The Philippines Saw a Sudden Surge of Fake Facebook Accounts. Here’s Why Everyone Is on Edge.

Eunice Sanchez had plans for the weekend of June 6, but they quickly went out the window.

Word of fake Facebook accounts impersonating a number of users in the Philippines began trickling into her Newsfeed, and friends started pleading for help to report duplicates. Soon, it seemed everybody knew someone who was affected.

Sanchez was in the midst of helping her friends report their fake accounts—mostly empty shells containing nothing but names—when she discovered that she, too, had dummy accounts of her own. Though she initially found only a handful of matching accounts, it seemed like more cropped up throughout the day.

“It was terrifying,” Sanchez told VICE News. “It was making me anxious, but at the same time, it was also making me angry because it consumed my entire day, just reporting these fake accounts... I feel like it was more of a distraction. I’m supposed to be doing something more important than chasing this thing.”

The recent explosion of fake Facebook accounts was just the latest in a series of troubling developments in the Philippines in the span of just a month. First, the country passed a controversial anti-terrorism bill widely feared to be a tool for stifling dissent. Then it convicted prominent journalist Maria Ressa in a controversial cyber libel trial. All this took place against the disturbing backdrop of the Philippines’ long-running and bloody drug war, and President Rodrigo Duterte’s administration’s habit of going after critics.

With free speech in the country seemingly more vulnerable by the day, it was no surprise that when the fake Facebook accounts began proliferating, many feared the worst—even if they weren’t sure what the accounts would be used for. Could they be used to post anti-government messages to frame real people or critics and get them arrested? Or would they be used to manufacture support for the government as criticism against the administration increased online?

The alarm bells were first sounded in Cebu City. Two students there shared in a private group chat that they had discovered empty Facebook accounts bearing their names, a day after the arrest of eight people during a protest against the controversial anti-terror bill.

Thinking the accounts were somehow related to their activism or community organizing, members were surprised to find that not only did people in their network have dummy accounts, so did their friends and even some relatives. A deluge of social media posts soon made it clear that this wasn’t just limited to their university, or even their city.

By Sunday, June 7, duplicate accounts were countless.

“We haven’t seen [anything at] that grand of a scale,” said Mel Joseph Castro, the editor in chief of Tug-ani, the official student publication of University of the Philippines-Cebu, and the first to report on the phenomenon, in an interview with VICE News. “We agreed that before [the perpetrators] had a chance to use these accounts, it’s better to publicize it.”

Youth Act Now Against Tyranny Cebu (YANAT), an alliance of youth groups that mobilized to collect data, soon started hearing from individuals all over the Philippines. Within a few hours, they tracked down almost 500 accounts duplicated from 115 individuals.

The Department of Justice meanwhile, received close to 200 reports regarding 300 suspicious accounts, according to Undersecretary Markk Perete. The National Privacy Commission confirmed that reports were “mostly coming from academic institutions.”

The true extent of the phenomenon remains unknown however, as Facebook has not yet released official figures.

While Facebook confirmed a spike in users reporting fake accounts during that period, it maintained there was no “evidence of the reported accounts engaging in coordinated or malicious activity focused on creating fake accounts,” leaving unanswered questions as to why they were created in the first place.

Not much else is known about when these accounts were created. While Facebook cloning can be used as a form of social engineering – a way for cyberattackers to gain trust and trick a user’s acquaintances into doing their bidding – the nature of these particular clones doesn’t quite fit that bill.

Most accounts remained largely blank, and others had only a handful of friends and photographs, plus a location. Unique nicknames and middle names of real users were also used, lending credence to the notion that the names chosen weren’t mere coincidence. Two of the students who were arrested at the protest had over 30 different dummy accounts to their names. At least one user complained of a clone actively adding her friends. Others reported being harassed by their digital doppelgangers.

The National Bureau of Investigation has speculated—without offering evidence—that the fakes may have been a glitch on the social media giant’s end, while a preliminary analysis by the National Computer Emergency Response Team stated that the accounts couldn’t have been created manually, and that “the responsible person/group behind these actions may have used software or applications.”

The truth is likely more sinister than a glitch.

National Privacy Commission head Raymund Enriquez Liboro said that while it’s too early to determine its cause, the mere fact that there are confirmed reports of some duplicates reaching out to users “suggests that there is some human intervention behind such attempts to communicate.”

“While the scale of cloning would suggest some level of automation, the fact that many of the cloned accounts contain basic errors would indicate that this is a manual ‘troll farm’ effort rather than anything automated,” Kevin O’Leary, the field chief security officer for Asia-Pacific at the cybersecurity company Palo Alto Networks, told VICE News.

Victims, meanwhile, fear that outspoken critics of the administration are being targeted. If true, it wouldn’t be the first time Facebook and other social media platforms have been weaponized in the country. Several arrests have been made in the last few months over allegedly libelous Facebook posts.

As the main social media platform in the Philippines, Facebook is a particularly significant target for trolls and sock puppets. There were an estimated 42 million Filipino users as of 2018, almost 40 percent of the population, and that number is expected to rise every year.

Meanwhile, the country has become notorious for hosting paid troll farms. In 2019, the Washington Post interviewed several individuals who worked for these farms, disclosing campaigns for companies, celebrities, and at least one senator.

According to O’Leary, the burden of protecting user privacy falls on social media companies like Facebook, and governments face the tricky task of legislating “for social media within a thriving democracy, allowing for free speech while at the same time protecting the individual.”

The Philippine government does not yet have this mechanism. O’Leary pointed to the Philippines’ Cybercrime Prevention Act of 2012, a law that protects computer-related identity theft (as in the case of the fake Facebook accounts), but also dangerously encroaches on free speech.

The timing of the duplication of accounts is also highly suspect. Weeks before the proliferation of the fake Facebook accounts, Congress expedited the passing of the controversial Anti-Terrorism Act of 2020, more commonly referred to as the anti-terror bill. Critics fear its broad definition of the term “terrorist” leaves plenty of room for potential abuse. The fake accounts proliferated, just as push back against the bill spread widely online.

“Alongside [a climate of impunity] is the climate of fear created by the current government's ongoing efforts to silence its critics,” Ming Yu Hah, Amnesty International’s deputy campaigns director for Asia and the Pacific, told VICE News. “The message from the Duterte administration is clear: dissent is not tolerated and will be harshly dealt with through both legal and illegal means.”

Indeed, that wariness and fear appears to have already taken hold. In the days that followed the proliferation of the fake Facebook accounts, users like Sanchez started cleaning house by updating their page’s privacy settings and scrubbing the internet of their presence. Sanchez, for example, took down all her photos, not just to protect her own privacy, but also to protect her friends—especially those vocal about their political opinions on the platform.

“I am in a constant state of worry,” Mary Rose Ampoon, a former student activist who also found duplicates of her account, told VICE News. “It makes me want to take a step back, especially from social media.

“These are extremely critical times. The pandemic, the progression of events, we exist in an unprecedented slow boil of events that I feel will eventually lead to something drastic.”

Despite it all, Castro, the student journalist who broke the story of the fake accounts, is committed to staying the course, and offered encouraging words for his peers.

“In a time of this political heat and instability, [I’m] urging everyone to not be intimidated by this phenomenon, but rather just continue doing what you do,” he said. “If you are pushing for change, if you are being critical, do so, because in the end we know we’re doing nothing wrong.”