how the Ukraine-Russia war is exported to Facebook


Alongside the ground war between Ukraine and Russia, a real information war is being played out online, and Facebook is one of the many battlefields. On the occasion of its quarterly report on the threats it has countered, Meta (Facebook’s parent company) detailed certain maneuvers resulting from the conflict which affected its main social network.

On Facebook, it is also Russia and its allies, renowned for their ability to manipulate public opinion, who take on the role of attackers, between attempts at espionage, disinformation and hacking.

Presidential 2022: is the election properly protected against misinformation?

Block misinformation

To recognize destabilization operations, the social network strives to detect “inauthentic coordinated behavior”, one of the major challenges of its moderation. Concretely, the platform tries to distinguish the movements of opinion generated by its users, from those whose magnitude is artificially increased by robots, hacked accounts or advertising. It thus banishes what it calls “networks”, sets of dozens of highly followed accounts and pages that act in a coordinated fashion.

For example, on February 24, the day of the Russian invasion, Facebook dismantled an influence operation initiated by Belarusian intelligence. The latter disseminated false information in Polish and English claiming that Ukrainian troops were surrendering without a fight and that the leaders had fled the country. The objective: to undermine the morale of Ukraine’s supporters and to support Russian propaganda according to which Ukraine was waiting for its “liberation” by Russian forces. Meta also specifies that it has blocked attempts to create an account by members of theInternet Research Agency (IRA), the powerful Russian propaganda outlet, which she had already banned following previous attempts in 2020 and 2021.

Last disinformation tool dismantled by Meta in the last quarter: a mass reporting network. More than 200 accounts were coordinated to artificially flag thousands of war-related posts that misrepresented Russia and have them removed by Facebook. “Surely in an effort to evade detection tools, the people behind this mass reporting activity were coordinating their efforts on a ‘cooking’ themed group, which had 50 members when we dismantled it“, specifies the platform. The challenge for the social network here is not to let these maneuvers trap its automatic moderation tools.

Hacking attempts

In the cyber world, who says state involvement, says involvement of one or more APTs (advanced persistent threats). These divisions of hackers, attached more or less closely to a State, have geopolitical objectives (theft or destruction of documents, espionage, manipulation), where cybercriminals seek financial interest.

Facebook thus identified the activity of Ghostwriter, linked by Mandiant company reports to the Belarusian and Russian governments. Accustomed to targeting countries bordering Russia such as Poland, the group always acts with the aim of instilling mistrust vis-à-vis NATO. Its modus operandi consists of compromising email addresses in order to recover access to the social networks linked to them. It targets the defence, energy, telecoms and media sectors. On February 27, Meta identified Ghostwriter’s targeting of Ukrainian public figures in an attempt to post a fake YouTube video on their social media showing Ukrainian soldiers waving the white flag. “We have blocked these videos from being shared“, says the platform.

If for the social network, the line of moderation is easy to draw on these abusive behaviors, it becomes much more delicate on diplomatic questions. For example, Russian official accounts – like that of the French embassy – continue to deny the massacre by their army of Ukrainian civilians in the city of Boutcha, despite the multiplication of evidence, without their messages being limited. In addition, to continue to control its version of the facts, the Russian government has banned Facebook and Instagram from its Internet.