Another Day, Another Major Disinformation Effort Facebook Thinks Is Ok

from the hoodwinked-patriots-dot-come dept

Our disinformation problem simply isn't going away. While the Russian "Internet Research Agency" has received most of the attention for filling the internet with bullshit and bile, the problem is routinely disclosed to be far larger than that. Take for example the thriving "fake news" efforts coming out of Macedonia, where (with the help of US allies) filling the internet and Facebook with disinformation has become a cottage industry. And while Facebook spends a lot of time insisting they're taking radical steps to police the problem in the wake of genocide in Myanmar, it remains fairly clear they still don't have a handle on the problem.

For example yet another disinformation operation uncovered this week involves a Ukrainian-run "I Love America" Facebook group with more than a million members. In concert with other similar pages like "God bless Donald and Melania Trump and God bless America," the effort lures boomers in with cute kittens and patriotic memes before getting to the real meat and potatoes of the effort:

Many of the posts are just repurposed versions previously pushed by the IRA in a bid to try and stoke existing racial and political tensions in the United States:

And while the usual suspects will likely try to downplay this as "just a few harmless memes," the outfit's engagement surpasses many of the biggest, actual news organizations on Facebook, meaning there's still an awful lot of folks having their patriotism and military respect exploited and their heads filled with fluff and nonsense so some Ukrainian nitwits can make a buck:

Collectively this effort is far larger than the IRA-linked Facebook groups highlighted in the Mueller report, none of which had more than 390,000 members. The report doesn't think this effort is covert or sophisticated enough to be a government-backed effort (in large part because the Ukrainian backers aren't trying to hide who they are), and is likely just some "entrepreneurs" using pro-Trump propaganda and kittens to make money. Facebook, for its part, doesn't think this rises to the level of "coordinated inauthentic behavior" because the Ukranians aren't hiding their identity (read: it's profitable to Facebook):

"A Facebook spokesperson told Popular Information that the company does not believe any of the Facebook pages discussed in this article violate its policies, including the policy against "coordinated inauthentic behavior." Facebook defines "coordinated inauthentic behavior" as "when groups of pages or people work together to mislead others about who they are or what they are doing."

While it may not be part of a foreign-government backed campaign, the end result is the same. Facebook users are being exploited and having their heads filled with rocks for profit. And (at least until this story gets some traction), Facebook's cool with it.

Update: That didn't take long, and Facebook appears to have seen the problem with a bunch of Ukrainians misleading US Facebook users to make a quick buck:

Filed Under: content moderation, coordinated inauthentic behavior, disinformation, elections, fake news
Companies: facebook

Twitter And Facebook Removing Chinese Disinfo Campaigns Shows That, Contrary To Popular Opinion, They Do Moderate Against Disinfo

from the moderation-happens dept

Leaving aside the ridiculous and ignorant suggestions from some that no internet platforms should moderate anything, many, many people seem to believe (incorrectly) that the various internet companies refuse to moderate anything because it goes against their bottom lines. We've heard this from a number of politicians -- especially among those seeking to change Section 230, arguing (again, incorrectly) that because of Section 230 there's somehow no incentive to moderate content on their platforms.

This is wrong on multiple levels. There is tremendous business, political, moral, and social pressure to moderate content on these platforms. When they get it wrong, they get criticized. They can lose users. And (importantly) they can lose advertisers, partners, customers and investors. There is demand for "healthy" platforms, and it's Section 230 that allows them to experiment and moderate accordingly. That's why it's notable to me that both Twitter and Facebook announced the removal of what appears to be a coordinated attempt to abuse both platforms to push disinformation against protesters in Hong Kong. Here's Facebook's announcement:

Today, we removed seven Pages, three Groups and five Facebook accounts involved in coordinated inauthentic behavior as part of a small network that originated in China and focused on Hong Kong. The individuals behind this campaign engaged in a number of deceptive tactics, including the use of fake accounts — some of which had been already disabled by our automated systems — to manage Pages posing as news organizations, post in Groups, disseminate their content, and also drive people to off-platform news sites. They frequently posted about local political news and issues including topics like the ongoing protests in Hong Kong. Although the people behind this activity attempted to conceal their identities, our investigation found links to individuals associated with the Chinese government.

And here's Twitter's announcement:

This disclosure consists of 936 accounts originating from within the People’s Republic of China (PRC). Overall, these accounts were deliberately and specifically attempting to sow political discord in Hong Kong, including undermining the legitimacy and political positions of the protest movement on the ground. Based on our intensive investigations, we have reliable evidence to support that this is a coordinated state-backed operation. Specifically, we identified large clusters of accounts behaving in a coordinated manner to amplify messages related to the Hong Kong protests.

As Twitter is blocked in PRC, many of these accounts accessed Twitter using VPNs. However, some accounts accessed Twitter from specific unblocked IP addresses originating in mainland China. The accounts we are sharing today represent the most active portions of this campaign; a larger, spammy network of approximately 200,000 accounts — many created following our initial suspensions — were proactively suspended before they were substantially active on the service.

Despite common perception, both companies have put a lot of effort into discovering and stopping these kinds of efforts. Of course, none of it will be perfect, because content moderation at scale is impossible to do well. Mistakes of both false positives and false negatives are inevitable. But, if anyone thinks that modifying Section 230 will magically make companies better at this, they're not paying attention. Adding more liability to companies over their moderation choices won't make these efforts any better or any easier -- they might just bog the companies down in lawsuits.

