EXCLUSIVE: Anatomy of a Russian Facebook Hoax

On September 6, 2017, Facebook acknowledged that over 10 million Americans had been served ads by a troll farm in Russia in an apparent attempt to influence our presidential election. The operation was massive: over 470 separate Facebook pages were used, 10 million Americans were reached, and over $100,000 was spent by the troll farm known for disseminating Russian propaganda.

But to date, Americans have been given very little information about these ads. As the Wall Street Journal reported,

Facebook has said little about the approximately 5,200 ads, which mostly centered on hot-button social and political issues like immigration and race relations. Facebook declined to say what the ads looked like, how many people they reached or who the targets were.

In response. Representative Adam Schiff, the top Democrat on the House Intelligence Committee, tweeted:

We agree, and present to you our findings, the first detailed history of what these accounts looked like, the types of ads they displayed, and who they targeted.

From New Jersey to A Russian Troll Farm

In the time since Facebook announced that Russian trolls had infiltrated its platform, much has been said about the accounts that were used. In all, Russia utilized 470 distinct Facebook pages, a massive undertaking by any standard. But answers to how Russia gained access to these 470 pages have largely centered around a single methodology: creating a Facebook audience from scratch.

The New York Times reported, for instance:

There was “Defend the 2nd,” a Facebook page for gun-rights supporters, festooned with firearms and tough rhetoric. There was a rainbow-hued page for gay rights activists, “LGBT United.” There was even a Facebook group for animal lovers with memes of adorable puppies that spread across the site with the help of paid ads.

But if Russia utilized 470 different small accounts to stay under the radar, we would expect them to have utilized a broad range of techniques to do so. Indeed, our investigation discovered that Russia did not limit themselves to creating fake new accounts, but far more nefariously, took over or hacked legitimate existing accounts.

Blue Crest Riding Center, Long Valley, NJ

Our story begins in a place you wouldn’t expect: Mendham Township, New Jersey, in the midst of Hurricane Sandy.

On October 31, 2012, New Jersey was being battered by Hurricane Sandy, the deadliest hurricane of the 2012 season. Sadly during the hurricane, a couple named Richard & Elizabeth Everett were trying to drive home when a 100-foot tall tree fell on their truck. The Everett’s became 2 of 117 tragic lives taken by Hurricane Sandy.

The couple had recently opened the Blue Crest Riding Center in Long Valley, N.J. in March 2012. After their death, the business was closed.

But that’s where this story takes an odd turn.

As most businesses do these days, the 7-month old Blue Crest Riding Center had a Facebook account. It is not clear how Russian hackers accessed the account, but what we do know is that four years later, shortly before the 2016 election, Blue Crest Riding Center’s Facebook account came back to life.

While the account, as well as it’s content, has since been removed by Facebook, Policulous was able to obtain historical archives of the original ads, as well as the demographics they were targeting.

Pre-Election Ads

On October 20th, 2016, the Blue Crest Riding Center Facebook account came to life after 4 years of dormancy. It posted a pro-Trump paid advertisement. The advertisement lasted only one day, and targeted young males exclusively between the ages of 18 and 24.

Next on October 28th, 2016, again for only one day, and again targeting exclusively younger men, the Blue Crest account paid for this ad:

By 2016 election standards, both ads were relatively benign. But Blue Crest was just getting warmed up.

Over the course of the next week, between October 30 and November 7, 2016, Blue Crest’s Facebook account promoted an array of anti-Clinton Facebook advertisements. Some of the information disseminated in these ads was true, some was fake. All had the goal of defaming Hillary Clinton.

The 5 pre-election ads which ran the week before the election can be seen below: 

Election Day: Denzel Washington Fake News

These advertisements ended on election day, November 8, 2016, in a sinister way.

On the day of the election, Blue Crest’s Facebook account sponsored an advertisement announcing that Denzel Washington had endorsed Trump. Snopes demonstrated the claim to be fake, but the ad accumulated 2,700 likes on Election Day.

Post-Election: France, Germany & Sweden

That might have been the end of the story, and for nearly 3 months after the election Blue Crest Riding Center’s Facebook account went dormant.

Then on January 30, 2017, the account came back to life once again, advertising a racially-tinged, anti-immigrant post about Somali immigrants in Germany.

A week later, on February 5, the account posted a graphic anti-immigrant video entitled Paris At War, claiming to show “Migrant gangs at war with police and locals.” The violent ad was viewed 6.8 million times on Facebook, and targeted men exclusively.

Two weeks later, at a Conservative Political Action Conference, Trump described Paris, Germany, and Sweden as prime examples of immigration gone wrong.

As for Sweden, on February 20, 2017 Trump baffled reporters by referring to violence in Sweden. As the Swedish Prime Minister noted, there had been no violence in Sweden. But when 2 days later, perhaps as a response to Trump’s comments, immigrant violence did break out in Sweden, the Blue Crest Riding Center Facebook account was there to bring attention to it.

First, on February 22, 2017, the Blue Crest Riding Center account promoted the below fake news post.

As Snopes has reported, the picture shown above does not depict civil war in Sweden, but rather came from a Russia Times tweet “taken during a 2013 fire at a recycling center that was entirely unrelated to their stories.” Moreover, the fake news article was written and published in November 2016, not February 2017.

That same day, demonstrating an apparent indifference to truth or fact, the Blue Crest account promoted a second ad regarding violence in Sweden, this time real:

In both instances, as with all instances we found of violence being promoted through these advertisements, the target was exclusively younger men.

Trump’s Voter Fraud Allegations

The second theme we found with post-election advertisements taken out by Blue Crest Riding Center’s account involved immigrant voter fraud.

On February 10, 2017, President Trump revived his voter fraud allegations, stating that he lost New Hampshire because thousands of Massachusetts residents were bused to NH to cast ballots for Clinton. Much has been written about the allegation and Trump’s seeming obsession with using voter fraud as an excuse for losing the popular vote. 

Interestingly, 4 days after Trump made these comments on February 14 2017, the Blue Crest Riding Center’s account buttressed his claims by promoting the below Facebook ad.

The target? Again young males between the ages of 18 and 24.

A week later, on February 23 2017, the account took out another ad along the same lines. Note that in both cases, the account was promoting real, not fake, news sites.

This was the final Facebook advertisement taken out by Blue Crest Riding Center. The account has since been shut down, and all content removed.

Final Analysis

Our analysis of The Blue Crest Riding Center account makes certain facts clear.

First, Russia’s Facebook meddling was highly sophisticated. They not only knew how to hack the dormant account of a deceased small business owner in New Jersey, but operated 469 additional accounts beyond Blue Crest’s.

Second, they not only knew that their target should be younger men, Trump’s base, but they had the technical sophistication to know how to target that audience on Facebook.

Third, they were savvy in how they operated the accounts. Rather than using a single account, the Russians used 470 smaller accounts, enabling them to stay below the radar. Furthermore, each advertisement linked to a different news site, and they alternated between promoting fake news and real news.

Last, the Facebook account used by Russia was in perfect sync with Trump’s public messaging after the election. When Trump focused on immigration in France, Germany, and Sweden, the Russian Facebook account focused on immigration in France, Germany, and Sweden. When Trump talked about domestic voter fraud, the Russian Facebook account focused on domestic voter fraud.

We hope to learn more in the months ahead. In the meantime, the Blue Crest Riding Center’s Facebook account, as well as it’s content, has since been removed by Facebook.