Facebook released a statement on Tuesday stating they had identified and deleted 32 accounts “involved in coordinated inauthentic behavior,” but haven’t determined who is behind them.

The deleted accounts were all created between March 2017 and May 2018, and include Facebook profiles, pages, and Instagram accounts, with varying followers from zero to over 200,000. 

The most followed accounts, “Aztlan Warriors,” “Black Elevation,” “Mindful Being,” and “Resisters,” promoted ideas of gender equality, spiritual awakening, pan-africanism, black liberation, and indigenous resistance. 

According to Facebook, this organized effort bares resemblance to the 2016 election interference campaign linked to the Russian-based Internet Research Agency (IRA), which saw thousands of fake accounts created to stoke tensions among voters with the goal of yielding a victory for President Donald Trump. 

“Some of the activity is consistent with what we saw from the IRA before and after the 2016 elections. And we’ve found evidence of some connections between these accounts and IRA accounts we disabled last year,” the statement reads. 

Facebook makes clear however, that there are significant differences between the election interference campaign and these closed accounts, such as IP addresses not being from Russian computers, and marketing services of up to US$9,500 being paid for in Canadian and American dollars.

Facebook’s statement also goes into detail about the investigation into the 2016 election interference and state responsibility for these attacks.

It said that the perpetrators hacked email accounts and stole data and then contacted journalists encouraging them to write about the stolen data. This was the case with the email leak from the Democratic Party meant to damage former presidential candidate Hillary Clinton’s campaign.

Facebook states that with U.S. government assistance they traced this attack to Russian Military intelligence, which was confirmed by the Special Council indictment of GRU officers in the case.

In addition to that, the Internet Research Agency is linked to the creation of fake profiles, pages, and the running of ads meant to sensationalize the voter public. The relationship with the Internet Research Agency and the Russian government is disputed, but according to Facebook, this effort was either “state-encouraged” or “state-ordered.” The newest closure of accounts resembles this operation.

One of the most alarming aspects uncovered in this recent closure of accounts is that one of the pages, “Resisters,” was planning to host a counter-protest in Washington, D.C., to a scheduled “Unite the Right” demonstration. The fake page reached out to five legitimate accounts to create the event, which boasted 600 attendees and over 2000 interested participants. 

The first Unite the Right rally took place in August 2017, where various white supremacist and neo-Nazi groups marched until the demonstration turned violent and resulted in the death of 32-year old counter-protester Heather Heyer, and dozens of injured people.

These cyber-threats are increasingly volatile ahead of the 2018 U.S. Midterm Elections. Facebook has stated that it is working with government authorities to figure out who is behind the fake accounts while continuing to develop new security measures. 

“Security is not something that’s ever done. We face determined, well-funded adversaries who will never give up and are constantly changing tactics. It’s an arms race and we need to constantly improve too,” The Facebook statement said.

occrp.org