7 ms·

Meta’s Adversarial Threat Report, Third Quarter 2022

133 points by holdingunsteady 4y ago

smrtinsert 4y ago
The transparency is much appreciated.
meta2023 4y ago
[flagged]
- bagels 4y ago
  Do you have a source for this?
throwaway_4ever 4y ago
> "This network originated in Russia and targeted primarily Germany, and also France, Italy, Ukraine and the United Kingdom. The operation centered around a large network of websites carefully impersonating legitimate news organizations in Europe. There, they would post original articles that criticized Ukraine, praised Russia and argued that Western sanctions on Russia would backfire. They would then promote these articles, memes and YouTube videos on Facebook, Instagram, Telegram, Twitter, petitions websites Change[.]org and Avaaz, and LiveJournal"
arbitrary_name 4y ago
>Together, these two approaches worked as an attempted smash-and-grab against the information environment, rather than a serious effort to occupy it long-term. I.e disintermediation: fascinating to see evidence of this in the field, and to see evidence of the investment made in this at the nation state level.
icelancer 4y ago
Whoa, US military involvement as well. >>> 1. United States: We removed 39 Facebook accounts, 16 Pages, two Groups and 26 accounts on Instagram for violating our policy against coordinated inauthentic behavior. This network originated in the United States and focused on a number of countries including Afghanistan, Algeria, Iran, Iraq, Kazakhstan, Kyrgyzstan, Russia, Somalia, Syria, Tajikistan, Uzbekistan and Yemen. The operation ran across many internet services, including Twitter, YouTube, Telegram, VKontakte and Odnoklassniki. It included several clusters of fake accounts on our platforms, some of which were detected and disabled by our automated systems prior to our investigation. The majority of this operation’s posts had little to no engagement from authentic communities. We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region. We’ve shared information about this network with independent researchers at Graphika and the Stanford Internet Observatory, who have published their findings about this network’s activity across the internet on August 24, 2022. Although the people behind this operation attempted to conceal their identities and coordination, our investigation found links to individuals associated with the US military.
- Sephr 4y ago
  We probably have the Countering Foreign Propaganda and Disinformation Act to thank for this.
- neuronexmachina 4y ago
  The report from Graphika has additional info about the US activity: https://public-assets.graphika.com/reports/graphika_stanford_internet_observatory_report_unheard_voice.pdf https://public-assets.graphika.com/reports/graphika_stanford... > Our joint investigation found an interconnected web of accounts on Twitter, Facebook, Instagram, and five other social media platforms that used deceptive tactics to promote pro-Western narratives in the Middle East and Central Asia. The platforms’ datasets appear to cover a series of covert campaigns over a period of almost five years rather than one homogeneous operation. > These campaigns consistently advanced narratives promoting the interests of the United States and its allies while opposing countries including Russia, China, and Iran. The accounts heavily criticized Russia in particular for the deaths of innocent civilians and other atrocities its soldiers committed in pursuit of the Kremlin’s “imperial ambitions” following its invasion of Ukraine in February this year. To promote this and other narratives, the accounts sometimes shared news articles from U.S. government-funded media outlets, such as Voice of America and Radio Free Europe, and links to websites sponsored by the U.S. military. A portion of the activity also promoted anti-extremism messaging. > ... At the same time, Twitter and Meta’s data reveals the limited range of tactics IO actors employ; the covert campaigns detailed in this report are notable for how similar they are to previous operations we have studied. The assets identified by Twitter and Meta created fake personas with GAN-generated faces, posed as independent media outlets, leveraged memes and short-form videos, attempted to start hashtag campaigns, and launched online petitions: all tactics observed in past operations by other actors. > Importantly, the data also shows the limitations of using inauthentic tactics to generate engagement and build influence online. The vast majority of posts and tweets we reviewed received no more than a handful of likes or retweets, and only 19% of the covert assets we identified had more than 1,000 followers. The average tweet received 0.49 likes and 0.02 retweets. Tellingly, the two mostfollowed assets in the data provided by Twitter were overt accounts that publicly declared a connection to the U.S. military.
  - 4y ago
cstejerean 4y ago
* US: 39 accounts * China: 81 accounts * Russia: 1,633 accounts Either Russia invests orders of magnitude more in these coordinated inauthentic behavior campaigns, or they are just that much worse at flying under the radar.
- droopyEyelids 4y ago
  Or russians used more accounts per campaign. Or facebook puts more effort into finding russian campaigns. Or russian campaigns are inherently easier to identify, or trying to achieve more difficult goals.
