South African-based Facebook groups stoked coronavirus fears to sell face masks

A Facebook page linked to Cape Town-based digital marketing firm Fansgate created at least 33 groups between January and March that leveraged fears around the coronavirus to build their respective audiences, a DFRLab investigation has found.

Fansgate's director subsequently used a separate but related entity called AppleBerry to exploit these fears and market non-medical face masks to the members of these groups.

LIVE | For the love of each other, stay at home, ministers urge SA

Its for-profit venture had an unintended consequence: Commercialising coronavirus-related fears of group members to market its product. It also created a platform for the propagation of misinformation.

The Facebook groups quickly became vectors for the spread of coronavirus mis- and disinformation after the administrator seemingly abandoned them to volunteer moderators.

Parallel to the spread of the coronavirus itself, related disinformation and factually misleading information propagated in a similar manner, quickly jumping around the globe.

The World Health Organisation referred to it as an infodemic - a public health crisis that has the potential to cause serious harm.

In response to DFRLab's investigation, Facebook took action against the companies hosting the groups.

"We removed these pages and groups for misleading people about their purpose and attempting to evade our prohibition on the sale of medical equipment," a Facebook company spokesperson said in a statement.

"We are grateful to the Atlantic Council's DFRLab for bringing this information to our attention."

DFRLab has reached out to the marketing company's owner for comment.

Geographic transmission

The Facebook groups, which included Coronavirus Philippines, Coronavirus South Africa and Coronavirus (COVID-19) Updates, segmented themselves geographically, and targeted individuals located in Africa, Europe, the UK, Philippines and US, among others.

They targeted individuals located in Africa, Europe, the United Kingdom, the Philippines and United States, among others.




DFRLab


Screengrab from the Facebook page @AppleBerryMasks, indicating the page’s marketing blurb added on 12 February. (Source: Facebook)






Considering that Fangate and AppleBerry are located in Cape Town, their interest in the spread of the coronavirus in foreign jurisdictions seems odd. But it is clear that AppleBerryMasks' motivation is commercial: A marketing blurb uploaded to the page on 12 February stated AppleBerry was created to satisfy a need for more "fashionable and upbeat" face masks. This in of itself was strange, as the South Africans do not generally wear face masks in public.

It also registered its AppleBerry.shop website on 15 February, which sells face masks for between $15 and $25. The various Facebook groups created by Fangate and AppleBerry are listed under a separate page as AppleBerry "communities".

On 11 March, AppleBerry posted veiled advertisements for its "non-medical" face mask on two of the South African coronavirus groups. While similar advertisements were not posted on the international groups, this is likely because AppleBerry has not yet secured an international distributor, according to its website. 

Despite claiming that the groups were not created for fear mongering or advertising purposes, the AppleBerry page did both of these things in short succession in March.

On 10 March, AppleBerryMasks posted on the Coronavirus South Africa group, drawing hypothetical parallels between South Africa (which only had seven confirmed cases at that stage) and the 631 deaths in Italy at the time.

The send-off "What are you doing today to protect yourself and your family?" dovetails with a post it published on the group the following day, in which AppleBerry promoted an "introductory offer" on its non-medical face mask to members of this group.



DFRLab


Screengrab of posts made by the @AppleBerryMasks Facebook page, indicating the marketing blurb added to the page on 12 February. (Source: Facebook)






For only R179 ($10), concerned members of these coronavirus awareness groups could be the proud owners of non-surgical face masks that AppleBerry claims "may" protect against the spread of germs in crowded environments.

The AppleBerry website uses heavily disclaimed statements and hedge language that makes it clear that their face masks are not intended for any real medical intervention. Despite this, the store's news page contains links to articles exclusively about the coronavirus, increasing the suspicion they are using coronavirus fears to market unsuitable face masks.

Cotton face masks, like the ones made by AppleBerry, are not capable of filtering out airborne viruses like the coronavirus, and instead act as a barrier.

A 2014 study even cautioned healthcare workers, who are most likely to come into contact with viruses, against using cotton masks due to the masks' poor filtration capacity and moisture retention.

The National Institute for Communicable Diseases, one of South Africa's national public health institutes, has also warned that citizens who are not used to wearing face masks are likely to start touching their faces more regularly, which in turn could theoretically increase the likelihood of contracting the virus.

