A Facebook page linked to Cape Town-based digital marketing firm Fangate (*) created at least 33 Facebook groups between January and March 2020 that leveraged fears around the novel coronavirus to build their respective audiences, a DFRLab investigation has found. Fangates director subsequently used a separate but related entity called AppleBerry to exploit these fears and market non-medical face masks to the members of these groups.
Fangates for-profit venture had an unintended consequence: in commercialising coronavirus-related fears of group members to market its product, it also created a platform for the propagation of misinformation. The Facebook groups quickly became vectors for the spread of coronavirus mis- and dis-information after the administrator seemingly abandoned them to volunteer moderators.
Parallel to the spread of the coronavirus itself, related disinformation and factually misleading information has propagated in a similar manner, quickly jumping around the globe. The World Health Organisation (WHO) referred to the spread of this information epidemic as an infodemic a public health crisis that has the potential to cause serious harm.
In response to the DFRLab investigation, Facebook took action against the companies hosting the groups.
We removed these Pages and Groups for misleading people about their purpose and attempting to evade our prohibition on the sale of medical equipment, a Facebook company spokesperson said in a statement. We are grateful to the Atlantic Councils DFRLab for bringing this information to our attention.
DFRLab has asked the marketing companies owner for comment. which did not arrive by the agreed time.
Geographic transmission
The Facebook groups, which included Coronavirus Philippines, Coronavirus South Africa and Coronavirus (COVID-19) Updates, segmented themselves geographically, and targeted individuals located in Africa, Europe, the United Kingdom, the Philippines and United States among others.
Considering that Fangate and AppleBerry are located in Cape Town, their interest in the spread of the coronavirus in foreign jurisdictions seems odd. But it is clear that AppleBerryMasks motivation is commercial: a marketing blurb uploaded to the page on February 12, 2020, stated that AppleBerry was created to satisfy a need for more fashionable and upbeat face masks. This in itself was strange, as the South African population does not generally wear face masks in public.
It also registered its AppleBerry.shop website on February 15, 2020, which sells face masks for between $15 and $25. The various Facebook groups created by Fangate and AppleBerry are listed under a separate page as AppleBerry communities. On March 11, AppleBerry posted veiled advertisements for its non-medical face mask on two of the South African coronavirus groups.
While similar advertisements were not posted on the international groups, this is likely because AppleBerry has not yet secured an international distributor, according to their website.
Despite claiming that the groups were not created for fear-mongering or advertising purposes, the AppleBerry page did both of these things in short succession in March 2020. On 10 March, AppleBerryMasks posted on the Coronavirus South Africa group, drawing hypothetical parallels between South Africa (which only had seven confirmed cases at that stage) and the 631 deaths in Italy at the time.
The sendoff, What are you doing today to protect yourself and your family? dovetails with a post it published on the group the following day, in which AppleBerry promoted an introductory offer on its nonmedical face mask to members of this group.
For only R179 (USD $10), concerned members of these coronavirus awareness groups could be the proud owner of a non-surgical face mask that AppleBerry claims may protect against the spread of germs in crowded environments. The AppleBerry website states that their face masks are not intended for any real medical intervention. Despite this, the stores news page contains links to articles exclusively about the coronavirus, increasing the suspicion they are using coronavirus fears to market unsuitable face masks.
Cotton face masks, like the ones made by AppleBerry, are not capable of filtering out airborne viruses like the novel coronavirus, and instead act as a barrier. A 2014 study even cautioned healthcare workers, who are most likely to come into contact with viruses, against using cotton masks due to the masks poor filtration capacity and moisture retention.
The National Institute for Communicable Diseases, one of South Africas national public health institutes, has also warned that citizens who are not used to wearing face masks are likely to start touching their faces more regularly, which in turn could theoretically increase the likelihood of contracting the virus.
