A Facebook page linked to Cape Town-based digital marketing firm Fansgate created at least 33 groups between January and March that leveraged fears around the coronavirus to build their respective audiences, a DFRLab investigation has found.
Fansgate's director subsequently used a separate but related entity called AppleBerry to exploit these fears and market non-medical face masks to the members of these groups.
LIVE | For the love of each other, stay at home, ministers urge SA
Its for-profit venture had an unintended consequence: Commercialising coronavirus-related fears of group members to market its product. It also created a platform for the propagation of misinformation.
The Facebook groups quickly became vectors for the spread of coronavirus mis- and disinformation after the administrator seemingly abandoned them to volunteer moderators.
Parallel to the spread of the coronavirus itself, related disinformation and factually misleading information propagated in a similar manner, quickly jumping around the globe.
The World Health Organisation referred to it as an infodemic - a public health crisis that has the potential to cause serious harm.
In response to DFRLab's investigation, Facebook took action against the companies hosting the groups.
"We removed these pages and groups for misleading people about their purpose and attempting to evade our prohibition on the sale of medical equipment," a Facebook company spokesperson said in a statement.
"We are grateful to the Atlantic Council's DFRLab for bringing this information to our attention."
DFRLab has reached out to the marketing company's owner for comment.
Geographic transmission
The Facebook groups, which included Coronavirus Philippines, Coronavirus South Africa and Coronavirus (COVID-19) Updates, segmented themselves geographically, and targeted individuals located in Africa, Europe, the UK, Philippines and US, among others.
They targeted individuals located in Africa, Europe, the United Kingdom, the Philippines and United States, among others.
Considering that Fangate and AppleBerry are located in Cape Town, their interest in the spread of the coronavirus in foreign jurisdictions seems odd. But it is clear that AppleBerryMasks' motivation is commercial: A marketing blurb uploaded to the page on 12 February stated AppleBerry was created to satisfy a need for more "fashionable and upbeat" face masks. This in of itself was strange, as the South Africans do not generally wear face masks in public.
It also registered its AppleBerry.shop website on 15 February, which sells face masks for between $15 and $25. The various Facebook groups created by Fangate and AppleBerry are listed under a separate page as AppleBerry "communities".
On 11 March, AppleBerry posted veiled advertisements for its "non-medical" face mask on two of the South African coronavirus groups. While similar advertisements were not posted on the international groups, this is likely because AppleBerry has not yet secured an international distributor, according to its website.
Despite claiming that the groups were not created for fear mongering or advertising purposes, the AppleBerry page did both of these things in short succession in March.
On 10 March, AppleBerryMasks posted on the Coronavirus South Africa group, drawing hypothetical parallels between South Africa (which only had seven confirmed cases at that stage) and the 631 deaths in Italy at the time.
The send-off "What are you doing today to protect yourself and your family?" dovetails with a post it published on the group the following day, in which AppleBerry promoted an "introductory offer" on its non-medical face mask to members of this group.
For only R179 ($10), concerned members of these coronavirus awareness groups could be the proud owners of non-surgical face masks that AppleBerry claims "may" protect against the spread of germs in crowded environments.
The AppleBerry website uses heavily disclaimed statements and hedge language that makes it clear that their face masks are not intended for any real medical intervention. Despite this, the store's news page contains links to articles exclusively about the coronavirus, increasing the suspicion they are using coronavirus fears to market unsuitable face masks.
Cotton face masks, like the ones made by AppleBerry, are not capable of filtering out airborne viruses like the coronavirus, and instead act as a barrier.
A 2014 study even cautioned healthcare workers, who are most likely to come into contact with viruses, against using cotton masks due to the masks' poor filtration capacity and moisture retention.
The National Institute for Communicable Diseases, one of South Africa's national public health institutes, has also warned that citizens who are not used to wearing face masks are likely to start touching their faces more regularly, which in turn could theoretically increase the likelihood of contracting the virus.
