In Facebook’s garden of bots and fakes

Garden? More like an infestation.

When I recently heard that Facebook had deleted 470 accounts that it determined were fake, I had to laugh. The infestation of fakes on Facebook is so large that it is as though a nest of termites have eaten up the floorboards under the rug. Deleting 470 is like stamping on the few stragglers that wander out from under it.

In fact, fakes on Facebook are easy to find, particularly in Facebook’s thriving Trumpland. Its unit is a Facebook group with rapid-fire posts from members that either link to entirely fictional ‘news’ or show memes that ask you to answer ‘yes’ or ‘amen’ or hit a Like.

Facebook suggestions

While I understand why investigators are focusing on paid political ads, the power and magic of Facebook’s suggestions algorithm is such that you don’t need to pay for ads in order to extend your reach — the algorithm will do it for you. If you’ve attended a gardening event, and live in California, it might suggest a page to you that showcases California gardens. If you’ve liked posts from groups about Indian food, your sidebar might suggest other Indian food recipe pages. The promise and the power of these suggestions is that these pages are crowded with content tailored to your particular interests, that are all but invisible to, say, your neighbor who only likes posts about NBA basketball.

Thus far, it seems innocuous. But this is a powerful new vector in human society that has never existed before. (I use the phrase ‘human society’ advisedly, because Facebook’s two billion active user base, sadly or not, is close to being a facsimile of human society.) It is a new medium for ideas to spread with deadly accuracy, at a high clip.

Of course, human society has had other vectors for ideas to spread. You could read a book, go to school, share recipes, write newspaper articles; the list goes on. But each of them suffer from either being too blunt, or too small. You know who among your circle of friends and family care about recipes, so you call them up to share your latest: but your reach is only a few dozen. You write a newspaper review of Salman Rushdie’s latest: but while the eyeballs on it number in the millions, most of those eyeballs are wasted because they don’t care about your subject matter. Of course, internet advertising has attempted to be more fine-grained with some success, but no corner of the internet knows as much about you as Facebook.

Facebook’s suggestions are like a new set of blood vessels in our body politic that take ideas from the wider world into your personal space. And when there is a new channel, inevitably, new viruses arise that want to attack it — in this case, not real microbial viruses nor computer viruses, but rather, something that could be called a meme-virus. And when there is an algorithm that determines who wants to see what, there are bad actors that will attempt to fool it for profit.

Trump groups

So let’s take a little jaunt through Facebook’s garden of Trumpland fakes. Let’s say you liked a Trump-related post at some point before the election. You would have then been bombarded with suggestions for Trump fan groups on your sidebar. While you may or may not be a Trump supporter already, seeing the number of members of each of these groups — in the tens of thousands each — or their triumphant names, such as “Trump Troopers” and “Trump USA’s CEO” — might tempt you to join.

Being on the group, it feels like the support for Trump is rising around the country like a crescendo. Thousands of people are on board — worldwide! The group seems an active one. The banner image is always a red, blue and white rendition of Trump in some triumphant pose, occasionally surrounded by his family or wearing a MAGA hat. You don’t know any of the people in the group, but they have faces, they say things, and are uniformly fans of Trump.

Once you are accepted as a member, which happens fairly quickly— you are exposed, as I said earlier, to a constant stream of ‘news’ about Trump’s dashing deeds, or Hillary’s crimes. Or triumphant memes about Trump. Each post has an active comment section that is the equivalent of fist-pumping, either throwing out an ‘amen’ or rants about ‘Hitlery’ and ‘Obummer’.

Hacked Profiles

But here’s the thing. Let’s say you have a slightly skeptical bent of mind. You’d start to notice some ‘tells’ about the group. All is not as it seems.

For one thing, you notice that many of the members have foreign-sounding names, that sound they come from the Islamic world or India or Africa. While you might not believe that Trump is racist, surely it would be at least a bit startling that people with names like “Haruna Alubankudi” and “Ghulam Fareed” claim to be Trump Troopers.

Let’s dissect the very first post I see up on Trump Troopers as of this morning.

Here’s Muhammed Rabi chiming in. Just about everything in this particular post happens to be fake. “Muhammed Rabi”’s profile has nothing but stock photos of Trump and his family. No friends, no family, no likes or comments from anyone, nothing. But he posts on a Trump group! So at least his posting finger is alive and well.

