At least three groups that Facebook banned this week for spreading disinformation shared similar names and traits with Twitter accounts that had been linked publicly to Russia six weeks earlier, underscoring the challenges of swiftly shutting down a foreign influence campaign even once strong hints emerge of who is behind it.
Facebook announced Tuesday that it had removed 32 accounts and pages as part of a sweep of malicious activity ahead of the November midterm elections. It said it identified the first of those pages – which the company said it couldn’t directly attribute to Russian operatives – two weeks ago.
But in May, Twitter turned over to Congress documents describing the activities of more than a thousand accounts it tied to the Internet Research Agency, the Russian organization that spread misinformation in the 2016 election. Congress publicly released the documents in mid-June, and Facebook began to scrape them for clues to shadowy operators on its network, said Andy Stone, a company spokesman.
Until two weeks ago, he said, Facebook’s engineers were not able to tie the information to corresponding Facebook pages, even though that at least several shared a name, a creation date, and posted similar content – and a logo in one case. Stone said that the trove lacked key technical details, such as an IP address, phone number or email, which made it hard to establish a clearer link.
Facebook’s handling of the situation underscores the nation’s struggles to respond to credible reports of disinformation two years after the first signs that Russians were seeking to manipulate the 2016 presidential election.
Security researchers argued that Facebook should have been able to move much faster because there were clear signs that the accounts were part of a coordinated campaign. One of the accounts, called “Resisters” on Facebook and Twitter, billed itself on both platforms as a feminist page that emphasized themes of gender equality and female empowerment – with a clear opposition to President Donald Trump’s agenda. Another Twitter account, @Warriors_Aztlan, tweeted regularly about the oppression of Native Americans and indigenous people. So too did the Facebook page “Aztlan Warriors,” and both referenced Aztec culture and imagery related to anti-colonial struggles.
Lawmakers and experts were quick to tie the Facebook pages to Russia this week, pointing out that stirring up passionate communities is a known strategy for Russian intelligence operatives.
Facebook said the pages violated its ban against what it calls “coordinated inauthentic activity,” suggesting that it had clues that the people behind the profiles were not who they said they were. But Facebook offered little information to explain why it drew that conclusion – besides that the Resisters group briefly had a known account administrator from the Internet Research Agency.
On Twitter, the “resisters” account was spelled as “@resistersunion,” but included the name “resisters” in its profile. Facebook’s equivalent, which organized a June protest outside the headquarters of Immigration and Customs Enforcement in Washington via its Facebook page, was “Resisters.” The “Resisters” Facebook page had the same profile image as the Twitter account – a red feminist symbol with the letters RS inside it.
Also similar were Twitter accounts @black_elevation, @BLACKELEVATION and @WARRIORS_AZTLAN, which closely mimic Facebook’s recently closed pages “Black Elevation” and “Aztlan Warriors.” The Twitter and Facebook accounts for “Resisters” and for “Aztlan Warriors” were all created in the same month – March 2017 – and posted content about similar themes.
“It makes little sense why they would let a known propaganda account carry forward with an on-the-ground event,” said Jonathan Albright, researcher director at the Tow Center for Digital Journalism at Columbia University, referring to Facebook not moving sooner to shut down the June immigration protest organized by “Resisters.”
He added, “There should be a full statement provided to Congress explaining the reasons under which they could let this happen.”
When they announced they were banning accounts this week, Facebook executives said that they had moved swiftly to prevent the potentially harmful consequences of a rally that was being organized on Facebook for later this month. The event, called “No Unite the Right 2 DC” on the “reSisters” Facebook page, was intended as a counterprotest to a planned far-right rally organized by supporters of the Charlottesville, Virginia rally last summer.
The situation was even more complex than previous purges because shadowy operatives running the event had managed to add five legitimate organizations as co-hosts, another sign that operatives are becoming more sophisticated, Facebook said. Those organizers lashed out at Facebook this week, claiming that even if they had been unwittingly drawn in by Russian operatives, the social network had curtailed their free speech rights and set them back in their ability to counter white supremacy.
One of the Facebook users who invited activists to join resisters called herself Mary Smith, activists said this week. Two of the suspected IRA handles Twitter shared with Congress in May were @MarySmi05400562 and @MarrySm43839664. Facebook said it removed her account.
With a congressional midterm vote looming in November, no single governmental or private-sector entity has taken the clear lead in combating ongoing efforts to manipulate voters, leading to a patchwork response that experts have said is not nearly sufficient to the threat. Security researchers said Facebook’s lag in taking action against the accounts had real-world consequences and raised questions about technology companies’ ability to get ahead of bad actors in a timely manner.
Facebook’s disclosures come at a moment when the company is under intense pressure from lawmakers, investors and the public to show that it is on top of threats. Earlier this month, Facebook’s stock dropped more than 20 percent after the company lowered its revenue projections, suggesting that the company’s need to refocus on privacy and security may temper its commercial ambitions.
In its announcement earlier this week, Facebook did not disclose the reach of the malicious pages it banned. But, Albright, using data from a Facebook-owned analytics tool called CrowdTangle, said that the two most popular pages, “Black Elevation” and “Aztlan Warriors,” had more than 80,000 followers. Aztlan Warriors was especially popular, he found, as 14 of its videos had garnered more than 1.4 million views before the page had been taken down. It posted much of its content in regular, two-hour increments each day.
For months, lawmakers have urged Facebook, Twitter and other tech giants to share vital information with the government, and one another, to stop the Kremlin’s propaganda from spreading on social media.
Their apparent lack of coordination is expected to come up when executives from the companies appear at a planned September hearing in front of the Senate Intelligence Committee, a person familiar with the panel’s investigation said Friday, speaking on the condition of anonymity to discuss committee plans. Facebook said it informed law enforcement and lawmakers of the new accounts before it deleted them Tuesday morning.
“We’re in constant dialogue with Facebook and are always open to questions they may have about any details that we’ve disclosed,” said Twitter spokesman Brandon Borrman.
A person involved in the companies’ conversations, but not authorized to speak on the record about the sensitive talks, said that Facebook and Twitter generally have shared the names of suspected disinformation accounts with each other – not more technical data, which is usually reserved for the government. In July, Twitter sought to help Facebook by pointing out similar Russia-tied accounts on both platforms, the person said.
“The tendency on hard challenges like disinformation from companies has been to retrench and only speak internally,” said Graham Brookie, the director and managing editor of the Digital Forensic Research Lab at the Atlantic Council. The think tank has been reviewing Facebook-supplied data and praised the social giant for being more transparent.
Broadly, though, Brookie said that tech companies, the government and other media organizations had to do more to compare notes.
“I think they’re doing a better job than they have in the past,” he said, “but I think there’s room for improvement.”
