Facebook page 'Vets for Trump' was hijacked, controlled for months by North Macedonians
By CRAIG TIMBERG | The Washington Post | Published: September 17, 2019
The Facebook page "Vets for Trump" was for most of its existence exactly what it seemed: a place where former U.S. servicemembers touted Donald Trump, discussed veterans issues and shared conservative memes with its more than 100,000 followers.
Then in March, say its longtime operators, a North Macedonian businessman hijacked it, leaving the Americans to watch helplessly as their page began operating under foreign control. Their messages seeking help from Facebook led to months of miscommunication and inaction.
The takeover of Vets for Trump, which has not previously been reported, underscores how money, politics and online misinformation remain deeply and often invisibly entangled ahead of the 2020 presidential election, despite years of promises by government officials and technology companies to combat such problems.
Foreign actors — some seeking profit, some seeking influence and some seeking both — haven't flagged in their efforts to reach U.S. voters through online information sources such as Facebook, Twitter and YouTube. Veterans and active-duty military personnel are especially valuable targets for manipulation because they vote at high rates and can influence others who admire their records of service.
"Veterans as a cohort are more likely than others to participate in democracy. That includes not only voting but running for office and getting others to vote," said Kristofer Goldsmith, chief investigator for Vietnam Veterans of America. He was the first to discover the takeover of Vets for Trump during research for a report to be released this week that documents widespread, persistent efforts by foreign actors to scam and manipulate veterans over Facebook and other social media.
The saga of Vets for Trump is a case study in how misinformation and political activism can become intertwined, and how the line between domestic and foreign actors can blur in an online world where social media accounts can be bought, sold and even hijacked. Ferreting out misinformation could become even harder ahead of the election as Facebook expands its private "groups," which are less transparent than "pages" such as Vets for Trump.
The shift to foreign control — into the hands of people who were neither American veterans nor U.S. voters — was all but invisible to those following Vets for Trump. There was no announcement, no telling change in the page's graphics, which depicted the president with his fists raised as if in a boxing ring. And the conservative memes kept coming, including many celebrating the president and bashing his potential Democratic opponents for reelection.
One meme in April pictured Sen. Bernie Sanders and former vice president Joe Biden with the caption "THE TWO FRONT RUNNERS FOR THE PARTY THAT HATES OLD, RICH, WHITE MEN." Other memes posted during the period of North Macedonian control ridiculed special counsel Robert Mueller, former FBI director James Comey and Rep. Alexandria Ocasio-Cortez, D-N.Y., a leading target of conservative attacks.
As the memes flowed, Vets for Trump also started seeking donations, according to online records of the exchanges. When a woman calling herself Laura messaged the page in July offering to give $25 in memory of her late father, who was a veteran and Trump supporter, a page administrator directed her to a PayPal account affiliated with a North Macedonian website known for spreading highly partisan, pro-Trump stories to American audiences during the 2016 presidential election.
"I've been writing Facebook letters saying, 'I have a problem, I have a problem, I have a problem,' " said Vets for Trump administrator and co-founder Vlad Lemets, a U.S. Army veteran who lives in Florida. "This could have been easily avoided if Facebook had just listened."
Facebook said it replied to one of the notes as far back as April but did not get a response to its request for more information.
"For many groups, their Pages are an essential way to connect, and this particular instance is an unfortunate abuse of what they've worked to build," said Jennifer Martinez, a Facebook spokeswoman.
The takeover of Vets for Trump began after a seemingly innocuous inquiry arrived in March over Facebook, according to Lemets, who was born in Russia but immigrated to the U.S. as a teenager and is now a citizen. A man who identified himself as Andrej Spasovski offered to generate profit for the page by helping expand its audience and place ads. In the exchange, Spasovski and his company, Ad Break, were to share the resulting revenue, which he estimated eventually could reach into the tens of thousands of dollars.
Fielding the inquiry was Navy veteran Joshua Macias, a Trump enthusiast and information technology consultant who was a co-founder and main administrator of the Facebook page. Macias said he previously had seen but ignored dozens of inquiries about business opportunities. He found Spasovski's pitch more compelling than others because he said it would allow the Americans to maintain control while reaping money to underwrite the site's political activities.
Spasovski soon added Macias as an administrator to the Ad Break business page on Facebook. Then Macias agreed to give Ad Break administrative powers over Vets for Trump, a move that let whoever controlled Ad Break operate the page, post content and alter settings.
Macias soon realized that he had been duped. His status on the Ad Break page was abruptly demoted to "employee" — with less authority than an administrator — and Ad Break was listed as the "owner" of Vets for Trump"
Macias said he had been under the impression that he had several days to reverse such a transfer of administrative powers, but he was wrong. There was no way for Macias to undo the move. Then the news got worse: Ad Break removed Macias and several other administrators from the Vets for Trump page, he said. Spasovski was in charge.
