An online network on Facebook discovered by German media outlet Der Spiegel, which partnered with the DFRLab for its analysis, used hundreds of fake user accounts to craft full lifetimes of often breathless drama by deploying common tactics for creating such fake profiles.

由Der Spiegel与DFRLab合作进行分析的德国媒体Der Spiegel在Facebook上建立了一个在线网络，该网络使用数百个虚假用户帐户，通过部署创建此类虚假个人资料的通用策略，来制作通常令人窒息的戏剧的完整版。

The network of accounts participated in what Facebook — in a statement provided to Der Spiegel and the DFRLab — referred to as “scamming behavior,” putting them out of the range of the company’s qualification as “coordinated inauthentic behavior” (CIB). The latter usually entails concentrated and targeted information manipulation, meant to persuade vulnerable audiences for political or financial purposes. In this case, given the real humans behind the accounts, their proclivity toward fabricating whole lives for fake people, and their private engagement with authentic Facebook users — as revealed by Der Spiegel — the accounts appeared to more closely fit the company’s idea of scams. Both CIB and scams lead to removal from the platform.

帐户网络参与了Facebook的活动-在提供给明镜和DFRLab的声明中 —称为“诈骗行为”，将其排除在公司的“ 协调不真实行为 ”(CIB)资格范围之外。 后者通常需要集中和有针对性的信息操纵，以说服弱势受众出于政治或经济目的。 在这种情况下，考虑到帐户背后的真实人物，他们倾向于为假人伪造一生，并且他们与真实的Facebook用户进行私人接触(如Der Spiegel所揭示的那样)，这些帐户似乎更符合公司的诈骗观念。 CIB和欺诈都会导致从平台中删除。

A joint investigation between the DFRLab and German newspaper Der Spiegel identified at least 329 accounts engaged in this activity. While many of the accounts had cultivated mature user personas, they also exhibited numerous biographical inconsistencies, linguistic errors, and use of stolen content, all of which ultimately helped expose the network.

DFRLab与德国报纸Der Spiegel之间的联合调查确定了至少329个从事此活动的帐户。 尽管许多帐户已经培养了成熟的用户角色，但它们也表现出许多传记上的不一致之处，语言错误以及被盗内容的使用，所有这些最终都有助于揭露网络。

While the investigation did not result in a conclusive attribution, the DFRLab found some evidence, such as language use and the time zone of postings, to suggest that at least part of the network may have originated in Latin America. In addition, Der Spiegel discovered that some of the accounts made contact via private messages with real users, a finding the DFRLab was able to corroborate via open-source evidence.

尽管调查未得出结论性的归因，但DFRLab发现了一些证据，例如语言使用和张贴时区，表明该网络的至少一部分可能起源于拉丁美洲。 此外， Der Spiegel发现某些帐户通过私人消息与真实用户建立了联系，并发现DFRLab能够通过开放源证据来证实这一点。

This article outlines the main features of the network. Additional pieces by the DFRLab provide greater detail on the content, coordination, and fake nature of the accounts.

本文概述了网络的主要功能。 DFRLab的其他部分提供了有关帐户 内容 ， 协调和虚假性质的更多详细信息。

成熟的用户角色 (Mature user personas)

Many of the accounts had cultivated mature user personas that presented a wealth of detailed biographical information, including work history and education.

许多帐户培养了成熟的用户角色，这些角色提供了大量详细的传记信息，包括工作经历和教育。

Most of the user personas identified themselves as military or law enforcement personnel. Others listed jobs in the tourism, aviation, arts, and fashion industries.

大多数用户角色将自己标识为军事或执法人员。 其他人列出了旅游，航空，艺术和时装行业的工作。

In terms of nationality, the accounts were diverse, claiming to hail from over 30 countries, including France, the United States, and Syria.

就国籍而言，这些账户的种类繁多，声称来自30多个国家，包括法国，美国和叙利亚。

The accounts often listed one another as family members, tagged each other in photos, and engaged in dramatic exchanges in the comment sections of one other’s posts. These interactions suggested that the operators were aware of one another and coordinating to some extent.

这些账目经常彼此列为家庭成员，在照片中彼此打上标签，并在彼此帖子的评论部分进行戏剧性的交流。 这些互动表明，操作员彼此了解并进行了一定程度的协调。

Furthermore, both the DFRLab and Der Spiegel found evidence that the fake accounts had engaged authentic users via private messages.

此外，DFRLab和Der Spiegel都找到了证据，证明伪造帐户通过私人消息吸引了真实用户。

The care that went into crafting the accounts’ personas may have been an attempt to lend the accounts an air of authenticity so as to avoid arousing suspicion when they contacted real individuals.

精心制作帐户角色的做法可能是试图使帐户具有真实性，以避免在与真实个人联系时引起怀疑。

传记不一致 (Biographical inconsistencies)

Ironically, the high degree of biographical detail these accounts provided ultimately exposed them by creating greater room for error and inconsistencies in the personas. Some accounts had different names in their Facebook IDs than their screennames, as well as conflicting listed and presenting genders, suggesting that they may have changed identities at some point.

具有讽刺意味的是，这些陈述所提供的高度的传记细节最终通过在角色中增加错误和不一致的余地而最终暴露了它们。 一些帐户的Facebook ID名称与屏幕名称不同，并且列出的性别和显示的性别相抵触，这表明它们可能在某个时候改变了身份。

Many accounts from the network did not identify themselves as native English speakers, but those that did made language errors characteristic of non-native speakers.

