Russian operatives sacrifice followers to stay under cover on Facebook

Russian operatives sacrifice followers to stay under cover on Facebook
By Jack Stubbs

LONDON (Reuters) – Efforts by Russian influence campaigns to stay undetected on social media ahead of next year’s U.S. elections are undermining their ability to gain followers and spread divisive political messages, a senior Facebook <FB.O> executive told Reuters.

Social media users need to stand out from the crowd to gain traction online, but that type of behavior also helps Facebook and other platforms identify suspicious activity to then analyze for signs of foreign involvement, said Nathaniel Gleicher, Facebook’s head of cyber security policy.

“If you are very, very loud, if you go viral very, very fast that’s exactly the sort of thing that our automated systems will detect and flag,” he said. “So when actors have really diligent, deliberate and effective operational security it weakens their ability to build an audience.”`

Facebook on Monday suspended a network of Instagram accounts it said targeted U.S. users ahead of next year’s presidential poll and were linked to Russia’s Internet Research Agency (IRA), an organization Washington says Moscow used to meddle in the 2016 U.S. election.

The latest Russian campaign posted on both sides of sensitive topics such as the environment and sexual equality but struggled to attract followers due to the operators’ attempts to stop the accounts being caught and disabled, said Gleicher.

Those efforts included sharing memes and screenshots of other users’ social media posts instead of producing original content in English, likely to avoid making language errors typical of non-native speakers, according to a report https://graphika.com/uploads/Graphika%20Report%20-%20CopyPasta.pdf by social media analytics firm Graphika.

This technique “gave each asset less of a discernible personality and therefore may have reduced the (campaign’s) ability to build audiences,” Graphika said.

The IRA-linked network of 50 Instagram accounts had around 246,000 followers, about 60 percent of which were in the United States, Facebook said, without providing a breakdown for each account.

That compares with charges by U.S. special counsel Robert Mueller that the IRA has previously run social media accounts with hundreds of thousands of followers each. Facebook says up to 126 million Americans may have seen Russian-linked posts aimed at the 2016 election.

Russian catering tycoon Evgeny Prigozhin, accused by U.S. prosecutors of orchestrating the IRA’s activities through Concord Management and Consulting LLC, did not respond to questions sent by Reuters.

Attorneys for Concord Management and Consulting LLC did not respond to a request for comment but have previously denied any wrongdoing.

PAYING IN ROUBLES

Facebook, Twitter <TWTR.N> and Google <GOOGL.O> have vowed to step up the fight against political manipulation of their platforms after facing fierce criticism for failing to counter alleged Russian interference in 2016.

Despite the increased scrutiny, U.S. officials have repeatedly warned of the threat posed by Russia and other countries such as Iran, who they say may still attempt to sway the result of next year’s vote.

Addressing U.S. lawmakers this week, FBI Deputy Assistant Director Nikki Floris said the bureau’s foreign influence task force was briefing candidates and running a series of public information videos to help safeguard the election.

The Department of Homeland Security did not immediately respond to a request for comment.

Moscow and Tehran have repeatedly denied allegations of election interference. The Kremlin and Russia’s foreign ministry did not immediately respond to requests for comment.

Russian efforts to avoid detection by the platforms’ security teams have been increasing since the IRA’s alleged efforts in 2016 were first exposed, said Ben Nimmo, who has helped Facebook analyze influence operations and currently runs investigations at Graphika.

A campaign exposed by the Atlantic Council’s Digital Forensic Research Lab in June, which attempted to seed false narratives online such as a bogus plot to assassinate British Prime Minister Boris Johnson, created a new account for almost every single post.

This made it harder to track connections between the accounts, Nimmo said, but also meant the posts only reached a small number of people.

Announcing the takedown of a network in July last year, which it said showed “some connections” to previously-identified IRA accounts, Facebook noted that “bad actors have been more careful to cover their tracks.”

The company said operators were using virtual private networks and internet phone services to obscure an account user’s location, and paying for advertising via third parties.

