News

Kosovar Facebook Pages Use Coronavirus Fears, 'Blue Lives Matter' Memes To Trick American Followers

Networks from the Balkans nation are deploying divisive content and patriotic nostalgia, echoing past foreign election-interference campaigns.

Published April 10, 2020

Dozens of Facebook pages run by residents and emigres from the Balkan nation of Kosovo have been pushing inauthentic, and at times inflammatory, "blue lives matter" and other American-themed content, a months-long Snopes investigation has found. The pages, some of which have existed since 2014, have grown an audience of more than 2 million followers, primarily Americans, using pro-police and pro-military content, as well as nostalgic memes and illegitimate giveaways.

In early 2020, the Kosovar administrators of a network of spammy pages used fears over the COVID-19 coronavirus disease pandemic to trick tens of thousands of people into entering illegitimate giveaways of "free groceries"—  and even a free mobile home. In another case, the Kosovar administrators of a "pro-police" group used photographs of a Mississippi man — without his consent, he says — to create a phony Facebook profile, apparently to give their efforts the veneer of American credibility.

It’s unclear what the long-term aims are of this coordinated inauthentic behavior. But Snopes has found evidence of financial motives in some cases, and in others, identified patterns of behavior that bear worrying similarities to previously revealed misinformation campaigns run by actors in Ukraine, as well as notorious Russian efforts during the 2016 presidential election.

Over the course of our investigation, some of the pages in question disappeared from Facebook, either because their administrators took them down, or Facebook did. We asked the social network which pages it had removed, on what dates, and for what reasons. Facebook didn’t answer those specific questions. But the company did say its automated systems had found and removed some pages before Snopes contacted the company and, based on information Snopes provided, removed still others for breaking Facebook’s rules against spam, impersonation, and inauthentic behavior.

Tiny Homes, Big Disappointment

In early 2020, a network of 51, largely Kosovo-run Facebook pages with more than 600,000 followers promoted an extraordinary offer: a free mobile home for someone who replied to a post with the word "Me," as well as liked the page and shared the promotion.

In fact, the network ran a whole series of giveaways in January 2020, offering followers "completely free groceries and meat for a year" and other free "mobile houses" and "tiny houses."

All available evidence indicates those promotions are illegitimate. Snopes tracked the progression of several "giveaways" in early 2020 and found that no real winner was ever announced. Facebook posts on the network repeatedly claimed that winners either couldn’t collect their prize because they were under age 18 or missed a deadline to collect.

That tactic meant that page admins could roll over the offered prize and fabricate a reason to re-promote it while also garnering a new wave of page likes, shares, and engagement — a classic example of using fake giveaways as a tactic for building audiences and "like-farming." Unlike authentic competitions or giveaways, those posted by the Kosovar network did not specify in advance that winners must be a resident in a particular region or country, or over a certain age, and none of the pages listed contact information, such as a physical address, location, phone number, or email address. Short of a signed statement by those behind the network, all available evidence suggests that the entire operation was inauthentic. In the rare case that a winner was announced, that, too, was faked.

For example, on Jan. 17, a Kosovo-run page called OMG posted a photograph of a happy-looking family with the message "Congrats to Morris family from Denver on their new mobile home. Live happily in your new home." Some Facebook users likely recognized that the photo of the "Morris family" showed actors posing for a stock image (see below, right), but many users possibly did not. And the latter would presumably further trust the authenticity of the OMG page, likely making them even more inclined to share, like, and engage the next time the page ran another "giveaway."

Here’s how the scheme apparently worked.

When unwitting users share the competition post and write "Me" in response to it, an account linked to the Kosovar network goes on their Facebook timeline and replies in turn, informing users they have won the prize and need only follow a certain link in order to register their details and claim the gift:

The link included in that post leads users to the following page:

Users who clicked on the "Register Now!" button were then directed to a suspect, Cyprus-registered "movie-streaming" website called Majerstars.com and were asked to sign up for an account by providing an email address and password:

Users who provided an email address and password were then directed to a page where they were asked to provide their credit card details, even though the previous page advertised "Majerstars.com" as having a "free" sign up. The site claims to guarantee that no charges will be levied, and that the credit card details are required only to verify a prospective user’s snail-mail address:

This claim makes little sense on its face, since the billing address associated with a user’s credit card need not bear any relation to the person’s mailing address, and that mailing address need not be located in the country from which the user accesses a particular website at a particular time.