  - 52358 4y ago
    or US adversaries (ie Russia, China, Iran, etc) are not as active on FB properties for example, there may be more US campaigns targeting WeChat or Telegram or VK
  - bawolff 4y ago
    Or russia is currently in crisis and needs to use its assets, where others are more biding their time.
- polyomino 4y ago
  Typically you build up accounts and pages over a long time period and try to fly under the radar until you're big enough to affect change without getting caught. In this case, my read is Russia is much better at growing before getting caught, probably due to more experience with influence operations.
- bsder 4y ago
  Russia is kind of at war--which means that Russia is probably actively using these accounts. Whereas, the US and China are probably just establishing the account networks.
  - watwut 4y ago
    I would say, Russia is actively at war where influencing public is their only chance.
yuliyp 4y ago
This feels like it's a drop in the ocean. 100 accounts is nothing as far as bad actors go. It probably set the attackers back a few dollars.
- ppsreejith 4y ago
  Depends on the impact distribution, I'd imagine? I.e they could go after the most impactful bad actors which, assuming a power law (typical for social networks), would have vastly more reach than other accounts. Or it could be that they're catching the low hanging fruit (careless accounts). Wish they'd share some numbers (i.e followers/reach of these accounts etc).
- kjkjadksj 4y ago
  With that in mind and with other comments here talking about how these attacks mirror others, and were somewhat naive even in their methodology, maybe they intended to lose these accounts to just evaluate some Meta detection systems. Apparently Stanford is writing up a full report on this incident which I’m sure will be well studied by the military departments involved.
  - AlexanderTheGr8 4y ago
    any link on stanford's report? When will it be published? It sounds pretty interesting
ethbr0 4y ago
'We found 2 amateur-hour networks that didn't have much engagement + 1 network we were tipped to "after reviewing public reporting into a portion of this activity by investigative journalists in Germany."' Wow. If this is what they come up with for a quarterly PR piece, it doesn't signal FB actually cares past the lowest-hanging fruit.
deleted 4y ago
[deleted]
gerbler 4y ago
I don't know what to expect exactly, but these numbers seem quite small. Wonder if bad actors are moving to other channels
- SilverBirch 4y ago
  Not only do the numbers look small, the explanations seem very poor. For example: >We began our investigation after reviewing public reporting... So what Meta is saying here is that despite Russia having started a land war in Europe, Meta didn't do any pro-active investigation and anti-influence operations. Instead it waited until public reporting uncovered that their service had acted as a useful idiot for fascists. Think about the level of information and data that Meta has access to that it could use to detect and prevent attacks, and instead your average journalist is more likely to actually uncover these attacks.
infinitedata 4y ago
Although this is appreciated, no matter what they do, and after Cambridge Analytica, trust in Facebook/Meta went downhill. To top it off, Mark’s vision of VR and how stubborn he is with the infamous Metaverse will really just push FB to bankruptcy. Unless an activist investor pushes them to fire him and change course. This is like Wells Fargo trying to regain trust, same thing. You had one chance…
- anon400232 4y ago
  Tell me more about your claim that an org, person, or brand gets only one chance at trust. What exactly do you mean? What about the passage of time? Memories can be reshaped; public opinion even more so. Is your claim falsifiable?
- anon400232 4y ago
  > To top it off, Mark’s vision of VR and how stubborn he is with the infamous Metaverse will really just push FB to bankruptcy. Unless an activist investor pushes them to fire him and change course. Let's make this testable. Bankruptcy by when? Saying, e.g. "at some point" or "eventually" is very problematic to falsify. I've noticed statements of this kind often have a lot of caveats; e.g. ... > unless an activist investor pushes them to fire him and change course ... typically there are many other unspoken/unwritten caveats/exceptions as well. When this happens, the statement becomes unfalsifiable. In such cases, I treat the statement more as a normative criticism (here, "Mark's vision of VR and how stubborn he is") rather than a testable prediction.
  - infinitedata 4y ago
    Funny how you defend this company, you must work there and in denial, or a Zucker fan. I don’t have time for all your arguments; will answer one of them: Regarding timing for bankruptcy - META lost ~65% of its COVID-Driven valuation in one year. Mainly driven by investors not trusting Mark’s vision of the Metaverse. Excluding COVID-driven boom, META has lost ~33% of its solid valuation based on its core product foundation in the past five years. If we follow this trend, and nothing external happens as I previously explained on activist investors, or acquisitions, META could be filing for bankruptcy in as soon as 1 year or a as long as 5 years.
deleted 4y ago
[deleted]

smrtinsert 4y ago

The transparency is much appreciated.

