By Joseph Menn and Paresh Dave, Reuters and AOL News
Facebook Inc has identified a new coordinated political influence campaign to mislead users and organize rallies ahead of November’s U.S. congressional elections, taking down dozens of fake accounts on its site, the company said on Tuesday.
A Russian propaganda arm tried to tamper in the 2016 U.S. election by posting and buying ads on Facebook, according to the company and U.S. intelligence agencies.
Moscow has denied involvement.
Facebook on Tuesday said had it removed 32 pages and accounts from Facebook and Instagram, part of an effort to combat foreign meddling in U.S. elections, attempts that lawmakers have called dangerous for democracy.
The company said it was still in the early stages of its investigation and did not yet know who may be behind the influence campaign for 2018 elections that will determine whether or not the Republican Party keeps control of Congress.
(Learn More. FBN’s Susan Li on Facebook reporting the uncovered a coordinated political propaganda campaign on the social networking platform. Courtesy of Fox Business News and YouTube. Posted on Jul 31, 2018.)
Chief Operating Officer Sheryl Sandberg said on a call with reporters that the attempts to manipulate public opinion would likely become more sophisticated to evade Facebook’s scrutiny, calling it an “arms race.”
“This kind of behavior is not allowed on Facebook because we don’t want people or organizations creating networks of accounts to mislead others about who they are, or what they’re doing,” the company said in a blogpost.
More than 290,000 accounts followed at least one of the pages and that about $11,000 had been spent on about 150 ads, Facebook said. The pages had created about 30 events since May 2017.
Facebook for months has been on the defensive about influence activity on its site and concerns over user privacy tied to longstanding agreements with developers that allowed them access to private user data.
Facebook identified influence activity around at least two issues, including a counter-protest to a “Unite the Right II” rally set next week in Washington.
The other was the #AbolishICE social media campaign aimed at the U.S. Immigration and Customs Enforcement agency.
A previous event last year in Charlottesville, South Carolina, led to violence by white supremacists.
Facebook said it would tell users who had expressed interest in the counter-protest what action it had taken and why.
(Facebook suspects a Russian group is behind more than 30 political pages; Rep. Brad Sherman reacts on ‘Outnumbered Overtime.’ Courtesy of Fox News and YouTube. Posted on Jul 31, 2018.)
Facebook officials on a call with reporters said that one known account from Russia’s Internet Research Agency was a co-administrator of one of the fake pages for seven minutes, but the company did not believe that was enough evidence to attribute the campaign to the Russian government.
The company previously had said 126 million Americans may have seen Russian-backed political content on Facebook over a two-year period, and that 16 million may have been exposed to Russian information on Instagram.
Adam Schiff, the top Democrat on the U.S. House of Representatives Intelligence Committee, in a statement urged Facebook to move against foreign groups trying to sway American voters and to warn legitimate users that such activity, as seen in 2016, is recurring this year.
“Today’s announcement from Facebook demonstrates what we’ve long feared: that malicious foreign actors bearing the hallmarks of previously-identified Russian influence campaigns continue to abuse and weaponize social media platforms to influence the U.S. electorate,” Schiff said.
Senate Intelligence Committee Chairman Richard Burr, a Republican, said in a statement there would be a hearing on Wednesday about the online threat to U.S. election security.
Burr said the goal of influence operations “is to sow discord, distrust, and division in an attempt to undermine public faith in our institutions and our political system. The Russians want a weak America.”
Washington imposed punitive sanctions on Russia following U.S. intelligence agency conclusions that Moscow interfered to undermine the 2016 U.S. elections, one of the reasons U.S.-Russian relations are at a post-Cold War low.
(Learn More. The results marked a disappointing day for investors in Facebook, which for years has regularly beaten analysts’ expectations. Courtesy of NBC News and YouTube. Posted on Jul 26, 2018.)
Both U.S. President Donald Trump and Russian President Vladimir Putin have said, however, that they want to improve ties between the two nuclear powers.
Facebook disclosed in September that Russians under fake names had used the social network to try to influence U.S. voters in the months before and after the 2016 election, writing about divisive issues, setting up events and buying ads.
U.S. intelligence agencies said Russian state operators ran the campaign combining fake social media posts and hacking into Democratic Party networks, eventually becoming an effort to help Republican candidate Trump, who scored a surprise victory over Democrat Hillary Clinton.
Over the past several months, the company has taken steps meant to reassure U.S. and European lawmakers that further regulation is unnecessary. Chief Executive Officer Mark Zuckerberg says the company has 20,000 people working to police and protect the site.
Costs associated with that effort are part of the reason Facebook said last week that it expects its profit margins to decline, a warning that sent shares tumbling about 25 percent, the biggest one-day loss of market cap in U.S. stock market history. Shares of Facebook were up about 1.5 percent in Tuesday’s midafternoon trading, part of a broader tech rebound.
