The indictment of 13 Russian nationals on Friday, announced by U.S. Special Counsel Robert Mueller, made extensive use of records from Facebook and Instagram, according to people familiar with the matter.
Yet the combination of tactics revealed in the indictment, including the use of shell corporations and stolen IDs, deployment of virtual private networks to avoid online detection, and payments to unwitting Americans, suggests even a company as powerful as Facebook could struggle to stop such activities by itself as they happen.
U.S. spy agencies have said Russia would try to interfere in the 2018 midterm elections, again by using social media to spread propaganda.
“They can’t out of hand stop it, because it’s very difficult for them to trace those things,” said Ann Ravel, a former member of the U.S. Federal Election Commission. The clandestine purchase of advertising on the site through fake personas was particularly alarming, she said.
To know the identities of ad buyers, internet companies might need to duplicate the “know your customer” practices of banks and regularly share information with authorities, Ravel said.
Facebook has said it will start requiring thorough documentation from election-related advertisers to verify their identity and location, beginning with U.S. elections this year.
How extensive that vetting will be is unclear. “If you want to put up a theme page for a group, in the ordinary course you wouldn’t expect that a vendor like Facebook would require that sort of vetting,” said Dan Petalas, a former U.S. federal prosecutor.
“The indictment really details an elaborate scheme that would be difficult to identify,” he said.
Facebook said on Friday it was making “significant investments” to guard against future attacks and was working with the Federal Bureau of Investigation to deter election interference.
The Russians’ alleged campaign began with three weeks of reconnaissance in 2014, when two of them traveled to nine U.S. states, including Colorado and Michigan, according to the indictment. They were equipped with cameras, SIM cards, drop phones and, if needed, “evacuation scenarios,” the indictment says.
It describes the Kremlin-linked Internet Research Agency in St. Petersburg as an organized bureaucracy. It was backed by an annual budget of millions of dollars, employed hundreds of people and boasted several departments dedicated to specific projects, like search-engine optimization and graphics.
Even those who have demanded Facebook do more acknowledged on Friday it could do only so much.
“We each bear some responsibility for exercising good judgment and a healthy amount of skepticism when it comes to the things we read and share on social media,” Senator Mark Warner, the top Democrat on the Senate Intelligence Committee, said in a statement.
The defendants are accused of stealing social security numbers of Americans to open up fraudulent accounts on digital payment system PayPal Holdings Inc. They purchased space on computer servers located within the United States to use virtual private networks to mask their identities and pose as Americans.
Facebook could go further in monitoring its platform and adopt the process cryptocurrency firms use to verify bitcoin traders, said Jordan Lieberman, president of ad firm Audience Partners. But if Facebook raises the bar much higher, “It’s going to interrupt revenue flows and it’s absolutely going to cost them money.”