Carrier networks
DFRLab's investigation identified two linked networks of Facebook groups. The first network was administered by the Fangate Facebook page, which had amassed more than 91 000 followers since it was created on 22 July 2013. The second network was mainly administered by AppleBerry. In stark contrast to FanGate, AppleBerry's Facebook page gained less than 300 page follows since its creation on 9 February 2020.
The larger of the two networks was administered by Fangate, and numbered around 100 private Facebook groups, such as unofficial pages for South African brands and football teams, as well as a large contingent of jobseeker groups. The overall impression was that Fangate was operating these groups as a means to gain access to their members for marketing purposes.
Nestled between these Fangate groups was a subset of 33 groups related to the coronavirus. Most of them were geographically segmented, with groups dedicated to the Philippines, Australia, Brazil, the US, and even individual counties within the UK.
By contrast, the AppleBerry groups were thematically limited to the coronavirus. The AppleBerryMasks page created a contingent of 25 groups focused specifically on South Africa, which resembled the groups in the FanGateZA network in many respects.
On 11 March 11, DFRLab compared the creation dates and designated administrator of these groups chronologically:
This analysis revealed AppleBerry was the designated administrator for two groups that were created before its own existence: Coronavirus South Africa and Coronavirus Botswana. This means Fangate, the original creator of both groups, ceded page administration over to AppleBerry after AppleBerry was created. Since then, several of the larger groups (including CoronaVirus U.S.A. and CoronaVirus Brazil) have also been transferred over to AppleBerry from Fangate.
This is important, as the transfer of the administrator function established a link between Fangate and AppleBerry.
This analysis also revealed similarities in the naming conventions used by the pages. Pages created between 9 and 21 February were administered by AppleBerry (the exception being Coronavirus Quezon City, which was created and administered by Fangate).
These groups were different from the first batch of groups, created by Fangate between 24 January and 2 February, in that they were focused on individual towns and provinces within South Africa, as opposed to broader countries or regions.
This more granular geographical pattern was carried over once Fangate resumed creating groups on 21 February, at which point it created coronavirus-related groups focused on specific counties within the UK.
Symptomatically similar
DFRLab's investigation noted both networks featured similar artistic renditions of microbes as their cover pictures. A reverse image search of these pictures identified them as renders of the Middle East Respiratory Syndrome (MERS), available on Pinterest, and a stock image of the coronavirus available on Unsplash.
The FanGateZA and AppleBerryMasks groups shared mutual administrators, as seen on the membership pages for these groups. Similar wording was used in the about, description and page rules sections of the groups across both networks.
Many of the groups across both the Fangate and AppleBerry networks used an automated "greeting" system to welcome new members to their respective groups. These greeting posts would either be posted by the Fangate or AppleBerry pages directly, or by the administrators for the groups.
Although the bulk of the groups had either the Fangate or AppleBerry pages listed as administrators, two user profiles belonging to accounts named Trisha Karina and Chris da Silva featured frequently among the lists of administrators for the groups in both networks.
While the similarities in the presentation of both groups already pointed to a nebulous link between the Fangate and AppleBerry networks, a further investigation into these two profiles made the link evident.
Contra-indications
The first of these user profiles claimed to be a woman from Cape Town named Trisha Karina. A fan page for her, created in 2013, claims she originally hails from Stellenbosch, despite her profile indicating she is from Durban.
The profile does not contain much by way of personal details, yet it shared many links to Fangate's coronavirus groups, as well as events promoted on its now-closed website. Trisha Karina is a staunch supporter of Fangate projects, and in September 2019 the profile posted favourable reviews to an employment-related page linked to Fangate.
Overall, the Trisha Karina profile appears inauthentic. The profile picture for the account is widely available online, as confirmed by a reverse image search using Google. There is no clear persona evident from the profile, and content it posts inevitably relates back to Fangate.
