How a Russian disinformation agency managed to get around Meta moderation

While Mark Zuckerberg, the patron of Meta, has just announced the end of the group verification programs (new window)more precise indications emerge on the disinformation efforts put in place to destabilize several European countries on Facebook. According to a checkfirm report (new window)a Finnish company specializing in the fight against disinformation, in collaboration with the Reset Tech organization (new window)and the company Ai Forensics (new window) Investigating on opaque algorithms and digital threats, Meta would have affected at least 330,616 dollars thanks to more than 8,000 advertisements disseminated by Social Design Agency (SDA), a Russian communication company closely linked to the Kremlin, between August 2023 and November 2024, And this, after European sanctions against this company.

This company contributed to the “Doppelgänger” campaign (new window)an operation specializing in the creation of false content to influence European public opinion. The investigation is based on an initial leak obtained by the Delfi media in Estonia (new window) et süddeutsche Zeitung (new window) In Germany, and that the TF1 auditors’ team was able to consult. More than 10,000 documents with internal notes, press drawings, and reports of reports detail how the agency was able to manipulate European public opinion, even though it was under sanction of the European Union since July 2023 . Here’s what is found there.

Stories adapted to the public, bypassing Meta moderation

According to the study published on the CheckFirst website (new window)the analysis could be done thanks to the Meta advertising library, in particular comparing where content, such as 452 false press drawings, had been published. Some of them have even been modified to be adapted to the target audience: for example, a drawing initially created to make fun of American aid in Ukraine has been modified to include a German flag.

Another technique to deceive Meta detection algorithms on duplicate advertisements, the SDA has slightly changed advertisements by adding discreet colored bands. The case is notably visible on a false quotation attributed to the French businessman Antoine Arnault, son of Bernard Arnault, the boss of LVMH. “Through the documents, we have proof that the SDA studies closely and document how regulators and platforms put sticks on the wheels”, Details Guillaume Kuster, CEO of CheckFirst. “To adapt, for example, to new moderation rules, the company constantly deploys bypass strategies. For example, to avoid displaying too clearly a political message which would may be deleted, SDA uses the Soft-Sell technique ‘, that is to say that messages are indirect, more subtle or figurative “.

The disclosed data made it possible to see 480 examples of advertisements with the details of the expenses, the number of people affected, as well as data such as the click rate and the scope of publications. These documents reveal, for example, that the campaigns have generated at least 15 million impressions and 74,000 clicks for the period alone from May to July 2022.

“What was particularly useful for analyzing the cost of these operations are screenshots of an internal interface to the SDA allowing to view the cost of each advertisement”continues Guillaume Kuster. According to the cross data of the three companies participating in the report, Meta has received a total of more than $ 455. 000 dollars following sponsored publications of the SDA network since June 2022. Some publications have been seen by hundreds of thousands of people.

Speed ​​of execution in the face of news and marketing language

A total of 624 Word files are also present in this data leak, where we discover in detail the strategic planning of the SDA. They show in particular how the agency exploits current events with “astonishing speed” according to the report by CheckFirst. He notably quoted two advertisements of October 11, 2023 accusing Ukraine of selling weapons to terrorists two days after the attack by Hamas in Israel. Likewise for an advertisement after the attack on the Islamic State against the Crocus City Hall in Moscow, on March 24, 2024: three advertisements validated on Meta had the hat of the attack to Ukraine brought. “68% of false press drawings are published as advertisements less than a week after their creation”, Add the researchers.

The documents reveal other interesting elements, not known so far, according to Guillaume Kuster. “They show in a striking way that the SDA works exactly as a communication agency: we see how they meticulously analyze the campaigns with a marketing language and an industrial method to react to current events with regular meetings and established processes for Define their target, the story to use and the means they will use to achieve their goals “. The editorial staff of the auditors could notably have seen in one of the minutes of a meeting that SDA employees had themselves baptized “Dopplegänger”, thus reclaiming term yet used by researcher Alexandre Alaphilippe de Eu Disinfo Lab to put The propaganda operation is up to date. “This shows that they need to show the effectiveness of their work to their client. So there is no bad publicity for them, from the moment they can demonstrate that they are talking about them, and So their supposed efficiency ” Adds Guillaume Kuster.

• 

  Read

  “Overload” campaign: a report reveals the extent of the offensive of disinformation prorussian on the media

An example of Meta failures to stem the disinformation

The conclusions of the report are rather amazing with regard to the information already disclosed by Meta: the company has identified the Dopplegänger operation since September 2022 in its reports on “coordinated inauthentic behaviors” (new window). In February 2023, she had even directly linked it to the SDA, confirming a broader ecosystem of foreign influence. Meta reports regularly indicated that it has identified disinformation operations from this campaign, and explained to block certain sponsored publications.

The situation is all the more problematic since on July 28, 2023, the European Union sanctioned the SDA (new window) For its role in the Recentable Reliable Campaign News (new window) (RRN), which involved the creation of false websites imitating European government organizations and legitimate media in order to disseminate pro-Russian stories. Meta has also explicitly referred to these sanctions in one of her latest reports, explaining that he wanted to comply with Digital Service Act (new window)Directive set up since February 2024 to protect European citizens against disinformation in particular.

As long as heavy fines are not imposed, nothing can change.

Guillaume Kuster, PDG De CheckFirst

Thus, the report of Checkfirst indicates “Although Meta has made progress to recognize and disrupt certain aspects of the operation, its repeated approval of advertisements and its acceptance of sanctioned entities payments highlight critical flaws in the application of the rules”. For Guillaume Kuster, it is more than ever the moderation on the platform which is once again to point the finger. “For them, detecting and removing fraudulent publications or advertisements costs money and only reports headaches. It must be remembered that platforms are companies that by definition exist first to earn money. Moderation, compliance with regulations are operational costs.

Contacted by the team of verifiers, Meta referred to her latest report on security threats to her platforms, available here (new window). We can read there that “Meta was the first technological company to reveal the Doppelgänger campaign in 2022, and since then we have investigated, disrupted and blocked tens of thousands of assets connected to this network and their domain infrastructure”. The company stresses that “These campaigns are increasingly difficult to attract audiences and unravel in public discourse”conclusions also made by a Viginum report in France (new window). However, Meta did not answer our questions concerning the conclusions of the CheckFirst report.

Do you want to ask us questions or submit information that does not seem reliable to you? Do not hesitate to write to us at [email protected]. Also find us on Twitter: our team is present behind the @verif_tf1lci account.