In any event, we provided Majerstars.com with credit card details and signed up for a "free" trial membership. What we received in return was a catalogue of games that required a software download and absolutely no movie streaming or movie downloads, contrary to the website’s claim that a Majerstars account would allow you to "Watch your favorite movies for free."

After the five-day trial period, the site charged $34.95 per month.

It’s unclear what the relationship is between Majerstars and the network of Kosovar-run Facebook pages that funnel American users towards that site, and neither Majerstars nor any of the pages in the Kosovar network responded to our requests for comment. But the project as a whole bears many of the hallmarks of an affiliate marketing scheme. Such schemes, as we have reported previously, often involve a company that hosts a website offering intermediaries a certain flat fee or percentage of future earnings for every internet user direct towards the site, often using deceptive or misleading tactics, such as the giveaways deployed by the Kosovar network.

The giveaways appear to have violated several Facebook policies, including the company’s prohibition on "deceptive or misleading business practices" and its ban on scamming users out of "money or personal information"; a requirement that promotional content include text stipulating that Facebook does not endorse the promotion; and a ban on requiring users to share content in order to enter a competition.

“Due to the Coronavirus”

Some of the pages in the Kosovar network that promoted apparent fake giveaways in January 2020 were either deleted by administrators or removed by Facebook. But most of them were not, and in mid-March, they returned with a vengeance.

On March 17, the network systematically promoted a similar "tiny home" giveaway, this time attempting to leverage widespread concerns over the COVID-19 pandemic, with a post that read:  "Due to the Coronoavirus, we decided to give this $100,000 tiny house to someone who shares and comments 'ME' by 8pm, Thursday! Like our page for updates!"

Once again, an account associated with the network posted on the Facebook feeds of so-called "winners" and instructed them to follow a suspect link in order to claim their prize.

And again, that link directed users to an external website with a large "register now" button almost identical to the one used in January. Clicking that button again directed users to the deceptive Majerstars website.

The Power of Prayer Facebook page, which published the original coronavirus "giveaway," was created on March 17. The post was deleted later that day, but in less than 12 hours, Power of Prayer went from zero followers to more than 21,000 — a striking illustration of how effective such efforts can be. The network used the same tactic twice the next day, March 18, this time using the similar-sounding Prayer is Powerful Facebook page. By the time they had deleted both posts, Prayer is Powerful had gained more than 29,000 followers in one day.

On March 19, the network took these tactics even further, offering "free groceries" "due to the Coronavirus."

Amid economic instability and fears of food shortages, the "free groceries/coronavirus" effort clearly struck a chord. By the following morning, after two days of relentless suspect “giveaways,” Prayer is Powerful had more than 70,000 followers.

We sent Facebook a list of the 51 pages involved in the "giveaway" network and asked the company what steps it had taken to proactively prevent or remove such posts and pages, which seek to capitalize on fears over the COVID-19 coronavirus disease pandemic. The company did not respond to that specific question, but within two hours of our contacting Facebook, all but two pages from the "giveaway" network were no longer available.

“I don’t know what they’re trying to gain”: Fake Identities

While the giveaway network played upon the desperation of American Facebook users, other Kosovar clusters exploited some Americans’ shared values — a reverence for law enforcement officers and the military and a widespread sense of nostalgia and nationalism.

Since it was launched in September 2016, a Facebook group called Support Law Enforcement has acquired around 3,000 members. "We stand for American law enforcement!" the group proclaims. "Humanizing the men and women behind the badge."

In that spirit, members post memes, videos, jokes, and news articles that reinforce their shared respect for police in the United States. But they also post hyperpartisan, right-wing content with no relevance to policing: a video that falsely claimed Hillary Clinton had said "Christians must change their religious beliefs"; a video stream of a speech by U.S. President Donald Trump at a pro-life rally; a video claiming to expose "the truth about socialism"; an inaccurate meme about the Democrats’ policy on immigration and military pay. The one thing the group does not abide, it seems, is criticism of police. "ANTI-COP=Block/Delete," the group administrators warn.

