UPDATED with additional information from Facebook about inauthentic accounts

Facebook has identified more than two dozen inauthentic accounts attempting to inflame social and political tensions ahead of the 2018 midterm elections.

COO Sheryl Sandberg said the company has deleted and removed 32 Facebook and Instagram accounts that engaged in coordinated efforts to mislead and manipulate people. The company is unable to tie these accounts to Russia, though the New York Times reports that Facebook officials have privately confided to lawmakers that Russia was probably involved.

“It’s clear that whoever set up these accounts went to greater lengths to conceal their identities,” Sandberg said in a press briefing this morning. “We’ve made it harder for inauthentic actors to  operate on Facebook, yet we face determined, well-funded adversaries who won’t give up and keep changing their tactics.”

Nathaniel Gleicher, Facebook’s head of cybersecurity policy, said the accounts were created from March 2017 through May, and exhibited some of the behaviors associated with the Internet Research Agency, which was at the heart of a series of indictments earlier this year in connection with Russian interference in the 2016 election.

One of the administrators for a fake account controlled by a”known IRA account,” whose access to Facebook was terminated seven minutes later.

Facebook said more than 290,000 accounts followed at least one of these phony pages, which used names such as Aztlan Warriors, Black Elevation, Mindful Being and Resisters. The company said it decided to alert the public early in its investigation because one event promoted to protest the Unite the Right 2 Rally was scheduled to take place on Aug. 10 in Washington, D.C.

“Legitimate pages helped build interest in ‘No Unite the Right 2,'” said Gleicher, noting pages posted information about transportation so people could attend the demonstration. “We disabled the event and reached out to the legitimate administrators of five other pages to let them know what’s happened.”

Facebook said it has begun to notify the 2,600 people who expressed interest in the event and the more than 600 who said they planned to attend.

In total, these bad actors created about 30 events since last May. Half attracted interest from fewer than 100 people, while others found broader appeal — with 1,400 users saying they planned to attend.

Facebook

Gleicher said the creators of these inauthentic accounts went to great lengths to disguise their identities, employing virtual public networks and internet phone services. The bad actors used third party intermediaries to buy 150 ads on Facebook and Instagram, paying $11,000 for promotions.

Facebook said it worked with law enforcement to identify these bogus pages, and significantly increased the amount of resources it devotes to security to tamp down manipulation on the platform. The company has been working with US law enforcement and the Atlantic Council’s Digital Forensic Research Lab, a research organization, to help identify and analyze abuse its platform.

“We’ve always known security’s an arms race,” said Sandberg. “We’ve always known our adversaries are going to get better. We’re going to continue to invest more heavily so we can find this.”