Facebook links Duterte campaign volunteer to 200 bogus accounts

The specific identification of Nic Gabunada, former chief executive of Omnicom Media Group Philippines, marks a departure for Facebook in its efforts against "coordinated inauthentic behavior."

Facebook says it has removed another 200 pages for misleading users about who was behind the content and for misrepresenting what the pages were supposed to achieve.

This time the pages, groups and accounts were located in the Philippines. Facebook has tied the activity to a network organized by Nic Gabunada, a businessman who said he managed social media for Philippine President Rodrigo Duterte during his 2016 campaign.

A bulletin published Thursday is the latest such update from the company, which in recent weeks has removed accounts from Iran, Russia, Moldova and elsewhere for “coordinated inauthentic behavior.” Facebook’s moves have been closely watched by political organizations, intelligence agencies, law enforcement and other entities with an interest in election security or information operations.

The identification of Gabunada, former chief executive of Omnicom Media Group Philippines, marks a departure for Facebook, which says it removes accounts based on their behavior, but that it doesn’t have the capability to identify who is behind it.

“The individuals behind this activity used a combination of authentic and fake accounts to disseminate content across a variety of pages and groups,” Nathaniel Gleicher, Facebook’s head of cybersecurity policy, said in a statement. “They frequently posted about local and political news, including topics like the upcoming elections, candidate updates and views, alleged misconduct of political opponents, and controversial events that were purported to occur during previous administrations.”

The accounts had names ranging from “Duterte Warriors,” “Bong Go Supporters,” a reference to one of Duterte’s top aides who is running for office, and “Trending Now,” a would-be news organization that trafficked in clickbait. That account spread apparent stories about a man who claimed to give birth via Cesarian section, and a husband and wife who confronted each other after each having numerous affairs.

Fake accounts frequently interacted with real people on such pages, according to Gleicher. The true intent was political manipulation, he said.

Gabunada is a former city mayor who says he volunteered for Duterte’s campaign in 2016. In an interview with ABS-CBN, Gabunaba said he “is just one of those that shares and [is] invited to certain groups … If they will have to take down my accounts it’s their prerogative, on the other hand they have to consider I’m not doing it for the sake of whatever it is they’re accusing me of.”

Duterte’s administration has been accused of an array of human rights violations, including a “war on drugs” that has killed more than 12,000 people, mostly urban poor, according to Human Rights Watch.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure