Fake “like” factories – how we reverse engineered facebooks user IDs [video]

I don’t think Facebook is paying Indian companies to fake like your ad.

Those accounts are probably trying to look legitimate so when they like they’re own pages, the signals are trusted.

That said, Facebook should have refunded you obvious non legitimate clicks. Did you report it?

Can you do a "link to website" ad and then link to your facebook group?

If you use the ad manager, try setting the demographic to people interested in a specific ski magazine, not in 'skiing' as a hobby. Notice how the number of potential audience reach is equal to the number of people who liked 'SKI magazine'. [0] Also, if starting out, limit the geography to the most wealthy of urban centers like within a mile like Foggy Bottom in DC or the Upper East Side of NYC, if college students get all the colleges where skiing is a big interest around Amherst, MA, for example. It's about getting creative to limit the number of the audience to around 20,000 or 30,000 using the interest technique. Only show the ad once per day per user. Use A/B testing with different ads and creatives at a TOTAL of $5 a day for a few days. Take the most effective ads and run them at $10 a day. If you have a page, post stories that will gain traction and interest. Boost them using this specific audience for a $1 or $2 to see if people share them. If not, stop promoting them. If they gain traction invest $20 to help them go viral. Facebook rewards high quality content ads by making them much, much cheaper to run. How do they know? People click and interact with them. Find the ads that people interactive with the most and throw the rest out. It only costs a $1 or 2 to know if they are successful.

I keep my account disabled unless I need it to run ads. I feel dirty having reactivated. Im going to disable it again.

[0] https://i.imgur.com/VLiou9O.png

IIRC, you are seeing the backscatter from other people's paid like campaigns. If the agents liked only the pages people paid for, it would be almost trivial to discount and delete. So the agents spray likes over a very broad range of items, mostly unpaid.

I may be out of the loop on this, but do people actually click on ads, especially FB ads?

> but there's no way to do so for "groups";

That is intentional. Facebook had facebook pages, where users could subscribe (like) to be your audience. Then pages became too popular and theyrealized that they were losing potential advertising so they cut down that channel - now you have to pay to reach the subscriber base that you created yourself. They don't want to end up in a similar situation with groups so they are limiting group engagement. FB wants moar money

Probably a http request tracking ID that can be used for debugging the request.

FBCLID is "Facebook Click ID". It is sent to third party sites as a URL parameter so that if an advertiser complains about fake clicks or something they can provide the IDs and the Facebook advertising team knows which ones they are talking about.

Analytics companies (I think Google and a few others) can pay Facebook to get data on your behalf like what page it came from and the demographics of the visitor.

Google AdWords does this as well on paid clicks with GCLID

I've seen this tracking param when people shared with me some links, which they got from Fb.

There is a Firefox extension ClearURLs, which strips some tracking parameters from the url.

From what I remember, if you click in Fb on a link, it redirects first to an internal tracking url, and then to your final link. This is not limited to Fb only.

Majority of cases is often a poor measure for such things -- what you're interested in is the significance (in the general, not increasingly fraught statistical sense) of the use.

There are more small businesses than large ones. But large business practices are, for the most part, far more meaningful. Some metric of net financial or revenue impacts might be a better (though much more difficult to acquire) metric.

It's kind of the "space aliens land on Earth, who do they encounter" problem. Most people are located in cities, but cities occupy a small fraction (~<1%) of Earth's surface.

By statistical likelihood, your alien is most likely to encounter ... a fish (or plankton). If they find land, they're most likely to find a rural area, and hence rural dweller. Not because that's a statistically accurate sampling of human population but because it's a statistically accurate sampling of human population areal distribution.

So: if you look at like-buying campaigns, you'll find, because there are far more small businesses, many more small businesses participating.

If you looked at other metrics -- say, bought likes distributed among all commercial accounts -- you'd probably find the weighting swinging far more toward at least moderate-to-large sized businesses.

