Internet companies have a long way to go before they’re capable of stopping any foreign meddling in future U.S. elections.
Changes rolled out so far by Facebook Inc., Twitter Inc. and other technology companies wouldn’t prevent the tactics revealed Friday by U.S. Special Counsel Robert Mueller’s investigation of Russian operatives — let alone any new hacks dreamed up by bad actors.
An indictment issued by Mueller said at least 13 Russians engaged in a sophisticated campaign to sway public opinion around the 2016 presidential election. They posed as U.S. citizens, using falsified paperwork and stolen bank numbers, to hide their real identities and opened PayPal Holdings Inc. accounts to buy ads on popular social media sites.
The narrative laid out by Mueller describes a more advanced Russian-backed misinformation effort than previously known. Until now, Facebook and Twitter had been criticized for missing Russian purchases of U.S. election ads through their systems. PayPal hadn’t featured publicly in the investigations until Friday.
The identity theft detailed in the indictment is tougher than the problems these companies have so far tried to solve. Facebook is boosting its security-focused workforce and adding transparency for who purchases ads. Twitter is creating a “transparency center” on political campaign ad spending, too. Alphabet Inc.’s YouTube is hiring thousands of people to vet videos. None of these steps would prevent foreign agents from using stolen identities and bank accounts to buy divisive ads and create misleading posts.
PayPal is a pioneer in online identity and fraud detection. And yet, it’s digital payments service was the funding vehicle for the Russian operatives’ deceptive campaigns — making their transactions appear in social media companies’ systems like any other purchases in U.S. dollars.
The Russians’ approach raises the question of whether other parties have bought — or will buy — ads using stolen identities. It also undermines the main value of social media business models: That people are who they say they are. Facebook and Twitter sell ads through automated systems where brands can opt to reach certain audiences, and later find out how many people they reached. Friday’s indictment shows how this system can be easily gamed, and highlights the risk that even more accounts may not be fake, eroding trust in those metrics.
Meanwhile, as long as social media platforms work the way they do, by making it easy to pay to spread incendiary messages, it’s hard to see this problem going away, said Zeynep Tufekci, an information sciences professor at the University of North Carolina at Chapel Hill.
“They used the platforms as they were designed,” Tufekci wrote on Twitter from a verified account. “All the problems most everyone is worried about will be with us pretty much at the same scale in 2018 and 2020 even if not another ruble is spent on U.S. elections.”
The indictment also described how the Russian operatives used online distribution and marketing tactics that were as advanced as any legitimate social media campaign — making it difficult for companies to detect anomalies. The operatives worked in shifts to ensure they made posts in accordance with U.S. time zones and circulated lists of U.S. holidays so the accounts posing as citizens could post appropriate content, according to the indictment. They also regularly evaluated their content to make sure it appeared authentic, and received feedback on how much text, graphics or video to use to appear naturally American.
The indictment has already renewed calls to regulate social media. Senator Amy Klobuchar, a Democrat from Minnesota, said Mueller’s investigation shows Russia was using online ads to wage an “information war” against the U.S. and Congress should pass new laws to police political advertising on social media immediately.
“We do not have time to wait. If Congress continues to refuse to act, we are aiding Russia’s efforts to divide and influence our nation—inaction is unacceptable,” Klobuchar said in an emailed statement. She is a co-sponsor of the Honest Ads Act, which would regulate online election ads.
Next month, the Federal Election Commission will also consider a proposal to require online political ads to carry the same disclaimers from sponsors as do radio, television and print ads.
“We know we have more to do to prevent against future attacks,” Joel Kaplan, Facebook’s vice president of global policy, said in a statement on Friday.
Facebook is working closely with the FBI, the Department of Homeland Security and other companies on better ways to protect the U.S. and the company’s users, he added. The FBI has created task force on election interference, and Facebook is actively working with the agency, Kaplan also said.
Ahead of midterm elections in the U.S. later this year, Twitter said it’s verifying major party candidates for all statewide and federal elective offices, and major national party accounts, as a “hedge against impersonation.” The company is also improving its anti-spam technology to track down networks of malicious bots targeting election-related matters, while monitoring trends and spikes in conversations about the 2018 elections to spot potential manipulation.
“Tech companies cannot defeat this novel, shared threat alone,” Twitter said in a statement. “The best approach is to share information and ideas to increase our collective knowledge, with the full weight of government and law enforcement leading the charge against threats to our democracy.”
