Editor's Note by Lead Stories Editor-in-Chief Alan Duke:
Three days after a virtual apocalypse wiped out hundreds of fake people used to run a foreign pro-Trump network on Facebook, we found signs of life among a few dozen surviving profiles. Their creators in Vietnam appeared to be revising their identities and assigning them new duties to support a handful of pages and groups that somehow escaped destruction in the Facebook takedown of Friday, December 20, 2019.
Facebook took TheBL.com network down for "engaging in foreign and government interference." A Vietnam-based editor acknowledged in an email to Lead Stories that their mission included spending "lots of money on pro-Trump contents" to support President Trump:
Yes, we have been spent lots of money on Trump's contents, but if you notice, we spend as much money on contents on exposing Communism, on the beauty of Falun Dafa, and on the persecution in China. These are our main goal!
The editor pleaded for "compassion" so that Falun Gong believers could continue their mission:
Those Facebook pages are our weapons to fight the evils and to save people and we've been trying very hard to nurture them.
The real people behind these fake profiles are not counting on "compassion." Instead, they are busy raising their network from the ashes, giving surviving profiles new looks and using them to administer about a dozen groups and pages that Facebook missed in the purge.
Carolina Chaney, who we introduced in our story Fake Faces: People Who Do Not Exist Invade Facebook To Influence 2020 Elections on December 12, 2019, did not survive the takedown, but Zeng Ziwei - previously known as Cheryl Guerra - did. Ziwei's profile image has been changed from a photo of a young woman wearing a hat, taken from the photo-sharing site UnSplash.com, to a picture of a dandelion covered by a Trump-Pence 2020 sticker. She also has a new job as administrator of Breaking News, a Facebook group described as "here to show our support for President Donald J. Trump." It appears that she was made the group's only administrator a day after the other admins vanished in the purge.
Ziwei and the other surviving admins have stopped posting links to TheBL.com stories, which have been banned by Facebook. Instead, they are posting the headline and several paragraphs of stories, along with photos.
Lead Stories' Social Media Authenticity Analyst Sarah Thompson continues her dig into TheBL.com in the aftermath of the takedown in this installment:
The purge of TheBL network ended their ability to make money by driving Facebook traffic to their stories, but they are still trying to rebuild. The post-purge postings on the surviving pages and groups suggest their motivation is ideological - not financial. One the day after the takedown, a BL video called "Freedom of Belief" was pinned to the top of two groups, "Breaking News" and "Stand with President Trump 2020." On "USA for President Trump", there was a video to raise awareness about the human-rights atrocities of forced organ harvesting in China.
Even though links to the website TheBL.com are no longer allowed on Facebook, they are posting links to articles from other websites: Fox News, Reuters, PBS, Business Insider, Brietbart and the Daily Caller. Since they can't post their own links, they are posting photos and excerpts of the text of their own articles as stand alone posts without a link. They also post engagement-bait memes.
Sixty-six of the StyleGAN face profiles - those synthetic faces we told you about in the story titled Fake Faces: People Who Do Not Exist Invade Facebook To Influence 2020 Elections - and 45 of the flowers and landscapes set remain. An additional 20 we've never seen before, but that were made around December 16, have appeared.
There are some profiles that seem to be backed by a real person and some profiles with names in Chinese that have been moved to the remaining American political groups. Mitchell Rodgers was the sole admin of the "Breaking News" Group on Saturday, but by Sunday he had been replaced by Zeng Ziwei. Also, the page "Keep America Great", which had been created the day before, on December 21, 2019, had posted only twice but had already collected about 500 likes before being deleted late the next day. The pages "Honor the conservative values" and "President Trump Supporters Only" are pages serving as an administration for the group "USA for President Trump."
There is a chance that some of these scrappy pieces of activity are animated by some post-scheduling that had been set up before the takedown. Two profiles even ventured out to place some spam posts into the Chad Prather Fans group. The fact that there are group-level administration overhauls and new pages being made despite the upheaval speaks to some real people on staff trying to salvage what is left.
