Pro-Russian Disinformation Outlet Evades Facebook Ban

23rd November 2021

By Elise Thomas

ISD’s recent investigation into pro-Russian disinformation reveals that News Front, a well-known propaganda outlet subject to US sanctions and supposedly banned from Facebook, has been able to resume many of its operations on the platform.

Strikingly, News Front has done this without any significant changes in their tactics. This raises questions about how meaningful Facebook’s bans really are, and whether Facebook’s ongoing efforts to enforce its own policies are working.

_________________________________________________________________________

News Front is an organisation based in Russian-occupied Crimea which publishes articles on a range of political, economic and social topics in multiple languages. It has been repeatedly identified as a source of pro-Russian propaganda, and earlier in 2021 was sanctioned by the US Treasury for its role in spreading disinformation.

News Front’s use of Facebook has formed a key pillar in their strategy for disseminating their propaganda. After several years of success on the platform, News Front’s operation was finally removed by Facebook in April 2020 for violating policies on coordinated inauthentic behaviour.

News Front uses mirror domains to evade its Facebook ban

However, in early 2021, investigations by ISD, the Alliance for Securing Democracy and EUvsDisinfo exposed News Front’s continued and active presence on Facebook. Each of these investigations found News Front was circumventing Facebook’s bans through relatively basic tactics – most notably through the use of mirror domains.

So, what is a mirror domain and how does it work? When an organisation like News Front is banned from Facebook, the platform prevents users from sharing links to that organisation’s website. A simple trick which many actors (both political and commercial actors such as spammers) use to get around this is to create a ‘mirror domain’. This is a website which presents all of the same content as the original site, but has a different domain name.

For example, the original domain name for News Front’s Spanish language content is es-news-front.info. After News Front’s initial ban from Facebook, this link could not be shared by users. However, what the investigations in early 2021 found was that News Front was instead sharing links to novedad.info. When Facebook users clicked on these links, they were taken to a site which was more or less identical to es-news-front.info. After the reports from ISD and others were released, Facebook also blocked links to novedad.info.

ISD’s most recent report, ‘What’s new (and What’s not) with News Front’, now reveals that News Front has simply shifted to sharing links to novedad-news.info, continuing to operate more or less exactly as before. The same is true for most of the other languages in which News Front publishes, using a total of eight mirror domains.

Based on CrowdTangle data, ISD found that between 1st January 2021 to 11th July 2021, links to these eight mirror domains were shared 6,423 times on Facebook. Notably, while mirror domains exist for English and German language content, these did not appear to be being publicly shared on Facebook at the time of analysis.

ISD found that a small number of accounts were systematically sharing News Front articles into specific Facebook groups, including Putin fan groups; conspiracy groups; and anti-imperialist, anti-colonialist, and fringe political groups. The accounts sharing these articles appear to belong to News Front editors or employees. Again, these are the same tactics, and in many cases even the same target groups, as in News Front’s operations that were removed earlier in the year.

News Front tailors its pro-Russian narratives to regional audiences

News Front’s renewed efforts also seemed to be amplifying different narratives in different regions, tailoring their content for regional audiences. For example, while much of the Francophone content focuses on European issues and Ukraine in particular, the Spanish-language content often emphasises narratives about Russia’s cooperation with China in Latin America.

News Front’s Francophone team have been especially busy: ISD found a Facebook group called ‘Contre l’occupation américaine de l’Ukraine’ (‘Against the American occupation of Ukraine’) and a page ‘French-News’, both of which appear to have been created by News Front France. In fact, the ‘French-News’ profile image openly states as much.

Neither the group nor the page have gained a significant number of followers. However, the willingness to flaunt connections to News Front underscores that the outlet is not overly concerned about their accounts being detected or removed by Facebook moderators.

The bottom line? – Facebook is failing to enforce its own bans

Policies are only as meaningful as their implementation. In its regular reporting on coordinated inauthentic behaviour, Facebook states that it engages in ‘continuous enforcement’ efforts to keep known bad actors off its platform. From the outside, it is difficult to make an assessment of what this entails in practice.

However, News Front’s repeated return to the platform – despite little if any innovation in its tactics – raises significant questions about the effectiveness of Facebook’s methods for continuous enforcement, and whether the platform is dedicating sufficient resources to enacting its own policies on bad actors in the long term.

Elise Thomas is an OSINT Analyst at ISD. She has previously worked for the Australian Strategic Policy Institute, and has written for Foreign Policy, The Daily Beast, Wired and others.