Facebook purges Philippine online network for malicious behavior

MANILA, Philippines — Hundreds of Facebook and Instagram accounts, pages and groups linked to a former social media strategist of President Duterte were simultaneously taken down yesterday for malicious behavior that deceives users of the social media platforms.

Nathaniel Gleicher, Facebook’s head of cybersecurity policy, said they have removed 68 Facebook accounts, 67 pages, 40 groups and 25 Instagram accounts linked to a network supposedly organized by communication strategist Nic Gabunada, who was among those who led the successful social media campaign of presidential candidate and then Davao City mayor Duterte.

The network, which was found to be involved in political messaging, was discovered to have been engaging in coordinate inauthentic behavior, a form of malicious behavior defined as a network of people or pages that “work together to mislead others about who they are and what they are doing.”

Among the pages taken down were social media pages supporting Duterte and some senatorial candidates.

“What we saw is this cluster of these pages, groups and accounts – a combination of authentic and fake accounts – that were basically being used to drive messaging on behalf of and related to political candidates. They were designed to look independent, but in fact they are working together,” Gleicher said in a press briefing at the local Facebook office in Taguig City.

“They would post about local and political news, they will post about the upcoming elections, candidate views. A lot of the messaging were supporting candidates they were working in behalf of, some would be attacking political opponents of those candidates,” he added.

While political content is not prohibited on the platform, Gleicher said using fake accounts – like in the case of this network – is against their community standards.

“The core hook here is that these groups are using fake accounts. In this context, it’s not just the use of fake accounts, it’s the use of fake accounts in an organized fashion along with groups and pages and other assets to mislead people about the origin of the content they are sharing,” he said.

“Not all of those are fake. One of the things we see in a cluster like this is a mixture of fake and authentic accounts. That could be intentional because it lends more credence to the fake accounts,” he added.

Gleicher stressed that the takedown was not because of the content of the posts but the behavior of those managing the network.

Gabunada has yet to comment on the matter.

Tactic

Gleicher said the tactic used in this appears similar to those of digital marketing group Twinmark Media Enterprises, which was banned on the platform in January also for coordinated inauthentic behavior.

The difference, the Facebook official said, is that the accounts taken down on Friday are connected to a person and not an enterprise.

Content are also mainly political, which he said may be related to the upcoming elections.

“We don’t necessarily analyze the content in this context, but the primary role we see that this network is doing is working on behalf of political candidates. So of course this is going to be related to the upcoming elections,” Gleicher said.

“What we have seen interestingly is that the tactics and techniques that one uses to drive a commercial message can actually be very similar to the tactics and techniques used on a political content,” he added.

Gleicher also noted the utilization of groups to drive the political messaging, which in essence involves fake accounts trying to get members motivated and engaged.

“Chances are the people in those groups believed that these are independent fan pages and fan groups,” he said.

Facebook said about 3.6 million accounts followed one or more of the pages taken down, while another 1.8 million accounts joined at least one of the groups.

Some 5,300 accounts followed one or more of the Instagram accounts that were part of the network.

Data also showed that the network spent $59,000 (around P3 million) for ads paid in Philippine peso, Saudi riyal and US dollars between 2014 and 2019.

Gleicher said they have shared relevant information about the takedown with policymakers and industry partners.

“We are constantly working to detect and stop this type of activity because we don’t want our services to be used to manipulate people,” he said.

“While we are making progress rooting out this abuse, as we’ve said before, it’s an ongoing challenge and we constantly have to improve to stay ahead. That means building better technology, hiring more people and working more closely with law enforcement, security experts and other companies,” he added.

Surprised

Gabunada said yesterday he was surprised with his association to the accounts and pages taken down by Facebook. 

In an interview with ABS-CBN, Gabunada described his association to the accounts as “unfortunate” and surprising. 

“Before kasi Facebook automatically makes you part of the group without asking you. Now they have to give consent. My name is all over the place. This may be the reason why some pages, after they examined, nandoon ang pangalan ko (my name was there),” he was quoted as saying. 

“I was so surprised…I just thought this is all unfortunate na ilagay pangalan ko,” he added.