來 源：
時 間：2019-12-31 20:05:29
美國頭條網(wǎng)主編艾蘭·杜克（Alan Duke，右）。圖源：互聯(lián)網(wǎng)
數(shù)百名人員利用虛假身份在臉譜網(wǎng)上經(jīng)營著一個外國親特朗普網(wǎng)絡(luò)，在他們遭到虛擬世界中的末日式清除三天后，從幸存下來的幾十個賬號中，我們發(fā)現(xiàn)了他們（再次）活動的跡象。這些賬號的越南創(chuàng)辦者貌似正在修改身份，賦予這些賬號新職責(zé)，來支撐那些在臉譜網(wǎng)2019年12月20日打擊中幸存下來的少數(shù)專頁和群組。
臉譜網(wǎng)以“參與外國和政府干預(yù)”為由，封殺了“美麗日報”（TheBL.com）網(wǎng)。“美麗日報”的一位越南編輯，在致“頭條網(wǎng)”的一封電子郵件中承認(rèn)，他們的任務(wù)包括花費(fèi)“大量資金用于（推送）親特朗普內(nèi)容”，以此來支持特朗普總統(tǒng)：
“是的，我們在有關(guān)特朗普的內(nèi)容上花了很多錢，但是，如果您留心的話，我們在揭露共產(chǎn)主義、（宣傳）法輪大法之美好以及曝光中國迫害等方面，也花了很多錢。這是我們的主要目標(biāo)！”
“法輪功”媒體利用人工智能合成照片在臉譜網(wǎng)上創(chuàng)辦大量虛假賬號。圖源：原文
該編輯呼吁人們給予他們“善（待）”，以便“法輪功”信徒可以繼續(xù)他們的使命：“這些臉譜網(wǎng)專頁是我們抗擊邪惡和拯救人們的武器，我們一直在努力培育它們。”
虛假賬號背后的這些真實人物，并不指望得到“善（待）”。相反，他們正忙著讓自己的網(wǎng)絡(luò)死灰復(fù)燃，賦予幸存賬號以新面孔，并使用這些賬號來管理他們那些臉譜網(wǎng)實施大封殺時漏網(wǎng)的十幾個群組和專頁。
“法輪功”人員在臉譜上使用的“卡羅琳娜·錢尼（Carolina Chaney）”，已遭臉譜網(wǎng)封殺。 圖源：原文
我們曾在《假面孔：并不存在的人入侵臉譜網(wǎng)以影響2020年選舉》報道中介紹過的卡羅琳娜·錢尼（Carolina Chaney），在這次臉譜網(wǎng)清洗中未能幸免。但是原名謝麗爾·古拉（Cheryl Guerra）的曾紫薇（Zeng Ziwei，音），其賬號則幸存了下來。曾紫薇的個人資料頭像，已從照片共享網(wǎng)站UnSplash.com上的頭戴帽年輕女子，搖身變?yōu)楸尘盀槠压⒌奶乩势?彭斯2020年競選貼紙圖片。她還擔(dān)任了臉譜網(wǎng)“突發(fā)新聞”群組（Breaking News）的管理員。該群組在簡介中稱，“在這里表明我們對唐納德·特朗普總統(tǒng)的支持”。在其他管理員消失后的第二天，她似乎成為該小組的唯一管理員。
左圖為網(wǎng)友Allef Vinicius在圖片分享網(wǎng)站unsplash上傳的照片（網(wǎng)址：https://unsplash.com/photos/0bWUNgYraHA），后被“法輪功”媒體合成后取名Kathy Crum用作臉譜網(wǎng)頭像。圖源：原文圖片拼合
曾紫薇及其他幸存管理員已停止發(fā)布指向“美麗日報”網(wǎng)的報道鏈接，這些鏈接已遭臉譜網(wǎng)封殺。取而代之，他們開始發(fā)布“美麗日報”相關(guān)報道的標(biāo)題和數(shù)段文字，并配以圖片。
“頭條網(wǎng)”社交媒體真實性分析師Sarah Thompson在臉譜網(wǎng)實施清除行動后，繼續(xù)深入挖掘“美麗日報”網(wǎng)并撰寫了本篇報告。
中國反邪教網(wǎng)小貼士：莎拉·湯普森和艾蘭·杜克在這篇調(diào)查報告中所提到的“法輪功”媒體在臉譜網(wǎng)“幸存”下來的群組和專頁，目前多數(shù)已經(jīng)無法瀏覽。據(jù)分析，應(yīng)為“頭條網(wǎng)”的調(diào)查報道登出后，已被臉譜網(wǎng)再次封殺。下為調(diào)查報告全文：
The massive takedown of TheBL network ended their ability to make money by driving Facebook traffic to their stories. But they are still trying to rebuild. The post-purge postings on the surviving pages and groups suggest their motivation is ideological and not financial. One the day after the purge, a BL video called "Freedom of Belief" was pinned to the top of two groups, "Breaking News" and "Stand with President Trump 2020." On "USA for President Trump", there was a video to raise awareness about the human rights atrocities of forced organ harvesting in China.
