We uncovered a network around linfonational.net, which impersonated politicians on Facebook to amplify disinformation in France. Our investigation shows just how easy it is to use Facebook’s features to manage a disinformation network using political content.
Following an OSINT investigation, we were able to determine that:
- The network consists of fake media websites;
- It manages fake political Facebook pages impersonating notable politicians in France, namely Marine Le Pen and Jean Luc Mélenchon, who represent the far-right and far-left, respectively;
- It targets Facebook groups, especially politicised Facebook ones, with polarising content;
- And is likely managed from Ukraine and/or Russia.
After coming across fact-checked content from an obscure media outlet named L’info National, we decided to have a closer look at the website. Among its content, L’info National republished disinformation and polarising content from French fringe news websites and reference media on French politics and identity issues, such as religion and migration.
Who’s behind this network
At first glance, identifying the owners of linfonational.net and its associated Facebook Page was not possible: no editorial or management team could be found on either page and so we decided to investigate to determine who managed the website.
On the website, we found a Google AdSense code. Google AdSense codes are useful to identify similar advertisement beneficiaries by looking at similarities of the ID. The Google AdSense code from L’info National was also shared by the following websites:
- Linfonational.net
- Linfopopular.net
- Republique5.fr
- Francenational.com
Domain registration records for the now-defunct website – Francenational.com – showed us that this website was registered by a so-called Ilya S, based in Kyiv, Ukraine. The phone number used to register francenational.com also appeared publicly on several websites connected to Ilya S as well as a Russian based company, which Ilya S openly declares he is currently working for.
Consequently, we determined that linfonational.net is more than likely managed by a Ukrainian/Russian citizen called Ilya S. and that he manages a set of websites in different languages (Ukrainian, Russian, French, English), which all turned out to be connected to the same Google AdSense code.
How Facebook was used to amplify this disinformation
Having a developed network of fake media websites isn’t particularly useful if there’s no audience for them. Therefore, in order to attract an audience to their websites where they republish polarising content from other French sources, the network created several fake French political Facebook pages where they could systematically share articles from their websites.
Marine Le Pen 2022
Using the CrowdTangle tool showed us that content from the L’Info National had been regularly shared by Facebook Pages called “Marine Le Pen 2022” and “soutien a Marine le Pen 2022”. Marine Le Pen 2022 has more than 30k likes, and collectively, these pages almost exclusively shared content from linfonational.net, linfopopular.net, and republique5.fr. By looking at the transparency information behind the Facebook Pages, we could piece the puzzle together and link these pages to L’Info National, as they are run from Ukraine.
What’s more, one of the pages had its name changed from “Marine Le Pen 2017” to “Marine Le Pen 2022”, showing that the page’s owner deliberately linked the page to the French presidential election cycles. At one point, during the 2019 EU elections campaign, the Marine Le Pen 2022 Facebook Page published an advertisement saying “We support Marine Le Pen”. The ad was taken down by Facebook as the owner of the page didn’t give information to the platform about who had paid for the advertisement, which is required when an ad is declared as linked to “social issues, elections or politics”.
…But also Jean-Luc Mélenchon 2022
After looking into L’info National’s Facebook page, we then decided to go back to LinfoPopular’s Facebook page where we were propositioned by Facebook’s recommendation algorithm to click on a Facebook Page called “Jean-Luc Mélenchon 2022” – a name identical to Marine Le Pen 2022’s Facebook Page. This raised alarm bells. In the French political landscape, Marine Le Pen and Jean-Luc Mélenchon represent opposite sides of the political spectrum – the far-right and far-left, respectively. That’s when we thought to check out the transparency information of the Facebook page Jean-Luc Mélenchon 2022, which has 5k likes, and found that it, too, is managed by an administrator based in Ukraine. Not to mention it almost exclusively shared content from linfopopular.net and Republique5.fr’s websites. Consequently, it seemed that the intention behind these pages was to play on the political polarisation present in the French-speaking information ecosystem.
Amplification through politicised Facebook groups
Thanks to the CrowdTangle analysis, we were able to determine that this network managed by Ilya S hijacked Facebook’s network structure to disseminate content via polarising Facebook groups. These groups could be classified into 3 categories:
- Pro-Rassemblement National Facebook groups
- Pro-Yellow Vest Movement Facebook groups
- Anti-Macron Facebook groups
In essence, by using these Facebook groups, the polarising content repropagated by the fake media websites could thrive more organically, since the narratives aligned with users’ beliefs and worldviews.
The same network managing the amplification
To amplify their reach and engagements, the network also used two Facebook accounts (“Ilya M” and “Ilya S”) to regularly post articles from linfonational.net and linfopopular.net on targeted Facebook groups.
We found Ilya M’s Facebook account to be rather misleading with the inclusion of a fake profile picture depicting the former Argentine President Mauricio Macri; he apparently also lives in Montpellier, France and posts some articles in French on his Facebook wall. In contrast, the Ilya S’ Facebook account looks more authentic, especially since the person doesn’t hide the fact that he lives in Moscow and has real profile pictures too. And to recast back to the offline websites, Ilya S is, of course, the name associated with the now-offline “francenational.com”.
Remaining questions…
What we learned is that these tactics of dissemination via Facebook could easily be deployed by any individual, and without politicians even knowing about it.
This investigation was published on the 22nd November 2019 on Twitter and by Le Monde. At present, questions are still unanswered:
- Is this inauthentic behaviour against Community guidelines of Facebook? And if so, why are some of this content still active?
- Is Ms. Le Pen aware that a Facebook page is impersonating her, which is managed from Ukraine/Russia?
- While we welcome the removal of the Jean-Luc Mélenchon 2022 page. We wonder why it was and by whom? Was Mr. Mélenchon aware that a Facebook page had impersonated him, which was managed from Ukraine/Russia?
- Who exactly paid for these advertisements?
- What are the motivations of the individual behind these websites: money or political incentives?
Our investigation revealed just how simple it was for any individual user to artificially amplify disinformation on Facebook. With relative ease, the network could plant disinformation into polarising Facebook groups and watch the engagements and shares multiply. Facebook’s network structure is being hijacked to spread disinformation. And what’s more, Facebook isn’t doing enough to stop it.
This investigation highlights that Facebook is stalling when it comes to the removal of accounts linked to disinformation. In spite of being notified when we first released this investigation in November, some of these Facebook pages still remain active two months later.
Lastly, Facebook must go to greater lengths to empower the research community. We need more data on user engagement with this content and how it then spreads organically from user to user. But, most importantly, we also need more transparency on to what extent Facebook’s algorithm increases reach.
You can also read more about the technical aspects of the investigation via our Twitter.