The side-by-side image below shows a search in the non-network group "Chad Prather Fans." Yi Larsen was a new member. The left side shows search results on December 22. One day later, on the right side, we can see that the posts originating from the "Keep America Great" page are replaced with unavailable notices because the page was deleted, and Yi has changed her profile picture.
Before The Takedown: Automated Posting
Many of the fake profiles were installed as administrators in TheBL groups before the purge. They published new articles and posted memes to move and amplify TheBL.com content throughout their network of hundreds of groups and pages. Some profiles were reserved for spamming and sent out to post memes and links into groups that are not a part of the BL's network. Many of the posts appeared to be automated in a fashion violating Facebook rules.
Here is a collection of three screenshots from the feed of TheBL group, "Stand With President Trump KAG 2020." A group member, when first encountering two posts containing a link to the same article one after the other, might assume that two people were posting at the same time and hadn't seen the other's post. The odds of that happening, unless it is a very popular breaking news story, are very slim. For it to happen to the same two people over and over - and in the same order - is a sign that the person tasked with setting up the post-scheduling made a mistake.
Burt Kasey's profile (the female) was one of over 100 network profiles deleted by Facebook in the days leading up to the takedown. Mulcahy Anne's (that's the guy) posts appeared for several days before the final blackout without an annoying automated echo. Aside from that sloppy scheduling error, the other way that we are certain these posts were automated is because they have a Postcron tag on them.
Postcron is one of many post-scheduling programs that a busy social-media manager can use to help budget their time and keep things running smoothly. These programs are a great way to manage one's own business pages, or for a professional social-media management firm to keep the accounts of many clients posting day and night. There is nothing unethical about using a program like this, but using a post-scheduler in conjunction with a fake profile is a clear violation of the terms of service.
You can see demos about how Postcron works on their website, but nothing in their demos looks remotely like this:
It appears someone was trying to do a bulk upload of article links, and rather than formatting as individual posts somewhere else, all the links dumped into the same post on their timeline. Over the course of a few days, this profile made eight posts containing over 100 links. That this happened over several days without correction suggests they were not aware it was happening.
This profile was still standing after the takedown but was finally removed two days later. Much of TheBL's social media activity is being run from Vietnam, and we might assume Thanh Le is a real Vietnamese employee. While the person behind the account may indeed be real, the profile picture is AI-generated. Here is a zoomed-in view of the bangs growing like tree roots against the forehead.
In the past, these third-party post-scheduling programs allowed much more freedom in the types of actions you could perform with them. In August of 2018, Facebook removed the ability to use a post-scheduler to post on personal timelines. This loss may have been softened a month later when Facebook introduced the possibility for pages to join groups and post under their page name. They can do this manually or with a scheduling program.
This new system of allowing pages to post in groups may have backfired, creating a motivation to make pages that look like personal profiles. The head of Facebook's security policy, Nathaniel Gleicher, wrote about a situation in Honduras involving this people-page design tactic in July.
When TheBL would design a page looking like a person, they also would make a profile with the same name and photo. I found at least eight of these page/profile account pairs. The Wallace Delgado page, as well as the personal profile, were installed as administrators in "Trump&Pence 2020 - Making America Great Again". The first time Wallace Delgado appears in the roster, it is the personal profile. Note "add friend" is a possibility. The second time Wallace appears, it is as a page, in the "community service" category.
When scrolling through posts in a group, hovering your cursor over a name will cause a preview of their timeline to pop up. Hovercards (shown here on the left side of the collage) are an underrated source of information, and one of the only ways you will be able to detect a page designed to look like a person when their post appears in a group feed. A person's hovercard will usually have "add friend", but the hovercard of a page is formatted differently and offers "like, follow, and message."
One other way to see these people pages revealed is in the member roster of a group. Pages are listed separately between the admins and the members.