Even though links to the website TheBL.com are no longer allowed on Facebook, they are posting links to articles from other websites: Fox News, Reuters, PBS, Business Insider, Brietbart and the Daily Caller. Since they can't post their own links, they are posting photos and excerpts of the text of their own articles as stand-alone posts without a link. They also post engagement bait memes.
Sixty-six of the StyleGAN face profiles - those synthetic faces we told you about in the story titled Fake Faces: People Who Do Not Exist Invade Facebook To Influence 2020 Elections - and 45 of the flowers and landscapes set remain. An additional 20 we've never seen before, but which were made around December 16 have appeared. There are some profiles that seem to be backed by a real person, and some profiles with names in Chinese that have been moved to the remaining American political groups.
Mitchell Rodgers was the sole admin of the "Breaking News" Group on Saturday, but by Sunday, he had been replaced by Zeng Ziwei. Additionally, the "Keep America Great" page that had been created the day before - December 21, 2019 - had posted only twice and already collected about 500 likes before being deleted late the next day. "Honor the conservative values" is serving as an admin for the group "USA for President Trump", along with the page "President Trump Supporters Only"
There is a chance that some of these scrappy pieces of activity were still animated by some post-scheduling that had been set up before the takedown. Two profiles even ventured out to place some spam posts into the Chad Prather Fans group. But the fact that there are administration overhauls and new pages being made despite the upheaval speaks to some real people on staff trying to salvage what is left.
Before The Takedown: Automated Posting
Many of the fake profiles were installed as administrators in TheBL groups before the purge. They published new articles and posted memes to move and amplify TheBL.com content throughout their network of hundreds of groups and pages. Some reserved profiles were sent out to post memes and links into groups that are not a part of the BL's network. Many of the posts appeared to be automated in a fashion that violated Facebook rules. Here is a collection of three screenshots from the feed of TheBL group, "Stand With President Trump KAG 2020." A group member, when first encountering two posts containing a link to the same article, one after the other, might assume that two people were posting at the same time and hadn't seen the other person's post. The odds of that happening, unless it is a very popular breaking news story, are very slim. For it to happen to the same two people over and over (and in the same order) is a sign that the person tasked with setting up the post-scheduling made a mistake.
Burt Kasey's profile (the female) was one of over 100 network profiles deleted by Facebook in the days leading up to the big takedown. Mulcahy Anne's (the male) posts appeared for several days before the final blackout without an annoying automated echo. Aside from that sloppy scheduling error, the other way that we know for certain these posts were automated is because they have a Postcron tag on them. Postcron is one of many post-scheduling programs a busy social media manager can use to help budget their time and keep things running smoothly. These programs are a great way to manage your own business pages, or for a professional social media management firm to keep the accounts of many clients posting day and night. There is nothing unethical about using a program like this, but using a post-scheduler in conjunction with a fake profile is a clear violation of the terms of service. You can see demos about how Postcron works on their website, but nothing in their demos looks remotely like this:
It appears someone was trying do a bulk upload of article links - and, rather than formatting as individual posts somewhere else, all the links dumped into the same post on their timeline. Over the course of a few days, this profile made eight posts containing over 100 links. That this happened over several days without correction suggests that they were not aware it was happening.
This profile was still standing after the big takedown but finally was removed two days later. Much of TheBL's social media activity is being run from Vietnam, and we might assume that Thanh Le is a real Vietnamese employee. While the person behind the account may indeed be, the profile picture is AI-generated, and that person does not exist. Here is a zoomed-in view of the bangs growing like tree roots against the forehead.
In the past, these third-party post-scheduling programs allowed much more freedom in what types of actions you could perform with them. In August of 2018, Facebook removed the ability to use a post-scheduler to post on personal timelines. This loss may have been softened a month later when Facebook introduced the possibility for pages to join groups and post under their page name. They can do this manually or with a scheduling program. This new system of allowing pages to post in groups may have created the effect of a motivation to make pages that look like personal profiles. The head of Facebook's security policy, Nathaniel Gleicher, wrote about a situation in Honduras involving these fake people-pages back in July. When TheBL would design a page that looked like a person, they also would make a profile with the same name and photo. I found at least eight of these page/profile account pairs. The Wallace Delgado page and personal profile were both installed as administrators in "Trump&Pence 2020 - Making America Great Again". The first time Wallace Delgado appears in the roster, it is a personal profile - note "add friend" is a possibility. The second time Wallace appears, it is as a page in the "community service" catagory.
