How Fake Influence Campaigns on Facebook Lured Real People

In late June, after word emerged that the white supremacists who organized last year’s deadly “Unite the Right” march in Charlottesville, Virginia, had applied to hold an anniversary rally this month in Washington, a local political activist, Brendan Orsinger, saw that a Facebook event page had been created for a counterprotest.

He recognized it as trouble. Little did he know just how much.

The event page was created on June 24 by a feminist-oriented Facebook political page called Resisters. On June 25, Orsinger reached out via Facebook to a Resisters administrator he knew as “Mary,” whom he had messaged before, to discuss how Washington-based activists resent it when national activists crowd out local organizers on an event.

Orsinger gently suggested to “Mary” that the Resisters “get buy-in from local DC organizers of color first,” like the local Black Lives Matter chapter, for the counterprotest, according to messages reviewed by The New York Times. “Mary” appeared receptive, he said. So Orsinger connected several other Washington-based activist groups to help flesh out the event page the Resisters had started.

This week, to the shock of Orsinger and other activists, Facebook deleted the event page, including all their handiwork. On Tuesday, the company suspended the account of “Mary,” apparently deeming it a fake, and said the Resisters page was a tool in a coordinated political influence operation to sow division before the midterm elections. National security officials on Thursday said Russia was still injecting misinformation into U.S. social media every day.

Orsinger’s experience shows how real people continue to become entangled with fake accounts and pages on Facebook — and the sometimes significant consequences for them as the company has tried to clamp down. Orsinger said he was invited into the Resisters page on Facebook in January and interacted with “Mary” for months on the social network, without thinking anything was amiss.

“Mary” was not the only apparently fake Facebook account that drew legitimate activists into the Resisters event page. On July 1, another Resisters administrator, “Natasha Shipley,” reached out to Workers Against Racism, a national group, to request help for the same event — quickly making it a co-host, too, according to messages reviewed by The Times. Facebook has suspended the “Natasha Shipley” account as well, the messages show.

“Being an activist, you come in contact with so many people here and there and have to also understand that people have a lot going on,” Orsinger, 36, said. “I feel curious right now, to see what exactly happened so I can learn from it.”

Facebook has been under intense pressure since the 2016 presidential election for failing to detect foreign meddling on its platform. The company did not identify who was behind the latest influence campaign, but it said the activity mimicked the manipulation of social media in 2016 by the Russian-backed Internet Research Agency. Facebook also said there were connections between the latest fake accounts and pages and some that it had terminated in a previous purge of Russian fakes.

But even as Facebook moved more quickly this time to limit meddling, some said the company had become heavy-handed. The activists working on the counterprotest, which is scheduled for Aug. 10 to 12, said Facebook had gone too far by removing videos and messages that real people had posted. Facebook also notified users who had indicated interest in attending the counterprotest of the suspicious activity. That essentially forced them to start over in gathering followers and building momentum to stage an effective protest, they said.

Dylan Petrohilos, a Washington-based organizer, said Facebook had deleted the event page without giving activists an opportunity to argue that the content they had posted to it was legitimate and should stay up. He accused the company of quashing their work as a “political out that Facebook took to deal with the scrutiny” it had been under.

Tom Reynolds, a Facebook spokesman, said the company’s decision to remove the event was about addressing the coordinated influence campaign “and maintaining the security of our services.”

He added, “We ban hate organizations from our platform and are encouraged to see people using Facebook to stand up against white supremacy.”

The Resisters page was created in March 2017, according to an analysis by the Atlantic Council’s Digital Forensic Research Lab. It gained momentum in the ensuing months by posting about feminist activism. Orsinger said he was invited to become an administrator on the page in January after he helped organize a protest against President Donald Trump’s State of the Union address.

In the late winter and early spring, word began circulating that the white supremacists who had organized the Charlottesville “Unite the Right” rally in August 2017 wanted to hold another one in 2018. Washington-based activists began discussing a counterprotest.

On June 20, news broke that the organizers had obtained a permit to hold their anniversary “Unite the Right II” rally in Washington. The Resisters page moved quickly, creating its counterprotest event organizing page. Andrew Batcher, 37, a Washington-based activist who is an administrator for the Facebook page of the group Smash Racism — one of those that the Resisters later invited to act as a co-host of their event page — said many local activists had traveled to Charlottesville last year to protest the original rally. He said he was there when a Nazi sympathizer deliberately plowed his car into a crowd of anti-racist demonstrators, killing a woman.

He said groups would protest the “Unite the Right II” rally in their own city regardless of whether the Resisters page had moved first to create an event page for it. But because the Resisters’ event page was up, he said, it made sense to reach out via Orsinger and essentially take it over, rather than create a redundant page and risk fracturing the potential audience.

“There wasn’t much on the page before we were added,” Batcher said. “The content, when it was taken down, was all from us.”

On July 1, the “Natasha Shipley” account reached out to Workers Against Racism seeking assistance with the Resisters. Reached via Facebook, a spokesman for WAR, who declined to give his name, citing security threats, said it was common for inexperienced but politically minded people to reach out for help organizing events.

WAR provided some advice to “Natasha” about fixing problems with the date and time on the event page, he said, and she made WAR a co-host. The group thought it was odd when “Natasha” disappeared for 17 days, then resurfaced and said she had been sick, he said. By then, local Washington activists had essentially taken over the event page and filled it out.

Messages from “Mary” and “Natasha” are now redacted in Facebook’s system, so The Times was able to review correspondence only from the side of Orsinger and WAR.

Facebook has said little about the specific accounts that it deemed fake, other than that there was more than one inauthentic administrator with the Resisters page, which connected with administrators of five legitimate pages to act as a co-host for the event. Facebook declined to comment on the “Mary” and “Natasha” accounts.

After Facebook deleted the event page Tuesday, activists swiftly recreated a new one from scratch to promote the counterprotest.

But the display of raw power — erasing the entire platform that the activists had been using to organize their political action — was striking, said Evan Greer, deputy director of Fight for the Future, an internet rights group.

“It’s an extremely dangerous situation for free speech when politicians are screaming at web platforms to ‘do something’ about a problem that is difficult to address,” she said. “Censoring an anti-Nazi protest was a particularly egregious example of collateral damage.” According to the Digital Forensic Research Lab analysis, certain posts on the Resisters page displayed grammatical errors that suggested they were written by native Russian speakers. Relying on local activists to generate content is not uncommon for a sophisticated influence campaign, said Graham Brookie, the director of the lab. He said such influence operations often seek to infiltrate organic political movements and use them to encourage polarization.

Orsinger said that he was not sure whether an account associated with the Resisters page had originated in Russia or not, but that it had done no harm to local organizers.

“I’m scared that my work moving forward is going to be either co-opted or deemed as illegitimate because Facebook didn’t decide to do the homework and background,” he said. “They decided to just start taking down stuff unilaterally.”