Carrier networks DFRLabs investigation identified two linked networks of Facebook groups. The first network was administered by the Fangate Facebook page, which had amassed more than 91,000 followers since it was created on July 22, 2013. The second network was mainly administered by AppleBerry. In stark contrast to FanGate, AppleBerrys Facebook page gained less than 300 page follows since its creation on February 9, 2020.
The larger of the two networks was administered by Fangate, and numbered around 100 private Facebook groups, such as unofficial pages for South African brands and football teams, as well as a large contingent of jobseeker groups. The overall impression was that Fangate was operating these groups as a means to gain access to their members for marketing purposes.
Nestled between these Fangate groups was a subset of 33 groups related to the coronavirus. Most of them were geographically segmented, with groups dedicated to the Philippines, Australia, Brazil, the US, and even individual counties within the United Kingdom. By contrast, the AppleBerry groups were thematically limited to the coronavirus.
The AppleBerryMasks page created a contingent of 25 groups focused specifically on South Africa, which resembled the groups in the FanGateZA network in many respects.
On March 11, 2020, the DFRLab compared the creation dates and designated administrator of these groups chronologically:
This analysis revealed that AppleBerry was the designated administrator for two groups that were created before its own existence: Coronavirus South Africa and Coronavirus Botswana. This means Fangate, the original creator of both groups, ceded page administration to AppleBerry after AppleBerry was created. Since then, several of the larger groups (including CoronaVirus U.S.A. and CoronaVirus Brazil) have also been transferred over to AppleBerry from Fangate.
This is important, as the transfer of the administrator function established a link between Fangate and AppleBerry. This analysis also revealed similarities in the naming conventions used by the pages. Pages created between February 9 and February 21, 2020, were administered by AppleBerry (the exception being Coronavirus Quezon City, which was created and administered by Fangate).
These groups were different from the first batch of groups, created by Fangate between January 24 and February 2, in that they were focused on individual towns and provinces within South Africa, as opposed to broader countries or regions.
This more granular geographical pattern was carried over once Fangate resumed creating groups on 21 February, at which point it created coronavirus-related groups focused on specific counties within the United Kingdom.
Symptomatically similar, The DFRLab investigation noted both networks featured similar artistic renditions of microbes as their cover pictures. A reverse image search of these pictures identified them as renders of the Middle East Respiratory Syndrome (MERS), available on Pinterest, and a stock image of the coronavirus available on Unsplash.
The FanGateZA and AppleBerryMasks groups shared mutual administrators, as seen on the membership pages for these groups. Similar wording was used in the about, description and page rules sections of the groups across both networks.
Many of the groups across both the Fangate and AppleBerry networks used an automated greeting system to welcome new members to their respective groups. These greeting posts would either be posted by the Fangate or AppleBerry pages directly, or by the administrators for the groups.
Although the bulk of the groups had either the Fangate or AppleBerry pages listed as administrators, two user profiles belonging to accounts named Trisha Karina and Chris da Silva featured frequently among the lists of administrators for the groups in both networks.
While the similarities in the presentation of both groups already pointed to a nebulous link between the Fangate and AppleBerry networks, a further investigation into these two profiles made the link evident.
Contra-indications
The first of these user profiles claimed to be a woman from Cape Town named Trisha Karina. A fan page for Trisha Karina, created in 2013, claims she originally hails from Stellenbosch, about 50km east of Cape Town, despite her profile indicating she is from Durban, about 1,600km further away.
The profile does not contain much by way of personal details, yet it shared many links to Fangates coronavirus groups, as well as events promoted on Fangates now-closed website. Trisha Karina is a staunch supporter of Fangate projects, and in September 2019 the profile posted favourable reviews to an employment-related page linked to Fangate.
Overall, the Trisha Karina profile appears inauthentic. The profile picture for the account is widely available online, as confirmed by a reverse image search using Google. There is no clear persona evident from the profile, and content it posts inevitably relates back to Fangate. Even an Instagram account associated with the profile only contained stock images of fitness models, and posts on the fan page contained similar content.
