There was a commercial interest in these actions, as the sites run paid advertising. Znaj and Politeka are among the three most visited sites in Ukraine.

Information about the owner of the media conglomerate is missing, but the declared financial beneficiary was identified as a non-resident of Ukraine.

How the Investigation Was Conducted

DFRLab found the Facebook page of the company Pragmatico, to which the social network had attributed this operation. A video ad on that page contained a number that was also found in a presentation by another company, Doping Digital Agency, which stated that it owns and manages Znaj, Politeka and Clutch.

58 of the 121 analyzed pages were linked to the "branches" of one of these aggregators. The pages were named after regional centers and published regional news there with links to subdomains of the Znaj and Politeka sites.

For the most part, the "branches" showed no direct connection to the holding. They posted about local news, politics, lifestyle and entertainment. Sometimes there were specific topics: the early elections of 2019, the war in the east and even memes. Each such page only occasionally published links to the site subdomains.

But analysts found several indicators of a connection between these pages. For example, a common creation date: 37 pages (about 30% of all analyzed) of Znaj and Politeka were created on December 22, 2018. Most pages (66-84%) published nothing but had many followers.

On average, Znaj and Politeka pages with no posts had about 12,000-14,000 followers, with minimums of 8,309 and 9,928 respectively. These are large numbers for pages without posts, which suggests the use of artificial methods to grow the audience.

Analysts noticed sharp spikes in follower growth on the same dates for both Politeka and Znaj. For example, two "branches" in Kropyvnytskyi for both sites were created on December 22, 2019. Each gained 1,900 followers within two weeks, and then another 600 each from December 30 to January 5.

The audiences of both pages also grew actively at the same time in late April and early May, and in late August and early September. During this period, the number of followers rose by 30-80%.

None of these pages ran ads during the peaks of audience growth. Znaj Kropyvnytskyi never ran ads at all, while Politeka Kropyvnytskyi launched its first ad only on September 2, 2019.

DFRLab also studied the followers of the pages. Their activity looked human, and most were from Ukraine.

Another indicator of a connection between the pages was identical content. The Zhytomyr "branches" of Politeka and Znaj reposted the same post, which was the only publication for both pages.

The analysts also noted identical covers for 17 of the 22 regional pages of Znaj and Politeka.

DFRLab also found that both sites are hosted on the same server. According to the domain analysis platform SpyOnWeb, the sites have identical IP addresses. Clutch, which belongs to the Znaj Media holding, is also hosted on the same server.

According to Whois.net, one company was used to register and host all 3 sites: Imena UA.

Some pages posted identical memes instead of news, which became another indicator of a connection between the pages. In this way, the pages "amplified" external links to the sites.

Conclusions

DFRLab identified numerous indicators of coordinated activity:

identical page creation dates;
identical posts and links;
identical periods of audience growth;
amplification of external links to the same sites;
a shared IP address for servers.

The pages mainly published regional or all-Ukrainian news content. Most posts were copied from other Ukrainian media outlets, with partial adaptation and/or source or authorship attribution.

It is possible that this network of pages and accounts was politically motivated, as some pages attacked specific Ukrainian politicians. The other interest was commercial, since the Znaj and Politeka sites run paid advertising.

How did the accused respond?

Znaj.ua published a refutation of this information and demands that the page be restored. The editor-in-chief of the publication, whose name is not indicated in the article or anywhere prominent on the site, claims that the editorial team was surprised to learn this about itself.

They confirm the connection with Pragmatico but state that the company did not manage the Znaj.ua pages, and for some time advised the team on promoting pages on social networks.

"We have never restricted our readers' right to express their opinions on the portal. We did not block those we disagreed with and tried to respond to any accusations. Now we admit that different political groups could have waged wars on the Znaj.ua page on Facebook, defending the interests of their owners. But by this principle, every second page of any media outlet in Ukraine could be deleted."

Znaj.ua allows that Facebook "became a victim of manipulation by Ukrainian political forces that want to silence well-known media outlets that criticize their activities."