Thinking Pinoy: #JunkTerrorBill: Fake Facebook Accounts linked to Fake Death Threat?

University of the Philippines Los Banos student organization Defend UPLB announced on 07 June 2020 [1] that it took down one of its posts after it supposedly launched an investigation on the matter. It was referring to an earlier post claiming that a #JunkTerrorBill protester received a death threat from an unidentified number, a screenshot of which can be seen below:

As we all know, the post above was used to justify claims of various camps that the Duterte Administration or its allies are threatening members of the opposition.

But a little sleuthing reveals that there's something really fishy going on.

A day later on 08 June 2020, Defend UPLB said [2]:

“Defend UPLB categorically denies any allegations of manufacturing death threats. We received the report from one of our volunteers and urgently released an alert as our standard procedure. However, we admit that there was lack of oversight on our part to vet the reports.”

An Inquirer article dated 04 June 2020 describes DefendUPLB as a student alliance [3], so I do not understand how it would discriminate between "allies" and mere "volunteers." While I commend the organization for launching an investigation into the matter, I just find it odd that the organization's members appeared to have immediately disowned that "volunteer" when he, in fact, is a part of it.

In the same 08 June 2020 statement, Defend UPLB included a link to the "Volunteer's Personal Statement [4]", which leads to a post by UPLB student Ray Silvestre Binas explaining his side of the story.

Here are some of Binas' significant claims in the lengthy personal statement:

Binas claims to have received an anonymous SMS threat from a number.
He disposed of some unneeded personal stuff on 26 April 2020, and his sister asked him, on that same day, if he'd like to dump his phone.
He agreed without realizing that the phone had the SIM for the Defend UPLB hotline.
The SIM Card hasn't received any calls or messages from anyone.
He hasn't loaded credits on his phone for a long time because it's his alternate SIM.
He claims that around 10 AM of 07 June 2020, he "received a text message saying "mamatay ka na" received a text message saying 'mamatay ka na.'"
He said he was "paralyzed with fear until the group chat of the Defend UPLB popped out on my notifications, and I cannot think of anything else but to report this matter to them."
He said, "someone from [his] alliance noticed that the exact phone number used to threaten me was the CRW hotline number last March.

The "personal statement" includes five photos:

1:A screenshot of the alleged SMS death threat from +639351220364, with time stamp 10:42 AM, 07 June 2020

2: A screenshot of an allegedly fake Facebook account with the name "Binas Ray."

3: A screenshot of Facebook image post of his supposed decluttering, which clearly shows "26 April".

4: Another screenshot of a 26 April 2020 Facebook image post of his supposed decluttering.

5: A screenshot of a random online article on how to clone phone numbers.

Fact-checking Binas

Binas claims he cleaned his flat on 26 April 2020, and only after then did he decide to dump the old phone, including the SIM card for Defend UPLB's hotline.

Defend UPLB has been using that number for its hotline no later than 16 March 2020, or when it announced [5] its Citizen Rights Watch project on Facebook, as shown below:

Given this, why would Defend UPLB allow who it considers as a mere "volunteer" – and a college freshman at that – to handle a hotline that deals with such sensitive and dangerous topics?

Defend UPLB is arguably a high-profile organization after being featured multiple times in news outlets like Inquirer [6], Interaksyon [7], Bandera [8]. The organization has also been featured in Rappler almost every month since 2014 [9].

Page after page of Rappler articles featuring Defend UPLB, with one published in 2014.

Such a high-profile organization with at least 6 years of experience would know better than to let an inexperienced volunteer handle such a critical task, right?

Moreover, considering that Defend UPLB has been in the news since 2014 and it repeatedly advertised the number on 17 March 2020 [10], 22 April 2020 [11], what are the odds that it hasn't received any SMS or calls for over a month, especially if the hotline is for reports involving harassment from the government?

Cloned SIM Card?

Recall that Binas claims somebody cloned his SIM and texted him using that cloned number.

But if Binas really did throw his phone and SIM into the trash, why would anybody bother to clone his number when one can just pick up the SIM and use it right away?

There's COVID-19 epidemic, so why would anybody go to the junkshop and expose himself to toxic waste just to get a SIM card when he can just buy a brand new one for next to nothing?

Is Binas, who Defend UPLB describes as just a "volunteer," so outstanding that somebody with very sophisticated electronics skills will bother spoofing him?

If Binas mistakenly threw the phone and SIM away on 26 April 2020, why would Defend UPLB still advertise the number on 28 April 2020 [12] and 01 May 2020 [13]?