Even an Instagram account associated with the profile only contained stock images of fitness models, and posts on the fan page contained similar content.
The Trisha Karina profile is also an administrator of several Facebook groups created by Fangate and one page associated with AppleBerry. Where the Trisha Karina profile is not an admin, the account has been added to the group as a regular member.
Attempts by DFRLab to make contact with the Trisha Karina account went unanswered. The account has since been deleted or deactivated, shortly after reaching out for comment.
Typhoid Mary
The second profile used to administer these groups belonged to Chris da Silva. The profile itself was devoid of any telling information on the owner's identity. One of the profile pictures seen on the account history could be traced to a community safety application called Neighbourly.
The Terms of Service page on the Neighbourly webpage provided the legal company name, N.brly (Pty) Ltd. Company records revealed that Neighbourly's sole director is an individual by the name of Chris da Silva.
The same Chris da Silva is also the director of several other companies.
Fansgate (registered to the same business address as displayed on the Fangate page) was created in 2013, the same year the Fangate Facebook page was created. Another of Da Silva's companies called TrishaKR (bearing a remarkable resemblance to the name used for the Trisha Karina profile) was also registered on the same date as Fansgate.
AppleBerry does not appear in the list of companies registered by Da Silva, but two phone numbers found on the AppleBerry and Fangate Facebook pages were linked to him using Truecaller. The first number was found in a series of marketing proposal documents on the Fangate Facebook page. The second number was found on the About section of AppleBerry's page. Truecaller indicated both phone numbers were registered to the same individual: Chris da Silva.
In addition, a WHOIS search of the appleberry.shop domain revealed that Da Silva was the individual who registered the AppleBerry website on 15 February.
While in isolation, each of these data points could be disregarded as mere coincidence, the confluence makes a compelling argument that Fangate's director is behind both pages, as well as the Chris da Silva user profile.
All things in moderation
In terms of activity, the groups created by Fangate and AppleBerry positioned themselves as public interest groups: Their respective about and information pages give the impression that they were intended to share updates on the spread of the virus, and keep communities safe through the sharing of this information.
Instead, the groups quickly became breeding grounds that proliferated conspiracy theories, misinformation and even disinformation surrounding the coronavirus. Group moderators, appointed by Fangate to keep the community in check, were themselves guilty of sharing links to websites that published dubious or debunked information.
In another instance, the very moderators meant to ensure a group did not spread false or misleading information were doing so themselves. Administrators on the CoronaVirus U.S.A. and the "main" CoronaVirus (COVID-19) Updates groups were seen posting links to Breitbart, ZeroHedge and Infowars.
Fangate's modus operandi appears to be to create these groups, recruit several local volunteers as moderators and then leave the responsibility for managing group conversations with them.
This can be seen from posts made by the administrators requesting individuals to volunteer as moderators.
After the moderators have been appointed though, the administrators seem to leave the building: Posts from moderators expressed frustration at Fangate's apparent inaccessibility. This seems similar to what happened with an unrelated jobs group, also administered by Fangate.
A user review posted to the Fangate page claimed the group was overrun with adult content and that no moderation was performed on the group at all.
Conclusion
Although the AppleBerry page claimed the local South African and international groups were created to connect communities, not for the purpose of fear mongering or advertising, AppleBerry appears to be using the groups for the inverse purpose.
By marketing non-medical masks in the "occupational safety and health services" category on Facebook, drawing parallels between South Africa and Italy, and asking people to question how they will protect their family, the newly created company seems to be capitalising on the public's fear of Covid-19 to make a quick buck. As a result, AppleBerry is adding fuel to the infodemic fire that makes the work of healthcare workers on those on the front line of tackling the spread of the virus all the more difficult.
* This article was originally published by the DFRLab on Medium, here.
Stay up to date and stay healthy. Subscribe to Health24’s Daily Dose newsletter for important updates on the spread of the coronavirus. Register and manage your newsletters in the new News24 app by clicking on the Profile tab