Dig further, we discover more. He claims to simultaneously go to University of Southern California and to an institution known as California Superbike School — which just happens to be in Chennai, India, while living in Ohio and being from Washington DC.

Does it seem like a blind algorithm searched for institutions that had the word ‘California’ in them, and some standard places to live in America, and patched together a profile?

Yes!

Dig further, and look at the website link on the address bar of your browser: this is the address of the web page, that starts with ‘https://www.facebook.com/’ and continues on with the user name of the Facebook account you are looking at. This is the unique address of each profile on Facebook. If you look at your own Facebook url, you will find your user name buried in there.

We discover something curious about Muhammed Rabi — his url is of a different user altogether: someone called ‘arif.ahmed.9083477’.

My guess is that there is an Arif Ahmed somewhere who lost his password and simply left his profile by the wayside: ready to be chomped up and repurposed by an algorithm — run by someone — looking for such unused accounts.

Hacked Facebook profiles of this sort profusely fill Trump fan groups. Here’s another example: ‘Camila Isaac’ is a member of a Trump group, whose posts on her own timeline are entirely memes supporting Trump, with no likes or comments from her 180 friends:

However: her user name from her website address is actually of someone known as Muhammad Saeed — clearly a male (look at the address bar above). Whoever hacked into poor Muhammed Saeed’s profile in order to snag it for fake “Camila Isaac” forgot to update the Intro: which still is a message for his daughter, by name. Muhammed Saeed’s friends list is also still his own: most of his friends have Islamic names are are from Saudi Arabia or India.

Digging into many such posters, you will find another, hidden person behind an assumed name. Here’s “Nancy Parr” posting often on the Facebook group known simply as Donald J Trump: her original name is actually Asanka Lakshan, from Kandy, Sri Lanka, and the gender known by Facebook is actually male. Here’s “Lucy Jefferson” posting in Trump Troopers with the original user name Anano Mumladze. The new persona uses a stock photo for their profile picture and claims to be from New York, but the original account is apparently from Tibilisi, Georgia, judging from the name and the entirety of their 300+ friends.

Images scraped from the web often find themselves on these made up Facebook profiles. “Johny Stevens” turns out to have snagged a picture of one of the Chuckle Brothers and his new bride, snagged from this website. The hacker forgot to change the gender on the profile and apparently, from the user name, the profile actually belongs to Stefanija (Stefi) Cvetkovic from Macedonia. Her photos still fill her timeline earlier than February 2016. When her profile was her own, she never posted in English at all; “Johny Stevens” though, posts frantically on Trump groups. Surprisingly, the real Stafanija (Stefi) Cvetkovic still exists under a new, thriving, un-hacked profile.

Facebook Bots

“Samir Handanovich” is another regular poster on one of the Trump groups. Unlike the hacked profiles above, this one appears to be a hollow fake, created entirely as a bot. Here are some clues. Look at the profile picture: nothing personal about it. In fact Google Image search turns up this exact image as a stock image on a website that allows you do download wallpapers. His timeline is almost completely blank expect for profile picture changes from one stock picture to another. His only friend has a similar stock image as their profile picture.

Another clue to finding bots — not definitive, but suggestive — is that the website address of fake profiles often link by their numeric ID rather than by their friendly user name.

Every Facebook user has a unique numeric ID assigned to their profile (there are ways to discover what yours is). You can always link to any particular profile by using their ID: for instance, navigating to https://www.facebook.com/4 takes you to Mark Zuckerberg’s profile. However, since Zuckerberg also has a user name, not just an ID, you will notice that upon opening up his profile, the website address link switches from ‘4’ to ‘zuck’, which is his user name. Many people neglect to create a user name for themselves. But Facebook bots, seemingly, never do.

Once you start looking, bots are everywhere on Trump groups. Here’s “Mary Morris” with a cute blond girl selfie on her profile. She claims to have gone to Las Vegas High School and University of New England, but none of her 58 friends are affiliated with these institutions — they are almost all older men from all around the world: India, Syria, Ohio, and so on. This appears to be a classic honeypot bot — HoneyBot? — who also, for some reason, is a member of Donald J Trump public group.