(Joseph Menn and Paresh Dave in San Francisco; additional reporting by Munsif Vengattil in Bengaluru, Kevin Drawbaugh in Washington; writing by Peter Henderson; Editing by Saumyadeb Chakrabarty and Grant McCool)
(Learn More. Apologies for poor visual quality. “Facebook Should Be Commended For Addressing Threat of Foreign Influence Campaign,” DHS Secretary Kirstjen Nielsen. Courtesy of Fox News, Jim Fabian and YouTube. Posted on Jul 31, 2018.)
July 31, 2018
Sharing an update on our work to remove bad actors on Facebookhttps://t.co/yAn3zF21j4
— Facebook (@facebook) July 31, 2018
What We’ve Found So Far
By Nathaniel Gleicher, Head of Cybersecurity Policy
About two weeks ago we identified the first of eight Pages and 17 profiles on Facebook, as well as seven Instagram accounts, that violate our ban on coordinated inauthentic behavior.
We removed all of them this morning once we’d completed our initial investigation and shared the information with US law enforcement agencies, Congress, other technology companies, and the Atlantic Council’s Digital Forensic Research Lab, a research organization that helps us identify and analyze abuse on Facebook.
- In total, more than 290,000 accounts followed at least one of these Pages, the earliest of which was created in March 2017.
- The latest was created in May 2018.
- The most followed Facebook Pages were “Aztlan Warriors,” “Black Elevation,” “Mindful Being,” and “Resisters.”
- The remaining Pages had between zero and 10 followers, and the Instagram accounts had zero followers.
- There were more than 9,500 organic posts created by these accounts on Facebook, and one piece of content on Instagram.
- They ran about 150 ads for approximately $11,000 on Facebook and Instagram, paid for in US and Canadian dollars.
- The first ad was created in April 2017, and the last was created in June 2018.
- The Pages created about 30 events since May 2017.
- About half had fewer than 100 accounts interested in attending.
- The largest had approximately 4,700 accounts interested in attending, and 1,400 users said that they would attend.
We are still reviewing all of the content and ads from these Pages.
In the meantime here are some examples of the content and ads posted by these Pages.
These bad actors have been more careful to cover their tracks, in part due to the actions we’ve taken to prevent abuse over the past year.
- For example they used VPNs and internet phone services, and paid third parties to run ads on their behalf.
- As we’ve told law enforcement and Congress, we still don’t have firm evidence to say with certainty who’s behind this effort.
- Some of the activity is consistent with what we saw from the IRA before and after the 2016 elections.
- And we’ve found evidence of some connections between these accounts and IRA accounts we disabled last year, which is covered below.
- But there are differences, too. For example, while IP addresses are easy to spoof, the IRA accounts we disabled last year sometimes used Russian IP addresses.
- We haven’t seen those here.
We found this activity as part of our ongoing efforts to identify coordinated inauthentic behavior.
- Given these bad actors are now working harder to obscure their identities, we need to find every small mistake they make.
- It’s why we’re following up on thousands of leads, including information from law enforcement and lessons we learned from last year’s IRA investigation.
- The IRA engaged with many legitimate Pages, so these leads sometimes turn up nothing.
- However, one of these leads did turn up something.
- One of the IRA accounts we disabled in 2017 shared a Facebook Event hosted by the “Resisters” Page.
- This Page also previously had an IRA account as one of its admins for only seven minutes.
- These discoveries helped us uncover the other inauthentic accounts we disabled today.
The “Resisters” Page also created a Facebook Event for a protest on August 10 to 12 and enlisted support from real people.
- The Event – “No Unite the Right 2 – DC” – was scheduled to protest an August “Unite the Right” event in Washington.
- Inauthentic admins of the “Resisters” Page connected with admins from five legitimate Pages to co-host the event.
- These legitimate Pages unwittingly helped build interest in “No Unite Right 2 – DC” and posted information about transportation, materials, and locations so people could get to the protests.
We disabled the event earlier today and have reached out to the admins of the five other Pages to update them on what happened.
- This afternoon, we’ll begin informing the approximately 2,600 users interested in the event, and the more than 600 users who said they’d attend, about what happened.
We don’t have all the facts, but we’ll work closely with others as we continue our investigation.
- We hope to get new information from law enforcement and other companies so we can better understand what happened — and we’ll share any additional findings with law enforcement and Congress.
- However, we may never be able to identify the source with the same level of confidence we had in naming the IRA last year.
- See Alex Stamos’ post below on why attribution can be really hard.
We’re seeing real benefits from working with outside experts.
- Partners like the Atlantic Council have provided invaluable help in identifying bad actors and analyzing their behavior across the internet.
- Based on leads from the recent US Department of Justice indictment, the Atlantic Council identified a Facebook group with roughly 4,000 members.
- It was created by Russian government actors but had been dormant since we disabled the group’s admins last year.
- Groups typically persist on Facebook even when their admins are disabled, but we chose to remove this group to protect the privacy of its members in advance of a report that the Atlantic Council plans to publish as soon as it concludes its analysis.
- It will follow this report in the coming weeks with an analysis of the Pages, accounts and profiles we disabled today.