When Snopes first discovered the page, in January 2020, it had three administrators. It would probably surprise some of the group members to discover that two of the administrators were Kosovars who appear to live in Germany — Adem Potoku and Igi Potoku. The third administrator profile, "Jacob Smith," featured a photograph of an African-American man wearing what looked like a police badge around his neck. The background image showed a first responder graphic with police, fire and EMT badges. His occupation was listed as "Police Sergeant" and his location as "New York, New York." The message was clear: the Support Law Enforcement group was on the level, and one of the people who ran it was himself a New York City police sergeant named Jacob Smith.

In reality, none of that was true. The man in the photographs was not even a police officer. His real name is James Foster, and he’s a 40-year-old private investigator who runs a company called Private Security and Investigations in New Albany, Mississippi. Foster told Snopes he had never even visited New York, not to mention worked as a police sergeant there. "I don’t know what they’re trying to gain or what they’re trying to do," said Foster, who was not aware his identity had been used until he was contacted by Snopes. “I was really shocked to see that. I’m just trying to figure out what the motive is for doing that,” he added.

"Jacob Smith’s" Facebook profile was created on Sept. 29, 2016 — the same day that Adem Potoku created the Support Law Enforcement group. Adem Potoku did not respond to our questions, but it appears that he created the persona of "New York Police Sergeant Jacob Smith" using photographs of a real person, in order to give the group a false veneer of law enforcement credibility and American authenticity.

After we contacted Igi Potoku on March 25, she abruptly changed the name of the group from Support Law Enforcement to Real Funny, hid it from searches, and removed herself as an administrator, effectively abandoning the group and leaving it without any custodians.

The Potoku Projects

In addition to the Support Law Enforcement group, Facebook accounts with the Potoku surname, which appear to be part of the same extended family of Kosovars located in various European countries, have been connected to at least five inauthentic Facebook pages or groups. Those pages or groups have garnered a total of 375,000 followers. All of them have hosted or published inauthentic, American-themed content.

Three pages — Police Officers, We Support Police, and All Lives Matter — listed the same YouTube channel, Police TV, as their website. That channel was registered in Finland and provided an email address for a “Kadir Potoku,” a Kosovar whose Facebook profile shows he lives in the Finnish city of Tampere. Both We Support Police and All Lives Matter had an administrator located in Finland, according to Facebook’s transparency tool, meaning it was highly likely that Kadir Potoku was that administrator.

All Lives Matter and We Support Police also listed their location as the city of Goppingen in Southern Germany. Snopes identified a Kosovar acquaintance of Kadir Potoku whose residence was listed as Goppingen, and who had liked other American law enforcement-related pages and posted "thin blue line" imagery on Facebook. But we were unable to confirm our suspicion that he was the Germany-based administrator of several inauthentic pages, including All Lives Matter and We Support Police.

It’s unclear whether or how Kadir Potoku and Adem Potoku are related, but they are undoubtedly acquainted with one another. Snopes discovered a photograph showing the two men together outside of a restaurant in the city of Podujevo, Kosovo, which was published to Facebook in August 2018 (the man at the far right is Adem Potoku, also pictured here).

That clear, real-life connection provides evidence of a link between the Support Law Enforcement group (whose administrators identified Mississippi resident James Foster as ersatz New York police sergeant “Jacob Smith”), and a cluster of similar, inauthentic law enforcement pages run by, or connected with, Kadir Potoku. Igi Potoku has also liked Kadir Potoku’s Facebook posts and photographs, demonstrating a direct connection between those two, as well. We asked Kadir, Adem and Igi Potoku a series of questions about their Facebook activities and their real-life connections to one another, but we did not receive a response from any of them. At the time of publication, all three Facebook accounts remained active.

“America is a dream. I have never left Kosovo.”

Kadir Potoku and Adem Potoku are also linked with a third cluster of inauthentic "American" police pages produced by their mutual acquaintance, Ibra Pervetica, a Kosovar man who has run several groups, including Law Enforcement Daily.

On Law Enforcement Daily, almost 2,000 members post pro-police content, with an emphasis on cute photos of K-9 dogs. But they also post anti-gun control memes and other content on divisive issues like drug testing for welfare recipients and racial-justice protests by NFL players.