Though: for a small business, some early-stage "growth hacking" might be both a modest budget line, a plausible-sounding practice (not necessarily true, but appearing to be true), and something a likewise ethically challenged black-hat SEO marketer could sell.

Then there's the possiblity of joe-job likes -- buying fake likes for a third party in order to present them as fraudulent. Possibly not widespread, but possible, and given the difficulties in attribution, something that's hard to demonstrate one way or the other.

Big brands:

- Likely have more effective tools.

- Have other ways of promoting online content without going through fake likes. (Paid "influencers" being one widely-practiced option.)

- Might be aware of the potential downsides and hence avoid this.

- Are a much smaller fraction of "like" campaigns, and have a higher "organic" (or at least organic-appearing) rate of user engagements.

There are numerous reports of ... large influencers in the political space ... paying $10k - $100k amounts monthly for social media promotion.

They already mirror their videos on YouTube...

But since they only query facebook.com/$ID and facebook.com/profile.php?id=$ID, aren't they only looking at one and the same "ID space", and hence only counting once?

Hi, this is actually incorrect. Facebook uses internal IDs (these are the ones used here, they are valid globally) AND external IDs for Apps and their connected pages. The external IDs have a completely different format and cannot be used to access a profile in the web browser (which is what we were able to do for all of them). We cannot completely rule out, that Facebook assigns two IDs to the same profile. However we think this is highly unlikely. We tried to check for that as far as possible. For example: If I search for a profiles name, that I found via a random ID lookup, and then check that profiles ID, its the same ID that was used in the lookup. We couldn't try this at scale though.

What you're mentioning is actually a very recent change to Facebook API. So it doesn't relate to the work done in the presentation.

I'm assuming the ones in denial will say something like "It's up to the individual to evaluate the quality of the content e̶v̶e̶n̶ ̶t̶h̶o̶u̶g̶h̶ ̶w̶e̶ ̶e̶n̶g̶i̶n̶e̶e̶r̶ ̶o̶u̶r̶ ̶p̶l̶a̶t̶f̶o̶r̶m̶ ̶t̶o̶ ̶g̶e̶n̶e̶r̶a̶t̶e̶ ̶a̶n̶ ̶i̶n̶s̶t̶a̶n̶t̶a̶n̶e̶o̶u̶s̶ ̶e̶m̶o̶t̶i̶o̶n̶a̶l̶ ̶r̶e̶s̶p̶o̶n̶s̶e̶ ̶t̶o̶ ̶m̶a̶x̶i̶m̶i̶z̶e̶ ̶e̶n̶g̶a̶g̶e̶m̶e̶n̶t̶."

Any thoughts on alternative approach they could use--what would it look like etc? Would there be any undesirable consequences of a different approach?

That's kind of like asking how Vint Cerf and Bob Kahn feel about intelligence services tapping internet traffic.

Not very useful.

A more cogent question would be "For anyone in Facebook working on this problem, do you feel like sufficient organizational resources are being spent combating it? Is there low hanging fruit, or are we into the whack-a-mole stage of any popular platform with a financial incentive to cheat?"

what do you think about the oversea slavery that made your clothes and your phone?

to be clear, I'm not blaming you as an individual, just honestly curious about your moral compass.

Frankly I don't understand this kind of "calls to action" directed to company X employeese.

First of all, it is not like FB employees are pushing people into gas chambers in Dachau, FB usage is not obligatory, what I keep telling everyone who complains about FB censorship or privacy abuse - I don't have FB account because of that.

In the same way we might ask to step out Coca Cola employees (say, delivery truck drivers), because drinking Coke is bad for ones health. Or HSBC employees because HSBC was laundering narco cartels money? Or John Deere employees because company forbids farmers to modify tractor software?

All of those practices are immoral and bad, but why chase the weakest, whose income, ability to pay rent, etc. depends on the employer? Why not target those, who are really responsible for that what is happening and who make huge money thanks to that?

