A Network of Lies on Facebook How To Fake Friends and Influence People

A network comprised of hundreds of fabricated Facebook profiles disseminates political propaganda and also coaxes real users to reveal as much about themselves as they are willing. The social network appears to be impotent in its response to the professional saboteurs.

Alice Bergmann lives in Chemnitz, Germany, and apparently has a problem with Islam. She had to overcome a tremendous blow a few years back when her sister Elizabeth was brutally murdered in a Berlin park. Both of the perpetrators were immigrants.

“I have a lot of hatred inside me, a lot of anger, I know that this wound will bleed forever,” Bergmann wrote in a post on Facebook in 2015. She’s been fighting against immigrants on the front lines ever since, including at her job at the Federal Office for Migration and Refugees (BAMF). One Facebook friend praised her post, writing: “For loyalty to your murdered sister, that’s the best you can do!”

Bergmann's opinions, though, are not completely one-sided. On the one hand, she detests Turkish President Recep Tayyip Erdoğan and Islam, but on the other, she loves Turkey, Turkish tea and Istanbul. And it’s not as if all of her Facebook postings are political. Bergmann is a fan of Leonardo DiCaprio, she supports animal welfare and she enjoys football, especially Bayern Munich and the German national team.

She also maintains close contact on Facebook with her cousin Helena, a model and artist who works at an art academy and seeks to raise awareness about the abuse and murder of women at the hands of immigrants through her art. In her profile, she writes that women are “murdered by immigrants in many cities of Germany.”

Bergmann also keeps in close touch on the platform with her brother David, who has been concerned about her safety since one of Elizabeth’s murderers swore at his trial that “Alice will also die. … I swear I’ll come back for (her).” That, at least, is what David wrote on his Facebook profile.

Photos on Facebook also suggest that the three have met up personally to commemorate the deceased sister. One post notes that they go on trips together to try to distract themselves from sadness. They also engage with a lot of other Facebook users online, sparking lively debates on issues like immigrants and the German government’s asylum policies.

There’s only one problem with the Bergmann’s tragic story: The family doesn’t exist.

No sister ever died and there was never a meeting of surviving family members. The photos on the profile are not of Alice Bergmann, but of a Chilean actress named Josefina Montané. The family only exists virtually.

The phantom Bergmanns are part of a large network of fake profiles on Facebook that a team of DER SPIEGEL reporters uncovered over the summer while researching suspected cases of right-wing extremism inside the German security authorities.

Initially, the team came across the profile of a man that seemed authentic enough, but the subsequent analysis of likes, posts and friends revealed that the man in question wasn’t a real person. Working together, DER SPIEGEL and the Digital Forensic Research Lab  (DFRLab), a unit of the American think tank Atlantic Council, were able to identify profiles from over 30 countries that communicate in different languages. The profiles originate from Germany, the United States, France and Russia. Although difficult to detect at first, none of the profiles are real – they’re all fabrications. Over a period of several months, DER SPIEGEL and DFRLab analyzed and assessed the activities of 330 profiles.

Facebook, which claims it currently has 2.45 billion active users per month, has had a massive problem with fake accounts for years now. From January to September 2019 alone, the company discovered and deleted around 5.4 billion fake profiles. Many of these profiles are clumsily designed and easy to detect due to the lack of interaction on the site. Others are more elaborately constructed. Facebook has also recognized the problem. In addition to new software that can automatically detect fake accounts, the company has also set up a team of experts that has been tasked with investigating the more complex networks. “We try to remove as many fake accounts as we can while removing as few authentic accounts as possible”, a company spokeswoman told DER SPIEGEL.

The fake friends can be used by their creators for a number of things, including exerting political influence. A few years back, Facebook made headlines around the world after Russian operatives tried to use the platform to influence voters during the 2016 U.S. presidential election. The operatives deployed manipulated advertising in addition to fake profiles as part of the campaign.

Private security companies and governments around the world are using Facebook accounts to launch covert political campaigns or conduct other operations aimed at exerting influence. It’s also possible that the network built around the Bergmann family could have been created for these purposes.  

Real users can also become victims of hacking attacks launched from the fake accounts, which can use malware hidden in images or other files and sent in private messages. This can enable them to infect computers surreptitiously, and even control them remotely.

“In order to have active fake profiles, one needs to make them look as real as possible by making them act like real users that are connected with each other, have photos and send private messages,” says Michael Fire, assistant professor of information technology at Ben-Gurion University of the Negev in Israel. He says the market for these profiles has grown into a multimillion-dollar business and that this has not been lost on Facebook officials. “There is a cat and mouse game between social network operators and the fake profiles operator,” he says.

