A Russian troll-farm in St. Petersburg
.ipgINVESTIGATIVE PRESS GROUP
People associated with the infamous St. Petersburg troll group that was part of Russia's attempt to interfere in the 2016 US presidential election are trying to target Americans again, Facebook (FB) announced Tuesday after receiving a tip from the FBI.
The disrupted operation used fake personas including realistic-looking computer-generated photos of people, a network of Facebook accounts and pages that had only a small amount of engagement and influence at the time it was taken down, and a website that was set up to look and operate like a left-wing news outlet.
This is the first publicly available evidence that people connected to the Russian troll group, which is known as the Internet Research Agency (IRA), are using unwitting Americans in an attempt to meddle with the 2020 election and stir discord.
The operation seems to have been shut down before it could get much traction on Facebook or the rest of the internet. That mirrors what happened around the 2018 midterm elections, when - as far as is publicly known - the Russian trolls' online efforts were halting and small.
The trolls had far more luck gaining followers and engagement in 2016, though it is not known how much of an impact, if any, their work had on the election.
Facebook said it relied on technical indicators to make the link between this operation and the IRA. The company does not typically share those indicators publicly, as it has said in the past doing so could tip off bad actors to how it finds them, but they could include unique information tied to specific accounts or devices. Facebook said it shared information with the FBI.
"This looks like an early-stage attempt to target left-wing audiences on a range of issues," Ben Nimmo, head of investigations at Graphika, a social media analytics company commissioned by Facebook to study the influence operation.
"The [US] election wasn't the only focus," he said, noting that the content had gained little traction online, "but it looks like the operation wanted to divide Democratic voters, the same way the IRA tried in 2016."
Part of Tuesday's expose included "Peace Data," a website that purports to be an independent leftwing news outlet and features articles about U.S foreign policy, President Donald Trump, former Vice President Joe Biden, and the QAnon conspiracy theory.
Only a small portion of Peace Data articles explicitly reference 2020 US election candidates, but headlines include "The Biden-Harris Ticket Encapsulates How the Western Left Will Give in to Right-Wing Populism" and "The Trump administration is continuing its relentless war on nature."
Nathaniel Gleicher, head of cybersecurity policy at Facebook, told CNN Business that this particular set of sites and accounts was in its infancy and had little traction on Facebook. But, he said, it was clear that people associated with past activity tied to the IRA were "actively, aggressively, and creatively trying to target the United States in the run up to the  election."
In an attempt to appear legitimate, Peace Data featured fake personas for people who were supposedly its editors, according to Graphika. These personas were used to recruit unwitting, real writers to contribute articles -- including, it seems, some writers in the United States, according to Graphika.
Pictures for some of the fake personas were created using artificial intelligence technology, Facebook and Graphika said, the same kind of technology that is used to create deepfake video.
Graphika pointed to a person identified online as "Alex Lacusta." A Twitter (TWTR) bio for "Lacusta" listed him as an associate and online editor at Peace Data. The profile picture on the account was created using deepfake technology, Graphika said.
Facebook said it had shared its findings with Twitter. Twitter has suspended an account supposedly belonging to "Lacusta." There is no indication the fake "Lacusta" account is connected to any actual Alex Lacusta.
In a series of tweets sent after this article was originally published, Twitter said, "We suspended five Twitter accounts for platform manipulation that we can reliably attribute to Russian state actors."
It specified the accounts were linked to Peace Data and added, "The Tweets from the Russian-linked accounts were low quality and spammy, and most Tweets from these accounts received few, if any, Likes or Retweets." Twitter also said that links to Peace Data would be blocked from its platform going forward.
CNN Business found a job posting for Peace Data on a website advertising work for freelancers. The posting described Peace Data as "a young international news organization focused on raising awareness about corruption, environmental crisis, abuse of power, armed conflicts, activism, and human rights."
"If you are interested in covering stories that are usually untold or kept hidden from the general public, we will be glad to work together," it added.
The posting promised a rate of $75, but didn't specify if that was per article submitted.
Graphika noted that IRA-linked operations' practice of hiring unwitting authors to create content online is consistent with the findings of a months-long CNN investigation published in March which identified an IRA off-shoot in Ghana.
Between February and August 2020, Peace Data published more than 500 stories in English and 200 stories in Arabic, Graphika's analysis found.
The U.S. intelligence community and Silicon Valley were caught off-guard in 2016, when Russian trolls used social media to promote divisive messages to millions of Americans, running - among other things - Facebook pages with hundreds of thousands of followers.
With companies like Facebook and federal agencies like the FBI now aware of the tactics trolls like these use and monitoring for them, Gleicher said, it is more difficult for covert social media operations to gain huge followings. It is clear Russians are "really aggressively trying to find a path in to have an impact and they are failing," he said.
Gleicher said the FBI tipped Facebook off to the Peace Data site in July. Facebook then independently determined through technical indicators that people linked to the IRA were involved with the website.
Gleicher said Facebook shared its findings with the FBI and with other technology companies.
Intelligence officials told Congress earlier this summer that Russia was spreading false information about Biden.
Some of the covert online tactics the people behind the Peace Data are using are similar to what the Russian trolls did in 2016, including setting up websites purporting to be independent news outlets, using fake social media personas to share divisive and controversial material, and offering to pay unwitting westerners to make their effort appear more legitimate.
But some of the tactics being used have evolved. Previously one obvious tell of a fake account was if it was using a profile picture that was stolen from a real person's account.
One of the most successful Russian troll accounts in 2016, "Jenna Abrams," amassed more than 70,000 followers, including some prominent Republicans. CNN later revealed that the profile picture used on the account was that of a then 26-year-old Russian woman who said she had not been aware her picture was used.
Now, technology widely available online allows for the creation of fake faces of people that do not exist. The technology is not only being used to generate faces to front online influence operations, but also for accounts used in online harassment campaigns.
The FBI says that Brian Mock went to the U.S. Capitol on Jan. 6 unsure of what he would face, but as he shared on social media just days later, he was prepared to fully commit to whatever came his way — even death. “I went to the Capitol not knowing what to expect but said goodbye to my 4 children, not sure if I was going to come home,” Mock wrote on Facebook on Jan. 8, according to federal documents charging Mock with multiple crimes. “I was at peace with that knowledge.” Mock, 43, is one of the latest people to be arrested for crimes related to the siege on the U.S. Capitol, according to a statement from the Justice Department.
The deadly insurrection at the US Capitol was “planned in plain sight” but intelligence failures left police officers exposed to a violent mob of Trump supporters, a Senate investigation has found. The Capitol police intelligence division had been gathering online data since December about plots to storm the building on 6 January, including messages such as: “Bring guns. It’s now or never.” But a combination of bad communications, poor planning, faulty equipment and lack of leadership meant the warnings went unheeded, allowing the insurrectionists to overrun the Capitol and disrupt certification of Joe Biden’s election victory. Five people died.
For over a year, Anthony Fauci has been a bogeyman for conservatives, who have questioned his handling of the Covid-19 pandemic and accused him of quietly undermining then-President Donald Trump. But those attacks took on a whole new level of vitriol this week, to the point that one social media analysis described it as highly misleading and at least one platform pulled down some posts, citing false content. It all stemmed from a tranche of Fauci’s emails that were published as part of a Freedom of Information Act request filed by various news outlets. Within hours of publication, the hashtag #FauciLeaks was trending on Twitter.
Donald Trump has appeared to drop his strongest hint yet at another presidential run in 2024, responding to news of his two-year ban from Facebook on Friday by saying he would not invite Mark Zuckerberg to dinner “next time I’m in the White House”.