The Trisha Karina profile is also an administrator of several Facebook groups created by Fangate and one page associated with AppleBerry. Where the Trisha Karina profile is not an admin, the account has been added to the group as a regular member.
Attempts by the DFRLab to make contact with the Trisha Karina account went unanswered. The account has since been deleted or deactivated, shortly after reaching out for comment.
Typhoid Mary
The second profile used to administer these groups belonged to Chris da Silva. The profile itself was devoid of any telling information on the owners identity. One of the profile pictures seen on the account history could be traced to a community safety application called Neighbourly. The Terms of Service page on the Neighbourly web page provided the legal company name, N.brly (Pty) Ltd. Company records revealed that Neighbourlys sole director is an individual by the name of Chris da Silva.
The same Chris da Silva is also the director of several other companies. Fansgate (registered to the same business address as displayed on the Fangate page) was created in 2013, the same year the Fangate Facebook page was created.
Another of da Silvas companies called TrishaKR (bearing a remarkable resemblance to the name used for the Trisha Karina profile) was also registered on the same date as Fansgate.
AppleBerry does not appear in the list of companies registered by da Silva, but two phone numbers found on the AppleBerry and Fangate Facebook pages were linked to him using Truecaller. The first number was found in a series of marketing proposal documents on the Fangate Facebook page. The second number was found on the About section of AppleBerrys page. Truecaller indicated both phone numbers were registered to the same individual: Chris da Silva.
In addition, a WHOIS search of the appleberry.shop domain revealed that Da Silva was the individual who registered the AppleBerry website on 15 February.
While in isolation, each of these datapoints could be disregarded as mere coincidence, the confluence makes a compelling argument that Fangates director is behind both pages, as well as the Chris da Silva user profile.
All things in moderation
In terms of activity, the groups created by Fangate and AppleBerry positioned themselves as public interest groups: their respective about and information pages give the impression that they were intended to share updates on the spread of the virus, and keep communities safe through the sharing of this information.
Instead, the groups quickly became breeding grounds that proliferated conspiracy theories, misinformation and even disinformation surrounding the coronavirus. Group moderators, appointed by Fangate to keep the community in check, were themselves guilty of sharing links to websites that published dubious or debunked information.
In another instance, the very moderators meant to ensure a group did not spread false or misleading information were doing so themselves. Administrators on the CoronaVirus U.S.A. and the main CoronaVirus (COVID-19) Updates groups were seen posting links to Breitbart, ZeroHedge and Infowars.
Fangates modus operandi appears to be to create these groups, recruit several local volunteers as moderators and then leave the responsibility for managing group conversations with them.
This can be seen from posts made by the administrators requesting individuals to volunteer as moderators. After the moderators have been appointed though, the administrators seem to leave the building: posts from moderators expressed frustration at Fangates apparent inaccessibility.
This seems similar to what happened with an unrelated jobs group, also administered by Fangate. A user review posted to the Fangate page claimed the group was overrun with adult content and that no moderation was performed on the group at all.
Conclusion
Although the AppleBerry page claimed the local South African and international groups were created to connect communities, not for the purpose of fear-mongering or advertising, AppleBerry appears to be using the groups for the inverse purpose.
By marketing non-medical masks in the occupational safety and health services category on Facebook, drawing parallels between South Africa and Italy, and asking people to question how they will protect their family, the newly created company seems to be capitalising on the publics fear of Covid-19 to make a quick buck.
As a result, AppleBerry is adding fuel to the infodemic fire that makes the work of healthcare workers and those on the frontline of tackling the spread of the virus all the more difficult. DM
* The Facebook page is named Fangate, and the actual legal entity is Fansgate.
Jean le Roux and Tessa Knight are researchers at the Atlantic Councils Digital Forensic Research Lab. Contact: twitter.com/dfrlab
Please note you must be a Maverick Insider to comment. Sign up here or if you are already an Insider.
See the original post:
