In June an NSA document, leaked to press, showed voter-registration-software management company VR Systems had been hacked by Russian state actors. At the time, eight states scrambled to figure out if their systems were compromised, with the NSA remaining uncertain about the results of the attacks. It was at least successful enough for the hackers to launch a second-stage spearphishing campaign posing as VR Systems and "targeting U.S. local government organizations."
In that instance, the NSA learned that Russian government hackers "focused on parts of the system directly connected to the voter-registration process, including a private-sector manufacturer of devices that maintain and verify the voter rolls," according to The Intercept.
The news about VR Systems bolstered a June report that Russian hackers hit voting systems in a total of 39 states, accessing voter databases, software systems and in one instance, a campaign-finance database.
"One of the mysteries about the 2016 presidential election is why Russian intelligence, after gaining access to state and local systems, didn't try to disrupt the vote," Bloomberg wrote. In all reported cases of 2016 voting systems hacking and intrusion attempts, it's suggested that the break-ins were unsuccessful, or to sow mistrust, or keep voters off registration lists.
But with new information about Russia's Facebook ad buys, we should consider that Russian actors hacked American state systems not to change votes or harm voter trust, but to glean voter information that could specifically target actual, active voters with pro-Trump and anti-Clinton Facebook ads.
Using hacked voter rolls to target Facebook ads?
Days ago, more details emerged about the Russian state ads used to influence voters toward a Trump presidential victory last November. Facebook has only recently conceded to press that 10 million people saw those ads -- the ads we know of from the one Russian campaign that Facebook has admitted to, anyway. Nowhere is Facebook's inadequacy more evident than in its response, as usual.
Those ads and their targeting were crucial. This was an election where the loser actually "won" by 2.9 million votes. Getting a fraction of those 10 million voters on Facebook to vote for Trump in specific, targeted states was absolutely critical for Trump's victory. And that's exactly what happened: Trump won by 10,000 votes in Michigan and 20,000 in Wisconsin.
Both states -- key to Trump's win -- were part of Russia's targeted, pro-Trump Facebook ads. It is unknown whether or not Michigan and Wisconsin were among the 39 states that had voting systems and databases breached before the election.
We can expect to learn more about other states targeted in the Russian Facebook ad influence campaign. Top Democrat on the House Intelligence Committee, Rep. Adam Schiff, told CNN the investigation panel was still figuring out the full geographical breakdown of the pro-Trump Russian ads.
"Michigan saw the closest presidential contest in the country -- Trump beat Democratic nominee Hillary Clinton by about 10,700 votes out of nearly 4.8 million ballots cast," reported CNN on Wednesday. "Wisconsin was also one of the tightest states, and Trump won there by only about 22,700 votes. Both states, which Trump carried by less than 1%, were key to his victory in the Electoral College."
Creating Facebook ad campaigns to target people by name, email address or physical address is not allowed by Facebook. But neither was creating the roughly 500 fake pages and accounts that bought the Russian ads in the first place. There are a number of ways to get around Facebook's ad-targeting rules, of course. Marketing-growth company Interconnected Strategy recommends the buyer "upload your mailing list to your Facebook ad account." It explains, "Facebook then will look for Facebook users who match your mailing list, and you'll be able to create a custom audience for your ads to target your mailing list."
While Facebook's trickle of information about the ad buys may open a new avenue of understanding about what Russian state actors were doing with the info they got from US voter-registration databases, it does little to help us understand whether or not Trump's team worked with Russia's team to coordinate their copious ad strategies. That would require Facebook to be transparent about political advertising on its platform.
But as Bloomberg reported Wednesday, "Since 2011, Facebook has asked the Federal Election Commission for blanket exemptions from political-advertising-disclosure rules -- transparency that could have helped it avoid the current crisis over Russian ad spending ahead of the 2016 U.S. election."
No wonder we're seeing more arguments being leveled than ever before that Facebook is incompatible with democracy.
It's clear the pro-Trump Russia-backed ad buys helped tip the election. What's less clear is what Russia-backed hackers were doing in US state voting systems if they weren't changing votes or removing voters. But if we have to speculate, my money's on grabbing data to use in laser-targeted, inflammatory Facebook ad buys in key states.
We may never know for sure, but if we did find out that's what happened, I'm certain Facebook would remind us it's not its fault. One only need look at its pursuit of money and power in the ad industry -- through third-party sales of people's personal data, recklessly empowering ad tools to target the vulnerable and exclude minorities, harmful emotional experiments on users -- to be not at all shocked at what's happened here. Zuckerberg talks a pretty good game to the press about Facebook bringing people together. It would be believable if his product didn't actively sabotage institutions that once formed the backbone of consensus and public trust -- or serve as the perfect platform for foreign agents to disrupt the democratic process that makes Facebook possible in the first place.