Russian operatives sacrifice followers to stay under cover on Facebook
By Jack Stubbs

LONDON (Reuters) – Efforts by Russian influence campaigns to stay undetected on social media ahead of next year’s U.S. elections are undermining their ability to gain followers and spread divisive political messages, a senior Facebook <FB.O> executive told Reuters.

Social media users need to stand out from the crowd to gain traction online, but that type of behavior also helps Facebook and other platforms identify suspicious activity to then analyze for signs of foreign involvement, said Nathaniel Gleicher, Facebook’s head of cyber security policy.

“If you are very, very loud, if you go viral very, very fast that’s exactly the sort of thing that our automated systems will detect and flag,” he said. “So when actors have really diligent, deliberate and effective operational security it weakens their ability to build an audience.”`

Facebook on Monday suspended a network of Instagram accounts it said targeted U.S. users ahead of next year’s presidential poll and were linked to Russia’s Internet Research Agency (IRA), an organization Washington says Moscow used to meddle in the 2016 U.S. election.

The latest Russian campaign posted on both sides of sensitive topics such as the environment and sexual equality but struggled to attract followers due to the operators’ attempts to stop the accounts being caught and disabled, said Gleicher.

Those efforts included sharing memes and screenshots of other users’ social media posts instead of producing original content in English, likely to avoid making language errors typical of non-native speakers, according to a report https://graphika.com/uploads/Graphika%20Report%20-%20CopyPasta.pdf by social media analytics firm Graphika.

This technique “gave each asset less of a discernible personality and therefore may have reduced the (campaign’s) ability to build audiences,” Graphika said.

The IRA-linked network of 50 Instagram accounts had around 246,000 followers, about 60 percent of which were in the United States, Facebook said, without providing a breakdown for each account.

That compares with charges by U.S. special counsel Robert Mueller that the IRA has previously run social media accounts with hundreds of thousands of followers each. Facebook says up to 126 million Americans may have seen Russian-linked posts aimed at the 2016 election.

Russian catering tycoon Evgeny Prigozhin, accused by U.S. prosecutors of orchestrating the IRA’s activities through Concord Management and Consulting LLC, did not respond to questions sent by Reuters.

Attorneys for Concord Management and Consulting LLC did not respond to a request for comment but have previously denied any wrongdoing.

PAYING IN ROUBLES

Facebook, Twitter <TWTR.N> and Google <GOOGL.O> have vowed to step up the fight against political manipulation of their platforms after facing fierce criticism for failing to counter alleged Russian interference in 2016.

Despite the increased scrutiny, U.S. officials have repeatedly warned of the threat posed by Russia and other countries such as Iran, who they say may still attempt to sway the result of next year’s vote.

Addressing U.S. lawmakers this week, FBI Deputy Assistant Director Nikki Floris said the bureau’s foreign influence task force was briefing candidates and running a series of public information videos to help safeguard the election.

The Department of Homeland Security did not immediately respond to a request for comment.

Moscow and Tehran have repeatedly denied allegations of election interference. The Kremlin and Russia’s foreign ministry did not immediately respond to requests for comment.

Russian efforts to avoid detection by the platforms’ security teams have been increasing since the IRA’s alleged efforts in 2016 were first exposed, said Ben Nimmo, who has helped Facebook analyze influence operations and currently runs investigations at Graphika.

A campaign exposed by the Atlantic Council’s Digital Forensic Research Lab in June, which attempted to seed false narratives online such as a bogus plot to assassinate British Prime Minister Boris Johnson, created a new account for almost every single post.

This made it harder to track connections between the accounts, Nimmo said, but also meant the posts only reached a small number of people.

Announcing the takedown of a network in July last year, which it said showed “some connections” to previously-identified IRA accounts, Facebook noted that “bad actors have been more careful to cover their tracks.”

The company said operators were using virtual private networks and internet phone services to obscure an account user’s location, and paying for advertising via third parties.

In contrast, previous campaigns linked to the IRA used Russian phone numbers and IP addresses to register their accounts, as well as paying for Facebook adverts in Russian roubles, raising suspicions about Russian involvement.

“The original IRA activity threw operational security to the wind,” Nimmo said.

(Additional reporting by Christopher Bing and Raphael Satter in Washington; Editing by Carmel Crimmins)