Recently, Facebook reported (here) that they have identified more than 150 coordinated inauthentic operations that they have disrupted. It is clear that the platform (Facebook) has advanced its content moderation, but beyond that, many hidden perpetrators of disinformation have also evolved their tactics, Facebook warns.
"euvsdisinfo.eu" has conducted an analysis of Facebook's report.
The advancement of Facebook's algorithms for identifying these operations is also being followed by the advancement of the creators and distributors of fake news and disinformation themselves. Facebook has listed six main trends of these operators of the production and distribution of disinformation:
The first trend is a shift from 'majority' to 'minority'. Threat actors are moving from massive, noisy, deceptive campaigns to smaller, more targeted operations. An example (here)is the case in early 2020, when Facebook found and removed a network run by Russian military intelligence. Focusing on Ukraine and neighboring countries and armed with fake personas operating across blog forums and multiple social media platforms, the network targeted policymakers, journalists, and other public figures.
“Retail” operations come at a cost to disseminators of misinformation, and Facebook claims their return on investment is low. This could change with the advent of technological advances. For example, last week, Georgetown University in the US released a report (here) on automation and disinformation. Researchers analyzed how GPT-3, an artificial intelligence (AI) system that writes text, is likely to be used in disinformation campaigns. Hostile actors could use this system to launch highly scalable disinformation campaigns with less manpower than currently required, the researchers warn.
Second trend What Facebook sees as a risk is the blurring of the lines between authentic public debate and manipulation. For example, in July 2018, Facebook eliminated (here) a network affiliated with the IRA (Internet Research Agency, a company based in Russia and affiliated with the Russian government) that was engaging in pre-planned authentic events. The network's goal was to target involvement in existing events, with the pretext of creating disruptive approaches.
Third, Facebook talks about “perception hacking.” Threat actors seek to capitalize on the public’s fear of influence operations (IO) to create the false perception of widespread manipulation of electoral systems, even without evidence. For example, in the waning hours of the 2018 US midterm elections, Facebook tracked an IRA operation that claimed they were running thousands of fake accounts with the capacity to sway election results across the United States. They even created a website – usaira[.]ru – complete with a ‘countdown’ timer to the election where they offered as proof of their claim nearly a hundred recently created Instagram accounts. The power of the self-fulfilling prophecy in disinformation.
Fourth trend according to Facebook is 'influence operations as a service'. Commercial actors run influence operations at home and abroad, distributing negative material from their clients and making influence operations more accessible. Over the past four years, Facebook has investigated and removed influence operations conducted by commercial actors including media, marketing companies, and public relations. Unfortunately, Facebook does not provide any quantitative information about this trend.
Fifth, Facebook describes the trend of increased operational security. Experienced actors have significantly improved their ability to hide their identities. In response to increased efforts to stop them, more sophisticated threat actors – including Russia and China – have improved their operational security. They are more disciplined to avoid careless mistakes, for example by accessing supposedly American accounts from St. Petersburg in Russia. For example, in October 2019, Facebook removed (here) a Russian network linked to the IRA that was among the first to target the 2020 US election. The network primarily posted other people's content, including memes with minimal or no English text, and screenshots of social media posts from news organizations and public figures.
Sixth, platform diversification. To avoid detection and diversify risks, operations target multiple platforms and media outlets and rely on their websites to continue the campaign. By running operations on multiple platforms, threat actors are likely trying to ensure that their efforts survive by using multiple platforms, in case one fails. They have also targeted hyper-local platforms to reach specific audiences and to target public spaces with weaker security systems.