meta2023 4y ago

[flagged]

bagels 4y ago
Do you have a source for this?

throwaway_4ever 4y ago

> "This network originated in Russia and targeted primarily Germany, and also France, Italy, Ukraine and the United Kingdom. The operation centered around a large network of websites carefully impersonating legitimate news organizations in Europe. There, they would post original articles that criticized Ukraine, praised Russia and argued that Western sanctions on Russia would backfire. They would then promote these articles, memes and YouTube videos on Facebook, Instagram, Telegram, Twitter, petitions websites Change[.]org and Avaaz, and LiveJournal"

arbitrary_name 4y ago

>Together, these two approaches worked as an attempted smash-and-grab against the information environment, rather than a serious effort to occupy it long-term. I.e disintermediation: fascinating to see evidence of this in the field, and to see evidence of the investment made in this at the nation state level.

icelancer 4y ago

Whoa, US military involvement as well. >>> 1. United States: We removed 39 Facebook accounts, 16 Pages, two Groups and 26 accounts on Instagram for violating our policy against coordinated inauthentic behavior. This network originated in the United States and focused on a number of countries including Afghanistan, Algeria, Iran, Iraq, Kazakhstan, Kyrgyzstan, Russia, Somalia, Syria, Tajikistan, Uzbekistan and Yemen. The operation ran across many internet services, including Twitter, YouTube, Telegram, VKontakte and Odnoklassniki. It included several clusters of fake accounts on our platforms, some of which were detected and disabled by our automated systems prior to our investigation. The majority of this operation’s posts had little to no engagement from authentic communities. We found this activity as part of our internal investigation into suspected coordinated inauthentic behavior in the region. We’ve shared information about this network with independent researchers at Graphika and the Stanford Internet Observatory, who have published their findings about this network’s activity across the internet on August 24, 2022. Although the people behind this operation attempted to conceal their identities and coordination, our investigation found links to individuals associated with the US military.

Sephr 4y ago
We probably have the Countering Foreign Propaganda and Disinformation Act to thank for this.
neuronexmachina 4y ago
The report from Graphika has additional info about the US activity: https://public-assets.graphika.com/reports/graphika_stanford_internet_observatory_report_unheard_voice.pdf https://public-assets.graphika.com/reports/graphika_stanford... > Our joint investigation found an interconnected web of accounts on Twitter, Facebook, Instagram, and five other social media platforms that used deceptive tactics to promote pro-Western narratives in the Middle East and Central Asia. The platforms’ datasets appear to cover a series of covert campaigns over a period of almost five years rather than one homogeneous operation. > These campaigns consistently advanced narratives promoting the interests of the United States and its allies while opposing countries including Russia, China, and Iran. The accounts heavily criticized Russia in particular for the deaths of innocent civilians and other atrocities its soldiers committed in pursuit of the Kremlin’s “imperial ambitions” following its invasion of Ukraine in February this year. To promote this and other narratives, the accounts sometimes shared news articles from U.S. government-funded media outlets, such as Voice of America and Radio Free Europe, and links to websites sponsored by the U.S. military. A portion of the activity also promoted anti-extremism messaging. > ... At the same time, Twitter and Meta’s data reveals the limited range of tactics IO actors employ; the covert campaigns detailed in this report are notable for how similar they are to previous operations we have studied. The assets identified by Twitter and Meta created fake personas with GAN-generated faces, posed as independent media outlets, leveraged memes and short-form videos, attempted to start hashtag campaigns, and launched online petitions: all tactics observed in past operations by other actors. > Importantly, the data also shows the limitations of using inauthentic tactics to generate engagement and build influence online. The vast majority of posts and tweets we reviewed received no more than a handful of likes or retweets, and only 19% of the covert assets we identified had more than 1,000 followers. The average tweet received 0.49 likes and 0.02 retweets. Tellingly, the two mostfollowed assets in the data provided by Twitter were overt accounts that publicly declared a connection to the U.S. military.
- 4y ago

cstejerean 4y ago

* US: 39 accounts * China: 81 accounts * Russia: 1,633 accounts Either Russia invests orders of magnitude more in these coordinated inauthentic behavior campaigns, or they are just that much worse at flying under the radar.

