Updated: Wednesday, May 10, 2017
Something peculiar is happening on USA Today’s Facebook page. Look closely, and you may notice the clues.
A Facebook status update that’s pure gibberish, but still gets thousands of likes from other accounts, is one hint that something may be amiss. This was one of the things digital security experts found as they were investigating strange web activity related to USA Today on Facebook.
“It was literally just ‘13459u2 34ltijsre’ and then it had 4,000 ‘likes’ because there were 4,000 fake accounts and they were all liking each other,” Dan Nadir, a vice president at the security company Proofpoint told USA Today. Reporters for the Gannett-owned newspaper revealed Gannett has requested an FBI probe in response to a flood of activity on its Facebook page from fake Facebook accounts.
A good first question to ask about all this is: But why involve the FBI?
It’s not as though intelligence agencies are disinterested in social-media scams. Quite the opposite. A declassified U.S. Director of National Intelligence report published in January describes in some detail how the Kremlin ordered and carried out a secret campaign on Facebook to sway public opinion in the United States.
But in the case of bots flocking to USA Today’s Facebook page, a spokesperson from the FBI told me it could neither confirm nor deny the existence of an investigation, and refused to provide any further information. And Facebook said it couldn’t comment on USA Today’s decision to involve law enforcement. Further, a spokesperson for the social giant declined to say whether law enforcement officials had even requested any data related to the incident, or whether—if such data even exists—it would comply with potential requests.
All that Facebook would say is that it was working on disrupting an ongoing spam campaign—one involving “a pattern of liking and interacting primarily with publisher Pages, with the apparent intent of eventually making friend connections and sending spam,” Shabnam Shaik, a technical program manager at Facebook, said in a statement provided by a Facebook spokesperson. Which raises the question of bot motivations more broadly: Even when it’s obvious that bots are present, it can be hard to tell what they’re up to. Some bots show up to collect people’s personal information. Others simply want to share malicious links. Still others exist to spread misinformation.
When Facebook went on a bot-purging spree last month, most publishers saw a small dip in fans—less than 3 percent, Facebook said at the time. But USA Today was, for some reason, absolutely walloped by the purge. Some 6 million accounts that had previously liked the USA Today Facebook Page vanished overnight, suggesting that the newspaper was, perhaps, the main target of some larger bot-laden scam.
USA Today reported that it went from 15.2 million likes to 9.5 million likes as of last week, and expected that subsequent spam purging could reduce overall followers to “as low as 6.5 million.” Facebook confirmed to me that it is taking additional action to fight off the bots swarming USA Today’s Facebook page. As of this writing, USA Today was down to about 8 million followers.
The newspaper “appears to have been the main target of this operation,” USA Today reported Gannett was compelled to contact the FBI about it late Wednesday “because the issue is not stopping nor has the source of the issue been identified,” a spokesperson for Gannett told me. The company, which notified Facebook of the bot onslaught in the first place, is working closely with Facebook to resolve the issue, she said.
“We don’t know why the scope of impact on USA Today’s Facebook Page appears greater than any other publisher, but we have been working closely with our partners to shut down this spam operation and remove the fake accounts associated with it,” said Shaik, the Facebook manager.
Many of the fake accounts were designed to look like people based in Bangladesh, India, Egypt, and Pakistan, USA Today reported, though it wasn’t clear where the spam activity actually originated. Stranger still: The accounts appeared to be manually made by humans—rather than generated by software—one of the telltale signs of a larger and more sophisticated operation. The suggestion, USA Today says, is that “somewhere in the world humans are busy setting up these profiles.”
But who? And where? And why?
Facebook said back in April that it was clear there was a coordinated effort behind the spam it was then targeting. “They used tricks to avoid detection, including redirecting their traffic through ‘proxies’ that disguised their location,” the company said in a statement at the time.
Complicating matters further is the financial incentive at stake for USA Today. Facebook is a major source of web traffic for publishers, and news sites like USA Today rely on traffic to command advertising dollars, which pay the salaries of journalists. It's conceivable that the fake accounts flocked to USA Today because someone wanted to help Gannett profit. Facebook declined to speak on the record about such a possibility. A spokesperson for Gannett told USA Today that “an internal investigation had found no evidence that Gannett or its marketing campaigns had deliberately attracted fake accounts.”
“By disrupting the campaign now, we expect that we will prevent this network of spammers from reaching its end goal of sending inauthentic material to large numbers of people,” Facebook had said in April.
But now, the extent to which the mysterious network was actually disrupted remains unclear.