Some accounts that are members of Trump groups appear to be solely created in order to dispense memes. Here’s oddly-named “Rahul Roy Rahulroy” (with a real first and last name simply repeated) — who sole provenance is to post disturbing images meant for an Indian audience in order to get clicks. Did an algorithm go wrong by repeating the first and last name while creating this bot? Perhaps; several of the profiles on his friends list have the same ‘bug’.

Here’s Rachid Alami from Morocco, who posts on the Trump group Vote Trump Only — the American Party Rising. His profile is completely blank and the link to his profile uses a numeric ID. An active poster, he posted the same link about Colin Kaepernick three times in the same few minutes. A few days earlier, the “Rachid Alami” bot was frantically posting fake news about Trump humiliating Obama three times a minute.

Here’s “Chrisitan Marinaro”, a bot whose profile picture is an image snagged from Canadian Wildlife Federation, who posts exclusively Trump-related right-wing posts — most often fake news — on his timeline, in the Trump Troopers group, and the oddly named LillyLilly for Trump group.

The saga of Carter Natalie, FBI Agent

I have no idea who or what is creating these Facebook fakes, but the saga of Carter Natalie, FBI Agent, might offer some clues.

“Carter Natalie, FBI Special Agent”, was my favorite bot. It appears to be defunct now and sadly, I neglected to snag the image. Her profile picture appeared to be a selfie of young skimpily-dressed girl in a provocative pose, who frankly appeared too young to be an FBI agent. The rest of the timeline was hollow: no friends, no posts, no user name, just a membership in a Trump group. Another strange thing: notice how the first name and last name are reversed? Carter is not a usual first name for women and Natalie is not a usual last name.

Therein lies a story with some curious implications.

Reversed, the name “Natalie Carter” turns up as a real FBI agent. Her name (and official FBI email) were part of a giant hacked data dump that occurred in February 2016, exposed through a Twitter account known as ‘@DotGovs ’ which is now suspended. The hack exposed the names and contact information of 20,000 government employees — of which, Natalie Carter was one. Her name, though, was listed last name first: “Carter, Natalie”, as is common with employee directories. So did an algorithm that scraped the dumped files in order to find names for fake Facebook profiles misfire by reversing the first and last names? Apparently.

Now ‘@DotGovs’ was instantly suspended, but a backup account known as @DotGovz_ got created by the hackers, and still exists. Both the original and the new backup claim to be working on behalf of anti-Israeli causes and claim allegiance to the hacker group Crackas With Attitude.

However, the web search for “Carter Natalie FBI” also turns up a cached result on Dentistry.org, which you might naively think is a medical website. Incorrect. The website is a hollow shell carrying nothing but ungrammatical search links like ‘Dent Removal’. Checking the registration of the website, you hit a wall: the registrants of the domain name used GoDaddy, but paid extra in order to be hidden.

Click on the link, and you discover that the hacked FBI list is found on this site, but is secured, because you see an “Information not available” message. The message, significantly, is in Russian.

Now the “Carter Natalie” bot did not vanish altogether from Facebook, rather, it proliferated. Here are two of the “Carter Natalie” profiles I found. Both say they are self-employed, instead of (semi-accurately) claiming to be FBI agents; both also use images snagged from the Internet.

Paid Trolls

Perhaps the most numerous, and the most insidious, type of fake account posting on Trump groups are accounts of real people, often Macedonian or Venezualean, who never post about Trump on their personal timelines, instead, have thriving interpersonal conversations in Cyrillic or other non-English language. Most of them appear to be youngsters in school. In this case, it’s not the accounts that are fake, it is their interest in Trump.

Here’s Pedro Rivero from Venezuela. His personal timeline is filled with pictures of friends and family, with not the least bit of interest in Trump or American politics at all. And yet, he posts on two separate Trump groups, the Trump Troopers group and the Vote Trump Only group, the former heavily in February, and the latter heavily in September and August. Each post is timely, referencing some deep and particular news item from American politics, whether about Colin Kaepernick or Jeb Bush’s reaction to Trump’s UN speech.

