Facebook Identifies an Active Political Influence Campaign Using Fake Accounts
WASHINGTON — Facebook said on Tuesday that it had identified a coordinated political influence campaign that was potentially designed to disrupt November’s midterm elections, with the social network detecting and removing 32 pages and fake accounts that engaged in activity around divisive social issues.
The Silicon Valley company did not definitively link the campaign to Russia. But Facebook officials said some of the tools and techniques used by the accounts were similar to those used by the Internet Research Agency, the Kremlin-linked group that was at the center of an indictment this year alleging interference in the 2016 presidential election.
“At this point in our investigation, we do not have enough technical evidence to state definitively who is behind it,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy. “But we can say that these accounts engaged in some similar activity and have connected with known I.R.A accounts.”
The jolting disclosure, delivered to lawmakers in private briefings on Capitol Hill this week and in a public Facebook post on Tuesday, underscored how behind-the-scenes interference in the midterm elections has begun. In recent weeks, there have been reports of other meddling, including a Daily Beast report that the office of Claire McCaskill of Missouri, one of the Senate’s most vulnerable Democrats up for re-election this fall, was unsuccessfully targeted by Russian hackers last year, which Ms. McCaskill confirmed. American intelligence officials have indicated that at least one other unnamed Democratic senator up for re-election has been targeted.
Facebook’s announcement on Tuesday was a proactive tack to ward off a major national security threat. Company officials said they were working with the Federal Bureau of Investigation and other intelligence agencies on the matter. And Sheryl Sandberg, Facebook’s chief operating officer, and other executives mounted a media blitz after the announcement to explain what the company did and did not know about the influence campaign.
Those actions were a far cry from last year, when the social network was widely criticized for failing to detect Russian interference in the 2016 election. It took Facebook executives months to acknowledge the extent of the Russian operation, and release information connected with their investigation.
Since then, Facebook and its chief executive, Mark Zuckerberg, have been under siege from lawmakers and regulators for other scandals including data misuse, a misinformation epidemic and allegations of political bias. Last week, the company lost more than $120 billion in market value as it projected it would spend more money on moderation and security.
Hogan Gidley, a White House spokesman, did not directly address Facebook’s findings with reporters aboard Air Force One on Tuesday, but he said President Trump had “made it clear that his administration will not tolerate foreign interference into our electoral process from any nation state or other malicious actors.”
Earlier on Tuesday, Mr. Trump declared again on Twitter that there had been “No Collusion” between his campaign and the Russians, and asserted that, in any case, “collusion is not a crime.”
Lawmakers from both parties quickly set aside questions of who had perpetrated the influence campaign and said Facebook’s disclosure only clarified what they had feared since the extent of Russian involvement in 2016 became clear more than a year ago: that social media companies would be unable to keep up with the pace and scope of malicious efforts to abuse their platforms.
Senator Mark Warner of Virginia, the top Democrat on the Intelligence Committee, praised Facebook on Tuesday for bringing the activity out into the public, but asked for its cooperation in updating laws to prevent influence campaigns.
“Today’s disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation,” he said.
Senator Richard M. Burr of North Carolina, the committee’s Republican chairman, said he would make the disclosure a central part of a previously scheduled hearing on Wednesday, when lawmakers plan to press outside experts on the pervasiveness of foreign influence on social media networks like Facebook.
Facebook executives characterized the continuing battle with foreign campaigns as a cat-and-mouse game, but said they were making progress to detect suspicious activity more quickly.
“Security is an arms race, and it’s never done,” Ms. Sandberg said in a conference call on Tuesday.
Facebook said the recently purged accounts — eight Facebook pages, 17 Facebook profiles and seven Instagram accounts — were created between March 2017 and May 2018 and were first discovered two weeks ago. More than 290,000 accounts followed at least one of the suspect pages, which had names like Aztlan Warriors, Black Elevation, Mindful Being and Resisters, the company said.
Between April 2017 and June 2018, the accounts ran 150 ads costing $11,000 on the two platforms. They were paid for in American and Canadian dollars. The pages created roughly 30 events over a similar period, the largest of which attracted interest from 4,700 accounts.
