Facebook detects influence operation ahead of 2018 midterm elections

Facebook announced on Tuesday that it had detected a coordinated influence operation whose activities appeared to target divisive political issues ahead of the 2018 midterm elections.

The company identified the activity roughly two weeks ago as part of an ongoing investigation into election interference, its representatives said, and had removed eight Pages and 17 profiles from Facebook and seven accounts from Instagram that had been created between March 2017 and last May. Taken together, the accounts and Pages created more than 9,500 posts, and more than 290,000 accounts had followed at least one of the pages, Facebook said. The pages ran ads 150 ads for $11,000 that were paid for in U.S. and Canadian dollars. 

Though the activity was not overtly linked to Russia, it was reminiscent of operations conducted by Russian accounts during the 2016 presidential election, Facebook said.

"We're still in the very early stages of our investigation and don't have all the facts — including who may be behind this," Nathaniel Gleicher, Facebook's head of Cybersecurity Policy, wrote in a public post. "It's clear that whoever set up these accounts went to much greater lengths to obscure their true identities than the Russian-based Internet Research Agency (IRA) has in the past."

In April, Facebook announced it had deleted hundreds of accounts associated with the IRA. Gleicher said at least one of those accounts engaged with one of the Pages the company removed on Tuesday, and that one Page, called "Resisters," had an IRA account as an administrator for seven minutes. "These discoveries helped us uncover the other inauthentic accounts we disabled today," Gleicher said. 

Chief Security Office Alex Stamos said during the press call that definitive attribution to a given actor was a task that had "traditionally fallen" to intelligence agencies, and that Facebook was declining to provide an assessment of the political motivations of the group behind the activity. He said Facebook would continue coordinating its efforts with U.S. law enforcement and intelligence agencies.

U.S. intelligence officials declined to offer immediate public attribution for the influence operations Facebook revealed. National Security Council spokesman Garrett Marquis said, "We applaud efforts by our private sector partners to combat an array of threats that occur in cyber space, including malign influence. National Security Council staff leads the regular and continuous coordination of the whole-of-government approach to addressing foreign malign influence and ensuring election security." 

Sheryl Sandberg, Facebook's Chief Operating Officer, said the company was "investing heavily" in security to combat "determined, well-funded adversaries who won't give up."

In the past year, Facebook has made extensive investments in combating disinformation and suppressing false news, including by enlisting third-party fact-checking partners and hiring thousands of new employees.  

The company saw a record-setting loss of $119 billion last Thursday, following a disappointing earnings announcement; it was Facebook's first full quarter following the Cambridge Analytica privacy scandal, which raised separate concerns about the company's ability to safeguard its users' data.

"Security is an arms race and it's never done," Sandberg said Tuesday.

In its announcement, the company revealed that roughly 30 events had been created by the inauthentic Pages since May 2017, and nearly 5,000 online accounts had indicated an interest in attending. Of those events, Gleicher told reporters, the date for all but two had already passed.

Facebook had timed Tuesday's announcement to precede the first event – a protest in Washington, D.C. called "No Unite the Right 2 – DC" – which had been scheduled for August 10 to 12, Gleicher said. "We disabled the event earlier today," he told reporters. (The second event had been scheduled for January 1.)

Gleicher indicated that the August event, set up by inauthentic administrators as part of the "Resisters" Page, had posted information about transportation and other logistics and enlisted support from real people, whom Facebook had contacted about the matter. He said the identities of the individuals who had RSVP'd for the event were being withheld out of concerns for their privacy.

Facebook was unable to determine whether past events actually took place, Gleicher also said. "We can assess what happened on Facebook," he said. "We can't assess what happened in the real world. In the external world."

The social media giant's announcement was among the most significant and concrete indications that foreign actors are targeting November's midterm elections, though officials from the FBI, DHS and Office of the Director of National Intelligence have all said in recent weeks that foreign efforts to spread disinformation continue. At a cybersecurity event in New York City on Tuesday, DHS Secretary Kirstjen Nielsen warned hackers that the U.S. would "no longer tolerate" election interference. "You will be exposed. And you will pay a high price," she said.

Director of National Intelligence Dan Coats singled out Russiaearlier this month, indicating that the intelligence community continues to see "aggressive attempts to manipulate social media and to spread propaganda focused on hot-button issues that are intended to exacerbate socio-political divisions," including from fake accounts created by the IRA.

At least two lawmakers – Sen. Claire McCaskill, D-Missouri, and Sen. Jeanne Shaheen, D-New Hampshire – have publicly acknowledged that their officers have already been targeted by Russian hackers. Their disclosures last week followed remarks by Microsoft's vice president of Customer Security and Trust, Tom Burt, who revealed at the Aspen Security Forum that congressional candidates who posed "interesting targets from an espionage standpoint" had been targeted by spear phishing attempts.

Before making its announcement on Tuesday, Facebook had briefed staffers for senior congressional leaders and the national security agencies this morning by telephone, two people familiar with the outreach told CBS News.

Some lawmakers seized on Facebook's disclosure as an indication that threats to U.S. election security have not abated, and appeared to draw their own conclusions about the provenance of the interference.

"Today's disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation, and I am glad that Facebook is taking some steps to pinpoint and address this activity," said Senator Mark Warner, D-Virginia, vice chairman of the Senate Intelligence Committee, who earlier in the week issued a wide-ranging white paper with proposals for regulating social media platforms. "I also expect Facebook, along with other platform companies, will continue to identify Russian troll activity and to work with Congress on updating our laws to better protect our democracy in the future." 

Warner later told reporters he had "a high level of confidence" that the accounts disabled by Facebook were tied to the IRA. "I can say with pretty high confidence this is Russia-related," Warner said.

"It is clear that much more work needs to be done before the midterm elections to harden our defenses, because foreign bad actors are using the exact same playbook they used in 2016 — dividing us along political and ideological lines, to the detriment of our cherished democratic system," said Rep. Adam Schiff, D-California, ranking member of the House Intelligence Committee.

In his own statement, Senate Intelligence Committee Chairman Richard Burr, R-North Carolina, said, "The goal of these operations is to sow discord, distrust, and division in an attempt to undermine public faith in our institutions and our political system."

"The Russians want a weak America," Burr added. 

The Senate Intelligence Committee is scheduled to hold a hearing on foreign influence operations and their use of social media platforms on Wednesday, and is expected to hear from top Silicon Valley executives in September. The hearings are part of the committee's ongoing investigation into Russia's interference in the 2016 presidential election.