Filed Under: cda 230, china, coordinated inauthentic behavior, disinformation, hong kong, misinformation, section 230
Companies: facebook, twitter

Facebook Files Questionable Lawsuit Over Fake Followers And Likes

from the is-that-truly-hacking? dept

Over the last year or so, a key focus of Facebook's has been to battle what it calls "coordinated inauthentic behavior." While the phrase may sound vaguely Orwellian, I actually appreciate the thinking behind it. It's one thing to say you're going after "fake accounts" or "propaganda" or "trolls," but that language is imprecise, and certainly doesn't provide much clarity for what Facebook is actually targeting. Indeed, using vague language continues to be a massive problem in all sorts of content moderation challenges. So, instead, Facebook focused on "coordinated inauthentic behavior," which is much more definable, and also neatly encapsulates a lot of activity that most people all agree is at least somewhat problematic in a variety of contexts. I've also appreciated some of the actions that Facebook has taken to try to stop or prevent such "coordinated inauthentic behavior."

What I don't appreciate is a highly questionable lawsuit Facebook filed on Friday, again supposedly targeting coordinated inauthentic behavior on its platforms: in particular fake likes and fake followers. Now, let's be clear: no one is suggesting that services that provide fake likes or fake followers are a good thing. They are scams and they are designed to mislead people. I think Facebook has every right to try to delete such fake likes and fake followers from its platforms.

What I'm less sure of, however, is if Facebook should be able to sue the companies (and the individuals behind those companies) for creating such a service. But that's what Facebook has done. The complaint argues that it's a CFAA violation (and a violation of California's version of the CFAA). If you don't recall, the CFAA (the Computer Fraud and Abuse Act) was the law that was originally designed to go after malicious hackers, but was written in such broad and vague language -- regarding things like "unauthorized access" and "exceeding authorized access" -- that it's been used in all sorts of questionable ways, including not obeying a web site's terms of service. It's been referred to as "the law that sticks" when no other law can be used against "vaguely icky" activity done on a computer.

One of the most annoying things over the past few years is seeing big internet companies regularly try to use the CFAA and expand what it covers in ways that are extraordinarily broad and could lead to real problems down the road. Facebook has actually done this for years, with a big case being the time it sued a site, Power Ventures, which helped users aggregate all their various social network info. This was not "hacking" in any real sense, and the access was "authorized" by the end user, but Facebook didn't like it and argued that because it sent Power a cease and desist letter, that any further access violated the CFAA. Unfortunately, the courts have agreed with Facebook, setting a dangerous precedent.

And, now, Facebook has gone back to the well, arguing that setting up fake likes and fake followers also violates the CFAA:

Defendants’ access and use of Facebook and Instagram’s computers and computer systems was unauthorized because Defendants accessed Facebook and Instagram’s computer network after Facebook and Instagram disabled their Instagram accounts and sent cease and desist letters to Defendants revoking their access.

Facebook and Instagram computers and servers are protected computers as defined by 18 U.S.C. § 1030(e)(2).

Defendants violated 18 U.S.C. § 1030(a)(4) because they knowingly and with intent to defraud accessed Facebook and Instagram-protected computers by sending unauthorized commands to Facebook and Instagram computers. Defendants sent the commands to Facebook and Instagram computers to manipulate Instagram’s service by fraudulently inflating likes of certain Instagram accounts. Defendants did these acts in exchange for profit.

Defendants violated 18 U.S.C. § 1030(a)(5)(A) because they knowingly and intentionally caused the transmission of a program, information, code, or command, and, as a result of such conduct, intentionally damaged Facebook and Instagram-protected computers.

Now, I dislike fake likes and fake followers on social media just as much (if not more) than the average person. I'm aware of some other news sites that some might consider competitors of ours that have used those tactics to build up larger claimed social media followings. And I can see how that's unfair.

But is it truly hacking? Is it truly "unauthorized access"? Note that Facebook calls out that it sent cease and desist letters to the defendants, as per the 9th Circuit's ruling in the Power Ventures case. We warned that such a case would set a dangerous precedent, and once again, here's Facebook claiming that if it sends a cease and desist to a company for participating in an activity which the Facebook platform allows technologically that it's magically breaking the law.

To be clear: Facebook should have a free hand in kicking these guys off of the platform -- and if it can figure out the accounts posting the fake likes and fake follows, it can and should kick them off as well. But suing the company behind it under an anti-hacking law is a step too far. It's treating it's own inability to clean up its own platform as a legal issue. And it's not difficult to see how such a precedent can be abused legally by all sorts of internet platforms. Perhaps some people don't mind, and feel that any action taken against spammers/fakers/etc. should be fine. But be careful what you wish for. Allowing this use of the CFAA will only serve to give big internet platforms much more power over what you and anyone else can do on those platforms -- including how you might be able to use third party services to better protect your own privacy or take control over your own data.

It's no surprise, given the Power Ventures case, that Facebook now views the CFAA as a weapon it can use against third party services on its platform. But it provides way too much power to turn issues of Facebook's own failure to police its own platform into a legal issue dragged into the federal court system.

Filed Under: cfaa, coordinated inauthentic behavior, fake, followers, likes
Companies: facebook, likesocial