Whack-a-Mole at Facebook

Facebook is taking another run at the Russian accounts, and finding some Iranian ones at the same time.  They terminate these accounts, and by tomorrow they are dealing with a new set, made by the same people with new personas.  It is the "feel good" kind of response that computer security people used to get when they caught someone distributing pornographic material on a business computer.  It means absolutely nothing, but it sure feels good. 

First, you can't find these people by algorithm.  It requires some good old fashioned intelligence work, which they may be getting benefit of, though the small numbers of accounts belie that.  Facebook has nearly 2.2 Billion users and they have removed some (the numbers reported this time vary from 200 or less, so there is still some lack of understanding of how these are computed).  Regardless, there are not very many.  Finding the root suppliers and putting them out of business is harder but worthwhile.

Second, the individual accounts are not that important.  We used to look for the cause of an incident at a higher level of abstraction, so when one of our groups that we monitored found pornography on a system, we looked for the same images across our networks.  We figured the person selling this stuff was not selling it to this one guy (it always is a guy too, ladies).  The Russians are able to produce a lot of letters and pictures but they are basically lazy too.  They don't keep producing unique material for each account.  Eventually, we traced the pornographic material back to a single source who was using our own computers to distribute (by subscription) 2000 images a day.  We then took hashes of his images and searched across more networks.  That led back to another distributor.  Going after the distributors works better but it doesn't stop pornography any better than we can stop the Russians from starting new accounts and keeping those that survive scrutiny.  This whack-a-mole strategy means the Russians get better at what they do or they don't survive.  This Darwinian approach makes them good at what they do. 

Third, disruption of the Russian covert operations cannot be done by Facebook, Twitter, Instagram, et al.  This is our social media fighting a government, or several governments in this case.  They will never win.  Our governments have to act to stop this by disrupting the operations at the source.  Until then, whack-a-mole feels good without doing anything worthwhile.