Carrier networks

DFRLab's investigation identified two linked networks of Facebook groups. The first network was administered by the Fangate Facebook page, which had amassed more than 91 000 followers since it was created on 22 July 2013. The second network was mainly administered by AppleBerry. In stark contrast to FanGate, AppleBerry's Facebook page gained less than 300 page follows since its creation on 9 February 2020.

The larger of the two networks was administered by Fangate, and numbered around 100 private Facebook groups, such as unofficial pages for South African brands and football teams, as well as a large contingent of jobseeker groups. The overall impression was that Fangate was operating these groups as a means to gain access to their members for marketing purposes.

Nestled between these Fangate groups was a subset of 33 groups related to the coronavirus. Most of them were geographically segmented, with groups dedicated to the Philippines, Australia, Brazil, the US, and even individual counties within the UK.

By contrast, the AppleBerry groups were thematically limited to the coronavirus. The AppleBerryMasks page created a contingent of 25 groups focused specifically on South Africa, which resembled the groups in the FanGateZA network in many respects.

On 11 March 11, DFRLab compared the creation dates and designated administrator of these groups chronologically:




DFRLab


A breakdown of the groups administered by Fangate (green) and AppleBerry (yellow) as at 11 March, indicating when these groups were created according to their About pages. Important to note is that the AppleBerry page was only created on 9 February, several days after Fangate began creating Facebook groups around the virus. The geographical granularity of these groups also followed a similar pattern over time. (Source: @jean_leroux and @awildknight/DFRLab)





This analysis revealed AppleBerry was the designated administrator for two groups that were created before its own existence: Coronavirus South Africa and Coronavirus Botswana. This means Fangate, the original creator of both groups, ceded page administration over to AppleBerry after AppleBerry was created. Since then, several of the larger groups (including CoronaVirus U.S.A. and CoronaVirus Brazil) have also been transferred over to AppleBerry from Fangate.

This is important, as the transfer of the administrator function established a link between Fangate and AppleBerry.

This analysis also revealed similarities in the naming conventions used by the pages. Pages created between 9 and 21 February were administered by AppleBerry (the exception being Coronavirus Quezon City, which was created and administered by Fangate).

These groups were different from the first batch of groups, created by Fangate between 24 January and 2 February, in that they were focused on individual towns and provinces within South Africa, as opposed to broader countries or regions.

This more granular geographical pattern was carried over once Fangate resumed creating groups on 21 February, at which point it created coronavirus-related groups focused on specific counties within the UK.

Symptomatically similar

DFRLab's investigation noted both networks featured similar artistic renditions of microbes as their cover pictures. A reverse image search of these pictures identified them as renders of the Middle East Respiratory Syndrome (MERS), available on Pinterest, and a stock image of the coronavirus available on Unsplash.

The FanGateZA and AppleBerryMasks groups shared mutual administrators, as seen on the membership pages for these groups. Similar wording was used in the about, description and page rules sections of the groups across both networks.



DFRLab


 Screengrabs of the groups administered by the Fangate and AppleBerry Facebook pages. Many of these groups administered by these two pages shared administrators, descriptions and posting conventions. (Source: Facebook)
DFRLab

 Screengrabs from the membership and administrator pages from a representative sampling of the Fangate and AppleBerry Facebook groups. Note the recurrence of the Trisha Karina, Fangate and Chris da Silva administrators between the groups. (Source: @jean_leroux/DFRLab via Facebook)





Many of the groups across both the Fangate and AppleBerry networks used an automated "greeting" system to welcome new members to their respective groups. These greeting posts would either be posted by the Fangate or AppleBerry pages directly, or by the administrators for the groups.

Although the bulk of the groups had either the Fangate or AppleBerry pages listed as administrators, two user profiles belonging to accounts named Trisha Karina and Chris da Silva featured frequently among the lists of administrators for the groups in both networks.




DFRLab


Screengrabs from greeting posts made by Trisha Karina (far left) AppleBerry (centre left) Fangate (centre right) and Chris da Silva (far right) pages, using the same automated greeting message for new users. (Source: Facebook)




While the similarities in the presentation of both groups already pointed to a nebulous link between the Fangate and AppleBerry networks, a further investigation into these two profiles made the link evident.