Most importantly, Defend UPLB even advertised the same number on 02 June 2020 [14] for registration of participants in its 04 June 2020 conference entitled "Ensuring Campus Safety under the Anti-terrorism Bill," an event that apparently pushed through [15].By dignifying Binas' personal statement, is Defend UPLB suggesting that the conference pushed through without them checking if anybody registered by contacting that hotline? Suppose Defend UPLB knew of the SIM card's loss, why didn't they announce it?

Are Binas and Defend UPLB basically saying that "the dog ate their homework"?

Whichever way it goes, it appears that Binas and Defend UPLB are lying.

Data suggest that Binas received the SMS death threat from somebody in charge of Defend UPLB's hotline and that somebody could be Binas or one of his pals in the organization.

The Fake Facebook Accounts

On 07 June 2020, thousands of fake Facebook accounts popped up overnight, mostly spoofing names of Filipino university students, faculty, and alumni [16].

Note that the fake accounts aren't fully-populated profiles: no photos, no posts, no friends' list, and they contain only the name of the person impersonated, and most of the victims are students or school employees.

Like this.

Again, we know two things:

The fake accounts typically contain only a name and nothing else.
Most of the victims are connected to universities.

Hold on to that thought for now.

Defend UPLB is the same organization that started the Change.Org petition [17] entitled "JUNK THE ANTI-TERRORISM BILL AND UPHOLD HUMAN RIGHTS!", which garnered almost 800,000 signatures as of 08 June 2020.

Change.Org, where the petition is located, allows a petition's starter to download the list of all those who signed the petition, either in PDF or Excel format, as shown below:

The resulting list contains the signatory's name, location, and the date he signed the petition. The location may sometimes include the signatory's city or just the signatory's country. Suffice it to say, the only useful field there is the one containing the names.

Isn't it too coincidental that the Change.org petitions have nothing but the names, just like the fake Facebook accounts that everybody's been complaining about?

Isn't it too coincidental that Defend UPLB's primary audience is university students and faculty, and the majority of the fake Facebook accounts contain names of people from that same community?

And most importantly, which among these possibilities is most likely:

Somebody hacked a database other than the signatories list in Change.org, and that database coincidentally also focuses on schools, and the names were used to create the fake accounts;
Somebody hacked the database of this Change.org petition, and the names were used to create the fake accounts;
Defend UPLB, who already has access to the list of names, used the names to create the fake accounts

Well, Occam's Razor suggests that all things being equal, the simplest solution tends to be the best one.

I see the perfect opportunity for agitprop, the weapon of choice of many left-wing groups.

There is much ready-to-use software out there that can automatically create fake Facebook accounts using a database of real names. I won't teach you how to do that in this article, so I won't get into trouble.

The Weird Timestamps

Interestingly, Binas edited his personal statement on Facebook 13 times in about five hours.
His edits have the following timestamps:

3:59 PM – Original Post
4:01 PM – 1st edit
4:01 PM – 2nd edit
4:02 PM – 3rd edit
4:03 PM – 4th edit
4:04 PM – 5th edit
4:06 PM – 6th edit
4:11 PM – 7th edit
4:17 PM – 8th edit
4:22 PM – 9th edit
4:22 PM – 10th edit
5:13 PM – 11th edit
6:56 PM – 12th edit
8:38 PM – 13th edit

Defend UPLB's post [18] that links to Binas' personal statement has a timestamp of 4:05.

Timestamps of the first six versions of Binas' personal statement, he edited his personal statement every minute (3:59 PM, 4:01 PM, 4:01, 4:02 PM, 4:03 PM, 4:04 PM), then the seventh edit is at 4:06. Nothing happened at 4:05, which is the exact time that Defend UPLB shared Binas' personal statement.

Given this, which among the following is most likely:

Binas, the inexperienced freshman, is also the administrator of Defend UPLB's Facebook Page;
Defend UPLB almost instantaneously shared Binas' personal statement after the latter published it;
Binas and Defend UPLB helped each other in crafting Binas' personal statement; or,
The 4:05 PM blip is purely coincidental

What's more interesting, however, is the 13th edit.

The original post until the 12th edit contains the sentence:

“My family is already seeking the help of the authorities like the NBI and the network operator, which is TM to resolve this matter.”

Then four hours later, Binas changed that sentence into:

“My family is already seeking the help of the right authorities and the network operator, which is TM to resolve this matter.”

Why did Binas decide to remove the phrase "like the NBI," when the NBI should be the first authority he should consult? Does he intend to avoid the NBI at all costs? If so, why?

NBI, can you invite Binas and Defend UPLB's officers? You guys may want to ask them more than a few questions. [Thinking Pinoy / RJ Nieto]