Here’s Ace Mileski, from Macedonia. His personal timeline is mostly snapchat type images of his adorable little girl, with comments from friends in an Eastern European language. No interest in anything American, let alone politics or Trump. But here he is, posting fake news links frequently on Trump Troopers, about topics ranging from George Soros having been found dead on the toilet, to Hillary starting a terrorist group.

Here’s 18-year old Levche Levkov, also from Macedonia, clearly a martial arts aficionado, who shows no interest in Trump on his personal profile, and yet posts inside baseball specifics about Jeff Sessions and Robert Mueller.

Now if they are paid trolls, who is paying them? This is for the FBI to find out, but I did see a hacked profile claiming to be Shaida Manzoor openly and rather brazenly soliciting members for payment, after several repeated appeals for friends to add 30–40 members to the group. By the way, this profile not only snagged its images from a probably unsuspecting Instagram user called Paige Thomas, it also originally belongs to someone called “Jeetu Rajak” who probably has no idea his account is being used in this way.

The list goes on, and on, and on; post after post on group after group: almost every poster turns out to be fake in one of these three ways.

Fake news

In your own special corner of the internet, on one of these Trump fan groups, you discover the most astonishing facts. The rolling news posts are constant and unrelenting. You discover that Chelsea Clinton called Barron Trump dumb. That Jennifer Lawrence says that the American flag is her toilet paper. That Obama’s classmate says that he was a lying, drug-using, homosexual foreigner — and then coyly asks, “do you agree?”

Each of these posts link to news websites. They may have a rather bare-bones design, with bland colors, but they look credible: with a sidebar and lifestyle sections. Their names are credible, and bland — American Politic News, or Online Global News, or All News About America, the web address of which is Haanity.com. The text on them is subtly ungrammatical. Their front pages might link you back to one of these Trump fan groups on Facebook in a symbiotic embrace.

But the news that they ‘inform’ you of is so flagrant and subversive, that if you are of a gullible bent of mind, you might think that you have discovered the secret cache of the internet that contains all the news that the mainstream media wants to keep from you. These fake news websites are so numerous that they form an entire Potemkin alternative media, with entirely made up news stories, all calculated to make you distrust and hate the Democrats, Hollywood, the media, NFL, or any other enemy-du-jour; and make you rush into the arms of Trump as your only savior.

Who owns these websites? WhoIs.com is a service that can help you find out. Most of them appear to be registered in Macedonia, but for some of them, the trail goes cold.

“AmericanPoliticNews.com” is registered by one Goran Kamcev of Macedonia. “AmericanInfoCorner.info”, that spreads ‘news’ that Hillary personally funded a terrorist group, is registered by Igor Janusev of Veles, Macedonia. “Online-global-news.com”, the website I snagged the above image from, is registered by Natasa Grozdanov of Skopje, Macedonia.

However, “Haanity.com”’s registrant has paid extra to have WhoIs hide their name; as did the registrant for “ThePoliticsNation.com”. One particular website is hosted on Blogspot.com, with no About page or any information about the blogger. This is just a small smattering of the deluge of fake news websites.

Eerily, not a single one of these posts evinces the slightest skepticism. Post after post gets shared, liked, and commented on by dozens with rage against the left.

Zuckerberg’s naivete

Three days after the 2016 election, Mark Zuckerberg, the founder of Facebook, pooh-poohed the notion that exposing voters to fake news could have any impact on how they vote. But Zuckerberg may not understand the power and reach of what he has created.

A clue to its power is hidden in the name of his enterprise: Facebook. The image of a face is a powerful hook that gives impersonal news a strange, undeserved credibility. Despite researching bots for this article, I found myself personalizing the entity behind these fake profiles, assigning them a gender, a personality, and a point-of-view, merely because I saw a face. News streaming in from apparent humans with faces that seem sympathetic to your worldview beguiles you into believing it. Faces tickle our need for tribalism and satisfy our need to belong in a movement.

He also may not understand the depths of depravity and dishonesty that nation states mired in the dark arts of propaganda can sink to. Social engineering through propaganda is a time-honored and well-studied discipline. Facebook is merely the most recent vehicle for transmitting it.

(With research help from Deepak Mirchandani)

(If you enjoyed this article, please recommend, share, and follow me at @TheOddPantry.)