The network uncovered by DER SPIEGEL has been active since at least 2011. Many of the accounts include a wealth of detailed biographical information, including résumés and employers. Most of the fictitious personalities purport to work for the military or law enforcement agencies. Others claim to work in the tourism, aviation, art and fashion industries.

Photos of alleged friends in the network have been edited to varying degrees of quality. Many have a red tint and intense color saturation that suggests poor color correction. Others have white borders, indicating they’ve been cropped. Some are mirror images or include additional graphics, like flowers or lettering. The photos originate from a number of different sources, including press photo databases, modelling and acting agencies, YouTube videos and other social networks like Instagram.

The individuals in the fake profiles seem real because they appear to maintain social relationships with each other. There are friendships that span national borders, declarations of love, everyday debates and even family members who purportedly hate each other. As in real life, the relationships and conversations can be marked by jealousy, mental illness, strokes of fate, but also great personal successes. At times, the fake interactive network feels like a gigantic soap opera.

Among the profiles claiming to be from Germany is that of Georg Schönfelder Römmer of Berlin. His Facebook account was the first to attract the reporters’ attention during their research into right-wing extremist activities this summer.

DER SPIEGEL 5/2020
Foto: Pascal Kerouche/ Universal Music

The article you are reading originally appeared in German in issue 05/2020 (January 25, 2020) of DER SPIEGEL.

Schönfelder Römmer has an impressive résumé, and he doesn't shy away from sharing it with the public. His profile states that he was born in the city of Cottbus and that he's worked in positions with the police in the state of Lower-Saxony, as a member of the GSG 9, an elite unit with the German Federal Police, and as an officer in the German armed forces’ elite KSK force. In the event of major law-enforcement operations, Schönfelder Römmer likes to share photos of the deployment that make it look as though he’s live at the scene – like the day of the mass shooting that took place in Munich in 2016 or the terrorist attack on a Berlin Christmas market the same year. What he doesn’t disclose it that the photos have been borrowed from media reports and were not taken by him.

When Schönfelder Römmer isn’t “on duty,” he's busy publishing hateful tirades against German Chancellor Angela Merkel, immigrants and Islam. It’s the same mix of racist slurs you see time and again on social networks: "Erdoğan, mass rapes and packs kicking people in the head. Parallel societies, Salafists and suicide bombers. Muslims, Muslims, and more Muslims. I’ve had enough of it. I want a Germany without Muslims," writes the alleged KSK soldier.

Facebook Political Posts

Hate and Veneration

In one 2016 post, full of mistakes in German, he urged people to participate in a right-wing extremist march in Berlin. "The German people, determined and ready to take action, are making history today," he wrote. Most recently, he commented on the left-wing riots on New Year's Eve in Leipzig, which made headlines across Germany. "Do all the ticks and do-gooders have a similar video with right-wing extremists or Nazis at their disposal?” I mean, I’m just saying, because the greatest danger is supposed to come from the right, isn’t it?”

But the hub of this network of fake profiles is a man allegedly named Robert Gautier. Photos of the man, who is under 30 and supposedly French, lend a sophisticated image. Most show him with a well-groomed stubble. The profile claims he works as a model for Armani, but most of his time is allegedly spent pursuing a different vocation: traveling to crisis hotspots around the world on behalf of a large, commercial law firm in Paris.

Gautier apparently heads to wherever the world's press is currently looking. In early 2017, he purportedly accompanied Ukrainian armed forces in the battle for Donetsk in eastern Ukraine. When Hurricane Harvey flooded Houston several months later, Gautier was once again allegedly Johnny-on-the-spot, filing reports complete with photos. In his profile, he claims he was kidnapped and tortured by members of Islamic State in Syria in 2018, only to be rescued and liberated by the Turkish military two weeks later.

Since then, photos of war and crimes in the region have been posted to the Gautier profile. The posts are pro-Kurdish and pro-Russian in nature. An “open letter” to an immigrant is also posted on the profile asking why young men come to Europe, why they don’t flee to countries that conform to “your region,” like Saudi Arabia or Qatar? Soldiers, policemen and lawyers engage in heated discussion about global political happenings under the photos and texts posted on the account. Many of those commenting are also fakes that don’t exist in real life.

It also features comments about Alice Bergmann, the woman from Chemnitz mourning the loss of her sister. But in this digital soap opera, she’s portrayed as Gautier’s stalking ex-girlfriend, hated by some of his friends and defended by others. It’s just like real life.

