核心提示：2019年12月20日，美国社交媒体巨头脸谱网发布公告，宣布封杀利用人工智能合成头像照片创办虚假账号进行政治宣传的“法轮功”邪教媒体“美丽日报”网。12月23日，美国头条网（Leadstories.com）登载了该网社交媒体真实性分析师莎拉·汤普森（Sarah Thompson）撰写的封杀效果调查报道，头条网主编艾兰·杜克（Alan Duke）专门为这篇调查报道撰写了一则长篇编者按，指出“法轮功”媒体口口声称要求他人“善”待自己的造假行为，自己却不思悔改，改头换面企图死灰复燃，继续在脸谱网散布反华政治宣传。中国反邪教网现将艾兰·杜克主编的编者按编译如下，同时附调查报道英文全文，以供对技术感兴趣的网民阅读。
美国头条网主编艾兰·杜克（Alan Duke，右）。图源：互联网
数百名人员利用虚假身份在脸谱网上经营着一个外国亲特朗普网络，在他们遭到虚拟世界中的末日式清除三天后，从幸存下来的几十个账号中，我们发现了他们（再次）活动的迹象。这些账号的越南创办者貌似正在修改身份，赋予这些账号新职责，来支撑那些在脸谱网2019年12月20日打击中幸存下来的少数专页和群组。
脸谱网以“参与外国和政府干预”为由，封杀了“美丽日报”（TheBL.com）网。“美丽日报”的一位越南编辑，在致“头条网”的一封电子邮件中承认，他们的任务包括花费“大量资金用于（推送）亲特朗普内容”，以此来支持特朗普总统：
“是的，我们在有关特朗普的内容上花了很多钱，但是，如果您留心的话，我们在揭露共产主义、（宣传）法轮大法之美好以及曝光中国迫害等方面，也花了很多钱。这是我们的主要目标！”
“法轮功”媒体利用人工智能合成照片在脸谱网上创办大量虚假账号。图源：原文
该编辑呼吁人们给予他们“善（待）”，以便“法轮功”信徒可以继续他们的使命：“这些脸谱网专页是我们抗击邪恶和拯救人们的武器，我们一直在努力培育它们。”
虚假账号背后的这些真实人物，并不指望得到“善（待）”。相反，他们正忙着让自己的网络死灰复燃，赋予幸存账号以新面孔，并使用这些账号来管理他们那些脸谱网实施大封杀时漏网的十几个群组和专页。
“法轮功”人员在脸谱上使用的“卡罗琳娜·钱尼（Carolina Chaney）”，已遭脸谱网封杀。 图源：原文
我们曾在《假面孔：并不存在的人入侵脸谱网以影响2020年选举》报道中介绍过的卡罗琳娜·钱尼（Carolina Chaney），在这次脸谱网清洗中未能幸免。但是原名谢丽尔·古拉（Cheryl Guerra）的曾紫薇（Zeng Ziwei，音），其账号则幸存了下来。曾紫薇的个人资料头像，已从照片共享网站UnSplash.com上的头戴帽年轻女子，摇身变为背景为蒲公英的特朗普-彭斯2020年竞选贴纸图片。她还担任了脸谱网“突发新闻”群组（Breaking News）的管理员。该群组在简介中称，“在这里表明我们对唐纳德·特朗普总统的支持”。在其他管理员消失后的第二天，她似乎成为该小组的唯一管理员。
左图为网友Allef Vinicius在图片分享网站unsplash上传的照片（网址：https://unsplash.com/photos/0bWUNgYraHA），后被“法轮功”媒体合成后取名Kathy Crum用作脸谱网头像。图源：原文图片拼合
曾紫薇及其他幸存管理员已停止发布指向“美丽日报”网的报道链接，这些链接已遭脸谱网封杀。取而代之，他们开始发布“美丽日报”相关报道的标题和数段文字，并配以图片。
“头条网”社交媒体真实性分析师Sarah Thompson在脸谱网实施清除行动后，继续深入挖掘“美丽日报”网并撰写了本篇报告。
中国反邪教网小贴士：莎拉·汤普森和艾兰·杜克在这篇调查报告中所提到的“法轮功”媒体在脸谱网“幸存”下来的群组和专页，目前多数已经无法浏览。据分析，应为“头条网”的调查报道登出后，已被脸谱网再次封杀。下为调查报告全文：
The massive takedown of TheBL network ended their ability to make money by driving Facebook traffic to their stories. But they are still trying to rebuild. The post-purge postings on the surviving pages and groups suggest their motivation is ideological and not financial. One the day after the purge, a BL video called "Freedom of Belief" was pinned to the top of two groups, "Breaking News" and "Stand with President Trump 2020." On "USA for President Trump", there was a video to raise awareness about the human rights atrocities of forced organ harvesting in China.
