Facebook Breaks Up Shadowy Plot Aimed at Jolting Elections

WASHINGTON — Facebook said Tuesday that it had identified a political influence campaign that was potentially built to disrupt the midterm elections, with the company detecting and removing 32 pages and fake accounts that had engaged in activity around divisive social issues.

The company did not definitively link the campaign to Russia. But Facebook officials said some of the tools and techniques used by the accounts were similar to those used by the Internet Research Agency, the Kremlin-linked group that was at the center of an indictment this year alleging interference in the 2016 presidential election.

Facebook said it had discovered coordinated activity around issues like a sequel to last year’s deadly “Unite the Right” white supremacist rally in Charlottesville, Virginia. Activity was also detected around #AbolishICE, a left-wing campaign on social media that seeks to end the Immigration and Customs Enforcement agency.

“At this point in our investigation, we do not have enough technical evidence to state definitively who is behind it,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy. “But we can say that these accounts engaged in some similar activity and have connected with known IRA accounts,” he said, referring to the Internet Research Agency.

The jolting disclosure, delivered to lawmakers in private briefings on Capitol Hill this week and in a public Facebook post Tuesday, underscored how behind-the-scenes interference in the November elections had begun.

In recent weeks, there have been reports of other meddling, including a Daily Beast report that the office of Claire McCaskill of Missouri, one of the Senate’s most vulnerable Democrats up for re-election this fall, was unsuccessfully targeted by Russian hackers last year, which McCaskill confirmed. U.S. intelligence officials have indicated that at least one other unnamed Democratic senator up for re-election has been targeted.

Officials at Facebook, which is based in Silicon Valley, said they were working with the FBI and other intelligence agencies on their discovery of the influence campaign. Sheryl Sandberg, Facebook’s chief operating officer, and other executives also mounted a media blitz to explain what the company did and did not know about the efforts.

Those actions were a change from last year’s efforts, when Facebook was widely criticized for failing to detect Russian interference in the 2016 election. It took Facebook executives months to acknowledge the extent of the Russian operation and release information connected with their investigation.

Since then, Facebook and its chief executive, Mark Zuckerberg, have been under scrutiny from lawmakers and regulators for other scandals, including data misuse, a misinformation epidemic and accusations of political bias. Last week, the company lost over $120 billion in market value as it projected it would spend more money on moderation and security.

Hogan Gidley, a White House spokesman, did not directly address Facebook’s findings with reporters aboard Air Force One on Tuesday, but he said President Donald Trump had “made it clear that his administration will not tolerate foreign interference into our electoral process from any nation-state or other malicious actors.”

Earlier Tuesday, Trump declared again on Twitter that there had been “No Collusion” between his campaign and the Russians, and asserted that, in any case, “collusion is not a crime.”

Lawmakers from both parties quickly set aside questions of who had perpetrated the influence campaign and said Facebook’s disclosure only clarified what they had feared since the extent of Russian involvement in 2016 became clear more than a year ago: that social media companies would be unable to keep up with the pace and scope of malicious efforts to abuse their platforms. Sen. Richard M. Burr of North Carolina, the Republican chairman of the Intelligence Committee, said he would make the disclosure a central part of a previously scheduled hearing Wednesday, when lawmakers plan to press outside experts on the pervasiveness of foreign influence on social media networks like Facebook.

Sen. Mark Warner of Virginia, the top Democrat on the committee, praised Facebook on Tuesday for bringing the activity out into the public, but asked for its cooperation in updating laws to prevent influence campaigns.

“Today’s disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation,” he said.

Facebook executives characterized the battle with foreign campaigns as a cat-and-mouse game, but said they were making progress to detect suspicious activity more quickly.

“Security is an arms race, and it’s never done,” Sandberg said in a conference call Tuesday.