In contrast, previous campaigns linked to the IRA used Russian phone numbers and IP addresses to register their accounts, as well as paying for Facebook adverts in Russian roubles, raising suspicions about Russian involvement.

“The original IRA activity threw operational security to the wind,” Nimmo said.

(Additional reporting by Christopher Bing and Raphael Satter in Washington; Editing by Carmel Crimmins)

Facebook suspends Russian Instagram accounts targeting U.S. voters

FILE PHOTO: Silhouettes of mobile users are seen next to a screen projection of Instagram logo in this picture illustration taken March 28, 2018. REUTERS/Dado Ruvic/Illustration/File Photo

Facebook suspends Russian Instagram accounts targeting U.S. voters
By Jack Stubbs and Christopher Bing

LONDON/WASHINGTON (Reuters) – Facebook Inc. said on Monday it has suspended a network of Instagram accounts operated from Russia that targeted Americans with divisive political messages ahead of next year’s U.S. presidential election, with operators posing as people within the United States.

Facebook said it also had suspended three separate networks operated from Iran. The Russian network “showed some links” to Russia’s Internet Research Agency (IRA), Facebook said, an organization Washington has said was used by Moscow to meddle in the 2016 U.S. election.

“We see this operation targeting largely U.S. public debate and engaging in the sort of political issues that are challenging and sometimes divisive in the U.S. right now,” said Nathaniel Gleicher, Facebook’s head of cybersecurity policy.

“Whenever you do that, a piece of what you engage on are topics that are going to matter for the election. But I can’t say exactly what their goal was.”

Facebook also announced new steps to fight foreign interference and misinformation ahead of the November 2020 election, including labeling state-controlled media outlets and adding greater protections for elected officials and candidates who may be vulnerable targets for hacking.

U.S. security officials have warned that Russia, Iran and other countries could attempt to sway the result of next year’s presidential vote. Officials say they are on high alert for signs of foreign influence campaigns on social media.

Moscow and Tehran have repeatedly denied the allegations.

Gleicher said the IRA-linked network used 50 Instagram accounts and one Facebook account to gather 246,000 followers, about 60% of which were in the United States.

The earliest accounts dated to January this year and the operation appeared to be “fairly immature in its development,” he said.

“They were pretty focused on audience-building, which is the thing you do first as you’re sort of trying to set up an operation.”

Ben Nimmo, a researcher with social media analysis company Graphika who Facebook commissioned, said the flagged accounts shared material that could appeal to Republican and Democratic voters alike.

Most of the messages plagiarized material authored by leading conservative and progressive pundits. This included recycling comments initially shared on Twitter that criticized U.S. congresswoman Alexandria Ocasio-Cortez, Democratic presidential candidate Joe Biden and current President Donald Trump.

“What’s interesting in this set is so much of what they were doing is copying and pasting genuine material from actual Americans,” Nimmo told Reuters. “This may be indicative of an effort to hide linguistic deficiencies, which have made them easier to detect in the past.”

Attorneys for Concord Management and Consulting LLC have denied any wrongdoing. U.S. prosecutors say the firm is controlled by Russian catering tycoon Evgeny Prigozhin and helped orchestrate the IRA’s operations.

Gleicher said the separate Iranian network his team identified used more than 100 fake and hacked accounts on Facebook and Instagram to target U.S. users and some French-speaking parts of North Africa. Some accounts also repurposed Iranian state media stories to target users in Latin American countries including Venezuela, Brazil, Argentina, Bolivia, Peru, Ecuador and Mexico.

The activity was connected to an Iranian campaign first identified in August last year, which Reuters showed aimed to direct internet users to a sprawling web of pseudo-news websites which repackaged propaganda from Iranian state media.

The accounts “typically posted about local political news and geopolitics including topics like public figures in the U.S., politics in the U.S. and Israel, support of Palestine and conflict in Yemen,” Facebook said.

(Reporting by Jack Stubbs; Additional reporting by Elizabeth Culliford in San Francisco; Editing by Chris Reese, Tom Brown and David Gregorio)