Overseas Operators, Domestic Identities

Accounts traced to India, Pakistan, and Indonesia have been posing as Albertans inside the province's most active separatist Facebook groups. CBC News reported this on 9 June 2026 after investigating coordinated inauthentic behavior — a term meaning multiple fake accounts working together to influence online conversation.

The CBC found more than a dozen such accounts in the highest-traffic Alberta separatism communities. But these accounts did more than just share posts. They copied material directly from real Albertan users — profile details, photos, text — and reposted it under fake identities. This technique is called persona hijacking, and it's a way to make false content look legitimate.

These were not fringe accounts. They were active contributors in groups that serve as main organizing spaces for a politically charged movement that has grown noticeably in Alberta's mainstream politics over recent years.

What the Accounts Were Doing

The activity follows a pattern that security researchers call an influence operation: creating or stealing convincing local identities to spread or amplify messages while hiding where those messages actually come from.

Copying content from real Albertans serves a specific purpose. A brand-new account with no local history looks suspicious — other users report it, and algorithms flag it. But an account that posts like an established community member, uses similar language, and even borrows their images gains what researchers call "social proof." When other group members engage with this content, they're unknowingly amplifying a message whose true origin has been hidden.

The accounts came from three countries — India, Pakistan, and Indonesia — but that does not necessarily point to a single government running the campaign. Instead, it could reflect either state-linked operations or the broader commercial disinformation market, where operators in various countries run fake campaigns for clients whose identities may never become public.

The Larger Context in Canada

This discovery fits within a broader pattern of foreign interference in Canadian politics. In the second half of 2023 alone, Canada's G7 Rapid Response Mechanism — a multilateral unit designed to catch foreign information operations — uncovered two separate disinformation campaigns targeting Canadians on WeChat, X, and Facebook.

Canada's Security Intelligence Service has separately identified foreign interference as a material threat to Canada's democratic institutions and the rights that depend on them. The service takes a broad view: it covers not just election interference but the slower, harder-to-see erosion of public conversation through sustained false narratives.

Alberta separatism is a valuable target for any actor interested in fracturing Canadian political unity. The movement involves federal-provincial tension, energy policy, identity, and constitutional questions — issues with enough real domestic heat that externally amplified content can easily blend in with organic discussion.

Why Platforms Struggle to Catch This

Meta, which owns Facebook, has published reports on coordinated inauthentic behavior since 2017. The company's system is built to detect networks of accounts that work together, share the same technical infrastructure, or use automation at scale. But the activity the CBC found does not necessarily trigger these alarms. Accounts that are individually operated, manually posted, mimic real users, and embed themselves in genuine communities rather than creating separate pages are structurally harder for Meta's systems to catch.

This is not a new problem. Researchers at Stanford's Internet Observatory, Oxford Internet Institute, and the Atlantic Council's Digital Forensic Research Lab have documented it repeatedly: the most effective influence operations are the ones that look least like influence operations. They avoid the coordination signatures — shared internet addresses, synchronized posting, templated language — that automated detection catches. They simply look like ordinary users.

There is an important detail here. The CBC investigation was conducted by journalists using traditional reporting methods, not by Meta's own trust-and-safety team. That matters significantly. If the accounts were still active when journalists found them, it suggests Meta's own detection systems had not caught them before publication. Meta had not publicly confirmed any enforcement action against those specific accounts at the time of reporting.

The Identity Theft Problem

Copying content from real Albertans introduces a harm beyond just damaging those individuals' reputations. Some of the engagement those fake accounts generated — likes, comments, shares, algorithmic boost — may have fed back into the feeds of the real users whose content was stolen. After the fact, it becomes hard to distinguish between genuine community growth and artificially inflated activity.

I have watched enough cycles of platform-mediated manipulation over the past three decades to recognize what makes this different from the bot farms that dominated headlines around 2016 and 2017. The shift from automated, high-volume, low-quality accounts to small numbers of convincing persona impersonation reflects a direct adaptation to better detection. This is an arms race, and right now the advantage goes to the attacker — because passing as human simply requires behaving like one, while detecting that behavior across billions of accounts at scale remains unsolved.

What This Means for Policy and Practice

For security researchers, trust-and-safety teams, and policymakers, the CBC findings point to several practical lessons.

Geographic location alone does not tell you who is behind an operation. Accounts from South or Southeast Asia posting Canadian political content could reflect government direction, commercial actors, ideologically motivated individuals, or some mix. Automatically equating geography with state sponsorship has distorted public understanding of influence operations in the past.

There is a documented shift in how influence operations work: they increasingly target sub-national movements — like Alberta separatism — rather than national elections. This is harder to monitor, harder to attribute, and harder to counter because the affected communities are smaller, less resourced, and less likely to have researchers watching them. A Facebook group for regional politics does not receive the same scrutiny as a federal election campaign.

For platforms, the case reinforces that current enforcement approaches need to expand. Detecting persona hijacking and low-speed infiltration tactics requires methods beyond current account-level monitoring. Some researchers have proposed analyzing behavioral patterns across networks of accounts rather than examining accounts individually, though no major platform has publicly committed to deploying this at scale.

For Canadian policymakers, this episode will likely strengthen calls for mandatory platform transparency — requirements that go beyond Meta's voluntary reports and force identification of coordinated activity targeting Canadian communities in near-real time.

The Unanswered Questions

The CBC investigation proves that foreign-operated accounts were manufacturing fake Albertan political participation. But it cannot answer the harder question: how common is this. More than a dozen identified accounts in top groups is likely a minimum, not the total. Standard practice assumes that visible detected activity understates the full scope of any operation.

What we know: foreign-operated accounts were creating the appearance of grassroots political participation. What remains unclear: the scale, who funded it, how long it ran before detection, and what measurable impact it had on the communities it targeted. Platform data, if properly disclosed, could begin to answer those questions.