网络中的许多帐户并没有将自己识别为说英语的人，但是那些确实造成了非母语者的语言错误的帐户。

While many accounts were connected to one another via family ties, there were inconsistencies in the accounts they listed as family members. In one case, for example, an account allegedly belonging to a father was clearly that for a woman.

虽然许多帐户是通过家庭纽带相互关联的，但它们列为家庭成员的帐户却存在不一致之处。 例如，在一个案例中，据称属于父亲的账户显然是针对女性的账户。

被盗内容 (Stolen content)

Many accounts from the network used images of “B-List” Latin American celebrities as profile pictures. Slight digital modifications, such as image mirroring and use of visual filters, suggested the accounts took steps to avoid detection via reverse image search.

网络中的许多帐户都使用“ B-List”拉丁美洲名人的图像作为个人资料图片。 轻微的数字修改(例如图像镜像和视觉过滤器的使用)建议帐户采取步骤，以避免通过反向图像搜索进行检测。

Some accounts copied and pasted text in their posts that originated on fringe media outlets from abroad.

一些帐户在其帖子中复制并粘贴了来自国外边缘媒体的文字。

发布收费的政治内容以吸引合适的人群 (Posting charged political content to draw the right crowd)

In addition to divulging details about their personal life in emotionally loaded posts, some of the accounts also posted charged political content. The exact nature of the content, however, was likely a superficial aspect of the network, as it was presumably targeting a highly engaged audience that the operators of the network felt might be most susceptible to their scam.

除了在充满感情的帖子中透露有关其个人生活的细节外，一些账户还发布了收费的政治内容。 但是，内容的确切性质可能是网络的一个肤浅的方面，因为它大概是针对网络运营商认为最容易受到骗局的高度参与的受众。

This, in part, explains why the network demonstrated no single or coherent ideological agenda; instead, the accounts seemed to be passionate about disparate political issues, from Kurdish autonomy to the refugee crisis in Europe. Different accounts often contradicted each other in political positioning.

这部分地解释了为什么网络没有表现出单一或连贯的意识形态议程； 相反，这些报道似乎对不同的政治问题充满热情，从库尔德自治到欧洲的难民危机。 不同的说法在政治立场上常常相互矛盾。

The one common thread was the likelihood of the content to provoke emotional reactions, a possible tactic to draw in highly engaged users as a part of the scam.

一个共同的话题是内容引发情绪React的可能性，这是吸引高参与度用户作为骗局的一种可能策略。

指向拉丁美洲的证据 (Evidence pointing to Latin America)

A few corroborating pieces of evidence suggested that the network might have been, at least in part, operated out of Latin America. Besides using images of Latin American celebrities, many of the accounts allegedly from other parts of the world frequently listed the languages they spoke in Spanish.

一些确凿的证据表明该网络可能至少部分在拉丁美洲以外运营。 除了使用拉丁美洲名人的图像外，据称来自世界其他地区的许多报道还经常列出他们用西班牙语说的语言。

Moreover, the time difference between the posting time and the time displayed on a researcher’s computer (in Central Europe) indicated a six-hour difference that matched with the time zone of eleven Latin American countries.

此外，发布时间与研究人员的计算机(在中欧)上显示的时间之间的时差表示与六个11个拉丁美洲国家的时区相匹配的六小时时差。

结论 (Conclusion)

This network was sprawling and longstanding. Some of the most prominent accounts, including Robert Gautier and Helena Bergmann, had been active since 2012–2013, having adopted fairly consistent and well-developed personas. Despite the conviction with which they played their parts, however, biographical inconsistencies and similar patterns of behavior revealed that these accounts were not who they claimed to be.

该网络庞大且长期存在。 自2012-2013年以来，包括Robert Gautier和Helena Bergmann在内的一些最著名的人物一直很活跃，他们采用了相当一致和完善的角色。 尽管他们坚定地发挥了自己的作用，但传记上的前后矛盾和类似的行为模式表明，这些说法并非他们声称的那样。

That the network was inauthentic and coordinated was clear, though the accounts — by Facebook’s own estimation to the DFRLab — were perpetrating “scamming behavior,” thus falling short of the company’s threshold for “coordinated inauthentic behavior.” Assuming the behavior was indeed intended to scam people in some form, it nevertheless remained unclear what the purpose of the scam was.

尽管由Facebook自己对DFRLab的估计，这些帐户确实存在“诈骗行为”，但仍低于该公司“协调的非真实行为”的门槛，但网络是真实的和协调的很明显。 假设该行为确实旨在以某种形式骗人，但仍不清楚骗局的目的是什么。

Some of the accounts posted innocuous special interest content, melodramatic stories, and flirtatious overtures; others were overtly political. The former behaviors are typical of audience-building attempts. On the other hand, the presence of political commentary on a host of divisive sociopolitical issues suggested that the network was deliberately targeting an audience of highly engaged real users it felt could be scammed.

一些帐目张贴了无害的特殊兴趣内容，叙事故事和挑逗性的提议； 其他人则公开地政治。 前者的行为是受众建立尝试中的典型行为。 另一方面，关于许多分裂性社会政治问题的政治评论的存在表明，该网络是故意针对那些可能被骗的高度参与的真实用户的。

Nika Aleksejeva is a Research Associate with the Digital Forensic Research Lab (@DFRLab) and is based in Latvia.

Nika Aleksejeva 是数字取证研究实验室(@DFRLab)的研究助理，总部位于拉脱维亚。

Zarine Kharazian is Assistant Editor with @DFRLab and is based in Washington, DC.

Zarine Kharazian 是 @DFRLab 的助理编辑，总部位于华盛顿特区。

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.

在Twitter上 关注 我们的#DigitalSherlocks，以进行更深入的分析。