The entire discussion around Facebook’s disclosures of what…

In the spring and summer of 2016, as reported by the Times, activity we traced to GRU was reported to the FBI. This was the standard model of interaction companies used for nation-state attacks against likely US targeted.

In the Spring of 2017, after a deep dive into the Fake News phenomena, the security team wanted to publish an update that covered what we had learned. At this point, we didn’t have any advertising content or the big IRA cluster, but we did know about the GRU model.

This report when through dozens of edits as different equities were represented. I did not have any meetings with Sheryl on the paper, but I can’t speak to whether she was in the loop with my higher-ups.

In the end, the difficult question of attribution was settled by us pointing to the DNI report instead of saying Russia or GRU directly. In my pre-briefs with members of Congress, I made it clear that we believed this action was GRU.

Do I wish the final compromise was more aggressive with public attribution? Yes. I also find the public outrage here to be a bit contrived. First off, the responsible parties had all of the data, and the paper very strongly pointed to Russia via the DNI release.

Second, Facebook was at the time and continues to be one of the only parts of the big ecosystem to publish anything. You haven’t seen anything at all from most tech companies, and until the SC indictments the government sat on most of what it knew.

A lot of parties failed in 2016. I failed to prepare my employer for the disinformation campaign and that is on me. The government gave no assistance to the companies in 2016 and very little in 2017 (this seems to have improved a lot in 2018).

The mass media was completely played by the GRU and wrote the stories they wanted after the DNC and Podesta disclosures. You could argue that this was much more impactful than the IRA disinfo, and there has been almost no self-reflection by NYT/WaPo/WSJ/TV on their role.

So yes, we all failed, and we need to own up to those failures to move forward. Those failures were not caused by a CSO getting chewed out in a meeting or editing of a voluntary report that nobody else was willing to publish.

I’m in the US Capitol today meeting with HPSCI, SSCI and interested members. My focus is on building a good working relationship between .gov and .com and the legal frameworks we need to protect our democracy in 2020 in beyond.

FIN