One other way to see these people-pages revealed is in the member roster of a group. Pages are listed separately between the admins and the members.
Here are seven fake profiles from TheBL network, all with synthetic faces. Except for Elliot, all of these accounts were still live as of late Monday, December 23. But they look very different without TheBL content showing up in their timeline. Two of them, Kellan Moore and Aidyn Aguirre even have the same fake face.
Three accounts were created on December 12, and the other four were made on December 7. Within minutes of creation, each account loaded their timeline with a variety of linked articles and memes. On each day, the posts that populated each timeline were the same and in the same order. Since it is not possible (nor permissible) to use a post-scheduling program to post to personal timelines, this points to the use of an unauthorised program designed to get around that barrier. That none of these profiles is a real person makes all of this a violation - even if it had been done manually.
There is a cluster of similar accounts that also had parallel timelines. They just changed their profile and cover photos in the early hours of Monday, December 23. This is what they looked like before they had the makeover.
To use one of these scheduler programs on a group or a page, the app must first be connected to the respective group or page. And then, it is possible for one person to schedule posts that will automatically be sent out to many groups at once. The groups receiving the post do not need to be owned by the person sending the posts, but they do need to have the app enabled in their group. Maintaining a network this size would be impossible without some automated assistance.
One action frequently used by TheBL profiles was to share posts out of a group to some other destination, frequently their own fake profile timeline - a place not unlike a ghost town.
So why do it?
When a post is shared, Facebook's algorithm takes note, and that post will become more visible to others who might encounter it. A post with lots of artificial engagement will surface to more people than a post not getting much attention. It may appear in someone's newsfeed - or at the top of a group feed - while other posts from real people drop into obscurity and are never seen. Inauthentic behavior does not only compete against differing viewpoints - it most directly competes with the authentic content and expressions from within that filter bubble. Facebook's design to keep the most engaging and interesting content in front of people has created an incentive for players to cheat.
If a profile is reposting content from one of their own network's groups, the benefit is very clear. Other times, the benefits may be harder to appreciate. If a member of the public posted some BL content freely onto a non-network group where BL spammers were present, the BL spammers would sometimes share those posts back to their timelines. This action had algorithmic and social benefits. Still other times, they shared random posts from non-network groups to their timelines - either to amplify the pro-Trump message or to build in a more natural mix of content on their timeline.
What if a BL spammer was sent out to put posts in a group that was not so friendly to Trump? In this case, two BL network spammers work together to amplify this article. Jay Gregory (using a fake face) reshares the post of one of the Patriotic Flag-theme spammers. Jay is sacrificing space on his own his own uninhabited timeline to help his teammate's post be more visible in that group. The amplification will not just help the post in that group but, in theory, it will help everywhere this article's link has been shared.
Here's an assortment of posts made by real people into groups where these BL spammers were. Just like their counterparts who were embedded in groups where the president is popular, these profiles are sharing random posts from a public group back to their timeline. Just the names of the groups make quite a statement and stood out when compared with the other BL brand content on the timeline. There was little risk of a real person ever seeing these shares - or asking what their intention was. I believe the act of sharing posts that real people had posted was a strategy to build in a variety of authentic-looking actions to their daily tasks so as not to appear as a spam-bot.
TheBL profiles had little regard for the quality of the groups they joined (and possibly were refused by the well-moderated groups). They were found in some of the notorious hotspots for foreign clickbaiters. This is the bizarre result: TheBL's face-fake profile randomly sharing (and amplifying) foreign clickbait posted by spammers.
Facebook took action and removed the pages, groups and profiles of TheBL network just days after we provided the data behind our first "Fake Faces" report. Facebook was already working on it with the help of Graphika and DFR Labs. These investigators had carefully been documenting and mapping a multilingual digital-publishing empire stretching around the globe.
But from what we have seen in the several days after the takedown, there is more work to be done given the fact that TheBL network tries to rise like a Phoenix from the ashes.