Facebook said the recently purged accounts — eight Facebook pages, 17 Facebook profiles and seven Instagram accounts — were created between March 2017 and May 2018 and were first discovered two weeks ago. More than 290,000 accounts followed at least one of the suspect pages, which had names like Aztlan Warriors, Black Elevation, Mindful Being and Resisters, the company said.

Between April 2017 and June 2018, the accounts ran 150 ads costing $11,000 on the two platforms. They were paid for in American and Canadian dollars. The pages created roughly 30 events over a similar period, the largest of which attracted interest from 4,700 accounts.

Finding suspicious activity was harder this time around, Facebook said. Unlike many of the alleged Russian trolls in 2016, who paid for Facebook ads in rubles and occasionally used Russian internet protocol addresses, these accounts used advanced security techniques to avoid detection. For instance, they disguised their internet traffic using virtual private networks and internet phone services, and they used third parties to buy ads for them.

“These bad actors have been more careful to cover their tracks, in part due to the actions we’ve taken to prevent abuse over the past year,” Gleicher said.

But there were clues that the suspicious accounts may have been connected to the Internet Research Agency. Gleicher said an account known to be associated with the agency had been listed as an administrator of one of the pages for seven minutes.

Like the 2016 Russian interference campaign, the recently detected campaign sought to amplify divisive social issues, including through organizing real-world events.

Among the campaign’s efforts was organizing support for a counterprotest to a conservative rally. Specifically, an account called Resisters, which interacted with one Internet Research Agency account in 2017, created an Aug. 10 event, “No Unite the Right 2 — DC,” to counter a planned white supremacist rally in Washington on Aug. 11 and 12 by the same group that organized the racist march in Charlottesville one year earlier.

Although other Facebook pages are promoting the counterprotest, the social network said that the Resisters page was the first, and that it had coordinated with administrators for five other apparently real pages to co-host its page — publicizing details about transportation and other logistics. A person familiar with the matter said the page was created June 24.

That event page has been taken down, and Facebook has notified roughly 2,600 users who had indicated interest in attending the event, and 600 more who planned to attend, about the suspicious activity behind it. Organizers of the counterprotest — who quickly created a new Facebook page — objected to Facebook’s suggestion that a fake account was behind the event itself and not just the creator of a Facebook event page for it.

One organizer, Chelsea Manning, the former Army analyst who was convicted of sending archives of secret documents to WikiLeaks in 2010 and whose sentence was commuted by President Barack Obama in 2017, said the counterprotest was “real and organic.” She called Facebook’s implication that the Resisters account had started it misleading.

“We started organizing several months ago,” Manning said. “Folks from D.C. and Charlottesville have been talking about this since at least February.”

On Capitol Hill and in congressional races across the country, the #AbolishICE campaign has divided Democrats and provided Republicans with fodder to paint Democratic candidates as extremists who want open borders. The issue, Republicans hope, could help drive a wedge between liberal Democrats and the moderate voters the party needs to retake control in Washington. Trump has gone as far as encouraging Democratic candidates to embrace the campaign.

“They’re going to get beaten so badly,” he said in early July.

After being caught flat-footed by the Internet Research Agency’s efforts ahead of the 2016 presidential election, Facebook has expanded its security team, hired counterterrorism experts and recruited workers with government security clearances. The company is using artificial intelligence and teams of human reviewers to detect automated accounts and suspicious election-related activity. It has also tried to make it harder for Russian-style influence campaigns to use covert Facebook ads to sway public opinion, by requiring political advertisers in the United States to register with a domestic mailing address and by making all political ads visible in a public database.

Despite Facebook’s efforts, stopping coordinated influence campaigns has proved difficult. False news flourished before the Mexican elections in July, and the company has been cracking down on misinformation ahead of Brazil’s national elections in October.

The U.S. midterms, though, are a major test for the company, which is trying to show that it can handle its role as a global arbiter of conversation and commerce — even with interference by others.

Earlier in July, Dan Coats, the director of national intelligence, warned that Russian interference remains an active threat to November’s elections.

“The warning lights are blinking red again,” he said.