Contra-indications

The first of these user profiles claimed to be a woman from Cape Town named Trisha Karina. A fan page for her, created in 2013, claims she originally hails from Stellenbosch, despite her profile indicating she is from Durban.



DFRLab


Screengrabs from the Trisha Karina profile and its associated fan page. Note the use of stock images and sharing of content linked to Fangate. (Source: @jean_leroux / DFRLab via Facebook)




The profile does not contain much by way of personal details, yet it shared many links to Fangate's coronavirus groups, as well as events promoted on its now-closed website. Trisha Karina is a staunch supporter of Fangate projects, and in September 2019 the profile posted favourable reviews to an employment-related page linked to Fangate.



DFRLab

Screengrabs from positive reviews left by the Trisha Karina profile on content associated with Fangate in September 2019 (top right, centre right) as well as a reverse image search conducted on the profile picture used by the account. (Source: @jean_leroux / DFRLab via Facebook)





Overall, the Trisha Karina profile appears inauthentic. The profile picture for the account is widely available online, as confirmed by a reverse image search using Google. There is no clear persona evident from the profile, and content it posts inevitably relates back to Fangate.

Even an Instagram account associated with the profile only contained stock images of fitness models, and posts on the fan page contained similar content.

The Trisha Karina profile is also an administrator of several Facebook groups created by Fangate and one page associated with AppleBerry. Where the Trisha Karina profile is not an admin, the account has been added to the group as a regular member.



DFRLab


Screengrabs of the administrator pages for Coronavirus South Africa (far left) and Coronavirus Australia, (centre left) both featuring Trisha Karina, Chris* and Fangate as admins. The Trisha Karina account posts welcoming messages identical to those posted by the AppleBerryMasks page (centre right). Even where the Trisha Karina account was not an admin, it was still added as a member of other groups, as seen in the welcome messages posted by Fangate and ApplBerryMasks (far right). (Source: @jean_leroux / DFRLab via Facebook)




Attempts by DFRLab to make contact with the Trisha Karina account went unanswered. The account has since been deleted or deactivated, shortly after reaching out for comment.

Typhoid Mary

The second profile used to administer these groups belonged to Chris da Silva. The profile itself was devoid of any telling information on the owner's identity. One of the profile pictures seen on the account history could be traced to a community safety application called Neighbourly.

The Terms of Service page on the Neighbourly webpage provided the legal company name, N.brly (Pty) Ltd. Company records revealed that Neighbourly's sole director is an individual by the name of Chris da Silva.



DFRLab


Screengrabs from the Chris da Silva Facebook profile (left) alongside the reverse image search of the logo seen on his profile (centre). The website associated with that logo contained the company’s legal name in the Terms of Service page, which allowed company records to be searched. (Source: @jean_leroux / DFRLab)




The same Chris da Silva is also the director of several other companies.

Fansgate (registered to the same business address as displayed on the Fangate page) was created in 2013, the same year the Fangate Facebook page was created. Another of Da Silva's companies called TrishaKR (bearing a remarkable resemblance to the name used for the Trisha Karina profile) was also registered on the same date as Fansgate.

DFRLab


Screengrab from the Companies and Intellectual Property Commission website, detailing the companies and closed corporations registered to Chris da Silva. (Source: CIPC)




AppleBerry does not appear in the list of companies registered by Da Silva, but two phone numbers found on the AppleBerry and Fangate Facebook pages were linked to him using Truecaller. The first number was found in a series of marketing proposal documents on the Fangate Facebook page. The second number was found on the About section of AppleBerry's page. Truecaller indicated both phone numbers were registered to the same individual: Chris da Silva.



DFRLab


 Screengrabs from the AppleBerry Facebook page (left) and marketing material posted on the Fangate page (right). The Truecaller profiles for these numbers reflect the same name as that of Fangate director Chris da Silva. (Source: @jean_leroux/DFRLab)




In addition, a WHOIS search of the appleberry.shop domain revealed that Da Silva was the individual who registered the AppleBerry website on 15 February.



DFRLab


A screengrab from a WHOIS search of the appleberry.shop domain indicating Chris da Silva as the owner of the website. (Source: GoDaddy)




While in isolation, each of these data points could be disregarded as mere coincidence, the confluence makes a compelling argument that Fangate's director is behind both pages, as well as the Chris da Silva user profile.