At least one of the aims of the group appears to be Pervetica’s personal financial gain. When joining, would-be new members are asked to commit to inviting 10 of their friends to the group, and Pervetica facilitates the sharing of divisive content all while using the group as a platform to sell merchandise. On the top-right corner of every post and page within Law Enforcement Daily, readers are informed that the group is administered in part by a Facebook page called Police Officer USA, and a "Shop Now" button brings readers to Pervetica’s Teespring account. There he sells hoodies, T-shirts, mugs, and yoga pants emblazoned with "Thin blue line" imagery and often-ungrammatical text like "I support police officer, Im [sic] blue family." In addition to that inauthentic American law enforcement merchandise, he also sells apparel with generic motivational slogans like "Don’t wait for opportunity. Create it," or "Sometimes the heart sees what id [sic] invisible to the eye."

The Police Officer US page is administered by a single user in Kosovo, namely Pervetica. The third administrator for Law Enforcement Daily is a user who goes by the name "Brian Heidy," whose profile picture is a Texas Ranger badge, and who claims to work for Regis College at the University of Toronto. However, a quick glance at "Brian Heidy’s" timeline reveals several posts written in Albanian, and we found no evidence of anyone by that name having been employed by Regis College or the University of Toronto. This strongly suggests “Brian Heidy” is no more than another fabricated persona whose law enforcement-related profile photo and Anglicized name are intended to superimpose a veneer of false credibility in the inauthentic Law Enforcement Daily group.

However thin that veneer, it has clearly been enough to convince thousands of members to join, and some of them to engage in the Law Enforcement Daily "community." For example, a New York Police Department (NYPD) branch in North Brooklyn joined the group, appearing at the top of the list of members and no doubt giving a significant boost to the apparent credibility and authenticity of Pervetica’s project.

We asked the NYPD how this connection had come to pass, and whether it had any concerns that an official departmental social media profile appeared to endorse an inauthentic, foreign-run group that was used as a platform for selling merchandise. We received no response from the NYPD, and at the time of publication, the Brooklyn North NYPD page was still a member of Law Enforcement Daily, and had continued posting to Law Enforcement Daily several days after Snopes contacted the NYPD about the true provenance of the group.

Pervetica told Snopes that he had created several American police-themed pages and groups, though he did not provide their names. He said Facebook had deleted a few of them, but he had sold control of two pages to anonymous online buyers, for $200 each, after amassing around 52,000 followers for one, and around 26,000 for the other. He told Snopes that relatively high unemployment rates in Balkan countries like Kosovo meant growing and selling Facebook pages and groups was a popular way for young people to make money in those countries. “I grew the pages, then I sold them,” he explained. The focus on American law enforcement was purely a way to maximize engagement, rather than being borne out of any lived experience. Pervetica has never even visited the United States. “America is a dream,” he told us. “I have never left Kosovo.”

Notwithstanding the clear financial considerations involved in Pervetica’s activities, the motivations behind many of the Kosovar-run "blue lives matter" pages we uncovered were not clear. However, some of the tactics and patterns of behavior were reminiscent of previous foreign-coordinated inauthentic behavior.

In the run-up to the 2016 presidential election, Russian-directed fake accounts targeted divisive social and cultural issues like race and police brutality. Running several clusters of "blue lives matter" pages and groups, the Kosovar network we uncovered may be engaging in an attempt to facilitate and encourage a certain version of right-leaning, "law-and-order" politics in the United States, thus deepening existing tensions. Alternatively, the primary goal might be similar to the one articulated by Pervetica — fostering engagement and building audiences that can later be monetized.

"Remember When"

Another familiar tactic in building those audiences is the production and dissemination of what might be described as nostalgic Americana.

On Oct. 14, 2019, for example, three separate Facebook pages posted the same piece of nostalgic, American content, asking users "Would you drive an old Chevy Camaro?"

All three pages — Have, Be Helpful and Just by Time — are run by administrators in Kosovo, almost certainly the same ones. Along with a fourth Kosovo-run page, Best Of, they specialize in posting generic, motivational quotes, fuzzy memes about friendship and God, inoffensive "sharebait" and pieces of "good old days" nostalgia, like "I’m so glad I had a childhood before technology took over."

Between them, the three pages have 177,000 followers, even though they largely post the same content. Everything they publish is in English, and much of it is clearly aimed at an American audience, in particular older American Facebook users:

This cluster of Kosovar-run pages does not often publish explicitly political or nationalistic content (with some rather notable exceptions), but the tone is clearly pitched towards older, more socially conservative Americans, with a consistent emphasis placed on family values, traditional mores, and Christianity — a kind of softer version of the "Make America Great Again" ethos that helped fuel Trump’s surge to the presidency in 2015 and 2016.