Even though links to the website TheBL.com are no longer allowed on Facebook, they are posting links to articles from other websites: Fox News, Reuters, PBS, Business Insider, Brietbart and the Daily Caller. Since they can't post their own links, they are posting photos and excerpts of the text of their own articles as stand-alone posts without a link. They also post engagement bait memes.
Sixty-six of the StyleGAN face profiles - those synthetic faces we told you about in the story titled Fake Faces: People Who Do Not Exist Invade Facebook To Influence 2020 Elections - and 45 of the flowers and landscapes set remain. An additional 20 we've never seen before, but which were made around December 16 have appeared. There are some profiles that seem to be backed by a real person, and some profiles with names in Chinese that have been moved to the remaining American political groups.
Mitchell Rodgers was the sole admin of the "Breaking News" Group on Saturday, but by Sunday, he had been replaced by Zeng Ziwei. Additionally, the "Keep America Great" page that had been created the day before - December 21, 2019 - had posted only twice and already collected about 500 likes before being deleted late the next day. "Honor the conservative values" is serving as an admin for the group "USA for President Trump", along with the page "President Trump Supporters Only"
There is a chance that some of these scrappy pieces of activity were still animated by some post-scheduling that had been set up before the takedown. Two profiles even ventured out to place some spam posts into the Chad Prather Fans group. But the fact that there are administration overhauls and new pages being made despite the upheaval speaks to some real people on staff trying to salvage what is left.
Before The Takedown: Automated Posting
Many of the fake profiles were installed as administrators in TheBL groups before the purge. They published new articles and posted memes to move and amplify TheBL.com content throughout their network of hundreds of groups and pages. Some reserved profiles were sent out to post memes and links into groups that are not a part of the BL's network. Many of the posts appeared to be automated in a fashion that violated Facebook rules. Here is a collection of three screenshots from the feed of TheBL group, "Stand With President Trump KAG 2020." A group member, when first encountering two posts containing a link to the same article, one after the other, might assume that two people were posting at the same time and hadn't seen the other person's post. The odds of that happening, unless it is a very popular breaking news story, are very slim. For it to happen to the same two people over and over (and in the same order) is a sign that the person tasked with setting up the post-scheduling made a mistake.
Burt Kasey's profile (the female) was one of over 100 network profiles deleted by Facebook in the days leading up to the big takedown. Mulcahy Anne's (the male) posts appeared for several days before the final blackout without an annoying automated echo. Aside from that sloppy scheduling error, the other way that we know for certain these posts were automated is because they have a Postcron tag on them. Postcron is one of many post-scheduling programs a busy social media manager can use to help budget their time and keep things running smoothly. These programs are a great way to manage your own business pages, or for a professional social media management firm to keep the accounts of many clients posting day and night. There is nothing unethical about using a program like this, but using a post-scheduler in conjunction with a fake profile is a clear violation of the terms of service. You can see demos about how Postcron works on their website, but nothing in their demos looks remotely like this:
It appears someone was trying do a bulk upload of article links - and, rather than formatting as individual posts somewhere else, all the links dumped into the same post on their timeline. Over the course of a few days, this profile made eight posts containing over 100 links. That this happened over several days without correction suggests that they were not aware it was happening.
This profile was still standing after the big takedown but finally was removed two days later. Much of TheBL's social media activity is being run from Vietnam, and we might assume that Thanh Le is a real Vietnamese employee. While the person behind the account may indeed be, the profile picture is AI-generated, and that person does not exist. Here is a zoomed-in view of the bangs growing like tree roots against the forehead.
In the past, these third-party post-scheduling programs allowed much more freedom in what types of actions you could perform with them. In August of 2018, Facebook removed the ability to use a post-scheduler to post on personal timelines. This loss may have been softened a month later when Facebook introduced the possibility for pages to join groups and post under their page name. They can do this manually or with a scheduling program. This new system of allowing pages to post in groups may have created the effect of a motivation to make pages that look like personal profiles. The head of Facebook's security policy, Nathaniel Gleicher, wrote about a situation in Honduras involving these fake people-pages back in July. When TheBL would design a page that looked like a person, they also would make a profile with the same name and photo. I found at least eight of these page/profile account pairs. The Wallace Delgado page and personal profile were both installed as administrators in "Trump&Pence 2020 - Making America Great Again". The first time Wallace Delgado appears in the roster, it is a personal profile - note "add friend" is a possibility. The second time Wallace appears, it is as a page in the "community service" catagory.
