Shortly before Sophie Zhang lost access to Facebook’s systems, she published one final message on the company’s internal forum, a farewell tradition at Facebook known as a “badge post”.
“Officially, I’m a low-level [data scientist] who’s being fired today for poor performance,” the post began. “In practice, in the 2.5 years I’ve spent at Facebook, I’ve … found multiple blatant attempts by foreign national governments to abuse our platform on vast scales to mislead their own citizenry, and caused international news on multiple occasions.”
Over the course of 7,800 scathing words, Zhang outlined Facebook’s failure to combat political manipulation campaigns akin to what Russia had done in the 2016 US election. “We simply didn’t care enough to stop them,” she wrote. “I know that I have blood on my hands by now.”
Zhang knew that this was not a tale that Facebook wanted her to tell, so when she hit publish, she also launched a password-protected website with a copy of the memo and provided the link and password to Facebook employees. Not only did Facebook temporarily delete the post internally, the company also contacted Zhang’s hosting service and domain registrar and forced her website offline.
Now, with the US election over and a new president inaugurated, Zhang is coming forward to tell the whole story on the record. (Excerpts of her memo were first published in September by BuzzFeed News.) This article is based on extensive internal documentation seen by the Guardian.
“What we have seen is that multiple national presidents believe that this activity is sufficiently valuable for their autocratic ambitions that they feel the need to do it so blatantly that they aren’t even bothering to hide,” Zhang told the Guardian.
“I tried to fix this problem within Facebook … I spoke to my manager, my manager’s manager, different teams, and everyone up to a company vice-president in great detail. I repeatedly tried to get people to fix things… I offered to stay on for free after they fired me, and they said no. I hoped that when I made my departure post it might convince people to change things, but it hasn’t.”
She argues that Facebook is allowing its self-interest to interfere with its responsibility to protect democracy, and that the public and regulators need to know what is happening to provide oversight.
“The whole point of inauthentic activity is not to be found,” she said. “You can’t fix something unless you know that it exists.”
A Facebook spokesperson, Liz Bourgeois, said: “We fundamentally disagree with Ms Zhang’s characterization of our priorities and efforts to root out abuse on our platform.
“We aggressively go after abuse around the world and have specialized teams focused on this work. As a result, we’ve taken down more than 100 networks of coordinated inauthentic behavior. Around half of them were domestic networks that operated in countries around the world, including those in Latin America, the Middle East and North Africa, and in the Asia Pacific region. Combatting coordinated inauthentic behavior is our priority. We’re also addressing the problems of spam and fake engagement. We investigate each issue before taking action or making public claims about them.”
Facebook did not dispute Zhang’s factual assertions about her time at the company.
BEHIND ‘COUNTERFEIT LIKES’
Zhang had been working for Facebook for about six months when she realized that Juan Orlando Hernández, the president of Honduras, was amassing large numbers of fake likes on the content he posted to his 500,000 followers on Facebook. Over one six-week period from June to July 2018, Hernández’s Facebook posts received likes from 59,100 users, more than 78% of which were not real people.
Hernández’s fake engagement stood out not just because of its volume, but because of an apparent innovation in how he acquired it. Most fake likes on Facebook come from fake or compromised user accounts, but Hernández was receiving thousands of likes from Facebook Pages – Facebook profiles for businesses, organizations or public figures – that had been set up to resemble user accounts, with names, profile pictures and job titles. One individual was the administrator for hundreds of those fake Pages, as well as for the official Pages of both Hernández and his late sister, who had served as communications minister.
Sitting behind a computer screen, the administrator could publish a post about how well Hernández was doing his job on the president’s Facebook Page, then use his hundreds of dummy Pages to make the post appear popular, the digital equivalent of bussing in a fake crowd for a speech.
Zhang had been hired that January to work on a relatively new team dedicated to combatting “fake engagement” – likes, comments, shares and reactions made by inauthentic or compromised accounts. In addition to distorting the public’s perception of how popular a piece of content is, fake engagement can influence how that content performs in the all-important news feed algorithm; it is a kind of counterfeit currency in Facebook’s attention marketplace.
The vast majority of the fake engagement on Facebook appears on posts or Pages by individuals, businesses or brands and appears to be commercially motivated. But Zhang found that it was also being used on what Facebook called “civic” – ie political – targets. The most blatant example was Hernández, who was receiving 90% of all the known civic fake engagement in Honduras as of August 2018.
