Facebook logo

Facebook announced today that it removed 32 Facebook and Instagram accounts and pages for exhibiting behavior consistent a political influence campaign, which Facebook said it previously saw during the 2016 US Presidential Election.

In particular, Facebook said it removed 17 Facebook accounts, eight Facebook pages, and seven Instagram profiles for what the social network categorized as "coordinated inauthentic behavior."

Both Facebook and Instagram accounts removed

Facebook says it identified this coordinated network two weeks ago and had spent the past weeks trying to track down its members.

According to preliminary results of its investigation, Nathaniel Gleicher, Head of Cybersecurity Policy at Facebook, said these accounts had been created between March 2017 and May 2018.

Gleicher says Facebook staff identified some thin links connecting some of these accounts and pages to the Internet Research Agency (IRA), a Russian-based entity that was charged in February by the Department of Justice for attempting to influence the 2016 US Presidential Election.

But according to the Facebook exec, this time around, the people behind these accounts took much greater care to hide their identities compared to the 2016 campaign.

Gleicher says these threat actors used VPNs and internet phone services to hide their location following Facebook's crackdown on IRA and other fake accounts in recent months. Gleicher details:

▻  In total, more than 290,000 accounts followed at least one of these Pages, the earliest of which was created in March 2017. The latest was created in May 2018.
▻  The most followed Facebook Pages were “Aztlan Warriors,” “Black Elevation,” “Mindful Being,” and “Resisters.” The remaining Pages had between zero and ten followers, and the Instagram accounts had zero followers.
▻  There were more than 9,500 organic posts created by these accounts on Facebook and one piece of content on Instagram.
▻  They ran about 150 ads for approximately $11,000 on Facebook and Instagram, paid for in US and Canadian dollars. The first ad was created in April 2017, and the last was created in June 2018.
▻  The Pages created about 30 events since May 2017. About half had fewer than 100 accounts interested in attending. The largest had approximately 4,700 accounts interested in attending, and 1,400 users said that they would attend.

Facebook also published images showing the type of content the Facebook pages published, including posts and events they tried to organize.

Sample content

Sample content

Sample content

No official attribution yet

Facebook has not yet officially attributed these fake accounts and pages to the IRA or the Russian government, like in 2016. But the social network did point out some connections.

"One of the IRA accounts we disabled in 2017 shared a Facebook Event hosted by the 'Resisters' Page [the one disabled today]," Facebook said. "This Page also previously had an IRA account as one of its admins for only seven minutes."

Facebook said it already shared the information about today's suspended accounts with US law enforcement, Congress, other technology companies, and the Atlantic Council’s Digital Forensic Research Lab, a research organization that helps Facebook identify and analyze abuse on its network.

Facebook to notify "influenced" users

Facebook also announced it would start notifying users who were interested (around 2,600) and users who said would attend events (around 600) created by one of the suspended accounts and pages.

Facebook warning to its users

According to a February indictment, the DOJ revealed that in the 2016 election meddling campaign, IRA fake Facebook accounts, pages, and groups often posted content on dividing topics or organized events and rallies, often for conflicting causes to pit the two groups together in order to exacerbate opposing political views inside the US.

Facebook may not have pointed the finger at the IRA or Russia just yet, but the modus operandi is consistent with past IRA election meddling tactics.

Related Articles:

Hacking is the Lesser Evil for the U.S. Midterm Elections

SEO Poisoning Campaign Targeting U.S. Midterm Election Keywords

Private Messages for 81k Hacked Facebook Accounts Being Sold Online

Facebook States 30 Million People Affected by Last Month's "View As" Bug

Facebook Vulnerability Affecting 50 Million Users Allowed Account Takeover