Pigeon overlooks Kremlin. Image: Georgy Dzyura/Shutterstock
Facebook says it has detected a coordinated effort to influence US politics ahead of the 2018 midterm elections.
Facebook claims to have taken down 32 pages belonging to ‘bad actors’ out to influence or meddle with the upcoming midterm elections in the US.
The company last night (31 July) said it detected “coordinated inauthentic behaviour” before the elections that could be linked to the Internet Research Agency, a Russian hacker group with ties to the Kremlin.
‘We face determined, well-funded adversaries who will never give up and are constantly changing tactics. It’s an arms race and we need to constantly improve, too’
Unlike the 2016 election that saw Donald Trump named US president, it is unclear if these were actually linked to the Internet Research Agency because whoever set up the accounts went to considerable lengths to conceal their identities, using VPNs and internet phone services to mask their digital footprints.
The 32 Facebook and Instagram accounts had a total of 290,000 followers between them and paid third parties to spend $11,000 for 150 ads on both platforms.
Undermining democracy
Facebook said that there were similarities to previous Russian disinformation campaigns. Some of these were used to create political stability by pushing political stances and organising events, including a fake protest against a Unite the Right rally that was due to take place in Washington DC next week.
“We’re still in the very early stages of our investigation and don’t have all the facts, including who may be behind this,” Facebook said in a statement. “But we are sharing what we know today given the connection between these bad actors and protests that are planned in Washington next week. We will update this post with more details when we have them, or if the facts we have change.
“It’s clear that whoever set up these accounts went to much greater lengths to obscure their true identities than the Russian-based Internet Research Agency (IRA) has in the past. We believe this could be partly due to changes we’ve made over the last year to make this kind of abuse much harder.
“But security is not something that’s ever done. We face determined, well-funded adversaries who will never give up and are constantly changing tactics. It’s an arms race and we need to constantly improve, too. It’s why we’re investing heavily in more people and better technology to prevent bad actors misusing Facebook, as well as working much more closely with law enforcement and other tech companies to better understand the threats we face.”
Facebook’s head of cybersecurity policy, Nathaniel Gleicher, said that the company shared its investigation information with US law enforcement agencies, Congress, other tech firms and the Atlantic Council’s Digital Forensic Research Lab, a group that helps Facebook analyse abuse on its platform.
He said that more than 290,000 accounts followed at least one of these pages, the earliest of which was created in March 2017. The latest was created in May 2018.
The most followed Facebook pages were Aztlan Warriors, Black Elevation, Mindful Being and Resisters. The remaining pages had between zero and 10 followers, and the Instagram accounts had zero followers.
There were more than 9,500 organic posts created by these accounts on Facebook, and one piece of content on Instagram.
Out of the $11,000 spent on Facebook and Instagram accounts (paid for in US and Canadian dollars), Gleicher said that the first ad was created in April 2017 and the last in June this year.
The 32 pages created 30 events since May 2017. Half had fewer than 100 accounts interested in attending but the largest had approximately 4,700 accounts, and 1,400 users said that they would attend.
“These bad actors have been more careful to cover their tracks, in part due to the actions we’ve taken to prevent abuse over the past year,” Gleicher said.
“For example, they used VPNs and internet phone services, and paid third parties to run ads on their behalf. As we’ve told law enforcement and Congress, we still don’t have firm evidence to say with certainty who’s behind this effort. Some of the activity is consistent with what we saw from the IRA before and after the 2016 elections. And we’ve found evidence of some connections between these accounts and IRA accounts we disabled last year … But there are differences, too. For example, while IP addresses are easy to spoof, the IRA accounts we disabled last year sometimes used Russian IP addresses. We haven’t seen those here.”
Gleicher said that because the so-called bad actors are working harder to obscure their identities, Facebook needs to find every small mistake they make.
“It’s why we’re following up on thousands of leads, including information from law enforcement and lessons we learned from last year’s IRA investigation. The IRA engaged with many legitimate pages, so these leads sometimes turn up nothing.
“However, one of these leads did turn up something. One of the IRA accounts we disabled in 2017 shared a Facebook event hosted by the Resisters page. This page also previously had an IRA account as one of its admins for only seven minutes. These discoveries helped us uncover the other inauthentic accounts we disabled today.”
The suspicious event in question, ‘No Unite the Right 2 – DC’, was scheduled to take place in Washington this month. Inauthentic admins from the Resisters page managed to connect with admins from five legitimate pages to co-host the event. Those five legitimate pages then unwittingly helped to post information about transport and locations to enable the protests.
Facebook said it has reached out to the admins of the legitimate pages and has begun informing the 2,600 users that were interested in going to the protest as well as the 600 who said they would attend.
Digital democracy reaches a dangerous epoch
The whole saga shows how blatant and potentially effective these mysterious players are in bridging the virtual world of social with real-world physical protests.
In October 2017, Facebook admitted that Russian-backed content had reached as many as 126m Americans during the 2016 presidential election, with Russian IP addresses and ads paid for in roubles.
This time, possibly, the same bad actors are covering their tracks.
It is clear that Facebook is taking on the lessons learned from the 2016 elections and its role in democracy and curbing so-called ‘fake news’, especially since the Cambridge Analytica affair that exposed how 87m users’ accounts were gleaned for potentially nefarious purposes.
What is also clear is that nation states (many of which are pointing the finger at Russia’s Kremlin) see opportunities to exploit platforms such as Facebook to sow the seeds of division and discord in order to undermine western governments and democracies.
We are at the dawn of a deadly new epoch in democracy.
