Thread by @olgs7

1/ Excited to share our 2017-2020 IO Threat Report! It looks back at the last 3+ years of our work at @Facebook to counter influence operations and analyzes the 150+ CIB takedowns we've done since 2017: about.fb.com/wp-content/upl…

2/ Back in 2017, we published our first IO white paper where we described how we conceived of this problem at the time:
about.fb.com/wp-content/upl…

I got to work with @jenrweedon @alexstamos @Will_Nuland on that paper and today feels like a million yrs later

https://twitter.com/jenrweedon/status/857628293012627456?s=20

3/ We've come a long way since 2017 - our investigations teams have grown, our knowledge of threat actors has expanded, and our understanding of the influence ops problem has evolved. Today's report is a chance to take a step back, reflect on what we've seen, and to look forward

4/ This report draws on over 150 CIB CIB networks that we found and disrupted on our platform since 2017. They came from over 50 countries and operated in dozens of languages providing a useful window to into influence operations trends

5/ In this report, we do a couple things. First, like any good disinfo conference, we start with definitions. We define influence operations and we talk about our CIB policy, which has been our primary vehicle for enforcing against covert IO

6/ Throughout history, influence ops have manifested in different forms: from covert campaigns to more overt efforts that rely on state media or leverage authentic voices. We focus on CIB here, as this is where we see actors conceal their identity through deceptive behavior

7/ We also discuss why content in and of itself isn’t a reliable signal for determining whether something is part of an influence operation. We've seen deceptive campaigns reuse authentic content to build audiences and real people unwittingly post memes created by IO actors

8/ Next, we dig into adversarial trends we've seen across CIB ops our investigations teams have disrupted. These include
➡️Shift from “wholesale” to “retail” IO
➡️Blurring btw authentic & inauthentic
➡️Perception hacking
➡️IO for hire
➡️Increased OPSEC
➡️Platform diversification

7/ Specifically, we've seen the rise of influence as a service across the CIB networks our investigations teams have exposed globally. When talking about IO, many ppl naturally gravitate towards govt actors, but we’ve seen a diversity of cutouts, media sites, PR firms in the mix

8/ Another trend worth highlighting is perception hacking. This is the meta IO problem where we see actors capitalize on the perception IO is everywhere, play on people's fear of widespread deception to appear more effective than they are and seed further distrust in institutions

9/ The report also features a case study specifically looking at the US 2020 election and the networks originating from primarily Russian, Iranian, and domestic US actors that our IO investigative team exposed and disrupted.

10/ Looking forward, we know that persistent IO threat actors will continue to evolve in response to detection/removals. Down the line, we expect more platform diversification, actor diversification, and more weaponization of uncertainty.

11/ We have seen IO threat actors adversarially adapt w/ improved operational security, reliance on for-hire services, and leveraging authentic communities. We expect them to continue moving into grayer spaces.

12/ With all that, the defender community can expect more difficult policy calls as IO actors push the boundaries of enforcement and more difficult attribution calls as actors create more layers of obfuscation between themselves and their operations.

13/ As we look back, we have certainly seen IO threat actors adapt, but the defender community of independent researchers, investigators and policy teams in government and at social media platforms, journalists, academics, and many more has advanced to stay ahead

14/ Across the defender community, we have made significant progress in countering influence operations. Our hope is that this report is way to continue the conversation, build on what we’ve learned, and invite new ideas to tackle some of the trends we’ve identified.

15/ It’s been a labor of love working on this report with wonderful colleagues and friends @DavidAgranovich @rzol @ngleicher @benimmo and the IO Threat Intelligence Team! The culmination of many years of work.