All things in moderation

In terms of activity, the groups created by Fangate and AppleBerry positioned themselves as public interest groups: Their respective about and information pages give the impression that they were intended to share updates on the spread of the virus, and keep communities safe through the sharing of this information.

Instead, the groups quickly became breeding grounds that proliferated conspiracy theories, misinformation and even disinformation surrounding the coronavirus. Group moderators, appointed by Fangate to keep the community in check, were themselves guilty of sharing links to websites that published dubious or debunked information.



DFRLab


Screengrabs of several posts containing misinformation shared on these groups. One user recommended Vitamin D (far left) and another member posted the conspiracy theories related to the coronavirus (centre). Another post, made by a moderator, claimed a vaccine has already been created (top right). Some of the groups are also used by moderators to advertise services (bottom right). Source (@jean_leroux / DFRLab)




In another instance, the very moderators meant to ensure a group did not spread false or misleading information were doing so themselves. Administrators on the CoronaVirus U.S.A. and the "main" CoronaVirus (COVID-19) Updates groups were seen posting links to Breitbart, ZeroHedge and Infowars.



DFRLab


Screengrabs from posts to various Fangate and AppleBerry groups that linked to dubious websites containing disinformation, including Breitbart and Infowars. The posts to Infowars and Breitbart were posted by an administrator of the CoronaVirus USA group. (Source: Facebook)




Fangate's modus operandi appears to be to create these groups, recruit several local volunteers as moderators and then leave the responsibility for managing group conversations with them.

This can be seen from posts made by the administrators requesting individuals to volunteer as moderators.

After the moderators have been appointed though, the administrators seem to leave the building: Posts from moderators expressed frustration at Fangate's apparent inaccessibility. This seems similar to what happened with an unrelated jobs group, also administered by Fangate.

A user review posted to the Fangate page claimed the group was overrun with adult content and that no moderation was performed on the group at all.



DFRLab


Screengrabs of several Facebook posts show page administrators Fangate and Chris da Silva calling on volunteer moderators (top right). One of the administrators lamented the fact that Fangate could not be reached after they created the group (centre). A post to an AppleBerry group (bottom left) indicated that there was a lot of misinformation being shared on the group without any moderation taking place, which echoes similar claims made about an unrelated Fangate administered page by a different user (right). (Source: @jean_leroux / DFRLab)


Conclusion

Although the AppleBerry page claimed the local South African and international groups were created to connect communities, not for the purpose of fear mongering or advertising, AppleBerry appears to be using the groups for the inverse purpose.

By marketing non-medical masks in the "occupational safety and health services" category on Facebook, drawing parallels between South Africa and Italy, and asking people to question how they will protect their family, the newly created company seems to be capitalising on the public's fear of Covid-19 to make a quick buck. As a result, AppleBerry is adding fuel to the infodemic fire that makes the work of healthcare workers on those on the front line of tackling the spread of the virus all the more difficult.

* This article was originally published by the DFRLab on Medium, here.

Stay up to date and stay healthy. Subscribe to Health24’s Daily Dose newsletter for important updates on the spread of the coronavirus. Register and manage your newsletters in the new News24 app by clicking on the Profile tab

Lockdown For
DAYS
HRS
MINS
Voting Booth
Have you downloaded the Covid-19 tracing app?
Please select an option Oops! Something went wrong, please try again later.
Results
Yes I have
13% - 753 votes
No, and I will not be downloading it
77% - 4283 votes
Not yet, but I plan to
10% - 545 votes
Vote
ZAR/USD
17.04
(-0.38)
ZAR/GBP
21.81
(-0.11)
ZAR/EUR
19.90
(-0.12)
ZAR/AUD
12.03
(-0.12)
ZAR/JPY
0.16
(-1.12)
Gold
1860.65
(+0.03)
Silver
22.87
(+0.11)
Platinum
844.51
(+0.50)
Brent Crude
42.23
(-0.12)
Palladium
2207.00
(+0.59)
All Share
53587.11
(-1.22)
Top 40
49547.74
(-1.16)
Financial 15
9401.28
(-1.95)
Industrial 25
72949.70
(-1.72)
Resource 10
53453.42
(-0.10)
All JSE data delayed by at least 15 minutes morningstar logo