A rightwing nationalist who supported Honduras’s 2009 military coup, Hernández was elected president in 2013. His re-election in 2017 is widely viewed as fraudulent, and his second term has been marked by allegations of human rights abuses and rampant corruption. US federal prosecutors have named Hernández as a co-conspirator in multiple drug trafficking cases. He has not been charged with a crime and has denied any wrongdoing.
Hernández did not respond to queries sent to his press officer, attorney and minister of transparency.
The tactics boosting Hernández online were similar to what Russia’s Internet Research Agency had done during the 2016 US election, when it set up Facebook accounts purporting to be Americans and used them to manipulate individuals and influence political debates on Facebook. Facebook had come up with a name for this – “coordinated inauthentic behavior” (CIB) – in order to ban it.
But Facebook initially resisted calling the Honduran activity CIB – in part because the network’s use of Pages to create false personas and fake engagement fell into a serious loophole in the company’s rules. Facebook’s policies to ensure authenticity focus on accounts: users can only have one account and it must employ their “real” name. But Facebook has no such rule for Pages, which can perform many of the same engagements that accounts can, including liking, sharing and commenting.
Zhang assumed that once she alerted the right people to her discovery, the Honduras network would be investigated and the fake Pages loophole would be closed. But it quickly became clear that no one was interested in taking responsibility for policing the abuses of the president of a poor nation with just 4.5m Facebook users. The message she received from all corners – including from threat intelligence, the small and elite team of investigators responsible for uncovering CIB campaigns – was that the abuses were bad, but resources were tight, and, absent any external pressure, Honduras was simply not a priority.
“It’s not for threat intel to investigate fake engagement,” an investigator from that team told Zhang. Katie Harbath, Facebook’s then public policy director for global elections, expressed interest in a “scaled way to look for this and action on other politician Pages” but noted that it was unlikely the case would get much attention outside Honduras, and that she didn’t “feel super strongly” about it. Other executives and managers Zhang briefed included Samidh Chakrabarti, the then head of civic integrity; David Agranovich, the global threat disruption lead; and Rosen, the vice-president of integrity.
“I don’t think Honduras is big on people’s minds here,” a manager from the civic integrity team told Zhang in a chat.
Frustrated and impatient after months of inaction, Zhang took her concerns semi-public – within the confines of the company’s internal communication platform. In late March 2019, she published a post to a group for the company’s “election integrity core team” pointing out that Hernández was “the only national president to be directly, actively, and consistently abusing Facebook to exploit fake engagement for himself” and that the company had known of the problem for months without doing anything.
The post succeeded in attracting the concern of an investigator from the threat intelligence team, but a further delay occurred in April when management temporarily suspended investigations into CIB cases that did not involve interference by a foreign government. In June, the investigator began working on the case and quickly confirmed Zhang’s findings: there was a large CIB network in Honduras working to promote Hernández that was linked to the president himself.
“This campaign has persistently boosted a likely illegitimate president in an ARC [at-risk country],” the investigator wrote in a report highlighting its likely “IRL [in-real-life] impact”. The accounts and Pages involved had been established in 2016 and 2017, prior to Hernández’s disputed re-election, the investigator noted.
On 25 July 2019, nearly one year after Zhang had reported the network to Facebook, the company announced that it was taking down 181 accounts and 1,488 Pages involved in “domestic-focused coordinated inauthentic activity in Honduras”. The campaign was “linked to individuals managing social media for the government of Honduras” and had spent more than $23,000 on Facebook ads, Facebook said.
Agranovich, the global threat disruption lead, praised Zhang for her role in the takedown, writing in an official feedback channel: “These disruptions removed networks on Facebook that used our services to suppress democratic expression, target innocent users on our platform, and enable clandestine geopolitical conflict. This is among the most important work at Facebook, and we could not have done any of these takedowns without your contributions.”
Privately, he added: “The Honduras case would never have happened without your continued advocacy … It means we’ve created a precedent that the Pages-as-Profiles archetype is inauthentic behavior.”
‘NO ONE CAN AGREE ON WHAT TO DO’
Zhang was invigorated by her success with the Honduras takedown and believed that the “precedent” Agranovich spoke of would clear the way for quicker takedowns in the future.
The next day, she filed an escalation within Facebook’s task management system to alert the threat intelligence team to a network of fake accounts supporting a political leader in Albania. In August, she discovered and filed escalations for suspicious networks in Azerbaijan, Mexico, Argentina and Italy. Throughout the autumn and winter she added networks in the Philippines, Afghanistan, South Korea, Bolivia, Ecuador, Iraq, Tunisia, Turkey, Taiwan, Paraguay, El Salvador, India, the Dominican Republic, Indonesia, Ukraine, Poland, and Mongolia.