After FBI tip, Facebook says it uncovered Russian meddling

New York(CNN Business) People associated with the infamous St. Petersburg troll group that was part of Russia's attempt to interfere in the 2016 US presidential election are trying to target Americans again, Facebook (FB) announced Tuesday after receiving a tip from the FBI.

The disrupted operation used fake personas including realistic-looking computer-generated photos of people, a network of Facebook accounts and pages that had only a small amount of engagement and influence at the time it was taken down, and a website that was set up to look and operate like a left-wing news outlet.

This is the first publicly available evidence that people connected to the Russian troll group, which is known as the Internet Research Agency (IRA), are using unwitting Americans in an attempt to meddle with the 2020 election and stir discord.

The operation seems to have been shut down before it could get much traction on Facebook or the rest of the internet. That mirrors what happened around the 2018 midterm elections, when -- as far as is publicly known -- the Russian trolls' online efforts were halting and small. The trolls had far more luck gaining followers and engagement in 2016, though it is not known how much of an impact, if any, their work had on the election.

Facebook said it relied on technical indicators to make the link between this operation and the IRA. The company does not typically share those indicators publicly, as it has said in the past doing so could tip off bad actors to how it finds them, but they could include unique information tied to specific accounts or devices. Facebook said it shared information with the FBI.

"This looks like an early-stage attempt to target left-wing audiences on a range of issues," Ben Nimmo, head of investigations at Graphika, a social media analytics company commissioned by Facebook to study the influence operation, told CNN Business Tuesday.

"The [US] election wasn't the only focus," he said, noting that the content had gained little traction online, "but it looks like the operation wanted to divide Democratic voters, the same way the IRA tried in 2016."

Part of Tuesday's expose included "Peace Data," a website that purports to be an independent leftwing news outlet and features articles about U.S foreign policy, President Donald Trump, former Vice President Joe Biden, and the QAnon conspiracy theory.

Only a small portion of Peace Data articles explicitly reference 2020 US election candidates, but headlines include "The Biden-Harris Ticket Encapsulates How the Western Left Will Give in to Right-Wing Populism" and "The Trump administration is continuing its relentless war on nature."

After Facebook's announcement on Tuesday, a message was posted to Peace Data's website disputing Facebook's findings and maintaining it was an independent news site.

Nathaniel Gleicher, head of cybersecurity policy at Facebook, told CNN Business that this particular set of sites and accounts was in its infancy and had little traction on Facebook. But, he said, it was clear that people associated with past activity tied to the IRA were "actively, aggressively, and creatively trying to target the United States in the run up to the [2020] election."

In an attempt to appear legitimate, Peace Data featured fake personas for people who were supposedly its editors, according to Graphika. These personas were used to recruit unwitting, real writers to contribute articles -- including, it seems, some writers in the United States, according to Graphika.

Pictures for some of the fake personas were created using artificial intelligence technology, Facebook and Graphika said, the same kind of technology that is used to create deepfake video.

Graphika pointed to a person identified online as "Alex Lacusta." A Twitter (TWTR) bio for "Lacusta" listed him as an associate and online editor at Peace Data. The profile picture on the account was created using deepfake technology, Graphika said.

Facebook said it had shared its findings with Twitter. Twitter has suspended an account supposedly belonging to "Lacusta." There is no indication the fake "Lacusta" account is connected to any actual Alex Lacusta.

In a series of tweets sent after this article was originally published, Twitter said, "We suspended five Twitter accounts for platform manipulation that we can reliably attribute to Russian state actors." It specified the accounts were linked to Peace Data and added, "The Tweets from the Russian-linked accounts were low quality and spammy, and most Tweets from these accounts received few, if any, Likes or Retweets." Twitter also said that links to Peace Data would be blocked from its platform going forward.

CNN Business found a job posting for Peace Data on a website advertising work for freelancers. The posting described Peace Data as "a young international news organization focused on raising awareness about corruption, environmental crisis, abuse of power, armed conflicts, activism, and human rights."

"If you are interested in covering stories that are usually untold or kept hidden from the general public, we will be glad to work together," it added.

The posting promised a rate of $75, but didn't specify if that was per article submitted.

Graphika noted that IRA-linked operations' practice of hiring unwitting authors to create content online is consistent with the findings of a months-long CNN investigation published in March which identified an IRA off-shoot in Ghana.

Between February and August 2020, Peace Data published more than 500 stories in English and 200 stories in Arabic, Graphika's analysis found.

In a statement to CNN after Facebook's announcement on Tuesday, the FBI said, "The FBI provided information in this matter to better protect against threats to the nation's security and our democratic processes."

"We consider strategic engagement with U.S. technology companies, which includes sharing threat indicators, to be critically important in combating malign foreign influence actors," it added.

Biden campaign spokesperson Bill Russo said the takedown showed that Russia was attempting to interfere in the election in support of Trump and that Facebook was a "key vector" in these efforts.

Adding, "President Trump's refusal to speak out against Russian interference makes it all the more important that Facebook does more to enforce their rules and ensure their platform cannot be used to corrode the foundation of our democracy."

The U.S. intelligence community and Silicon Valley were caught off-guard in 2016, when Russian trolls used social media to promote divisive messages to millions of Americans, running -- among other things -- Facebook pages with hundreds of thousands of followers.

With companies like Facebook and federal agencies like the FBI now aware of the tactics trolls like these use and monitoring for them, Gleicher said, it is more difficult for covert social media operations to gain huge followings. It is clear Russians are "really aggressively trying to find a path in to have an impact and they are failing," he said.

Gleicher said the FBI tipped Facebook off to the Peace Data site in July. Facebook then independently determined through technical indicators that people linked to the IRA were involved with the website.

Gleicher said Facebook shared its findings with the FBI and with other technology companies.

Intelligence officials told Congress earlier this summer that Russia was spreading false information about Biden.

Some of the covert online tactics the people behind the Peace Data are using are similar to what the Russian trolls did in 2016, including setting up websites purporting to be independent news outlets, using fake social media personas to share divisive and controversial material, and offering to pay unwitting westerners to make their effort appear more legitimate.

But some of the tactics being used have evolved. Previously one obvious tell of a fake account was if it was using a profile picture that was stolen from a real person's account.

One of the most successful Russian troll accounts in 2016, "Jenna Abrams," amassed more than 70,000 followers, including some prominent Republicans. CNN later revealed that the profile picture used on the account was that of a then 26-year-old Russian woman who said she had not been aware her picture was used.

Now, technology widely available online allows for the creation of fake faces of people that do not exist. The technology is not only being used to generate faces to front online influence operations, but also for accounts used in online harassment campaigns, as CNN Business reported in February.

- CNN's Sarah Mucha and David Shortell contributed to this report