"I realized we had a real problem when he locked me out," recalled Macias, who lives in Virginia Beach. "That's when I knew he had control."
Spasovski did not reply to messages from The Washington Post seeking comment by phone, text and Facebook's messaging service.
The takeover of Facebook pages — sometimes through deception, sometimes through private purchase agreements — has become increasingly common on the platform, say misinformation researchers. Those who gain control of popular pages can place ads, direct traffic to outside web sites and sell products such as T-shirts or solicit donations.
Martinez, the Facebook spokeswoman, said, "We encourage Page owners to exercise extreme caution in turning over administrative rights to anyone, and never to someone they don't know."
In the course of the struggle over Vets for Trump in March, Macias discovered that Ad Break was based in Kumanovo, a city less than an hour's drive from Skopje, the capital of North Macedonia.
The Balkan state had emerged as a hub for sites peddling misleading news reports aimed at American readers, as documented by BuzzFeed News and other news organizations. BuzzFeed counted 140 politically themed websites operating in what was then called Macedonia, a former Yugoslav republic, shortly before the November 2016 presidential election. Such sites pushed viral reports about the pope favoring Trump and the FBI preparing to charge Democrat Hillary Clinton with crimes.
As the sense of crisis at Vets for Trump deepened, Macias and Lemets sought help from Facebook. They began sending emails, they said, and Macias sent a note through an online Facebook portal he found on April 6.
"ALERT," said the message, according to a screen shot. "HACKED PAGE."
Macias then described the "hostile take over by a foreign entity" and said that he also had called the company to report the problem. Facebook — in an apparently automated response — took note of the complaint from Macias and assigned a 16-digit case number.
This query, according to Facebook, prompted a response to Macias delivered to an inbox on his personal Facebook page and accompanied by a notification. But Macias said he does not recall seeing any such communication and that he would have acted on it if he had.
"Anything they did was really pathetic," Macias said.
A few weeks later, on April 29, Lemets sent his own email to Facebook's advertising department along with a sworn affidavit from Macias. Memes from North Macedonia, meanwhile, were appearing several times a day on Vets for Trump.
"We LOST the control of the page," Lemets wrote to Facebook. "This is NOT our Team. This has NOTHING to do with us. They POSE as the page owners and post content WE have NOT approved. We don't know at this point who they are. Please return the page to rightful owners."
The frantic communications and missed connections went on for several more months.
Sometime between March and August, Vets for Trump came under the control of a second North Macedonian, Panche Arsov, the younger of two brothers well known to those who study foreign misinformation.
The Arsovs had featured prominently in the BuzzFeed story last year. Elder brother Trajche Arsov, an attorney, was the creator and owner of USAPoliticsToday.com, which during the 2016 election generated millions of page views with sharply conservative, pro-Trump stories, many of them variations on conservative conspiracy theories, according to BuzzFeed. One headline read, "Obama's Ex-Boyfriend Reveals Shocking Truth That He Wants To Hide From America."
Trajche Arsov said he paid freelance writers to do this work, which consisted mainly of rewriting articles they found on conservative American news and opinion sites and adding new headlines. A key goal was avoiding violations of U.S. copyright law, Trajche Arsov told The Washington Post.
Of such activity, Trajche Arsov said by phone, "We have done nothing wrong. It's not criminal here. It's all legal."
Other Macedonians that election season followed the lead of Trajche Arsov, creating their own sharply conservative sites to profit from the rapt attention of American readers, but he remained the industry leader. It was an operation, he said, that started as a business venture but increasingly became a political passion.
"I respect conservatives more than liberals," he said. Of his site's efforts to help Trump in 2016, Trajche Arsov added, "We helped the American people decide on the right person."
As Trajche Arsov recounted the story of his brother acquiring Vets for Trump, he offered a twist.
When Panche Arsov first raised the subject of possibly purchasing the page, his elder brother was surprised, he said. Trajche Arsov knew there was rampant buying and selling of pages on Facebook, which he said was riddled with fraud. But this particular page, Vets for Trump, was one that Trajche Arsov had heard of before.
"Wait a second," he told his brother, "I know the real owner of this page."
And while ownership is a slippery concept when it comes to social media accounts, Trajche Arsov did indeed know the man who once controlled Vets for Trump.
But it wasn't Spasovski. It wasn't even Lemets or Macias.
The man Trajche Arsov knew was a voluble, conservative Texan named Thomas Dillingham. A former Marine, he was the original veteran behind Vets for Trump. Facebook records showed that the page for a time was called "Thomas Dillingham, a Vet for Trump."
Not long after starting the page in 2015, Dillingham had joined forces with Lemets and Macias, whom he had met online. All three were veterans and all three were excited about Trump and his conservative rhetoric. Dillingham backed away from Vets for Trump, however, in 2017 as he focused on other projects, leaving Lemets and Macias in charge.
