Whoever Is Trying to Hack America's Elections Is Getting Smarter

By Maya Kosoff, Vanity Fair

01 August 18

New malicious accounts discovered by Facebook “went to much greater lengths to obscure their true identities,” the company warned.

arlier this month, when Facebook executives were asked whether the company had detected any sign of foreign interference in the rapidly approaching 2018 midterm elections, the company hedged. “We know that Russians and other bad actors are going to continue to try to abuse our platform,” Nathaniel Gleicher, Facebook’s head of cybersecurity policy, told reporters on a call. “We are continually looking for that type of activity, and as and when we find things, which we think is inevitable, we’ll notify law enforcement, and where we can, the public.” As it turns out, Facebook was already well on its way to identifying a new threat. On Tuesday, the company announced it had detected a campaign to influence November elections by targeting divisive social issues, similar to the effort put forth by the Kremlin-linked Internet Research Agency in the run-up to the 2016 election. “We’re still in the very early stages of our investigation and don’t have all the facts—including who may be behind this,” the company wrote in a blog post. But, the post continued, “It’s clear that whoever set up these accounts went to much greater lengths to obscure their true identities than the Russian-based Internet Research Agency has in the past.”

Facebook identified 8 Pages and 17 profiles, along with 7 Instagram accounts, that violated its rules. The accounts and Pages were set up between March 2017 and May 2018, and were first discovered about two weeks ago. While they haven’t been definitively tied to the I.R.A. or Moscow, Facebook chief security officer Alex Stamos told reporters on Tuesday that an account linked to the Kremlin troll farm was made an administrator of one of the Pages for several minutes before being scrubbed from the site. “Some of the tools, techniques, and procedures of this actor are consistent with those we saw from the I.R.A. in 2016 and 2017,” Stamos said. “We can’t say for sure whether this is the I.R.A. with improved capabilities or a separate group based on what we know today.” There were other differences, too: “While IP addresses are easy to spoof, the I.R.A. accounts we disabled last year sometimes used Russian IP addresses,” Gleicher said. “We haven’t seen those here.”

Similar to disinformation campaigns orchestrated by the I.R.A. in 2016, the group of Facebook Pages sought to capitalize on divisive social issues. Pages such as “Aztlan Warriors,” “Mindful Being,” “Resisters,” and “Black Elevation” were among the most-followed accounts; at least one was followed by more than 290,000 Facebook users. In total, the fake Pages spent approximately $11,000 on about 150 ads on Instagram and Facebook, purchased between April 2017 and June 2018. Facebook’s chief operating officer, Sheryl Sandberg, said the Facebook pages and accounts were removed on Tuesday. The company made the information public in advance of a real-life protest the “Resisters” page had promoted to counter a “Unite the Right” meet-up of white supremacists for next week. Facebook says it also shared its findings with other tech companies, Congress, and U.S. law enforcement.

The news, which confirmed an earlier Times report, follows myriad warnings from law-enforcement agencies that election meddling would likely only increase in 2018. “The warning lights are blinking red again,” director of national intelligence Dan Coats said earlier this month, warning of future cyberattacks. “Today, the digital infrastructure that serves this country is literally under attack.” The administration’s ability to respond has been hobbled by its leader, who has at various points seemed to contradict the findings of his own intelligence community in asserting Russia’s innocence. Facing a lack of support from Donald Trump himself, at least two government agencies—the N.S.A. and Cyber Command—have launched their own efforts to stymie meddling, though officials fear even those will fall short. “As good as it is, it’s not good enough,” Michael V. Hayden, who has led both the N.S.A. and the C.I.A., told The Washington Post earlier this month. “This is not a narrowly defined cyber-threat. This is one of the most significant strategic national-security threats facing the United States since 9/11.”

At least on the surface, the Trump administration has pledged to ramp up its efforts. On Tuesday, as she announced the creation of a new interagency center to protect against cyberattacks, Department of Homeland Security Secretary Kirstjen Nielsen said of election meddling, “Let me be clear: Our intelligence community has it right. It was the Russians. We know that. They know that. It was directed from the highest levels. And we cannot and will not allow that to happen again.” At the same time, social-media companies face mounting pressure to address the problem themselves. “I’m glad Facebook is taking some steps to pinpoint [and] address this activity,” Democratic Senator Mark Warner said in a statement. “Today’s disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation.”