droopyEyelids 4y ago
Or russians used more accounts per campaign. Or facebook puts more effort into finding russian campaigns. Or russian campaigns are inherently easier to identify, or trying to achieve more difficult goals.
- 52358 4y ago
  or US adversaries (ie Russia, China, Iran, etc) are not as active on FB properties for example, there may be more US campaigns targeting WeChat or Telegram or VK
- bawolff 4y ago
  Or russia is currently in crisis and needs to use its assets, where others are more biding their time.
polyomino 4y ago
Typically you build up accounts and pages over a long time period and try to fly under the radar until you're big enough to affect change without getting caught. In this case, my read is Russia is much better at growing before getting caught, probably due to more experience with influence operations.
bsder 4y ago
Russia is kind of at war--which means that Russia is probably actively using these accounts. Whereas, the US and China are probably just establishing the account networks.
- watwut 4y ago
  I would say, Russia is actively at war where influencing public is their only chance.

yuliyp 4y ago

This feels like it's a drop in the ocean. 100 accounts is nothing as far as bad actors go. It probably set the attackers back a few dollars.

ppsreejith 4y ago
Depends on the impact distribution, I'd imagine? I.e they could go after the most impactful bad actors which, assuming a power law (typical for social networks), would have vastly more reach than other accounts. Or it could be that they're catching the low hanging fruit (careless accounts). Wish they'd share some numbers (i.e followers/reach of these accounts etc).
kjkjadksj 4y ago
With that in mind and with other comments here talking about how these attacks mirror others, and were somewhat naive even in their methodology, maybe they intended to lose these accounts to just evaluate some Meta detection systems. Apparently Stanford is writing up a full report on this incident which I’m sure will be well studied by the military departments involved.
- AlexanderTheGr8 4y ago
  any link on stanford's report? When will it be published? It sounds pretty interesting

ethbr0 4y ago

'We found 2 amateur-hour networks that didn't have much engagement + 1 network we were tipped to "after reviewing public reporting into a portion of this activity by investigative journalists in Germany."' Wow. If this is what they come up with for a quarterly PR piece, it doesn't signal FB actually cares past the lowest-hanging fruit.

deleted 4y ago

[deleted]

gerbler 4y ago

I don't know what to expect exactly, but these numbers seem quite small. Wonder if bad actors are moving to other channels

SilverBirch 4y ago
Not only do the numbers look small, the explanations seem very poor. For example: >We began our investigation after reviewing public reporting... So what Meta is saying here is that despite Russia having started a land war in Europe, Meta didn't do any pro-active investigation and anti-influence operations. Instead it waited until public reporting uncovered that their service had acted as a useful idiot for fascists. Think about the level of information and data that Meta has access to that it could use to detect and prevent attacks, and instead your average journalist is more likely to actually uncover these attacks.

infinitedata 4y ago

Although this is appreciated, no matter what they do, and after Cambridge Analytica, trust in Facebook/Meta went downhill. To top it off, Mark’s vision of VR and how stubborn he is with the infamous Metaverse will really just push FB to bankruptcy. Unless an activist investor pushes them to fire him and change course. This is like Wells Fargo trying to regain trust, same thing. You had one chance…

anon400232 4y ago
Tell me more about your claim that an org, person, or brand gets only one chance at trust. What exactly do you mean? What about the passage of time? Memories can be reshaped; public opinion even more so. Is your claim falsifiable?
anon400232 4y ago
> To top it off, Mark’s vision of VR and how stubborn he is with the infamous Metaverse will really just push FB to bankruptcy. Unless an activist investor pushes them to fire him and change course. Let's make this testable. Bankruptcy by when? Saying, e.g. "at some point" or "eventually" is very problematic to falsify. I've noticed statements of this kind often have a lot of caveats; e.g. ... > unless an activist investor pushes them to fire him and change course ... typically there are many other unspoken/unwritten caveats/exceptions as well. When this happens, the statement becomes unfalsifiable. In such cases, I treat the statement more as a normative criticism (here, "Mark's vision of VR and how stubborn he is") rather than a testable prediction.
- infinitedata 4y ago
  Funny how you defend this company, you must work there and in denial, or a Zucker fan. I don’t have time for all your arguments; will answer one of them: Regarding timing for bankruptcy - META lost ~65% of its COVID-Driven valuation in one year. Mainly driven by investors not trusting Mark’s vision of the Metaverse. Excluding COVID-driven boom, META has lost ~33% of its solid valuation based on its core product foundation in the past five years. If we follow this trend, and nothing external happens as I previously explained on activist investors, or acquisitions, META could be filing for bankruptcy in as soon as 1 year or a as long as 5 years.

deleted 4y ago

[deleted]