Facebook says it broke up plot targeting elections

Pages were linked to counter-rally against white supremacists, effort to abolish ICE

WASHINGTON — Facebook said Tuesday that it had identified a political influence campaign that was potentially built to disrupt the midterm elections, with the company detecting and removing 32 pages and fake accounts that had engaged in activity around divisive social issues.

The company did not definitively link the campaign to Russia. But Facebook officials said some of the tools and techniques used by the accounts were similar to those used by the Internet Research Agency, the Kremlin-linked group that was at the center of an indictment this year alleging interference in the 2016 presidential election.

Facebook said it had discovered coordinated activity around issues like a sequel to last year’s deadly “Unite the Right” white supremacist rally in Charlottesville, Va. Activity was also detected around #AbolishICE, a left-wing campaign on social media that seeks to end the Immigration and Customs Enforcement agency.

“At this point in our investigation, we do not have

enough technical evidence to state definitively who is behind it,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy. “But we can say that these accounts engaged in some similar activity and have connected with known IRA accounts,” he said, referring to the Internet Research Agency.

The jolting disclosure, delivered to lawmakers in private briefings on Capitol Hill this week and in a public Facebook post Tuesday, underscored how behind-the-scenes interference in the November elections had begun.

In recent weeks, there have been reports of other meddling, including a Daily Beast report that the office of Claire McCaskill of Missouri, one of the Senate’s most vulnerable Democrats up for re-election this fall, was unsuccessfully targeted by Russian hackers last year, which McCaskill confirmed. U.S. intelligence officials have indicated that at least one other unnamed Democratic senator up for re-election has been targeted.

Officials at Facebook, which is based in Silicon Valley, said they were working with the FBI and other intelligence agencies on their discovery of the influence campaign. Sheryl Sandberg, Facebook’s chief operating officer, and other executives also mounted a media blitz to explain what the company did and did not know about the efforts.

Those actions were a change from last year’s efforts, when Facebook was widely criticized for failing to detect Russian interference in the 2016 election. It took Facebook executives months to acknowledge the extent of the Russian operation and release information connected with their investigation.

Since then, Facebook and its chief executive, Mark Zuckerberg, have been under scrutiny from lawmakers and regulators for other scandals, including data misuse, a misinformation epidemic and accusations of political bias. Last week, the company lost over $120 billion in market value as it projected it would spend more money on moderation and security.

Hogan Gidley, a White House spokesman, did not directly address Facebook’s findings with reporters aboard Air Force One on Tuesday, but he said President Donald Trump had “made it clear that his administration will not tolerate foreign interference into our electoral process from any nation-state or other malicious actors.”

Earlier Tuesday, Trump declared again on Twitter that there had been “No Collusion” between his campaign and the Russians, and asserted that, in any case, “collusion is not a crime.”

Lawmakers from both parties quickly set aside questions of who had perpetrated the influence campaign and said Facebook’s disclosure only clarified what they had feared since the extent of Russian involvement in 2016 became clear more than a year ago: that social media companies would be unable to keep up with the pace and scope of malicious efforts to abuse their platforms.

Facebook said the recently purged accounts — eight Facebook pages, 17 Facebook profiles and seven Instagram accounts — were created between March 2017 and May 2018 and were first discovered two weeks ago. More than 290,000 accounts followed at least one of the suspect pages, which had names like Aztlan Warriors, Black Elevation, Mindful Being and Resisters, the company said.

Between April 2017 and June 2018, the accounts ran 150 ads costing $11,000 on the two platforms. They were paid for in American or Canadian dollars. The pages created roughly 30 events over a similar period, the largest of which attracted interest from 4,700 accounts.

Finding suspicious activity was harder this time around, Facebook said. Unlike many of the alleged Russian trolls in 2016, who paid for Facebook ads in rubles and occasionally used Russian internet protocol addresses, these accounts used advanced security techniques to avoid detection. For instance, they disguised their internet traffic using virtual private networks and internet phone services, and they used third parties to buy ads for them.

“These bad actors have been more careful to cover their tracks, in part due to the actions we’ve taken to prevent abuse over the past year,” Gleicher said.

But there were clues that the suspicious accounts may have been connected to the Internet Research Agency. Gleicher said an account known to be associated with the agency had been listed as an administrator of one of the pages for seven minutes.

Like the 2016 Russian interference campaign, the recently detected campaign sought to amplify divisive social issues, including through organizing real-world events.

Among the campaign’s efforts was organizing support for a counterprotest to a conservative rally. Specifically, an account called Resisters, which interacted with one Internet Research Agency account in 2017, created an Aug. 10 event, “No Unite the Right 2 — DC,” to counter a planned white supremacist rally in Washington on Aug. 11 and 12 by the same group that organized the racist march in Charlottesville one year earlier.

Although other Facebook pages are promoting the counterprotest, the social network said that the Resisters page was the first, and that it had coordinated with administrators for five other apparently real pages to co-host its page — publicizing details about transportation and other logistics. A person familiar with the matter said the page was created June 24.

That event page has been taken down, and Facebook has notified roughly 2,600 users who had indicated interest in attending the event, and 600 more who planned to attend, about the suspicious activity behind it.