When you are scrolling through posts in a group, if you hover your cursor over a name, a preview of their timeline will pop up. Hovercards (shown here on the left side of the collage) are an underrated source of information - and one of the only ways you will be able to detect a page designed to look like a person when their post appears in a group feed. A person's hovercard will usually have "add friend", but the hovercard of a page is formatted differently and offers "like, follow, and message."
One other way to see these people-pages revealed is in the member roster of a group. Pages are listed separately between the admins and the members.
Here are seven fake profiles from TheBL network, all with synthetic faces. Except for Elliot, all of these accounts were still live as of late Monday December 23, but they look very different without TheBL content showing up in their timeline. Two of them, Kellan Moore and Aidyn Aguirre, even have the same fake face.
Three accounts were created on December 12, the other four were made on December 7. Within minutes of creation, each account loaded their timeline with a variety of linked articles and memes. On each day, the posts that populated each timeline were the same, and in the same order. Since it is not possible (permissable) to use a post-scheduling program to post to personal timelines, this points to the use of an unauthorized program designed to get around that barrier. That none of these profiles is a real person makes all of this a violation - even if it had been done manually.
There is a cluster of similar accounts that just changed their profile and cover photos in the early hours of Monday, December 23, that also had parallel timelines. This is what they looked like late in the day:
To use one of these scheduler programs on a group or a page, the app must first be connected to the respective group or page, and then it is possible for one person to schedule posts that will automatically be sent out to many groups at once. The groups receiving the post do not need to be owned by the person sending the posts, but they do need to have the app enabled in their group. Maintaining a network of this size would be impossible without some automated assistance. One action frequently used by TheBL profiles was to share posts out of a group to some other destination, frequently their own fake profile timeline - a place not unlike a ghost town.
So why do it?
When a post is shared, Facebook's algorithm takes note, and that post will become more visible to others who might encounter it. A post with lots of artificial engagement will surface to more people than a post that is not getting much attention. It may appear in someone's newsfeed or at the top of a group feed, while other posts from real people drop into obscurity and are never seen. Inauthentic behavior does not only compete against differing viewpoints - it most directly competes with the authentic content and expressions from within that filter bubble. Facebook's design to keep the most engaging and interesting content in front of people has created an incentive for players to cheat.
If a profile is re-posting content from one of their own network's groups, the benefit is very clear. Other times, the benefits may be harder to appreciate. If a member of the public posted some BL content freely into a non-network group where BL spammers were present, the BL spammers would sometimes share those posts back to their timelines. This action had algorithmic and social benefits. Other times, they shared random posts from non-network groups to their timelines - either to amplify the pro-Trump message, or to build in a more natural mix of content to their timeline.
What if a BL spammer was sent out to put posts in a group that was not so friendly to Trump? Here, a synthetic face BL profile reshares the post of one of the patriotic theme BL spammers. Jay is sacrificing space on his uninhabited timeline to hopefully help his teammate's post be more visible in that group. The amplification will not just help the post in that group, but theoretically, everywhere this article's link has been shared.
Here's an assortment of posts that were made by real people in groups where BL spammers were. Just like their counterparts, who were embedded in groups where the president is popular, these profiles are sharing random posts from a public group back to their timeline. Just the names of the groups make quite a statement and stood out when compared with the other BL brand content on the timeline. There was little risk of a real person ever seeing these shares or asking what their intention was. I believe that the act of sharing posts real people had posted was a strategy to build in a variety of authentic-looking actions to their daily tasks to not appear to be a spam-bot.
TheBL profiles also had little regard for the quality of the groups they joined (and possibly were refused by the well-moderated groups). They were found in some of the notorious hotspots for foreign clickbaiters, which resulted in them sharing out some content posted by the spammers of other foreign networks gaming Facebook's audience.
Facebook took action and removed the pages, groups and profiles of TheBL network just days after we provided the data behind our first "Fake Faces" report. Facebook was already working on it with the help of Graphika and DFR Labs. These investigators had carefully been documenting and mapping a multilingual digital publishing empire that stretched around the globe. But from what we have seen in the several days after the takedown, there is more work to be done as TheBL network tries to rise like the a Phoenix from the ashes.
