Facebook report details how a Russia-linked troll farm was set up in Ghana to influence the 2020 US elections
Ghana is one of over 50 countries worldwide where an influence operation (IO) – coordinated efforts to manipulate or corrupt public debate for a strategic goal – has been identified and removed by Facebook.
According to the social media company, over 150 networks were busted across these countries for violating its policy against Coordinated Inauthentic Behavior (“CIB”) which relates to any coordinated network of accounts, Pages and Groups that centrally rely on fake accounts to mislead Facebook and people using its services about who is behind the operation and what they are doing.
According to the popular social media platform, threat actors have since 2017 continued to evolve their techniques to evade detection.
This was observed in the Ghana operation where individuals associated with the Russian Internet Research Agency (IRA) recruited locals to focus their posts on Facebook on racial equality issues in the US and attempted to run political ads, including by co-opting people in the US to do so ahead of the country’s 2020 elections.
The campaign relied heavily on authentic accounts and off-platform coordination, including setting up an office in Accra for a fictitious NGO.
“They assessed that the operation outsourced this activity in an effort to appear more credible and authentic, minimize language discrepancies, and frustrate our ability to attribute,” Facebook stated in its May 2021 report.
According to Facebook, the investigation started internally but evolved into a collaboration with investigative journalists at CNN and Twitter to help in understanding the on-the-ground operations behind the network.
“We removed 49 Facebook accounts, 69 Pages and 85 Instagram accounts for engaging in foreign interference — which is coordinated inauthentic behaviour on behalf of a foreign actor — on Facebook, Instagram and other internet platforms. This network was in the early stages of building an audience and was operated by local nationals — some wittingly and some unwittingly — in Ghana and Nigeria on behalf of individuals in Russia.” Facebook’s Head of Security Policy, Nathaniel Gleicher stated in a blog post in March 2020.
Here are the key trends and tactics involving influence operations (IO) observed by Facebook:
A shift from “wholesale” to “retail” IO: Threat actors pivot from widespread, noisy deceptive campaigns to smaller, more targeted operations.
The blurring of the lines between authentic public debate and manipulation: Both foreign and domestic campaigns attempt to mimic authentic voices and co-opt real people into amplifying their operations.
Perception Hacking: Threat actors seek to capitalize on the public’s fear of IO to create the false perception of widespread manipulation of electoral systems, even if there is no evidence.
IO as a service: Commercial actors offer their services to run influence operations both domestically and internationally, providing deniability to their customers and making IO available to a wider range of threat actors.
Increased operational security: Sophisticated IO actors have significantly improved their ability at hiding their identity, using technical obfuscation and witting and unwitting proxies.
Platform diversification: To evade detection and diversify risks, operations target multiple platforms (including smaller services) and the media, and rely on their own websites to carry on the campaign even when other parts of that campaign are shut down by any one company.
Mitigations
Influence operations target multiple platforms, and there are specific steps that the defender community, including platforms like Facebook, can take to make IO less effective, easier to detect, and more costly for adversaries.
There is the need to combine automated detection and expert investigations. Because expert investigations are hard to scale, it’s important to combine them with automated detection systems that catch known inauthentic behaviours and threat actors. This in turn allows investigators to focus on the most sophisticated adversaries and emerging risks coming from yet unknown actors.
In addition to stopping specific operations, platforms should keep improving their defences to make the tactics that threat actors rely on less effective: for example, by improving automated detection of fake accounts. “As part of this effort, platforms can incorporate lessons from CIB disruptions back into their products, and run red team exercises to better understand the evolution of the threat and prepare for highly-targeted civic events like elections.” The 44 paged Facebook report said.
Independent researchers, law enforcement and journalists would also have to work together to better counter IO because they rarely are confined to one medium.
Influence operations are not new, but over the past several years they have burst into global public consciousness. These campaigns attempt to undermine trust in civic institutions and corrupt public debate by exploiting the same digital tools that have diversified the online public square and empowered critical discussions from Me Too to the Black Lives Matter movements.