I would say it makes much more sense to vote with our money, avoid services and products from companies we consider immoral.

Publicly discourage people from using such services and products, publicly stand against CEOs, shareholders of those companies, spread the knowledge about their personal responsibility for such kind of behavior - this is not that difficult and actually can make a difference. Imagine PR outcome of a conference that would invite Mark Zuckerberg, but no one else would want to attend it? Mark shows up on, say, TED, and all the people leave the room during his talk? In the media-driven World surely this would become "viral" and even Mark with all his money couldn't ignore that easily.

If Facebook were to defeat astroturfing, all advertising firms would just promote their new social media network on all the major news networks.

Our economy is founded upon mutual relationships of grift and greed, even if Zuckerberg were to disagree with his own platform, he would not be able to change it.

This kind of poisonous invitation to grandstand might as well be grandstanding in and of itself, and all of these performative paper ethics makes me want to puke.

What is surprising is your assumption Facebook isn't aware of this. Nay, that Facebook was not designed for this very purpose. Facebook, who employs some of the top data analysts and AI specialists, actively building tooling on the cutting edge of those fields, who's funded primarily by commercial use of its platform, with the for-pay 'reach' being the most obvious monetization scheme.

I don't see how you could be missing that everything about Facebook incentivizes nonsense such as like-factories.

Every time yet another scandal comes out of Facebook, Google, etc... I think that the 1985 film Real Genius still holds up today.

The TL;DW version is that a young, idealistic tech guy learns the hard way that not everyone is as idealistic as he is about technology when a greybeard informs him that the project he just finished is a weapon.

https://www.imdb.com/title/tt0089886/

Silicon Valley needs more Laszlo Holyfelds.

I'm an engineer who recently started at Facebook. I can't speak for the org as a whole, but during the team selection process, the main themes were ads teams and integrity teams (fake account, scraping, security, etc. all fall under that umbrella), so it's something Facebook is taking as seriously as making money.

> what do they think of their employer still enabling massive disinformation, astroturfing etc?

This isn't a behavior management wants, and there's a lot of internal effort to reduce it.

Something the public doesn't get but engineers do is it's impractical to manually review every action on Facebook, human reviewers aren't necessarily more accurate than ML, and you'll always have some amount of abuse.

> Just honestly curious how they deal with these issues on their personal moral compass.

I have no qualms here. Roads are used during thefts, but no one asks construction workers how they sleep at night knowing the roads they build might facilitate crimes. Spammers gonna spam, but that doesn't mean we can't have any online platforms.

Why would they even have a response? The advertisers don't really care.

Everyone knows that most FB traffic is garbage, but it's easy to sell garbage. And in a few limited circumstances the micro-targeting works.

Even if it turned out that most FB/IG traffic was fake it wouldn't change anything until someone comes up with something better.

You have to remember how the ad ecosystem works. Until FB came along there was nothing but display and search and the gap was huge. Facebook comfortably occupies the entire middle ground between display and search these days. Even if half the traffic is totally bogus it's still going to be better than display.

Every big company pretends to work on these problems for image reasons, but they don't really care. It's always a "special team dedicated to" whatever the flavor is that reports to a kangaroo court.

If companies actually cared about these things they could use their immense engineering talent to fix them, or just prevent it in the first place. But BOTH of these mean less revenue at the end of the day. The only way companies would actually prioritize these things is if it had a positive impact on revenue somehow, but it doesn't. Never will.

I'll never understand where the idea came from that Facebook had some kind of moral compass as a company that was anything other making money.

> their personal moral compass

"It is difficult to get a man to understand something when his salary depends on his not understanding it"

Personal morals are just that: personal. Two people can have 100% conviction in their moral position and be totally opposed, it happens all the time in social issues.

Moral beliefs also happen to line up with social circles and group interests suspiciously well too (hence the Sinclair quote).