The vast majority of the profiles featured in the fake network show photos of women and men who adhere to current beauty ideals. They often look like scenes from ads – the women tend to be between 20 and 40 years old and post selfies in bikinis; and the men, who are around the same ages, are athletic and muscular. The tone is generally friendly, with friends sending each other kiss and heart emojis.

There’s also a dark side to the profiles, though, as they pursue a hate-filled agenda. The fake profiles are used to disseminate racist posts, while at the same time venerating people like Vladimir Putin and Donald Trump. When political issues are addressed, the tone can quickly get nasty. Merkel, former U.S. President Barack Obama and French President Emmanuel Macron are among the declared enemies. The German chancellor is depicted with blood on her hands and disparaged as a murderer. One picture shows Macron’s face superimposed on that of "Star Wars" villain Darth Vader and another image, with clearly anti-Semitic tones, depicts him as a “Rothschild Bilderberg Gangster.” Obama is defamed as a “child killer” and “war criminal.”

At the same time, the fake profiles hail Russia’s president as “great tsar Vladimir,” whom they portray as being an exemplary statesman and the man who took down Islamic State. A photomontage posted on the Bergmann profile shows Putin in a superhero costume. In a comment, a Facebook friend writes, “Sanity prevails with Captain Russia.”

The direction of the accounts has changed repeatedly over the years. In some cases, the profiles were altered completely, with women becoming men and vice versa. In the beginning they generally featured links to music videos on YouTube and the postings were harmless, but political issues were thrown into the mix over the years. The Kurdistan issue has been dominant since 2018 on several profiles, although the political slant is explicitly pro-Kurdish.

The profiles include a lot of emotional photographs and comments relating to major events such as the recent brush fires in Australia, hurricanes in the U.S. and terrorist attacks like those in Orlando, Brussels or Paris. There are often lengthy political debates in the comment areas.

The fake profiles are members of hundreds of Facebook groups that provide an inexhaustible source of photos and stories. They’re tapped as raw material for creating the profiles. Sometimes, they seem less authentic. Some of the discussions in the comments areas seem like first attempts by poorly programmed bots to automatically generate posts. Others look like bad online translations.

The network’s real power comes through its contacts with genuine Facebook users, though it's unclear exactly how many of these contacts have been established. One of the largest profiles has almost 1,600 followers, meaning the total figure could be in the tens of thousands. Among them are many who claim to be employed in politics, medicine, the military, as police officers, journalists, lawyers, psychotherapists, investment advisers or at Facebook itself. The point appears to be getting as many influencers as possible as friends who can then broadly spread the messages coming out of the network of fakes. But the friends linked to the profiles also include artists and others working in creative professions.

“It's possible the fake profiles establish contact with real people in order to identify potential victims,” says IT security expert and hacker Marco Di Filippo. “These could, for example, include people who are lonely or who are open to talking. People who reveal a lot about themselves are later easily compromised.”

Over the course of several weeks, DER SPIEGEL contacted real friends who were in contact with the fake network. Many refused to answer or declined to speak about it. Others only had contact for a brief period of time. One man, who we'll call Sebastian Müller, provided DER SPIEGEL with an in-depth account of his interactions with Helena Bergmann, the cousin of Alice Bergmann.

Müller no longer remembers exactly how the Facebook connection with the art admirer originated. He has been searching online for a relationship for quite some time. "I am constantly confronted with fake profiles – from Africa, from Ukraine, from Russia," he says -- to the point that he has developed a sense for when a profile is real. "But these fake profiles are getting better all the time," he says. "The people behind them are really smart." Müller says he has a golden rule: Never send money. He has heard stories of men sending money to their online acquaintances to help pay for a visa or for a trip to come visit.

Müller was certain that the phony Helena Bergmann wanted a relationship with him. She told him she was the single mother of a young daughter and even sent a picture of the girl. "A lovely blond girl, but with a really sad look on her face that I found shocking," Müller recalls. One day, he says, he invited his Facebook friend to his parents' house in the mountains, suggesting that they go for a hike and get to know each other better. But Helena Bergmann never came. Müller says he still doesn't know what she wanted from him.

He also experienced Helena Bergmann's political side. Müller says she told him that someone from her family had been murdered and that the political situation in France made her "want to puke." That, Müller says, was around the time of the terrorist attack on the satirical publication Charlie Hebdo in Paris, which killed 12 people. "I do not want to hear anything about the Muslims, how they reproduce, how rats are invading the world," Helena wrote at the time in a message to Müller.