Finding suspicious activity was harder this time around, Facebook said. Unlike many of the alleged Russian trolls in 2016, who paid for Facebook ads in rubles and occasionally used Russian internet protocol addresses, these accounts used advanced security techniques to avoid detection. For instance, they disguised their internet traffic using virtual private networks and internet phone services, and used third parties to buy ads for them.
“These bad actors have been more careful to cover their tracks, in part due to the actions we’ve taken to prevent abuse over the past year,” Mr. Gleicher said.
But there were clues that the suspicious accounts may have been connected to the Internet Research Agency. Mr. Gleicher said an account known to be associated with the agency had been listed as an administrator of one of the pages for seven minutes.
Like the 2016 Russian interference campaign, the recently detected campaign sought to amplify divisive social issues, including through organizing real-world events.
Among the campaign’s efforts was organizing support for a counterprotest to a conservative rally. Specifically, an account called Resisters, which interacted with one Internet Research Agency account in 2017, created an Aug. 10 event, “No Unite the Right 2 — DC,” to counter a planned white supremacist rally in Washington on Aug. 11 and 12 by the same group that organized the racist march in Charlottesville, Va., one year earlier.
Although other Facebook pages are promoting the counterprotest, the social network said that the Resisters page was the first, and that it had coordinated with administrators for five other apparently real pages to co-host its page — publicizing details about transportation and other logistics. A person familiar with the matter said the page was created on June 24.
That event page has been taken down, and Facebook has notified roughly 2,600 users who had indicated interest in attending the event, and 600 more who planned to attend, about the suspicious activity behind it.
Organizers of the counterprotest — who quickly created a new Facebook page — objected to Facebook’s suggestion that a fake account was behind the event itself and not just the creator of a Facebook event page for it.
One organizer, Chelsea Manning, the former Army analyst who was convicted of sending archives of secret documents to WikiLeaks in 2010 and whose sentence was commuted by President Barack Obama in 2017, said the counterprotest was “real and organic.” She called Facebook’s implication that the Resisters account had started it misleading.
“We started organizing several months ago,” Ms. Manning said. “Folks from D.C. and Charlottesville have been talking about this since at least February.”
Coordinated activity was also detected around a protest affiliated with #AbolishICE, a left-wing campaign on social media that seeks to end the Immigration and Customs Enforcement agency.
On Capitol Hill and in congressional races across the country, the #AbolishICE campaign has divided Democrats and provided Republicans with fodder to paint Democratic candidates as extremists who want open borders. The issue, Republicans hope, could help drive a wedge between liberal Democrats and the moderate voters the party needs to retake control in Washington. Mr. Trump has gone as far as encouraging Democratic candidates to embrace the campaign.
“They’re going to get beaten so badly,” he said in early July.
[How “Abolish ICE” went from social media to progressive candidates’ rallying cry.]
After being caught flat-footed by the Internet Research Agency’s efforts ahead of the 2016 presidential election, Facebook has expanded its security team, hired counterterrorism experts and recruited workers with government security clearances.
The company is using artificial intelligence and teams of human reviewers to detect automated accounts and suspicious election-related activity. It has also tried to make it harder for Russian-style influence campaigns to use covert Facebook ads to sway public opinion, by requiring political advertisers in the United States to register with a domestic mailing address and by making all political ads visible in a public database.
Despite Facebook’s efforts, stopping coordinated influence campaigns has proved difficult. False news flourished before the Mexican elections in July, and the company has been cracking down on misinformation ahead of Brazil’s national elections in October.
The American midterms, though, are a major test for the company, which is trying to show that it can handle its role as a global arbiter of conversation and commerce — even with interference by others.
Earlier in July, Dan Coats, the director of national intelligence, warned that Russian interference remains an active threat to November’s elections.
“The warning lights are blinking red again,” he said.
Follow Kevin Roose and Nicholas Fandos on Twitter: @kevinroose and @npfandos