The sentence, though worded a bit awkwardly, is not implying there is anything strange about Asians, but it is implying that anyone who has dozens of phones in multiple lines is odd.

The many phones is what makes the person "not ordinary."

> It's the poor, as always. The people who know the system is rigged, know the system has to be gamed in order to make money, and are desperately looking for a way to be competitive and get ahead. > They get slammed for life for making a poor moral choice. Why? Because they're easy to find and it's easy to punish them.

This observation has strong parallels with how the poorest are lowest rung of the drug trade - on the street, and bear the highest price of it - death or imprisonment, while the higher level traffickers usually get away with impunity. But the populace feels good because of the disheveled mugshot of the street drug dealer they saw on the evening news.

Honestly I was underwhelmed. They started by scraping a site that offered paid likes for a list of their "clients" i.e. the pages to be liked. They talked to a couple of people who got paid to like pages. They then reported that platform to Facebook so they blocked it (dick move towards the workers they interviewed imo) then they noticed how Facebook profile IDs are incremental so they deduced a profile's creation date from that using "interpolation" even though it didn't account for various sparious points. They used that to look at the distribution of certain pages' and like services' liker profile age (recent profiles -> fake, older profiles -> genuine account) and that's about it. Not to be cynical but I don't find this groundbreaking at any shape or form.

I see plenty of bot comments on many sites

A lot of them are bots or paid astroturfers, also.

I think the more important point here isn't about ethics and punishment, but incentives. The larger a system is and the stronger it incentivises something, the more effort you're going to have to put into enforcing the status.

This is why, in general, ideas that involve lots of actors changing their behavior contrary to incentives, instead of changing the incentives, are fundamentally flawed.

There are trustless systems though, like bitcoin

Oh btw you can buy hn upvotes too : https://upvotes.club/buy/hacker-news-upvote/

People do the right thing if it's worth their while. You don't need people to fear the state showing up and inflicting physical violence or rotting in hell for eternity in order to get people to act "right". You just need "right" to be more worth their while than "wrong". Now, fear of the state and/or fear of god are often used by society to weight people's choices but there's no reason thing have to be all stick and no carrot.

>any solution which relies on "doing the right thing" (ethics) but does not have any rules, laws or other repercussion for abusing it...

Doing the right thing can vary by culture, perspective, and situation. What is right or wrong to us may be entirely different to someone who's family is starving as just one example. Given the world-wide nature of the Internet, as a species, it is unlikely we are going to be able to agree on a single set of rules or punishments within our life-time.

> This may rub some folks raw and be pessimistic, but a half a century on this planet has taught me that any solution which relies on "doing the right thing" (ethics) but does not have any rules, laws or other repercussion for abusing it, then (some entity - person or company) will use your altruistic belief to their own gain, ethics be damned.

100%.

I live in a big city and while there are bylaws, without enforcement people will break them all the time. An example of this is people bringing their dogs where they are not allowed to (e.g. school yards) or have them off-leash when they're not supposed to (e.g. on-leash parks). But because there are so few bylaw officers, few dog owners follow those rules.

>Just Google "buy reddit upvotes" and the internet is full of folks who will sell you a million Likes for cheap

Some years ago I made a post on /r/learnprogramming that TL;DR was along the lines of "go to college, great ROI, plus for your first job most employers auto reject resumes without a degree" or something along those lines.

I was offered $500 up front and $500 referral bonuses to edit my comment to link to a fake degree mill. IIRC they charged something like $1500 for a fake degree and one year of service for employer education checks/transcripts. (by the by, if you're going to run a fake degree mill out of a residential address in San Mateo, use a VPN!)

Point being, Reddit comments are ripe for abuse.

"Rules are only as good as their enforcement"

Does anybody besides me wonder why they never seem to do anything about it? Its really not that hard of a problem to solve.

