Facebook has discovered a new campaign of "inauthentic behavior" that's used dozens of Facebook pages and accounts, and $11,000 worth of ads, to promote political causes prior to the US midterm elections, the social network said Tuesday.
In all, Facebook said it shut down and removed 32 accounts and pages. Those include eight pages and 17 profiles on Facebook, as well as seven accounts on Instagram, which Facebook owns. In all, 290,000 accounts followed at least one of the pages, which had names like "Aztlan Warriors," "Black Elevation" and "Resisters."
"We're still in the very early stages of the investigation and don't have all the facts," COO Sheryl Sandberg said on a conference call with reporters. "We don't have perfect information."
Sandberg was joined on the call by Facebook's security chief, Alex Stamos, and its head of cybersecurity policy, Nathaniel Gleicher. Missing from the call was Mark Zuckerberg, Facebook's CEO. The New York Times earlier reported that Facebook was set to reveal a new "coordinated political influence campaign" on Tuesday.
The world's largest social network is already in the hot seat with lawmakers over its role in the 2016 US presidential election. Russian trolls affiliated with the Kremlin-linked Internet Research Agency used a combination of paid ads and organic posts to spread misinformation and sow discord among voters ahead of the election.
In the wake of the scandal, Facebook made several changes to its advertising operations. They include a stricter verification process for political ads, and labeling ads with who paid for them. On Tuesday, Gleicher, wrote in a company blog post that his team couldn't say for sure who was behind the new campaign.
But though Facebook was quick to emphasize the company isn't yet attributing the campaign to Russia, there are still some connections. A co-administrator for one of the pages was a known IRA account, Stamos said on the conference call. The account was only an admin for seven minutes, Stamos said. He also said Facebook identified and removed the account.
"Some of the activity is consistent with what we saw from the IRA before and after the 2016 elections," Gleicher said. "And we've found evidence of some connections between these accounts and IRA accounts we disabled last year." But there are differences as well, Gleicher said.
The people behind the new fake accounts are taking more steps to cover their tracks, and Facebook hasn't found any activity coming from Russian IP addresses. What's more, the ads were purchased in US and Canadian dollars.
Facebook, which reaches more than 2 billion people a month, has become one of the premier ways for people to consume news. Nearly half of adults in the US get their news on the platform, according to a 2017 study from the Pew Research Center. Facebook's disclosure on Tuesday also follows harsh criticism of the company for the last two years from law enforcement, Congress and the public for its lack of .
Facebook said it found about 30 real-world events linked to the fake pages since May 2017. One of them, called "No Unite the Right 2 -- DC," was scheduled in Washington for Aug. 10 as a counterprotest to a "Unite the Right" rally in the same city. Sandberg said on the call that Facebook wanted to disclose its findings on the coordinated campaign because of the timing of the event.
Organizers for the protest came from Black Lives Matter DC, according to reports from local news station WTTG. Facebook's Gleicher said some of the administrators of the event page for the counterprotest were real accounts, and that the company had notified the people running the real accounts that it was taking down the event page.
Black Lives Matters DC didn't immediately respond to a request for more information about the event and its accompanying Facebook page.
A reaction from Washington
After Facebook made the disclosures on Tuesday, several lawmakers and other federal officials chimed in.
Sen. Mark Warner, a Virginia Democrat who's helped lead the Senate Intelligence Committee's investigation into Russian efforts to influence the 2016 presidential election, said the news shows that social media remains a propaganda target for the Russians.
"Today's disclosure is further evidence that the Kremlin continues to exploit platforms like Facebook to sow division and spread disinformation," Warner said, "and I am glad that Facebook is taking some steps to pinpoint and address this activity. I also expect Facebook, along with other platform companies, will continue to identify Russian troll activity and to work with Congress on updating our laws to better protect our democracy in the future."
Sen. Richard Burr, a North Carolina Republican and chairman of the Senate Select Committee on Intelligence, applauded Facebook for catching the campaign.
"I am glad to see that Facebook is taking a much-needed step toward limiting the use of their platform by foreign influence campaigns," he said in a statement. "The goal of these operations is to sow discord, distrust and division in an attempt to undermine public faith in our institutions and our political system. The Russians want a weak America."
Christopher Krebs, a Department of Homeland Security cybersecurity official, said at a conference on Tuesday in New York City that the agency has already been in contact with Facebook.
"We've been clear across the administration that even though we're not seeing this sort of activity directed at elections specifically, we continue to see Russian information operations directed at undermining American democracy," he said.
CNET's Alfred Ng and Sean Hollister contributed to this report. Disclosure: Sean's wife works for Facebook as an internal video producer.
First published July 31, 9:41 a.m. PT.
Updates, 11:12 a.m.: Adds information from Facebook's conference call with reporters; 12:18 p.m.: Includes comments from federal officials.
Cambridge Analytica: Everything you need to know about Facebook's data mining scandal.
iHate: CNET looks at how intolerance is taking over the internet.