Tech

Facebook Busts Election Trolls Who Look a Lot Like the Russians

ARE THEY BACK?

Fake accounts impersonated leftist activists looking to protest against the alt-right and ICE. Whoever it was, they were good at covering their tracks.

180731-weill-poulson-fb-tease_uuwwe3
Photo illustration by Sarah Rogers/The Daily Beast

Facebook announced on Tuesday that it’s found more fake accounts engaged in covert influence operations against Americans. The company has closed down eight fake organization pages and 17 fraudulent profiles that were collectively followed by 290,000 people.

The eight fake organizations included “Aztlan Warriors,” “Black Elevation,” “Mindful Being,” and “Resisters,” according to Facebook. In total, the pages and profiles were responsible for 9,500 posts. They also spent $11,000 for 150 ads beginning in April 2017.

“At this point in the investigation, we don’t have enough technical information to say definitively who is behind it,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy, in a press call Tuesday. But Gleicher noted some overlap between the newly-purged accounts and Russia's notorious troll factory. “Some accounts and pages were connected with Internet Research Agency accounts.”

ADVERTISEMENT

In February, special counsel Robert Mueller indicted 13 individuals and three Russian companies linked to the Internet Research Agency (IRA), the St. Petersburg troll farm that used fake accounts to organize demonstrations on U.S. soil and flood American social media with alt-right memes during the 2016 election.

180731-weill-poulson-fb-embed1_wbymp0

The newly discovered accounts and pages are a mix of fresh personas created after Facebook’s August 2017 purge of IRA accounts, and older profiles that Facebook missed the first time. Facebook says the newly discovered accounts were more difficult to find.

“The set of actors we're seeing now is doing a lot more to conceal their activities than the Internet Research Agency did during the 2016 election” said company security chief Alex Stamos in a press call Tuesday.

For example, this time the fake accounts were accessed through anonymizing VPN services, whereas in the 2016 operation the Internet Research Agency sometimes connected directly from St. Petersburg, Russia. And the new ad buys were purchased through third parties, and paid for in U.S. and Canadian dollars instead of Russian rubles.

Facebook identified the new batch by looking at which pages and profiles the previously deleted IRA accounts interacted with. One of those known IRA accounts had been co-administrator of the Resisters page.

The meme-crafting and writing styles echoes the Internet Research Agency’s posts on the fake pages like Secured Borders and Being Patriotic used to support Donald Trump during the election, with frequent stumbling over English idioms.

The Atlantic Council's Digital Forensic Research Lab highlighted the style similarities in an analysis of the newly-banned accounts. “It is too early to attribute them,” the researchers wrote, “but an initial scan shows behavioral patterns and use of language reminiscent of the troll operations run from Russia in 2014 through 2017.”

The most openly political of the accounts was the “Resisters” page created in March 2017. Described as “Online and offline feminist activism against fascism,” the page was voiced as a left-learning group opposed to Donald Trump’s immigration and refugee policies, among other issues.

As in the past, the fake personas were used to launch divisive memes and organize events on U.S. soil. including an anti-Trump event called “No Unite the Right 2” scheduled for next week in Washington, D.C. Just as in the 2016 election interference trolling, the fake Resisters persona reached out to legitimate US political activists to co-organize the event.

180731-weill-poulson-fb-embed3_nbanif

As of Monday, 18 legitimate activist groups were involved in organizing protests, and told The Daily Beast they were expecting several thousand attendees. Those genuine activists were dismayed Tuesday when Facebook abruptly deleted the event page, which had become a hub for coordination.

Workers Against Racism, one of the official groups in the activist coalition, said they initially planned their own anti-Unite the Right events when they were invited to co-organize the event started by Resisters.

“Workers against Racism was made a co-host of a pre-existing event by a page with a multi-year post history,” said a spokesperson for the group. “That page is the one deleted by Facebook, run by an individual who also had their profile removed.”

“We thought this was an inexperienced liberal organizer and were hoping to guide the effort and make the day’s resistance more robust and diverse. Not much was happening with them in the way of organizing, and what we’ve been doing was entirely separate and apart.”

Other leftist organizations later joined as co-hosts, leading to a swell of activist RSVPs to the event.

“I cannot believe I have to say this but DC organizers are planning a protest,” Dylan Petrohilos, an organizer with Resist This told The Daily Beast. Resist This is among the coalition of leftist groups organizing the anti-Unite the Right protest.

“We took over the event when it became a bigger thing, to make sure local organizers had control of messaging and so on, and the event was accountable to our community. Besides that, the organizing in DC included experienced organizers, some from Black Lives Matter, Showing Up For Racial Justice, former J20 defendants, and numerous other groups. We had a call to action that included real groups from all over the country supporting us.”

180731-weill-poulson-fb-embed2_qdfybr

Petrohilos and a spokesperson for a coalition of anti-Unite the Right groups said they thought Workers Against Racism had launched the event page. The coalition has since launched a new event page, but blasted Facebook for deleting the first.

“When Facebook decides what is real political organizing and what's not, it takes agency out of people organizing on the ground in their own communities,” Petrohilos said. “People who might not have access to PR firms, who are motivated by helping their community."

The new disclosures by Facebook prompted a swift battery of press releases from Capitol Hill.

“It is clear that much more work needs to be done before the midterm elections to harden our defenses, because foreign bad actors are using the exact same playbook they used in 2016—dividing us along political and ideological lines, to the detriment of our cherished democratic system,” said Rep. Adam Schiff (D-CA), the ranking member of the House intelligence committee.

“Vladimir Putin is apparently determined to hijack Americans’ outrage against Donald Trump and his administration for his own purposes: weakening America and ensuring that his corrupt dictatorship can act with impunity around the world,” said intelligence committee member Sen. Ron Wyden (D-OR).