I'm of a similar age, and generally agree with you, but for the sake of countering complete pessimism I also think it's worth adding some context in that it depends on numbers of people and the medium. The village that my mother lives in, population roughly 1000, has a broad cross-section of ages and political views, but everyone genuinely looks out for each other and does the right thing in the vast majority of circumstances. However, I live in a block of flats with around 150 people, and the residents association had to take down the forum on the website because people were making all sorts of wild accusations. (The WhatsApp group with families is pretty self-policing). The Internet is a problematic mix of vast numbers of people and very little personal accountability.

If you built an upvote system that works more like the old Netflix system worked in theory, then the only outcome of my upvoting something is that I see more things like it.

There are quite a few problems with that, but the obvious ones I think are obvious to different people.

One, movies are a fairly concrete topic. There are tons of laws about Copyright, so every movie has some bits of information you and I could exchange to know that we are talking about the same thing. And for purposes of marketing and awards ceremonies they are even grouped and tagged in some fairly official ways. Comments are amorphous. How do I tell if your comment and mine are 'alike'?

Two, Netflix only sort of works because liking things is not free. If I were promoting a horror movie, I could create a bunch of accounts that like all of the classics of the horror genre, then add a few random movies, and my movie. Everyone who loves classic horror movies would correlate with my account, and that will mean my likes affect their suggestions. But... This is going to cost me. I have to create an account to vote. I have to (probably, I haven't checked in a while) attach a credit card to that account, so I could do that once, twice, a dozen times (everyone on my PR team) but beyond that things get complicated. There are limits to how much I could amortize those costs across multiple PR campaigns, but it might still be lucrative to do so.

With Twitter or Facebook or a million other sites, there is no friction. I could create bots to do this for me, for the cost of some network-connected CPU time (Amazon spot instances). I could speculatively create bots so that I have a stable of 'clean' accounts for future activities that haven't even occurred to me or my customers yet.

These activities are effectively parasitic, in the biological sense of the word (though some would agree in the rhetorical sense as well, but let's not get into that). Only when the host begins to die is there any selective pressure against them. Maybe we're seeing that now. The 'parasite' load is getting so high that the health of the host is in jeopardy. In nature this is one of the major selective pressures on parasites and some pathogens. Kill the host and you lose your meal ticket & transportation.

Yeah, create the problem and then provide the solution is one of the best business models.

Climate change is also making people rich now due to this logic.

The difference is the disclosure. Only on the other you know that money is being used to affect your opinion on something.

People expect that companies pay for their ads to be presented. A big reason for buying likes seems to be deceiving people into believing the posts aren't ads. I'd say it's similar to "sponsored content" that doesn't disclose the fact that it's sponsored

Wether it’s right or not, likes are perceived as social validation.

When a company is buying likes, not only this is not disclosed but also gives a false sense of approval by a community which is not only deceiving for the customers but also unfair competition for businesses providing a similar product / service.

> I would consider paid ads, paid likes, paid comments, etc., to be unethical if the content they're supporting is false.

That's not a very useful statement. What if it's in support of an opinion? Advertisements are rarely just a list of facts and likes

> TLDR: What's the difference between paying Facebook/Google/etc for an ad vs paying someone else to like your post? The 2nd seems like a better solution for a majority of people.

The difference is pretty clear, one is purchasing a real ad on a real platform. The other is paying for fake interactions to project a false response to something.

> I have a hard time seeing the difference between paying for likes vs paying for ads from an ethical stand point.

That's a bit like saying you don't see the difference between peeing in a toilet and peeing in someone's pool. You're relieving yourself either way, after all.

"Likes" are supposed to represent the sentiment of the real users. Ads are supposed to be advertising messages.

The two things are very different for a bunch of reasons. First, buying likes is straight up unethical because it's lying and gaming the system. Second, buying likes is harmful because it reduces the trustworthiness of likes.

We don't use application level IDs for this but global IDs. These are unique for users (at least we have no evidence otherwise).