Ben NimmoVerified account

One of the most interesting aspects was the way this network, which we call #OperationFFS, used AI-generated profile pictures. Interesting, but remember: the network sent up many signals of fake behaviour. It takes a lot more than a fake profile pic to hide a fake campaign.pic.twitter.com/fy3Tzj4fqV

(#OperationFFS stands for "Fake Face Swarm", incidentally. Thanks for asking.)pic.twitter.com/IjexRObnAr

There's a lot in this set: assets around the world in English, Spanish, Chinese, Portuguese, Vietnamese; feelgood content, anti-China content, pro-Trump content. But takedowns are about behaviour not content, so here are a few main points.pic.twitter.com/kQrBeEQDEx

A ton of groups and pages - over 80 of them - posed as pro-Trump American patriots. They almost exclusively shared content from TheBL. But page transparency is a great thing. Most of the managers across those pages were in Vietnam.pic.twitter.com/5SCduzJEWG

There were groups and pages focused on Taiwan, Hong Kong and China, too. A lot of them were managed by the same admins, grouped into clusters. (H/t @realShawnEib for the mapping.)pic.twitter.com/TmLsOc0LN1

And a similar pattern in the US-focused ones. Dense cluster, same admins across lots of different groups.pic.twitter.com/d1hihUIpIB

What's interesting in the US groups, which were all variants on a theme of pro-Trump messaging and TheBL content, was the faces of the admins. They were AI-generated. How can you tell? Well, human faces tend to asymmetry. Glasses, not so much.pic.twitter.com/lVIyiNaZG2

Here's the close-up of the two halves. Spot the difference.pic.twitter.com/5EqVOIEmF0

Turns out earrings are difficult, too.pic.twitter.com/2Ihw8db488

Again, here's the closeup. There's no rule that says earrings have to match, of course, but the blurriness and general effect are telling.pic.twitter.com/JbkMWQdhDx

Perhaps counter-intuitively, backgrounds are even harder, because there's more variation in scenery than there is in faces.pic.twitter.com/mWtwRfjwBt

Always worth looking at the background on pics like this, in fact.pic.twitter.com/k1aBp9mvL7

There were a lot of pics like this. Dozens at least in the accounts we looked at, both admins and members of groups.These are a sample.pic.twitter.com/odJom00GpI

Fun trick that works for now, though I guess the AI will evolve pretty fast: see what happens when you make all 40 opaque and superimpose them. Note how the eyeballs line up? (H/t @conspirator0 and @ZellaQuixote for the idea)pic.twitter.com/tdAIK69C4n

But I'll say again, it takes much more than fake faces to hide a fake operation. There were other indicators of fakeness too. These were all admins on the same group. All uploaded their only profile pics in the space of an hour.pic.twitter.com/sqIG22bjcE

These were the clustered admins on the China-focused assets. Ten admins, all with profile pics taken off the web - often from Vietnamese sites.pic.twitter.com/R4zGGtJNFH

These were another cluster. Note the sources, and...pic.twitter.com/xX7d3ipbHj

... note how they all uploaded different profile pics at first, in a batch in September, and then changed in a batch on November 4.pic.twitter.com/SslBvRX7fS

Here's the coordinated bit in action. Same post from TheBL, different admins, different groups, all in just over an hour.pic.twitter.com/rpduXQErTx

Even with AI-generated profile pics, somebody thought it would be a good idea to reuse them.pic.twitter.com/XYAQP888w4

It wasn't just activity on Facebook. There were at least some Twitter assets too. Some looked like spam retweeters, amplifying posts from @TheBLcom and @TheBLNews. They are no longer with us.pic.twitter.com/4BRCPaQTBI

And there was this interesting YouTube channel. It posted three videos, two of them advertising TheBL, the third one showing President Trump insulting journalists. Three videos, 15 responses, 51 subscribers. And 1.8 million views.pic.twitter.com/roFdpQAOxS

Oddly, that may not all have been organic.pic.twitter.com/kGySBi8gz2

Some of this activity was demonstrably automated, using Postcron on both Facebook and Twitter. Note the profile pic for "Davidson Susan", too.pic.twitter.com/ZnKI3LrxsX