But, as Trajche Arsov recalled, there was more to Dillingham's story.
In 2016, Dillingham provided online services to more than a dozen politically conservative sites from his business in suburban Fort Worth, Dillingham said. He said this included, for a brief period, Arsov's site USApoliticstoday.com.
But the busiest and most lucrative was LibertyWritersNews.com, run by a pair of former restaurant workers who dubbed themselves the "new yellow journalists" as they churned out stories with headlines such as "BREAKING: Top Official Set to Testify Against Hillary Clinton Found DEAD!," according to a Washington Post story shortly after the presidential election that year. At its peak around the presidential election, the site generated tens of millions of clicks a month, Dillingham said.
"I wasn't paying attention to what they were writing," Dillingham recalled. "I was eyeballs deep in the technical aspects of it," though he acknowledged that the content was "click bait." "I don't dispute the fact that their headlines were deceptive." (He said the site closed in 2017.)
After Dillingham turned over control of Vets for Trump to Macias and Lemets, they worked to build its popularity by posting and reposting conservative memes, including some that generated accusations of misinformation.
The report from Vietnam Veterans of America singles out a doctored, misleading image from January of Rashida Tlaib, D-Mich., a Muslim pictured with three other women of color with a black ISIS flag and a picture of Osama bin Laden in the background. The text says, "Guess who's sitting with a picture of Osama bin Laden and an ISIS flag!? Yep, the new Congress woman and leftist media darling Rashida Tlaib."
The fact-checking sites Snopes identified a meme posted in September 2017 by Vets for Trump as "false" for depicting an African American football player burning a flag in the Seattle Seahawks locker room — an incident that never happened.
Both doctored images were posted during the period when Macias and Lemets controlled the content on Vets for Trump. Both said, in interviews with the Post, that while they didn't create the images, they were fair game in the world of memes, where those who share such images do not expect literal truth.
"You're fact checking a meme?" Macias said. "Come on, man."
The story behind Vets for Trump began to surface when Goldsmith, the researcher for Vietnam Veterans of America, was digging through pages that targeted veterans and noticed some curious things.
The page was relentlessly political, with little content for veterans specifically. When Goldsmith checked the "Page Transparency" box — a feature Facebook that allows users to see where page administrators are based — he discovered that three of those listed for Vets for Trump were based in North Macedonia; none was based in the United States.
One more thing caught his attention: Under the contact information for Vets for Trump was an email address that included the name "Arsov" — a name he recognized from the BuzzFeed story.
Goldsmith sent a query to the email address — without knowing anything about the struggle among Macias, Lemets and Spasovski — asking basic questions about who controlled the page. In the exchange that followed, Panche Arsov declared himself the rightful owner of Vets for Trump.
"I am the owner of that Page Vets for Trump since April 2019," Arsov wrote to Goldsmith. "I bought it from the previous owner. What else do you want to know about it?"
When Goldsmith pushed for a more thorough explanation, he hit a wall.
"Unfortunately, I can't tell you anything else cuz you should respect my privacy," Arsov said by email. "Have a nice day."
The full story gradually tumbled out. Goldsmith found Macias, Lemets and Dillingham and heard their stories. Panche Arsov, despite his initial resistance, kept chatting by email. Goldsmith also learned that Vets for Trump had recently shifted back to the control of the American vets.
Lemets and Dilligham said they finally established successful contact with a representative in Facebook's advertising department in July — in a communication in which they also offered to buy ads if they could regain control of the page. Facebook returned it to them in mid-August, they said.
Panche Arsov, however, was unhappy about losing control of Vets for Trump, and complained to Goldsmith that his legitimate purchase had been undermined by Facebook. In email exchanges with the Post, Panche Arsov declined to say how much he paid for Vets for Trump or provide evidence of the purchase, which his brother said happened in June. Panche Arsov also said he was "pro-conservative" and supported Trump.
Goldsmith came away convinced that the entire Macedonian operation was about deceiving and manipulating American veterans ahead of the 2020 election. It's a theory with ample circumstantial evidence. Two leading misinformation research groups — Oxford University's Computational Propaganda Project and network analysis firm Graphika — have documented extensive efforts to target U.S. veterans, active duty personnel and their families online.
But, according to Goldsmith, who studied the page for months, the content on Vets for Trump did not markedly change either after the North Macedonian takeover or when the American veterans regained control.
"The changes are subtle and would only be noticeable to somebody like me who's been staring at this propaganda for two years," Goldsmith said.
Goldsmith's suspicions about the motive behind the Macedonian takeover are shared by Lemets. "They were growing this following, and they were pretending to be us," he said. "It all boils down to what would have happened during the election time."
But Trajche Arsov said the motive was not influence but profit.
"It was just business," Trajche Arsov said.
The Washington Post's Alice Crites contributed to this report.