The long-term goal of these pages may be to build up an audience that is on average somewhat culturally inclined toward conservative politics and right-leaning policies, and then at a certain point in time, shift the tone and subject matter of posts and memes to more politically explicit and divisive fare, in an effort to inflame tensions before the 2020 elections. We don’t have specific evidence to support this hypothesis, and it’s also possible that the objective behind these nostalgia-driven pages is simply to provoke engagement and build an audience for the purpose of selling some product, service or subscription or, as Pervetica says, the pages themselves, at a later date.

However, this kind of mass production of inauthentic, American-themed nostalgia by foreign accounts is something we’ve seen before. In October 2019, Snopes reported that World USA, a Facebook page with nearly 1 million followers that produced similar “generically patriotic, Norman Rockwellian remembrances of a bygone America,” was actually run by two individuals in Ukraine.

In a statement, a Facebook spokesperson told Snopes:

“We routinely take action when we find violations of our Community Standards, including spam and financially motivated inauthentic behavior. In this case, we removed a number of Pages and Groups that misled people about their identity and the origin of their content to drive people to their websites to generate ad clicks.”

We requested a breakdown of the names of pages and groups it had removed, the dates on which those actions were taken, and the reasons for each individual takedown, but we did not receive those details. We also asked Facebook what specific actions or protocols they had put in place to proactively combat illegitimate giveaways and other deceptive posts that capitalize on fears surrounding the COVID-19 coronavirus disease pandemic, but we did not receive a specific response to that question.

Conclusion

Many of the pages, groups, and accounts we uncovered over months of research violated multiple Facebook policies, including those against spam, impersonation, and inauthentic coordinated behavior. Some of them disappeared as we conducted our research, while Facebook took down others after we contacted the company. Still others were active at the time of this story’s publication. It remains to be seen whether the individuals behind those clusters will "start again" in the coming weeks and months.

In the case of the illegitimate "giveaways, that network risked the personal finances of those who fell for the scheme by funneling users towards a website that asked for credit card details, under the guise of asking “winners” to provide their contact details and claim their prize.

But the activities our research uncovered also had a less tangible but no less significant human impact: offering hundreds of thousands of Facebook users, principally Americans, a sense of belonging and community that was in reality built on fake foundations.

The pages and groups wasted countless hours of Facebook users’ time and attention by falsely presenting themselves as a home for real, patriotic Americans, when in fact they were run by foreign nationals, living thousands of miles away, with no actual experience of American life, and with their own dubious motivations. And in an era of widespread desperation and uncertainty, the Kosovar-run “giveaway” network offered more than 600,000 Facebook users false hope. In the throes of a global pandemic, and with millions experiencing financial uncertainty, participants pleaded with the administrators of the network for the miracle of a free home, or a free supply of groceries that, according to available evidence, did not exist.

"I raise my three grandkids without any help," one woman pleaded. "My husband passed away a year ago so I’m doing it all on my own … I desperately need this."

A man who said he had been unable to work for months after getting into an accident was moved by what he thought was the generosity and altruism of those who claimed to be donating a free home.

He wrote: "You guys have a huge heart to be giving this away at a difficult time of our lives."

Sources

Arntz, Pieter.   “Explained: Like-Farming.”    Malwarebytes Blog.   17 April 2019.

Kasprak, Alex.   “Savage Memes and Lunar Dreams: Deceptive Dating Sites’ Intimate Ties to Firefly Aerospace.”    Snopes.com.   12 February 2020.

Facebook.   “Pages, Groups and Events Policies.”    Accessed 17 March 2020.

Kosoff, Maya.   “How Russia Secretly Orchestrated Dozens of U.S. Protests.”    Vanity Fair.   30 October 2017.

Kasprak, Alex; Liles, Jordan; Green, Vinny.   “Popular ‘USA’ Facebook Page Run By Ukrainians Targeted Older Americans.”    Snopes.com.   1 October 2019.

Dan Mac Guill is a former writer for Snopes.

Jordan Liles is a Senior Reporter who has been with Snopes since 2016.