Company reports ‘coordinated inauthentic behaviour’ as it deletes 32 political pages and accounts
Facebook has detected “coordinated inauthentic behaviour” before the United States midterm elections that could be linked to the Internet Research Agency (IRA), a Russian-based group with ties to the Kremlin.
On Tuesday, the social network removed 32 pages and accounts from Facebook and Instagram that were pushing American political stances and organising events, including a protest against a Unite the Right rally due to take place in Washington next week.
“It’s clear whoever set up these accounts went to much greater lengths to obscure their identities than the Internet Research Agency did in the run up to the 2016 presidential election,” said Facebook’s chief operating officer, Sheryl Sandberg, in a call with reporters.
Has Zuckerberg, like Frankenstein, lost control of the monster he created?
John Naughton
Read more
In October 2017, the social network admitted that Russia-backed content reached as many as 126 million Americans during the 2016 presidential election. Those accounts sometimes used Russian IP addresses and paid for advertising in roubles.
The people behind the accounts removed on Tuesday, which had a total of 290,000 followers, used virtual private networks (VPNs) to conceal their locations and internet phone services to hide their identities. They paid third parties to spend approximately $11,000 (in US and Canadian dollars) for about 150 ads on Facebook and Instagram.
Advertisement
“At this point we don’t have enough technical evidence to state definitively who is behind this, but they have shown similar activity and have connected with known IRA accounts,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy.
In one case, a known IRA account was a co-admin on one of the pages for seven minutes before the account was removed from Facebook.
“We think that is interesting but not determinative,” said Alex Stamos, the company’s chief security officer. Stamos said it was not clear whether this was the “IRA with improved capabilities or a separate group”.
Stamos said intelligence agencies were in a better position to make an attribution by combining the technical details from Facebook with their own knowledge of the political motivations and goals of countries and other threat actors.
Sign up for Guardian Today US edition: the day's must-reads sent directly to you
Read more
“If they want to make an attribution decision, it’s up to them,” he said.
In spite of Facebook’s caution over attribution, members of Congress who had been briefed by the company this week were quick to ascribe blame to Russia.
“Today’s disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation, and I am glad that Facebook is taking some steps to pinpoint and address this activity,” said Senator Mark Warner, a Democrat.
Some of the deleted pages include “Aztlan Warriors”, “Resisters” and “Black Elevation”.
The “Resisters” page created a Facebook event for a protest on 10-12 August titled “No Unite The Right 2”. Admins for the page connected with the admins of five legitimate pages to promote the event and post logistical information for protesters. About 600 users said they would attend the event and 2,600 expressed an interest in attending.
“We disabled the event earlier today and reached out out to the legitimate admins of five other pages,” said Gleicher. Facebook also pledged to inform the people considering attending the protest about what happened.
There was also coordinated activity around #AbolishICE, a leftwing campaign aimed at shutting down the Immigration and Customs Enforcement agency, the . The activity appears to echo the in the run-up to the presidential election.
Facebook revealed that the bad actors had created 30 Facebook events since May 2017, most of which had been scheduled over the past year. The company said it did not know if people had showed up to those events.
Facebook said it would continue to investigate the activity and share any further findings with law enforcement and Congress.
“Security isn’t a problem you ever completely solve,” said the company’s chief executive officer, Mark Zuckerberg, in a Facebook post. “We face sophisticated and well-funded adversaries, including nation states, that are always evolving and trying new attacks.”
Does Facebook's plummeting stock spell disaster for the social network?
Read more
The cybersecurity researcher Lukasz Olejnik said: “Artificially inducing civil unrests or protests via internet platforms is a worrying development, and incorporation of Instagram is quite novel.”
He added: “This development touching Washington indicates that concerns about European parliament 2019 elections might now be viewed in rather intriguing light.”
Since you’re here…
… we have a small favour to ask. More people are reading the Guardian than ever but advertising revenues across the media are falling fast. And unlike many news organisations, we haven’t put up a paywall – we want to keep our journalism as open as we can. So you can see why we need to ask for your help. The Guardian’s independent, investigative journalism takes a lot of time, money and hard work to produce. But we do it because we believe our perspective matters – because it might well be your perspective, too.
The Guardian is editorially independent, meaning we set our own agenda. Our journalism is free from commercial bias and not influenced by billionaire owners, politicians or shareholders. No one edits our Editor. No one steers our opinion. This is important because it enables us to give a voice to the voiceless, challenge the powerful and hold them to account. It’s what makes us different to so many others in the media, at a time when factual, honest reporting is critical.
If everyone who reads our reporting, who likes it, helps to support it, our future would be much more secure. For as little as $1, you can support the Guardian – and it only takes a minute. Thank you.