Facebook has detected “coordinated inauthentic behaviour” before the United States midterm elections that could be linked to the Internet Research Agency (IRA), a Russian-based group with ties to the Kremlin.
On Tuesday, the social network removed 32 pages and accounts from Facebook and Instagram that were pushing American political stances and organising events, including a protest against a Unite the Right rally due to take place in Washington next week.
“It’s clear whoever set up these accounts went to much greater lengths to obscure their identities than the Internet Research Agency did in the run up to the 2016 presidential election,” said Facebook’s chief operating officer, Sheryl Sandberg, in a call with reporters.
In October 2017, the social network admitted that Russia-backed content reached as many as 126 million Americans during the 2016 presidential election. Those accounts sometimes used Russian IP addresses and paid for advertising in roubles.
The people behind the accounts removed on Tuesday, which had a total of 290,000 followers, used virtual private networks (VPNs) to conceal their locations and internet phone services to hide their identities. They paid third parties to spend approximately $11,000 (in US and Canadian dollars) for about 150 ads on Facebook and Instagram.
“At this point we don’t have enough technical evidence to state definitively who is behind this, but they have shown similar activity and have connected with known IRA accounts,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy.
In one case, a known IRA account was a co-admin on one of the pages for seven minutes before the account was removed from Facebook.
“We think that is interesting but not determinative,” said Alex Stamos, the company’s chief security officer. Stamos said it was not clear whether this was the “IRA with improved capabilities or a separate group”.
Stamos said intelligence agencies were in a better position to make an attribution by combining the technical details from Facebook with their own knowledge of the political motivations and goals of countries and other threat actors.
“If they want to make an attribution decision, it’s up to them,” he said.
In spite of Facebook’s caution over attribution, members of Congress who had been briefed by the company this week were quick to ascribe blame to Russia.
“Today’s disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation, and I am glad that Facebook is taking some steps to pinpoint and address this activity,” said Senator Mark Warner, a Democrat.
Some of the deleted pages include “Aztlan Warriors”, “Resisters” and “Black Elevation”.
The “Resisters” page created a Facebook event for a protest on 10-12 August titled “No Unite The Right 2”. Admins for the page connected with the admins of five legitimate pages to promote the event and post logistical information for protesters. About 600 users said they would attend the event and 2,600 expressed an interest in attending.
“We disabled the event earlier today and reached out out to the legitimate admins of five other pages,” said Gleicher. Facebook also pledged to inform the people considering attending the protest about what happened.
There was also coordinated activity around #AbolishICE, a leftwing campaign aimed at shutting down the Immigration and Customs Enforcement agency, the New York Times reported. The activity appears to echo the Kremlin’s creation and promotion of black activism pages such as “Blacktivist” in the run-up to the presidential election.
Facebook revealed that the bad actors had created 30 Facebook events since May 2017, most of which had been scheduled over the past year. The company said it did not know if people had showed up to those events.
Facebook said it would continue to investigate the activity and share any further findings with law enforcement and Congress.
“Security isn’t a problem you ever completely solve,” said the company’s chief executive officer, Mark Zuckerberg, in a Facebook post. “We face sophisticated and well-funded adversaries, including nation states, that are always evolving and trying new attacks.”
The cybersecurity researcher Lukasz Olejnik said: “Artificially inducing civil unrests or protests via internet platforms is a worrying development, and incorporation of Instagram is quite novel.”
He added: “This development touching Washington indicates that concerns about European parliament 2019 elections might now be viewed in rather intriguing light.”
