Facebook plans to use U.S. mail to verify IDs of election ad buyers

> I mean...... were foreign agents so obviously involved that they were buying election ads on foreign cards/wires with foreign billing addresses?

Yes. I think I've heard an egregious story in late 2016 but can't find a reference.

For something less concrete, see RT's complaint against Twitter [1].

And a few other equally less-than-concrete report regarding Facebook[2] and others [3].

[1] https://www.theguardian.com/media/2017/oct/27/russias-rt-rev...

[2] https://www.theguardian.com/technology/2017/sep/06/facebook-...

[3] https://www.recode.net/2017/10/6/16419388/facebook-google-tw...

They need to show that they are doing something to combat this problem, and this is something.

There is a whole industry of companies that exist to give mail forwarding from a US address to foreign countries. They are mostly services used to buy stuff off ebay from sellers who won't ship outside the US due to higher chances of fraud.

What you’re missing is that Facebook doesn’t really want to solve this problem — dollars from Russians are still green. They just want the news story to go away.

It's purely a PR damage control move. Foreign agents would certainly know how to buy a PO box and/or incorporate an LLC.

They already were buying US identities / bank information in order to seem like US citizens.

Foreign entity engaging in this kind of action probably would not like to have a direct link from the campaign to their embassy or consulate.

There's ways to get a few fake addresses, but it gets more complicated if you want thousands. If you run spend significant amounts of money for campaigns and run through just few accounts your activities are easy to detect.

Stolen IDs can be bought anywhere in the world and used online. A stolen ID linked to a PO Box means that someone went into a federal facility with stolen information.

As an Australian who has never shown ID to vote in any local, state, or federal election, where do you live?

"In Australia, where voting is compulsory for all adult citizens, no form of ID is required to cast a ballot at an election; instead, voters are asked three questions before being issued a ballot, so that they can be checked off the electoral roll: (1) what is your full name; (2) where do you live; and (3) have you [voted in this election]"

- Wikipedia

True but don’t you have a fraction of the illegal immigration that the USA has?

Send in my ballot by mail for all elections and sign it. Election fraud is a miniscule problem in the USA, there's probably a bigger problem with e-voting not counting the votes correctly with all the unauditable systems being used currently. The only people who claim the USA has a signficant voter fraud problem are trying to suppress turnout among minorities.

In America, the instances of the kind of voter fraud you're talking about are so low that you can basically discount it as a factor:

* https://www.brennancenter.org/analysis/debunking-voter-fraud...

* https://www.nytimes.com/2016/12/18/us/voter-fraud.html

* https://www.washingtonpost.com/news/wonk/wp/2017/01/25/here-...

I'm getting a suspicious feeling that this product (I'm calling it a product at this point rather than a mitigation as it seems like it's intended to enhance election ad buys rather than actually mitigate a particular risk) wasn't actually designed with Alex Stamos' team's involvement. Which somewhat surprises me considering it's essentially acting as a second-factor for authenticating your physical location.

Expanding on your point, the biggest risk I see with postcards rather than really plain security envelopes would be that savvy postal workers may become acquainted with what even ambiguous or anonymous-sender postcards would look like, enabling them to literally deny service (acting, again literally, as a web service DoS) to particular street addresses making election ad buys by suppressing delivery. With time-critical ad purchases just weeks or even potentially <7 days before election day, this would seem like a legal pandora's box, and even anonymizing postcards wouldn't sufficiently mitigate the risk of an employee blackballing a postcard with an exposed PIN or scratch-off on it that's heading e.g. to Koch HQ or MoveOn.org within weeks of election day.

Besides Google Places/Maps/Business whatever listings, you mean?

State of California made me use mail for some tax related PIN, I think the Federal government did as well for verification of something to start my automatic tax deductions for self employment but it's been a while.

  It'll have to go to a residential / business address

How about "1050 Kiely Blvd #666, Santa Clara CA 95055"?

That's actually a PO Box. (Replace 666 with a real number) Do you think Facebook would care?

What do you mean by "fair"?

People who have never done this before. To be good at something, you must first be bad at it. Although I'm smh considering Facebook resources.

"“If you run an ad mentioning a candidate, we are going to mail you a postcard and you will have to use that code to prove you are in the United States,” Harbath said at a weekend conference of the National Association of Secretaries of State, where executives from Twitter Inc and Alphabet Inc’s Google also spoke.

“It won’t solve everything,” Harbath said in a brief interview with Reuters following her remarks.

But sending codes through old-fashioned mail was the most effective method the tech company could come up with to prevent Russians and other bad actors from purchasing ads while posing as someone else, Harbath said."

Less postcards, more unraveling shell corporations using their corporate metadata. Authenticate political ad buyers using LexisNexis, IRS tax IDs/political org registrations, perhaps going so far as to implement KYC [1] controls and procedures. It's not going to scale, plan on hiring if this matters. Otherwise, this is going to be defeated with a UPS store mailbox.

"KYC controls typically include the following:

* Collection and analysis of basic identity information such as Identity documents (referred to in US regulations and practice as a "Customer Identification Program" or CIP)

* Name matching against lists of known parties (such as "politically exposed person" or PEP)

* Determination of the customer's risk in terms of propensity to commit money laundering, terrorist finance, or identity theft

* Creation of an expectation of a customer's transactional behavior

* Monitoring of a customer's transactions against expected behavior and recorded profile as well as that of the customer's peers"

[1] https://en.wikipedia.org/wiki/Know_your_customer

Source: I work in risk management for a financial services firm.