DER SPIEGEL was also able to take a look at the chat protocols of a man who exchanged private messages over the course of four years with Alice Bergmann. The first messages were from the early days of the network, a time when political issues didn't play such a prominent role. Alice Bergmann is a rather depressive character, a woman who has had trouble accepting her sister's death. She repeatedly heaped pressure on her chat partner, accusing him of not showing enough love and of not being romantic enough for a relationship.

When her chat partner asked if they could meet up somewhere in Germany, she was stand-offish. The exchange came to an end after four years, a period during which the man had revealed many intimate details to her, including personal setbacks, places he had visited and opinions on certain issues. She also asked him to send pictures of his apartment. Indeed, it seems likely that the virtual flirtation was intended as a way of spying on real people.

But why such a huge effort? And who is behind this professionally orchestrated fictitious world? According to Michael Fire, the IT expert from Israel, there are a variety of reasons for why people or companies would manage such profiles. All of them, though, he says, are aimed at collecting as much data as possible. "They can be used for collecting personal data, for trying to influence people's opinions, for research, for advertising, for spreading viruses, for scams and even for law enforcement," Fire says. The network analyzed by DER SPIEGEL and DFRLab could have been used for almost all of those purposes, or several at once.

It is only rarely possible to determine who is behind such networks. It is difficult to obtain "100 percent confirmation about who is actually running a malign information campaign," says Nika Aleksejeva, a DFRLab researcher who participated in the analysis of the profiles discovered by DER SPIEGEL. But, she adds, it is possible to "narrow down the list of suspects."

Early on in the analysis of the network, clues were found that hinted at a Spanish-speaking country of origin. The operators of the complex network made several mistakes: Accounts of people who allegedly only spoke German, English or Russian included Spanish-language entries on their Facebook profile's info page, for example.

It became much clearer once the initial network postings from 2011 and 2012 were examined. At that time, all of the accounts were using Spanish, and many of the comments included the abbreviation "TKM," short for the Spanish phrase "te quiero mucho," or "I love you a lot."

Many of the fake friends initially posted from Santiago de Chile and some of them listed Chile as their country of residence. Alice Bergmann also wrote in several private messages that she lived in Chile. The mobile phone number that Alice used to communicate with real people via WhatsApp was also Chilean.

The timing of the posts provides a further clue that they could have originated from Chile. An analysis shows that the authors of the posts were in a time zone four hours behind German time, the time difference between Chile and Germany. In the digital era, though, even clues like that can be faked. Internet scammers, hackers and trolls frequently lay false tracks to avoid getting caught. Manipulation is the name of the game.

At the end of December, DER SPIEGEL used Facebook Messenger to confront select profiles from the network with several questions. Only Alice Bergmann responded, and she made an attempt to maintain the fictitious façade. "It is obvious that you have never lost a sister in that way," she wrote, and then she accused DER SPIEGEL of lying.

Surprisingly, Alice Bergmann then sent a copy of a message that DER SPIEGEL had sent to a real contact of a different fake account just a few days earlier. It was an indication that the accounts are controlled centrally. "My friends are very loyal, so don't waste your time trying to send those messages to my friends," Bergmann wrote. "My father is a lawyer," she continued, before threatening to sue DER SPIEGEL. In an attempt to prove that she was a real person, she sent photos of herself, her sister and her brother. But in truth, none of the photos is of a person by the name of Bergmann.

At the same time the private messages were sent, other fake accounts linked to Alice Bergmann went on the attack. Several figures from the network suddenly began posting on the page of Robert Gautier: "Please do not talk to any German journalist," and "don't trust anything coming from Germany."

Georg Schönfelder Römmer, the alleged elite soldier, went even further by building the DER SPIEGEL reporters into a frequently used legend: "Please ignore and block those messages from those two German journalists, they are Alice's friends ... don't give any information to those German people please." Suddenly, the DER SPIEGEL reporters had themselves become part of the virtual soap opera.

The network has now been stopped. Following a tip-off from DER SPIEGEL and DFRLab, Facebooks took steps to shut down the accounts associated with the network as this story went to press on Thursday.

But the number of fake profiles on Facebook is still likely to continue growing, and their quality is improving. "With the new technology today, it is easy to create fake profiles that look and behave like real people," says IT expert Fire. Artificial intelligence can generate faces that look real, he says, and it can be used to automatically generate coherent texts that sound authentic. The fake world in Facebook is growing larger and larger.

Mehr lesen über
Die Wiedergabe wurde unterbrochen.