A year ago, in his annual New Year’s resolution post, Mark Zuckerberg pledged to spend 2018 fixing Facebook by addressing foreign manipulation, election interference and other threats. He and other tech leaders should probably renew that vow for 2019, and 2020, and possibly every year after that.
On Monday, the Senate Intelligence Committee released a pair of sweeping reports illuminating how effectively Russian influence operations weaponized social media during the 2016 presidential election, targeting groups like African-Americans, evangelical Christians and pro-gun activists to sow division, confuse voters and support the candidacy of Donald J. Trump. These reports showed conclusively that Russia’s Internet Research Agency used every digital attack surface available — whether it was Facebook or Instagram, where their posts got millions of interactions, or smaller social media networks like Vine and LiveJournal, or even networked video games like Pokémon Go.
One takeaway from these reports might be that the Russian influence campaign of 2016 was a freak occurrence enabled by a perfect storm of vulnerabilities: growth-obsessed social media companies, unsuspecting intelligence agencies and an election featuring two hyper-polarizing candidates, one of which had a Russian blind spot and an army of supporters willing to believe convenient lies and half-truths.
The other way to look at these reports, and probably a more accurate one, is that the 2016 election was the Pearl Harbor of the social media age: a singular act of aggression that ushered in an era of extended conflict.
In an essay last month, Renee DiResta — one of the researchers involved in analyzing the social media data for the Senate committee — used the term “Information World War” to describe the battles being waged by nations and ideological factions on social media platforms. Ms. DiResta wrote:
The theatre opportunistically shifts as geopolitical events and cultural moments present themselves, but there is no sign of abatement — only tactical evolution as the digital platforms that serve as the battlespaces introduce small amounts of friction via new security checks and feature tweaks.
Indeed, in the pair of reports prepared for the Senate committee, we see that Russia’s attacks did not stop after Mr. Trump’s election, but they have continued to evolve and adapt. Russians appear to have shifted their focus away from Facebook, where a team of trained specialists now prowls for influence operations, and toward Instagram, another Facebook-owned app that has flown under the radar. The Internet Research Agency appears to have largely sat out the 2018 midterm elections, but it is likely already trying to influence the 2020 presidential election, in ways social media companies may not yet understand or be prepared for.
And Russia is just the beginning. Other countries, including Iran and China, have already demonstrated advanced capabilities for cyberwarfare, including influence operations waged over social media platforms.
Since 2016, tech companies have tried to demonstrate that they are up to the challenge, by bulking up their security teams and rolling out new transparency features. Some of their efforts have paid off, but others have seemed mostly cosmetic — like the “war room” set up at Facebook headquarters ahead of the 2018 midterm elections, a glorified conference room that was nevertheless heralded as the second coming of Stratcom. In the pair of independent reports presented to the Senate Intelligence Committee, researchers criticized these companies for providing incomplete or poorly formatted data sets for examination and for appearing to mislead Congress while answering questions about the extent of Russia’s operations.
There is also something uncomfortably America-centric about all of this investigation. Social media companies have, reluctantly and belatedly, disclosed details about the extent of their platforms’ misuse during the 2016 election in the United States. But they have not made similar disclosures in Italy, France, Brazil or any number of other countries where social media disinformation has played a major role in tectonic political shifts.
The researchers who analyzed data from the 2016 election have framed the continuing battle over disinformation and social media manipulation as a “high-stakes information war.” But if this is indeed a war, it isn’t a simple, bilateral one — with tech firms and American intelligence agencies on one side, and state-sponsored hackers and trolls on the other.
Social networks, after all, are not extensions of the United States government. They are owned by corporations seeking to maximize their growth and profitability, and many of them operate mostly outside the United States. (It’s useful to periodically recall that fewer than 10 percent of Facebook’s users are American.) The social media apparatus that Russia exploited in 2016 — feeds engineered to show users emotionally engaging content, paired with viral sharing mechanisms and self-service advertising platforms — has been enormously profitable for these companies, and remains largely intact.
To the extent that social media giants’ incentives align with America’s national security interests, it is because they fear the wrath of lawmakers and regulators, and because the reputational damage associated with Russia’s 2016 exploitation has dragged down their stock prices and made it harder to recruit.
We shouldn’t hold our breath for these companies to voluntarily self-regulate. Instead, to contain this amorphous threat, we’ll almost certainly have to look elsewhere for help.
First, while pressuring social media companies to take information warfare seriously, the public and the media will need to take steps to make ourselves less vulnerable to influence campaigns, by increasing our fluency with disinformation and media manipulation tactics. As long as tools for targeted digital mass persuasion exist, Russian-style influence operations will be with us. And any new social network competing with Facebook, Instagram and Twitter will need to consider, from Day 1, how propaganda can be kept at bay. It is no longer enough to build a platform, attract millions or billions of users, and then deal with the consequences.
Second, Congress will need to act. Since the 2016 election, we have learned about Russia’s disinformation campaigns in incredible detail, but lawmakers have done virtually nothing to prevent future influence operations. Conventional economic sanctions have not deterred Russia, and efforts to address the threat through legislation — like the Honest Ads Act, a bipartisan bill introduced in the Senate last year that would require additional transparency from online political advertisers — have gone nowhere.
Two years after the 2016 election, there is still no single federal agency charged with securing American elections from cyberattacks and foreign influence campaigns. Mr. Trump and many other top Republicans have not formally acknowledged the extent of Russia’s 2016 campaign. And although relationships between Silicon Valley tech companies and American intelligence agencies have reportedly improved, there is still more work to be done.
If anything has changed since 2016, it’s that social media is no longer seen as just a useful tool for influencing elections. It’s the terrain on which our entire political culture rests, whose peaks and valleys shape our everyday discourse, and whose possibilities for exploitation are nearly endless. And until we either secure that ground or replace it entirely, we should expect many more attacks, each one in a slightly different form, and each leaving us with even more doubt that what we see online reflects reality, or something close to it.