When you are scrolling through posts in a group, if you hover your cursor over a name, a preview of their timeline will pop up. Hovercards (shown here on the left side of the collage) are an underrated source of information - and one of the only ways you will be able to detect a page designed to look like a person when their post appears in a group feed. A person's hovercard will usually have "add friend", but the hovercard of a page is formatted differently and offers "like, follow, and message."
One other way to see these people-pages revealed is in the member roster of a group. Pages are listed separately between the admins and the members.
Here are seven fake profiles from TheBL network, all with synthetic faces. Except for Elliot, all of these accounts were still live as of late Monday December 23, but they look very different without TheBL content showing up in their timeline. Two of them, Kellan Moore and Aidyn Aguirre, even have the same fake face.
Three accounts were created on December 12, the other four were made on December 7. Within minutes of creation, each account loaded their timeline with a variety of linked articles and memes. On each day, the posts that populated each timeline were the same, and in the same order. Since it is not possible (permissable) to use a post-scheduling program to post to personal timelines, this points to the use of an unauthorized program designed to get around that barrier. That none of these profiles is a real person makes all of this a violation - even if it had been done manually.
There is a cluster of similar accounts that just changed their profile and cover photos in the early hours of Monday, December 23, that also had parallel timelines. This is what they looked like late in the day:
To use one of these scheduler programs on a group or a page, the app must first be connected to the respective group or page, and then it is possible for one person to schedule posts that will automatically be sent out to many groups at once. The groups receiving the post do not need to be owned by the person sending the posts, but they do need to have the app enabled in their group. Maintaining a network of this size would be impossible without some automated assistance. One action frequently used by TheBL profiles was to share posts out of a group to some other destination, frequently their own fake profile timeline - a place not unlike a ghost town.
So why do it?
When a post is shared, Facebook's algorithm takes note, and that post will become more visible to others who might encounter it. A post with lots of artificial engagement will surface to more people than a post that is not getting much attention. It may appear in someone's newsfeed or at the top of a group feed, while other posts from real people drop into obscurity and are never seen. Inauthentic behavior does not only compete against differing viewpoints - it most directly competes with the authentic content and expressions from within that filter bubble. Facebook's design to keep the most engaging and interesting content in front of people has created an incentive for players to cheat.
If a profile is re-posting content from one of their own network's groups, the benefit is very clear. Other times, the benefits may be harder to appreciate. If a member of the public posted some BL content freely into a non-network group where BL spammers were present, the BL spammers would sometimes share those posts back to their timelines. This action had algorithmic and social benefits. Other times, they shared random posts from non-network groups to their timelines - either to amplify the pro-Trump message, or to build in a more natural mix of content to their timeline.
What if a BL spammer was sent out to put posts in a group that was not so friendly to Trump? Here, a synthetic face BL profile reshares the post of one of the patriotic theme BL spammers. Jay is sacrificing space on his uninhabited timeline to hopefully help his teammate's post be more visible in that group. The amplification will not just help the post in that group, but theoretically, everywhere this article's link has been shared.
Here's an assortment of posts that were made by real people in groups where BL spammers were. Just like their counterparts, who were embedded in groups where the president is popular, these profiles are sharing random posts from a public group back to their timeline. Just the names of the groups make quite a statement and stood out when compared with the other BL brand content on the timeline. There was little risk of a real person ever seeing these shares or asking what their intention was. I believe that the act of sharing posts real people had posted was a strategy to build in a variety of authentic-looking actions to their daily tasks to not appear to be a spam-bot.
TheBL profiles also had little regard for the quality of the groups they joined (and possibly were refused by the well-moderated groups). They were found in some of the notorious hotspots for foreign clickbaiters, which resulted in them sharing out some content posted by the spammers of other foreign networks gaming Facebook's audience.
Facebook took action and removed the pages, groups and profiles of TheBL network just days after we provided the data behind our first "Fake Faces" report. Facebook was already working on it with the help of Graphika and DFR Labs. These investigators had carefully been documenting and mapping a multilingual digital publishing empire that stretched around the globe. But from what we have seen in the several days after the takedown, there is more work to be done as TheBL network tries to rise like the a Phoenix from the ashes.
